CROSS-LAYER SELF-HEALING MECHANISMS IN WIRELESS NETWORKS Christopher M Sadler Department of Electrical Engineering, Princeton University [email protected]

Latha Kant and Wai Chen Telcordia Technologies. One Telcordia Drive, NJ 08854 {lkant,wchen}@research.telcordia.com

Contact Author: Dr. Latha Kant; [email protected]; Tel: 732-699-2428 maintain system connectivity as node failures and mobility change the topology of the network. However, the methods The use of wireless mobile ad-hoc networks (MANETs) utilized by the routing protocols are far from ideal. has gained rapid momentum, both in the commercial and non-commercial sectors. In the commercial sector, sensor Current routing protocols stubbornly adhere to established networks are being considered for deployment for a wide routes even though they may change over the duration of a variety of purposes including to sense robustness of transmission and exhibit a complete inability to deal with elevators, bridges, and other structures and to explore the situations in which the destination is no longer reachable earth (e.g., oil, soil type, etc.). Examples in the nonthrough the network. Many of the observed problems stem commercial (military) sector include the use of MANETs from each protocol’s origins in the wired realm; in the battlefield. Regardless of the particular sector in assumptions that are valid in wired networks, such as the which MANETs are being employed, one thing is notion that all destinations are unique and that the best common: MANETs are being used to collect, process, and route at the start of the transmission will be the best route relay vital information. As a result, it is critical that nodes through the duration of the transmission, are no longer in these networks be equipped to make decisions to ensure valid in the wireless networks being considered in this the integrity of information in an inherently unreliable work. For example, if sensor element A is unreachable, its environment. In this paper, we propose a Cross-layer neighboring sensor element B may be able to service the Approach To Self-healing (CATS), in which nodes use request. As a result, self-healing mechanisms restricted information from each layer of the protocol stack to help within an individual layer are not suitable for ad hoc the routing protocol maintain network reliability in the networks. presence of failures. These actions serve both to provide uninterrupted communications amidst unforeseen failures The ultimate goal of our work is to improve the overall and also to reduce packet latency and energy consumption. performance of networks comprised of mobile nodes with a variety of sensing and processing capabilities. To 1. Introduction accomplish this goal, we have developed a cross-layer Research in the area of wireless sensor networks that approach that allows individual nodes to use information utilizes mobile ad-hoc networking principles has gained from each of the seven layers of the OSI Reference Model rapid momentum both in the commercial and nonto make better decisions about how to use the network. commercial environments. These mobile ad-hoc networks More specifically, the proposed cross layer self-healing (MANETs), as can be expected, function in an inherently approach assimilates information that will come together unreliable environment, fraught with unpredictable to form a Management Plane. The Management Plane will changes causing node and route failures. As a result, in turn assist in moving packets reliably through the nodes need to heal the network autonomously to ensure network despite unpredictable network failures, resulting that critical information is delivered promptly despite in un-interrupted information flow (self-healing) as well as network changes, i.e., self-heal to provide uninterrupted improvements to both the system’s performance and information flow amidst these inevitable failures in the energy profile. underlying network. In fact, we observe that self-healing is a well-established concept in the field of mobile ad hoc In particular, the contributions of this paper are as follows: networks. For example, routing protocols such as DSR [2] and AODV [6] are designed to establish new routes to • We develop a cross-layer framework for a multilayer Management Plane to assist the routing protocol in making robust routing decisions 1 Prepared through collaborative participation in the amidst node/route failures Communications and Networks Consortium sponsored by the • We establish equivalence properties among nodes U.S. Army Research Laboratory under the Collaborative in a mobile ad hoc network through the use of a Technology Alliance Program, Cooperative Agreement Table of Interchangeable Nodes DAAD19-01-2-0011. © Telcordia Technologies, Inc. Abstract1

•

We describe specific reactive methods that can be instantiated to alleviate network problems and temporarily circumvent soft errors such as poor link quality

The remainder of this paper is organized as follows. Section 2 provides a brief overview of related work in the field and contrasts it with ours. In Section 3, we provide a description of the proposed cross-layer self-healing mechanism. Section 4 describes the Table of Interchangeable Nodes. Section 5 summarizes our work todate with pointers to further work that is under way and Section 6 contains the bibliography.

[8] uses Cross-Layer information to perform more efficient MAC layer transmission scheduling across the network. However, the author’s own evaluation indicated that this method is a poor choice in event driven networks so it will not work with our research. Finally, researchers at the University of Delaware are developing a fault localization scheme that parallels our work [9]. Their Incremental Hypothesis scheme is capable of accurately identifying multiple, simultaneous faults in a node. One of the long term goals of both of our groups is to merge the two bodies of work to develop a more advanced, unified system that can identify and correct a wide range of system and network faults.

2. Related Work Self-healing at the hardware level is fairly common in both wired and wireless networks. Typically, if a piece of hardware absolutely cannot fail, a redundant, back-up system is installed and activated immediately in the event of an error. However, this redundancy is expensive in terms of area, financial cost, and energy. [4] attempts to reduce these costs in sensor networks by adding redundant sensors. In the proposed system, they add an extra sensor to a system with N sensors in a way that any combination of N-1 sensors provides the desired result. [11] describes a checkpointing system for embedded systems in which sanity checks are performed at constant intervals. If a check fails, the node rolls the program back to the last successful checkpoint rather than having to rerun it from scratch. We are not the first group to use cross-layer information in sensor networks, just the first to use it for self-healing purposes. To date, cross-layer information has been used primarily for energy conservation and bandwidth management and this work has focused on making changes in the MAC layer. In [7], nodes use low-level information to determine the available bandwidth. Nodes then require all applications to adjust their quality of service accordingly by making adjustments at each layer of the protocol stack. At the present time, we do not attempt to monitor bandwidth in our system. [10] integrates protocol layers 1 and 2 in order to create a new MAC layer. This research has conceptual similarities to our method of changing radio transmission power based on MAC layer statistics, but our work allows for layers 1 and 2 to remain abstracted and we do not alter the MAC layer at all. This is crucial because our project requires our system to be able to accommodate any MAC layer provided by the Army.

3. Cross Layer Self-Healing 3.1. Concept Overview This work builds upon the work described in [3]. Our goal in this paper is to design a cross-layer self-healing mechanism that will provide seamless restoration of affected services and thereby enhance overall system performance without changing the underlying infrastructure – i.e., without requiring changes to the underling/existing routing or MAC protocols. More specifically, the proposed CATS system works by allowing a Management Plane to gather information from each of the seven protocol layers and place it into a special platform, called the Cross-Layer Platform, which is visible across all layers. As shown in Figure 1, the Management Plane will integrate seamlessly along side existing routing and MAC layer protocols. It improves upon existing routing protocols by using cross-layer information to identify and react to network failures including both soft failures (e.g. poor link quality) and hard failures (e.g. node damage). These measures are designed to ensure that high priority information is transmitted successfully and to also improve packet latency as well as the percentage of transmissions that arrive successfully. The Management Plane executes any necessary selfhealing mechanisms as the packet is passed through each protocol layer. Not only does this provide the critically needed self-healing, but it also improves the overall response time, reduces overhead, and promotes layered abstractions by handling problems at the layers in which corrective actions may be taken. Since the evaluations are made based on information that is stored by each of the protocol layers in the Cross-Layer Platform over time, the information needed to evaluate the situation and enact the proper corrective measures will be available without having to involve the other layers. If corrective actions are necessary at multiple layers, they will be taken at each

layer individually as the packet passes through them, with the Cross-Layer Platform coordinating the self-healing across the individual layers.

The Management Plane stores information obtained from each protocol layer in the Cross-Layer Platform. This Platform exists along side of the protocol stack to allow layers to be changed as they could be in a system in which individual layers are completely abstracted from one another. Each node maintains its own Cross-Layer Platform which allows them to collect the information that best reflects their own view of the network.

Cross-Layer Platform

3.2. The Cross-Layer Platform

Layers 5-7: Session, Presentation, and Application Layers Layer 4: Transport Layer

Layer 3: Network Layer

Layer 2: Data Link Layer

Layer 1: Physical Layer Management Layer

The following five subsections provide examples of what information can be collected from each protocol layer and how that information can be used to aid the routing protocol to achieve seamless restoration of services affected by unexpected network failures (i.e., self-healing). 3.2.1. Layer 1 The Management Plane obtains the current battery status using the simple ADC converter that is standard on all microcontrollers. If the battery voltage drops below a preset value, the Management Plane will halt all noncritical applications in layers 5-7, reprioritize packets at layer 4, stop responding to route requests, and refuse to forward packets for non-critical applications at layer 3. These steps serve to preserve battery power for mission critical applications. Similar measures will be taken to alleviate low resource errors. The Management Plane collects hardware usage statistics at layer 1 and in the event that the system runs low on memory or the CPU becomes overloaded, it will interrupt the process and take the same corrective actions. These measures will ensure that mission critical applications will not be stalled by non-mission critical applications that have large resource requirements. 3.2.2. Layer 2 By observing the MAC layer, the Management Plane will generate two important statistics, the Successful Transmission Rate (STR) and the Clear Channel Rate (CCR):

STR =

Successful Transmissions Attempted Transmissions

CCR =

Successful Attempts to find a Clear Channel Total Attempts to find a Clear Channel

Figure 1: The Management Plane stores unique information from each protocol layer in the Cross-Layer Platform. It can then use this information to take corrective actions at any of the protocol layers.

The STR provides a measure of quality of service (QoS) including collisions but excluding congestion. The CCR, primarily useful in CSMA systems, provides a measure of congestion. In turn, these metrics can be used to make adjustments to other layers that provide the node with a better overall view of the network; for example, they can be used at layer 1 to decide how to change the radio transmission power. The notion of changing the transmission power in energyconstrained ad hoc networks is not new. This idea has been used for years as a proactive measure to conserve energy and increase network capacity by using the minimum transmission power required to move packets from one node to another [1] [5]. However, in our system, we intend to use this idea as a reactive measure to attempt to heal the network by reconnecting orphaned nodes and combating poor link quality, congestion, and high collision rates. Increasing transmission power is effective in situations where communication is hindered by a lack of reliable connections such as in the presence of poor link quality and when nodes that have become orphaned due to mobility. In these cases, we reduce latency and energy consumption simply by reducing the number of packets that are lost in transit. On the other hand, reducing transmission power is effective in combating problems caused by a high load on the network such as collisions and congestion. Since signal strength drops at a rate proportional to the transmission distance squared, reducing the transmission power by a factor of two only cuts the range to around 71% of its previous value. Even with the increased hop count, since both of these problems are signs

of a dense network we reduce latency and energy consumption by increasing network capacity. The CCR will provide the node with a measure of channel congestion; if it is too low, the self-healing node will respond by reducing the transmission power. Beyond that, determining the best action is often difficult because different problems that require conflicting countermeasures may have similar symptoms. For example, both poor link quality and a high collision rate are characterized by the inability to deliver uncorrupted packets to the destination. If the STR is low, but well above 0, from the node’s point of view the problem is just as likely to be collisions as it is to be poor link quality. To help the Management Plane make the best guess possible, we took different approaches to latency critical applications and non-latency critical applications. In the case of non-latency critical applications, the Management Plane will try reducing the transmission power first. The node is hypothesizing that collisions are the problem rather than poor link quality or mobility; although that may be a poor guess, the reduced power transmissions consume much less energy so it is the best approach to try first. If that fails, the node will then increase transmission power. For the same criteria in latency critical applications, we attempt to increase the transmission power first. This may be able to overpower collisions or, with the routing protocol’s help, may even allow the node to send packets past the problem. Since it is a latency critical application, it is worth trading the energy to save time. If this fails, the self-healing node will then decrease transmission power. In either case, if the STR is extremely low, the problem is much more likely to have been caused by link errors due to mobility or poor link quality rather than by collisions. As a result, the Management Plane will try to increase the transmission power first and reduce it later if that fails. 3.2.3. Layer 3

As the routing protocol performs its duties, it learns about node failures. This information will also be collected by the Management Plane in a list of unavailable nodes. Some routing protocols already generate such a list, but it is not available to the other protocol layers. If the Management Plane sees that the intended destination is unavailable, it will choose a new destination at layers 5-7 before passing the packets down to layer 4. This saves time and energy by eliminating unnecessary overhead and route discovery messages that will not succeed.

Additionally, to facilitate healing of soft communication errors, we propose that each node maintain a list of the last n neighbors with which it has had contact, where n is a parameter (we have used n=5 as a starting point). This list will provide potential forwarding nodes with an opportunity to route around problems before the communication fails. When a failure is detected by an external failure detection scheme (i.e. outside of the routing protocol), the Management Plane will take action at layer 2; this is done to reinforce the sovereignty of the routing protocol. The two primary objectives of this mechanism are to preserve routes during transient soft failures and to conserve energy in the system by making an attempt to quickly navigate around problems before activating the routing protocol’s self-healing mechanism. The Management Plane achieves the first goal by only storing information about the last five neighbors with which it has had contact. Since nodes in this system can be mobile, a node will typically only have time to forward a couple of packets before it sees n (five) new neighbors. If the failed node has not resolved its problems by then, this mechanism will stop working and the routing protocol will take over. On the other hand, if, for example, a node is experiencing a low resource error, it will likely recover quickly and the routes including that node will be preserved. Depending on the degree of mobility in the network, the system designer can change the length of the list and add a timeout mechanism to improve accuracy. 3.2.4. Layer 4

Layer 4 is responsible for dropping duplicate packets, so the Management Plane can easily determine the percentage of duplicate packets received. This metric provides the system with another measure of latency since reliable, high latency links will trigger retransmissions in the same manner as unreliable, low latency links. For example, combined with the STR, the Management Plane can use this statistic at layer 3 to decide whether to invalidate routes and force the routing protocol to reinitiate route discovery or to just increase the timeout delay for the link. 3.2.5. Layers 5-7

As the application will choose destinations for requests, it will already need to know certain nodes’ capabilities. In addition, in MANET sensor nets, multiple nodes will have similar sensing and processing capabilities. To exploit this property, the Management Plane will use information from the higher layers to generate a matrix of nodes that have interchangeable capabilities. This table, called the Table of Interchangeable Nodes, can be used to reroute requests at layer 3 in forwarding nodes when a destination node

Receive Packet

Next hop No found in routing table?

Next hop found in TIN?

No

Routing protocol invalidates the route

Yes Yes Node exists that can handle the request?

Forward the packet

No

Yes Packet forwarded successfully?

Figure 2: Node S requests information from Node D. A route is established but during transmission, D fails. In this scenario, S and N1 do not know that D is now unavailable. D2 is immediately next to D and has identical processing and sensing capabilities. The picture on the left demonstrates how most current routing protocol would respond. The picture on the right demonstrates our improvement; N2 recognizes that D2 can fulfill the task requested of D and reroutes it on-the-fly.

becomes unavailable. It will save the time and overhead associated with failed communications and is expanded next in Section 4. 4. Table of Interchangeable Nodes

One primary attribute of our Management Plane is its ability to change destinations on-the-fly. An example of this attribute is depicted in Figure 2. In this example, Node S has a request for Node D. A route is established through nodes N1 and N2. After transmission begins, D fails; however, S and N1 do not know this. In existing routing protocols, N2 will receive the packet, determine D is unavailable, and pass a destination unreachable error message back to S. This means that the system has failed to complete the task at hand and that the energy spent on those four transmissions was wasted. In our improved system, N2’s Management Plane uses protocol layers 5-7 to generate a Table of Interchangeable Nodes (TIN) which is stored in the Cross-Layer Platform. Based on this table, N2 is able to determine that its neighbors D and D2 are in close proximity to each other and have the same sensing and processing abilities. N2 knows that D is no longer available so once N2 gets the request from S, it reroutes the request to D2. D2 then successfully performs the task requested of D and passes the data back to S through N2. This measure conserves

No

Management Layer redirects request to equivalent node

Yes Packet arrives at next hop

Figure 3: This flow chart documents the process a node undertakes to access the TIN.

energy and minimizes latency by eliminating the overhead required to invalidate the current route, establish a new route, and retransmit the request. It also preserves the route if the unavailable node recovers from its failures and becomes available again as in the case of transient failures. The TIN works by maintaining a list of interchangeable components for each pair of nodes. This list may, for example, only include one sensor out of many in each node. When a forwarding node determines that the packet’s destination is unavailable, its Management Plane executes code along side of the routing protocol in layer 3 to look up the unavailable node in the table to see if there are any other nodes that it knows can handle the request. If there is a substitute node available, the packet is redirected and the request is fulfilled. Every node that has the processing and memory capabilities to maintain a TIN does so. As a result, any node along the transmission path that recognizes that the destination is now unavailable and knows of a proper substitute can make the necessary correction. This process is depicted in Figure 3. At the source itself, the TIN can be used to make corrections at higher layers too; for example, if the Management Plane sees that a packet’s intended destination is on the list of unresponsive nodes and it knows of an interchangeable node, it can go ahead and change the destination at layers 5-7 before passing the packet down to the transport layer.

Eavesdrop for sensed data from a neighbor

Same sensor on node?

Yes

Take a reading

Readings match?

No Resume normal operation

No Yes

Send TIN update to neighbors

Add reading to table

Figure 4: This flow chart documents the basic process a node undertakes to populate the TIN.

We observe that the CATS system proposed in this work is the first to establish equivalence relationships among nodes in ad hoc networks. It takes advantage of the fact that unlike components in wired networks, components in these networks are redundant by nature. The TIN records equivalence information on both the processor and sensors to allow both processing and sensing requests to be redirected if necessary. Nodes discover information on interchangeability by eavesdropping on their neighbor’s transmissions. When a neighbor generates and transmits data collected by a sensor that is also on the eavesdropping node, the eavesdropping node takes its own reading. If the readings match, the two nodes are interchangeable with respect to that sensor. This method takes advantage of the spatial locality of sensor readings. Once a match is identified, the eavesdropping node then alerts its neighbors by transmitting a TIN update message. This process is depicted in Figure 4. 5. Summary and Continuing Work

In this work, we have provided the building blocks for the first cross-layer management system to use information from each of the seven layers of the OSI Reference Model to help identify and address network failures in mobile ad hoc networks2. For this purpose, we introduce a CrossLayer Platform that makes useful information from each layer available to all layers and a Management Plane that works with the routing protocol and the MAC layer to accomplish multi-layer self-healing based on the most upto-date cross layer information. More specifically, we propose a mechanism to establish equivalence relationships among nodes in ad hoc networks 2

The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Army Research Laboratory or the U.S. Government.

and outline rapid self-healing operations at the routing layer in the event of failures. These actions serve to ensure successful completion of high priority applications, reduce packet latency and reduce energy consumption. Further, our proposed solution works along side of existing routing protocols without altering them and is independent of their various implementations. As a result, our solution can be seamlessly integrated into a wide variety of systems. As continuing work, we are developing simulation models to further study the trades produced – namely, the overheads vs. performance improvement achieved via the proposed cross-layer self-healing mechanism. 6. Bibliography [1] J. Gomez and A. Campbell. A Case for Variable-Range Transmission Power Control in Wireless Multihop Networks. In Proc. IEEE INFOCOM 2004, 2004. [2] D. Johnson and D. Maltz. Dynamic Source Routing in AdHoc Wireless Networks. In Mobile Computing, pages 153– 181. Kluwer Academic Publishers, 1996. [3] L. Kant and W. Chen. Alarm Model Specification and Dynamic Multi-Layer Self-healing Mechanisms for Commercial and Ad-hoc Wireless Networks. In Proc. 15th IEEE Intl. Symposium on Personal, Indoor and Mobile Radio Communications, 2004. [4] F. Koushanfar, M. Potkonjok, and A. SangiovanniVincentelli. Fault Tolerance Techniques for Wireless Ad Hoc Sensor Networks. In Proc. IEEE Sensors, 2002. [5] M. Kubisch, H. Karl, A. Wolisz, et al. Distributed Algorithms for Transmission Power Control in Wireless Sensor Networks. In Proc. IEEE Wireless Communications and Networking Conference, 2003. [6] C. E. Perkins and E. M. Royer. Ad hoc On-Demand Distance Vector Routing. In Proc. 2nd IEEE Workshop on Mobile Computing Systems and Applications, Feb. 1999. [7] S. Shah, K. Chen, and K. Nahrstedt. Cross-Layer Architectures for Bandwidth Management in Wireless Networks. Kluwer Academic Publishers, 2004. M. Cardei, I. Cardei, and D. Du, ed. [8] M. Sichitiu. Cross-Layer Scheduling for Power Efficiency in Wireless Sensor Networks. In Proc. IEEE INFOCOM 2004, 2004. [9] M. Steinder and A. S. Sethi. Probabilistic Event-driven Fault Diagnosis Through Incremental Hypothesis Updating, pages 635–648. Kluwer Academic Publishers, 2003. G. Goldszmidt and J. Schonwalder, ed. [10] J. Stine. Integrating the Physical and Link Layers in Modeling the Wireless Ad Hoc Networking MAC Protocol, Synchronous Collision Resolution. In Mitre Corporation Technical Report, 2003. [11] Y. Zhang and K. Chakrabarty. Fault Recovery Based on Checkpointing for Hard Real-Time Embedded Systems. In Proc. of the 18th IEEE Intl. Symposium on Defect and Fault Tolerance in VLSI Systems, Nov. 2003.