Failure Recovery

In this article, we examine consumer reactions to two service recovery strategies: fixing the service failure for a fee and fixing the service failure for no fee and adding compensation. We expect that the more desirable recovery strategy will result in higher levels of satisfaction and higher postpurchase intentions. However, the effect of these recovery strategies on consumers' reactions is likely to be moderated by the setting (online versus offline). The empirical results support our predictions that the effect of the service failure recovery on satisfaction and postpurchase intentions would be stronger in offline media than in online media. Managerial implications thus are presented. D

It is now well recognized that an effective service recovery program is essential to generating customer satisfaction and loyalty. A number of studies have investigated the impact of service recovery efforts (compensation, speed of response, etc) on post-recovery satisfaction. However, despite the importance of global markets, none have examined the impact of customers' cultural value orientation (i.e., cultural values measured at the individual level) in implementing effective service recovery programs. In this research we use the individual rather than the nation as the unit of analysis. Using an experimental design with data from both Eastern and Western cultures, we investigate how customer evaluations of recovery efforts are influenced by interplay of consumers' value orientation and service recovery attributes (apology, cognitive control, and recovery initiation). The results reveal that cultural values of individual Power Distance, Uncertainty Avoidance and Collectivism do indeed interact with a firm's recovery tactics to influence perceptions of fairness (justice). Finally, all three forms of justice (distributive, procedural, interactional) positively impact on overall service recovery satisfaction.

1 Due to the lack of a general theoretical foundation, today's distributed traffic control mechanisms developed at the networking layer, transport layer, and overlay are largely disintegrated. As a result, traffic control protocols developed at different layers may achieve conflicting design objectives and interact with one another in an unpredictable fashion. In this paper, we propose a novel strategy to tackle this issue. First, we propose a theoretical foundation for distributed traffic control. On the basis of this foundation, we then propose an integrated, multilayer, multi-domain traffic control structure. This structure makes it possible to develop traffic control protocols at different layers, possessing the following nice features: (1) they achieve nonconflicting design objectives; (2) they enable rich service quality features, including Quality-of-Service (QoS), Traffic Engineering (TE), and Fast Failure Recovery (FFR); (3) they lead to highly scalable, globally stable and optimal control; (4) they can deal with network diversities and tussles among administrative domains; (5) they allow effective control of dynamically generated overlay networks. The proposed strategy only makes two assumptions about the Internet architecture, i.e., the ability to support multiple domains and multi-path forwarding. As a result, the proposed strategy can be applied to the existing or any future Internet architectures for which these two assumptions hold.

This paper investigates learning approaches for discovering fault-tolerant control policies to overcome thruster failures in Autonomous Underwater Vehicles (AUV). The proposed approach is a model-based direct policy search that learns on an on-board simulated model of the vehicle. When a fault is detected and isolated the model of the AUV is reconfigured according to the new condition. To discover a set of optimal solutions a multi-objective reinforcement learning approach is employed which can deal with multiple conflicting objectives. Each optimal solution can be used to generate a trajectory that is able to navigate the AUV towards a specified target while satisfying multiple objectives. The discovered policies are executed on the robot in a closed-loop using AUV's state feedback. Unlike most existing methods which disregard the faulty thruster, our approach can also deal with partially broken thrusters to increase the persistent autonomy of the AUV. In addition, the proposed approach is applicable when the AUV either becomes under-actuated or remains redundant in the presence of a fault. We validate the proposed approach on the model of the Girona500 AUV.

One of the desirable features of any network is its ability to keep services running despite a link or node failure. This ability is usually referred to as network resilience and has become a key demand from service providers. Resilient networks recover from a failure by repairing themselves automatically by diverting traffic from the failed part of the network to another portion of the network. This traffic diversion process should be fast enough to ensure that the interruption of service due to a link or node failure is either unnoticeable or as small as possible. The new path taken by a diverted traffic can be computed at the time a failure occurs through a procedure called rerouting. Alternatively the path can be computed before a failure occurs through a procedure called fast reroute. Much attention is currently being paid to fast reroute because service providers who are used to the 50-ms failure recovery time associated with SONET networks are demanding the same feature from IP and MPLS networks. While this requirement can easily be met in SONET because it operates at the physical layer, it is not easily met in IP and MPLS networks that operate above the physical layer. However, over the last few years, several schemes have been proposed for accomplishing 50-ms fast reroutes for IP and MPLS networks. The purpose of this paper is to provide a survey of the IP fast reroute and MPLS fast reroute schemes that have been proposed.

Today small autonomous helicopters offer a low budget platform for aerial applications such as surveillance (both military and civil), land management and earth sciences. In this paper we introduce a prototype of autonomous aerial vehicle, the Helibot helicopter, specifically designed for applications in cooperative networks. Fundamental steps in the design process of an UAV are shown. We also present work in progress in the field of failure detection and a novel idea to the problem of failure recovery using a terrain vision system.

With the increasing interest in deploying 4G/LTE networks, IMS has a potential to be deployed in a wide scale in order to support mobile Internet and value-added services over next-generation networks. Moreover, the effort to create an operator-controlled signaling infrastructure using IP-based protocols has resulted in a large number of functional components and interactions between core networks elements. Thus, the carriers are trying to explore alternative ways to deploy IMS that will allow them to manage their network in a cost effective manner while offering rich communications services. One of such approaches is self-organization of IMS (SOIMS). The self-organizing IMS can enable the IMS functional components to adapt dynamically based on the features like network load, number of users, node failures and available system resources. This paper proposes different mechanisms to handle self-organizing IMS with usage of load balancing paradigm. The proposed solution enables topology hiding, IMS nodes failure recovery, session continuity support, and IMS scalability.

This paper presents Sonora, a platform for mobile-cloud computing. Sonora is designed to support the development and execution of continuous mobile-cloud services. To this end, Sonora provides developers with stream-based programming interfaces that coherently integrate a broad range of existing techniques from mobile, database, and distributed systems. These range from support for disconnected operation to relational and event-driven models. Sonora's execution engine is a fault-tolerant distributed runtime that supports user-facing continuous sensing and processing services in the cloud. Key features of this engine are its dynamic load balancing mechanisms, and a novel failure recovery protocol that performs checkpoint-based partial rollback recovery with selective re-execution. To illustrate the relevance and power of the stream abstraction in describing complex mobile-cloud services we evaluate Sonora's design in the context of two services. We also validate Sonora's ...

We investigate methods to improve fault-tolerance of Autonomous Underwater Vehicles (AUVs) to increase their reliability and persistent autonomy. We propose a learning-based approach that is able to discover new control policies to overcome thruster failures as they happen. The proposed approach is a model-based direct policy search that learns on an on-board simulated model of the AUV. The model is adapted to a new condition when a fault is detected and isolated. Since the approach generates an optimal trajectory, the learned fault-tolerant policy is able to navigate the AUV towards a specified target with minimum cost. Finally, the learned policy is executed on the real robot in a closed-loop using the state feedback of the AUV. Unlike most existing methods which rely on the redundancy of thrusters, our approach is also applicable when the AUV becomes under-actuated in the presence of a fault. To validate the feasibility and efficiency of the presented approach, we evaluate it with three learning algorithms and three policy representations with increasing complexity. The proposed method is tested on a real AUV, Girona500.

The tremendous popularity of wireless systems in recent years has led to the commoditization of RF transceivers (radios) whose prices have fallen dramatically. The lower cost allows us to consider using two or more radios in the same device. Given this, we argue that wireless systems that use multiple radios in a collaborative manner dramatically improve system performance and functionality over the traditional single radio wireless systems that are popular today. In this context, we revisit some standard problems in wireless networking, including energy management, capacity enhancement, mobility management, channel failure recovery, and last-hop packet scheduling. We show that a systems approach can alleviate many of the performance and robustness issues prevalent in current wireless LAN systems. We explore the implications of the multi-radio approach on software and hardware design, as well as on algorithmic and protocol research issues. We identify three key design guidelines for constructing multi-radio systems and present results from two systems that we have built. Our experience supports our position that a multi-radio platform offers significant benefits for wireless systems. 1

In choosing a network service technology, a subscriber considers many features such as latency, jitter, packet loss, security, and availability. The most important feature, and usually the one that determines the final selection, is the service availability. In this article, a full spectrum of applications are studied, ranging from the minimal constraints of home networks to the rigorous demands of Industrial Ethernet Networks. This is followed by a thorough examination of Ethernet layer resilience technologies. This paper provides the resilience characteristics that are key for each class of application Ó

This paper presents a failure detection service (FDS) and a flexible failure handling framework (Grid-WFS) as a fault tolerance mechanism on the Grid. The FDS enables the detection of both task crashes and user-defined exceptions. A major challenge in providing such a generic failure detection service on the Grid is to detect those failures without requiring any modification to both the Grid protocol and the local policy of each Grid node. This paper describes how to overcome the challenge by using a notification mechanism which is based on the interpretation of notification messages being delivered from the underlying Grid resources. The Grid-WFS built on top of FDS allows users to achieve failure recovery in a variety of ways depending on the requirements and constraints of their applications. Central to the framework is flexibility in handling failures. This paper describes how to achieve the flexibility by the use of workflow structure as a high-level recovery policy specification, which enables support for multiple failure recovery techniques, the separation of failure handling strategies from the application code, and user-defined exception handlings. Finally, this paper presents an experimental evaluation of the Grid-WFS using a simulation, demonstrating the value of supporting multiple failure recovery techniques in Grid applications to achieve high performance in the presence of failures.

We present the availability model of a high availability SIP Application Server configuration on WebSphere. Hardware, operating system and application server failures are considered. Different types of fault detectors, detection delays, failover delays, restarts, reboots and repairs are considered. Imperfect coverages for detection, failover and recovery are incorporated. Computations are based on a set of interacting sub-models of all system components capturing their failure and recovery behavior. The parameter values used in the calculations are based on several sources, including field data, high availability testing, and agreedupon assumptions. In cases where a parameter value is uncertain, due to assumptions or limited test data, a sensitivity analysis of that parameter has been provided. Our analysis indicates the failure types and recovery parameters that are most critical in their impact on overall system availability. These results will help guide system improvement efforts throughout future releases of these products.

Fault tolerance is a crucial design consideration for missioncritical distributed real-time and embedded (DRE) systems, which combine the real-time characteristics of embedded platforms with the dynamic characteristics of distributed platforms. DRE systems present unique challenges for traditional fault tolerance approaches because of their scale, heterogeneity, real-time requirements, and other characteristics. Most previous R&D efforts in fault tolerance middleware has focused on client-server object sys-This work was supported by the Defense Advanced Research Projects Agency (DARPA) under contract NBCHC030119. Contact Author: prubel@bbn.com 2 Paul Rubel et al. tems, whereas DRE systems are more and more frequently being based on component-oriented architectures, which support more complex interaction patterns. This paper describes our current applied R&D efforts to develop fault tolerance technology for the characteristics of DRE systems. This paper makes three contributions to the state of the art in fault tolerance.

We investigate methods to improve fault-tolerance of Autonomous Underwater Vehicles (AUVs) to increase their reliability and persistent autonomy. We propose a learningbased approach that is able to discover new control policies to overcome thruster failures as they happen. The proposed approach is a model-based direct policy search that learns on an on-board simulated model of the AUV. The model is adapted to a new condition when a fault is detected and isolated. Since the approach generates an optimal trajectory, the learned fault-tolerant policy is able to navigate the AUV towards a specified target with minimum cost. Finally, the learned policy is executed on the real robot in a closed-loop using the state feedback of the AUV. Unlike most existing methods which rely on the redundancy of thrusters, our approach is also applicable when the AUV becomes under-actuated in the presence of a fault. To validate the feasibility and efficiency of the presented approach, we evaluate it with three learning algorithms and three policy representations with increasing complexity. The proposed method is tested on a real AUV, Girona500.

In choosing a network service technology, a subscriber considers many features such as latency, jitter, packet loss, security, and availability. The most important feature, and usually the one that determines the final selection, is the service availability. In this article, a full spectrum of applications are studied, ranging from the minimal constraints of home networks to the rigorous demands of Industrial Ethernet Networks. This is followed by a thorough examination of Ethernet layer resilience technologies. This paper provides the resilience characteristics that are key for each class of application Ó

Today small autonomous helicopters offer a low budget platform for aerial applications such as surveillance (both military and civil), land management and earth sciences. In this paper we introduce a prototype of autonomous aerial vehicle, the Helibot helicopter, specifically designed for applications in cooperative networks. Fundamental steps in the design process of an UAV are shown. We also present work in progress in the field of failure detection and a novel idea to the problem of failure recovery using a terrain vision system.

The combination of photogrammetric aerial and terrestrial recording methods can provide new opportunities for photogrammetric applications. A UAV (Unmanned Aerial Vehicle), in our case a helicopter system, can cover both the aerial and quasi-terrestrial image acquisition methods. A UAV can be equipped with an on-board high resolution camera and a priori knowledge of the operating area where to perform photogrammetric tasks. In this general scenario our paper proposes vision-based techniques for localizing a UAV. Only natural landmarks provided by a feature tracking algorithm will be considered, without the help of visual beacons or landmarks with known positions. The novel idea is to perform global localization, position tracking and localization failure recovery (kidnapping) based only on visual matching between current view and available georeferenced satellite images. The matching is based on SIFT features and the system estimates the position of the UAV and its altitude on the base of the reference image. The vision system replaces the GPS signal combining position information from visual odometry and georeferenced imagery. Georeferenced satellite or aerial images must be available on-board beforehand or downloaded during the flight. The growing availability

Today small autonomous helicopters offer a low budget platform for aerial applications such as surveillance (both military and civil), land management and earth sciences. In this paper we introduce a prototype of autonomous aerial vehicle, the Helibot helicopter, specifically designed for applications in cooperative networks. Fundamental steps in the design process of an UAV are shown. We also present work in progress in the field of failure detection and a novel idea to the problem of failure recovery using a terrain vision system.

A sensor network can be described as a collection of sensor nodes which coordinate with each other to perform some specific function. These sensor nodes are mainly in large numbers and are densely deployed either inside the phenomenon or very close to it. They can be used for various application areas (e.g. health, military, home). Failures are inevitable in wireless sensor networks due to inhospitable environment and unattended deployment. Therefore, it is necessary that network failures are detected in advance and appropriate measures are taken to sustain network operation. We previously proposed a cellular approach for fault detection and recovery. In this paper we extend the cellular approach and propose a new fault management mechanism to deal with fault detection and recovery. We propose a hierarchical structure to properly distribute fault management tasks among sensor nodes by introducing more 'self-managing' functions. The proposed failure detection and recovery algorithm has been compared with some existing related work and proven to be more energy efficient.

Brick and object-based storage architectures have emerged as a means of improving the scalability of storage clusters. However, existing systems continue to treat storage nodes as passive devices, despite their ability to exhibit significant intelligence and autonomy. We present the design and implementation of RADOS, a reliable object storage service that can scales to many thousands of devices by leveraging the intelligence present in individual storage nodes. RADOS preserves consistent data access and strong safety semantics while allowing nodes to act semi-autonomously to selfmanage replication, failure detection, and failure recovery through the use of a small cluster map. Our implementation offers excellent performance, reliability, and scalability while providing clients with the illusion of a single logical object store.

Key service elements combine to create the service concept and its value proposition for customers. During service operations failures, employee interactions with customers are a critical service element in restoring customer satisfaction. However, research in consumer psychology shows that customers seek reasons for service failures and their attributions of blame moderate the effects of the failure on the level of customer satisfaction. This paper extends research on services operations failures by hypothesizing that attributions of blame also affect what matters to the customer during service failures. Specifically, we hypothesize that the relative weights that customers assign to the key elements of the service in reaching an overall assessment of customer satisfaction are affected by customer attributions of blame for service failures. We use the U.S. airline industry as a quasi-experimental research setting to investigate the components of customer satisfaction for three samples of customers who experience: 1) routine service, 2) flight delays of external (i.e., weather) origin, and 3) flight delays of internal origin. Although the level of customer satisfaction is lower for all service failures, we find that the key components of satisfaction differ between delayed and routine flights only when customers blame the service provider for the failure. Specifically, when delays are of external original, satisfaction is lower than for routine flights, but there is virtually no difference in the weight that customers assign to the components of customer satisfaction (including employee interactions). In contrast, when delays are of internal origin, satisfaction is lower than for either routine flights or flights delayed by external factors and employee interactions have a significantly diminished role in customer satisfaction evaluations. Contrary to the popular view that employee interactions take on a greater role in determining customer satisfaction during service failures, we find that the opposite is true if the customer attributes blame to the service provider. The results highlight the important role of customer attributions during service failures and present more nuanced evidence on the role of employee-customer interactions in mitigating the effects of service failures on customer satisfaction. Data Availability: Data for replicating the results of this study are available online at: [insert web site address]. Included in an online appendix and as electronic data files are: the LISREL program code for the basic model and data files containing the variable means, standard deviations and covariance matrices for each of the three treatment groups. In addition to replicating the results of the study, the reader may explore any model that is nested within our model by making changes to the original program code to reflect constraints of a nested model. Confidentiality and nondisclosure agreements with the data provider preclude us from redistributing the raw survey data or reporting results that may be used to identify the customer satisfaction performance of any air carrier.

We are interested in the validation of a cognitive theory of human communication, grounded in a speech acts perspective. The theory we refer to is outlined, and a number of predictions are drawn from it. We report a series of protocols administered to 13 brain-injured subjects and to a comparable control group. The tasks included direct and indirect speech acts, irony, deceits, failures of communication, and theory of mind inferences. All the predicted trends of difficulty are consistently verified; in particular, difficulty increases from direct/indirect speech acts to irony, from irony to deceits, and from deceits to failure recovery. This trend symmetrically shows both in the successful situation and in the failure situation. Further, failure situations prove more difficult to handle than the relevant successful situation. In sharp contrast with previous literature, there is no difference between the subjects' comprehension of direct and indirect speech acts. The results are discussed in the light of our theoretical approach.

—Software failures are still a major concern in mission-and enterprise-critical contexts, despite significant efforts spent in software testing. In fact, while software testing is effective against easily-reproducible bugs (Bohrbugs), it is considerably less suitable for dealing with bugs that lead to hard-to-reproduce failures (Man-delbugs). On the positive side, the elusive nature of Mandelbugs provides opportunities for failure recovery, which are investigated in this paper. Based on real cases of Mandelbugs in eleven Information Technology (IT) systems running in production, the paper proposes a model that describes the recovery processes in IT systems. It then presents closed-form expressions, and a numerical analysis, of the mean time to recovery, and the software (un)availability. This analysis allows the designer to compare recovery strategies, as well as to determine the parameters having a high influence on the efficacy of recovery from failures caused by Mandelbugs. Index Terms—Mandelbugs, mean time to recovery, semi-Markov model, sensitivity analysis, software quality.

This paper addresses the problem of optimal Quality of Service (QoS), Traffic Engineering (TE) and Failure Recovery (FR) in Computer Networks by introducing novel algorithms that only use source inferrable information. More precisely, optimal data rate adaptation and load balancing laws are provided which are applicable to networks where multiple paths are available and multiple Classes of Service (CoS) are to be provided. Different types of multiple paths are supported, including point-to-point multiple paths, point-to-multipoint multiple paths, and multicasting. In particular, it is shown that the algorithms presented only need a minimal amount of information to achieve an optimal operating point. More precisely, they only require knowledge of whether a path is congested or not. Hence, the control laws provided in this paper allow source inferred congestion detection without the need for explicit congestion feedback from the network. The proposed approach is applicable to utility functions of a very general form and endows the network with the important property of robustness with respect to node/link failures; i.e., upon the occurrence of such a failure, the presented control laws reroute traffic away from the inoperative node/link and converge to the optimal allocation for the "reduced" network. The proposed control laws set the foundation for the development of feature-rich traffic control protocols at the IP, transport, or higher layers with provable global stability and convergence properties. Highly scalable QoS, TE, and FR features can be implemented based on these control laws, without the involvement of the routers in the network core.

The IEEE 802.11i wireless networking protocol provides mutual authentication between a network access point and user devices prior to user connectivity. The protocol consists of several parts, including an 802.1X authentication phase using TLS over EAP, the 4-Way Handshake to establish a fresh session key, and an optional Group Key Handshake for group communications. Motivated by previous vulnerabilities in related wireless protocols and changes in 802.11i to provide better security, we carry out a formal proof of correctness using a Protocol Composition Logic previously used for other protocols. The proof is modular, comprising a separate proof for each protocol section and providing insight into the networking environment in which each section can be reliably used. Further, the proof holds for a variety of failure recovery strategies and other implementation and configuration options. Since SSL/TLS is widely used apart from 802.11i, the security proof for SSL/TLS has independent interest.

Web services are building blocks of interoperable systems. Composing Web services makes the processes capable of doing complex tasks. Composite services may fail during their execution which can be diagnosed by a mediator. The mediator adapts the structure so that the failure is recovered. Moreover, future executions should avoid the situation or organize a strategy to repair the structure with a minimum delay. In this paper the failure reasons of a composite service are reviewed. Furthermore, the requirements of a solution for recovery of a system from a failure are investigated.

Deploying Ethernet in the metro domain will require many different upgrades including end-to-end QoS guarantees, protection mechanisms and service performance monitoring. In this paper we propose a distributed method to address network failures for Ethernet which restores lost facilities within tens of milliseconds. Recovery algorithm is localized around the point of failure on the spanning tree thus avoiding the disruption of entire network.

The combination of photogrammetric aerial and terrestrial recording methods can provide new opportunities for photogrammetric applications. A UAV (Unmanned Aerial Vehicle), in our case a helicopter system, can cover both the aerial and quasi-terrestrial image acquisition methods. A UAV can be equipped with an on-board high resolution camera and a priori knowledge of the operating area where to perform photogrammetric tasks. In this general scenario our paper proposes vision-based techniques for localizing a UAV. Only natural landmarks provided by a feature tracking algorithm will be considered, without the help of visual beacons or landmarks with known positions. The novel idea is to perform global localization, position tracking and localization failure recovery (kidnapping) based only on visual matching between current view and available georeferenced satellite images. The matching is based on SIFT features and the system estimates the position of the UAV and its altitude on the base of the reference image. The vision system replaces the GPS signal combining position information from visual odometry and georeferenced imagery. Georeferenced satellite or aerial images must be available on-board beforehand or downloaded during the flight. The growing availability

Traditional pure performance model that ignores failure and recovery but considers resource contention generally overestimates the system's ability to perform a certain job. On the other hand, pure availability analysis tends to be too conservative since performance considerations are not taken into account. To obtain realistic composite performance and availability measures, one should consider performance changes that are associated with failure recovery behavior. In this paper, a brief review is first given over the advances in composite performance and availability analysis. Thereafter, three techniques for composite performance and availability analysis are discussed in detail through a queueing system in a wireless communications network.

In choosing a network service technology, a subscriber considers many features such as latency, jitter, packet loss, security, and availability. The most important feature, and usually the one that determines the final selection, is the service availability. In this article, a full spectrum of applications are studied, ranging from the minimal constraints of home networks to the rigorous demands of Industrial Ethernet Networks. This is followed by a thorough examination of Ethernet layer resilience technologies. This paper provides the resilience characteristics that are key for each class of application Ó

A mobile computing system consists of mobile and stationary nodes, connected to each other by a communication network. The presence of mobile nodes in the system places constraints on the permissible energy consumption and available communication bandwidth. To minimize the lost computation during recovery from node failures, periodic collection of a consistent snapshot of the system (checkpoint) is required. Locating mobile nodes contributes to the checkpointing and recovery costs. Synchronous snapshot collection algorithms, designed for static networks, either force every node in the system to take a new local snapshot, or block the underlying computation during snapshot collection. Hence, they are not suitable for mobile computing systems. If nodes take their local checkpoints independently in an uncoordinated manner, each node may have to store multiple local checkpoints in stable storage. This is not suitable for mobile nodes as they have small memory. This paper presents a synchronous snapshot collection algorithm for mobile systems that neither forces every node to take a local snapshot, nor blocks the underlying computation during snapshot collection. If a node initiates snapshot collection, local snapshots of only those nodes that have directly or transitively a ected the initiator since their last snapshots need to be taken. We prove that the global snapshot collection terminates within a nite time of its invocation and the collected global snapshot is consistent. We also propose a minimal rollback/recovery algorithm in which the computation at a node is rolled back only if it depends on operations that have been undone due to the failure of node(s). Both the algorithms have low communication and storage overheads and meet the low energy consumption and low bandwidth constraints of mobile computing systems.

In this paper, we discuss the design and implementation of fault-aware Global Memory Management (GMM) for a multi-kernel architecture. Scalability of today's systems is limited by SMP hardware, as well as by the underlying commodity operating systems (OS), such as Microsoft Windows or Linux. High availability is limited by insufficiently robust software and by hardware failures. Improving scalability and high availability are the main motivations for a multikernel architecture, and GMM plays a key role in achieving this. In our design, we extend the underlying OS with GMM supported by a set of software failure recovery modules in the form of device drivers. While the underlying OS manages the virtual address space and the local physical address space, the GMM module manages the global physical address space. We describe the GMM design, prototype implementation, and the use of GMM.

Unknown, unexplored and abandoned subterranean voids threaten mining operations, surface developments and the environment. Hazards within these spaces preclude human access to create and verify extensive maps or to characterize and analyze the environment. To that end, we have developed a mobile robot capable of autonomously exploring and mapping abandoned mines. To operate without communications in a harsh environment with little chance of rescue, this robot must have a robust electro-mechanical platform, a reliable software system, and a dependable means of failure recovery. Presented are the mechanisms, algorithms, and analysis tools that enable autonomous mine exploration and mapping along with extensive experimental results from eight successful deployments into the abandoned Mathies coal mine near Pittsburgh, PA.

Service Oriented Architecture facilitates automatic execution and composition of web services in distributed environment. This service composition in the heterogeneous environment may suffer from various kinds of service failures. These failures interrupt the execution of composite web services and
lead towards complete system failure. The dynamic recovery decisions of the failed services are dependent on non-functional attributes of the services. In the recent years, various methodologies have been presented to provide recovery decisions based on time related QoS (Quality of Service)
factors. These QoS attributes can be categorized further. Our paper categorized these attributes as space and time. In this paper, we have proposed an affinity model to quantify the location affinity for composition of web services. Furthermore, we have also suggested a replication mechanism and
algorithm for taking recovery decisions based on time and space based QoS parameters and usage pattern of the services by the user.

Multipath routing is essential in the wake of voice over IP, multimedia streaming for efficient data transmission. The growing usage of such network requirements also demands fast recovery from network failures. Multipath routing is one of the promising routing schemes to accommodate the diverse requirements of the network with provision such as load balancing and improved bandwidth. Cho et al. introduced a resilient multipath routing scheme known as directed acyclic graphs. These graphs enable multipath routing with all possible edges while ensuring guaranteed recovery from single point of failures. We also built a prototype application that demonstrates the efficiency of the scheme. The simulation results revealed that the scheme is useful and can be used in real world network applications.

Multipath routing is essential in the wake of voice over IP, multimedia streaming for efficient data transmission. The growing usage of such network requirements also demands fast recovery from network failures. Multipath routing is one of the promising routing schemes to accommodate the diverse requirements of the network with provision such as load balancing and improved bandwidth. Cho et al. introduced a resilient multipath routing scheme known as directed acyclic graphs. These graphs enable multipath routing with all possible edges while ensuring guaranteed recovery from single point of failures. We also built a prototype application that demonstrates the efficiency of the scheme. The simulation results revealed that the scheme is useful and can be used in real world network applications.

The High Level Architecture (HLA) is a standard for the interoperability and reuse of simulation components, referred to as federates. Large scale HLA-compliant simulations are built to study complex problems, and they often involve a large number of federates and vast computing resources. Simulation federates running at different locations are liable to failure. The failure of one federate can lead to the crash of the overall simulation execution. Such risk increases with the scale of a distributed simulation. Hence, fault-tolerance is required to support runtime robustness.

A mobile computing system consists of mobile and stationary nodes, connected to each other by a communication network. The presence of mobile nodes in the system places constraints on the permissible energy consumption and available communication bandwidth. To minimize the lost computation during recovery from node failures, periodic collection of a consistent snapshot of the system (checkpoint) is required. Locating mobile nodes contributes to the checkpointing and recovery costs. Synchronous snapshot collection algorithms, designed for static networks, either force every node in the system to take a new local snapshot, or block the underlying computation during snapshot collection. Hence, they are not suitable for mobile computing systems. If nodes take their local checkpoints independently in an uncoordinated manner, each node may have to store multiple local checkpoints in stable storage. This is not suitable for mobile nodes as they have small memory. This paper presents a synchronous snapshot collection algorithm for mobile systems that neither forces every node to take a local snapshot, nor blocks the underlying computation during snapshot collection. If a node initiates snapshot collection, local snapshots of only those nodes that have directly or transitively a ected the initiator since their last snapshots need to be taken. We prove that the global snapshot collection terminates within a nite time of its invocation and the collected global snapshot is consistent. We also propose a minimal rollback/recovery algorithm in which the computation at a node is rolled back only if it depends on operations that have been undone due to the failure of node(s). Both the algorithms have low communication and storage overheads and meet the low energy consumption and low bandwidth constraints of mobile computing systems.

Today small autonomous helicopters offer a low budget platform for aerial applications such as surveillance (both military and civil), land management and earth sciences. In this paper we introduce a prototype of autonomous aerial vehicle, the Helibot helicopter, specifically designed for applications in cooperative networks. Fundamental steps in the design process of an UAV are shown. We also present work in progress in the field of failure detection and a novel idea to the problem of failure recovery using a terrain vision system.

A framework for planning and supervision of robotized assembly tasks is initially presented, with emphasis on failure recovery. The approach to the integration of services and the modeling of tasks, resources and environment is briefly described. A planning strategy and domain knowledge f o r nominal plan execution is presented. Through the use of machine learning techniques, the supervision architecture will be given capabilities for improving its peij5ormance over time. In particular, an approach for memorizing failure recovery episodes, based on abstraction, deductive generalization and feature construction, is presented. Recovery planning consists of adapting plan skeletons from similar episodes previously occurred.

An important research area in the workflow management domain is the adaptation of workflows to unexpected events or failures at runtime. In this paper we present a concept for dynamic and automated workflow re-planning that allows to recover from such failures. To handle the complex dynamic situation of a partially executed workflow, we propose a multi-step procedure that includes the termination of failed activities, the sound suspension of the workflow, the generation of a new process definition, and the adequate process resumption. An important aspect of the presented re-planning procedure is that all steps including the generation of a new process definition are fully automated.

''Stateless'' servers have been popularized by NFS [Sandberg85]. The benefit of a stateless server is that the server can crash and reboot and no special recovery action is required. Clients simply retry their operations until they get a response from the server. There are two draw-backs to this approach, however. First, clients can get stuck if they try to contact a server that stays down for a long time. Second, and much more important, a stateless server suffers a performance hit because all changes in the service's internal state † must be saved on stable storage.

Defects per million (DPM), defined as the number of calls out of a million dropped due to failures, is an important service (un)reliability measure for telecommunication systems. Most previous research derives the DPM from steady-state system availability model. In this paper, we develop a novel method for DPM computation which takes into consideration not only system availability, but also the impact of service application as well as the transient behavior of failure recovery. We illustrate this approach using a real system which is the IBM SIP SLEE cluster. Our method takes into account software/hardware failures, different stages of recovery, different phases of call flow, retry attempts and the interactions between call flow and failure/recovery behavior.

Today small autonomous helicopters offer a low budget platform for aerial applications such as surveillance (both military and civil), land management and earth sciences. In this paper we introduce a prototype of autonomous aerial vehicle, the Helibot helicopter, specifically designed for applications in cooperative networks. Fundamental steps in the design process of an UAV are shown. We also present work in progress in the field of failure detection and a novel idea to the problem of failure recovery using a terrain vision system.

The rapid advances in dense wavelength-division multiplexing technology with hundreds of wavelengths per fiber and worldwide fiber dcployment have brought about a tremendous increasc in the size (i.e., number of ports) of photonic cross-connects, as well as in thc cost and difficulty associated with conrrolling such largc cross-connects. Waveband Switching (WBS) has attractcd attention for its practical importance in reducing the port count, associated control complexity, and cost of photonic cross-cunnects. In this article we show that WBS is differcnt from traditional wavelength routing, and thus techniques developed for wavelengthrouted networks (including. for example, those for traffic grooming) cannot he directly applied to effectively address WBS-related problems. We dcscrihe two multigranular OXC architectures f o r WBS. By using the multilayer MG-OXC in conjunction with intelligent WBS algorithms for hoth static and dynamic traffic, we show that one can achieve considerable savings in thc port count. Wc also present various WBS schemes and lightpath grouping stratcgies, and discuss issues related to waveband conversion and failure recovery in WBS nctworks.