Nowadays, large enterprises, critical infrastructures, and utilities are complex systems, and consist of a number of sub-systems, often located far away from each other, that coordinate their operations over geographic networks. Typically, they are interconnected through the Internet and communicate by means of TCP/IP-based protocols. When system-level resilience is required, extremely high dependability is demanded from the network. In this paper a solution is described and evaluated that loosely resembles SDN architectures. A redundant version of MQTT is used for the data plane, whereas an adaptive mechanism is implemented in the control plane that evaluates the quality of paths and dynamically selects the best choice. To maximize dependability, yet keeping resource consumption to acceptable levels, concepts borrowed from Reinforcement Learning are exploited. An experimental campaign corroborated our expectations and showed the practical feasibility of our proposal.

The ability to predict the behavior of a wireless channel in terms of the frame delivery ratio is quite valuable, and permits, e.g., to optimize the operating parameters of a wireless network at runtime, or to proactively react to the degradation of the channel quality, in order to meet the stringent requirements about dependability and end-to-end latency that typically characterize industrial applications.In this work, prediction models based on the exponential moving average (EMA) are investigated in depth, which are proven to outperform other simple statistical methods and whose performance is nearly as good as artificial neural networks, but with dramatically lower computational requirements. Regarding the innovation and motivation of this work, a new model that we called EMA linear combination (ELC), is introduced, explained, and evaluated experimentally. Its prediction accuracy, tested on some databases acquired from a real setup based on Wi-Fi devices, showed that ELC brings tangible improvements over EMA in any experimental conditions, the only drawback being a slight increase in computational complexity.

New generation electrified and self-driving vehicles require much higher performance and flexibility for onboard digital communications than Controller Area Networks may offer. For this reason, automotive Ethernet is often regarded as the next de facto standard technology in these contexts, and by extension for networked embedded systems as well. However, an abrupt and drastic move from CAN to Ethernet is likely to cause further cost increases, which can be hardly tolerated by buyers. This paper analyzes the third generation of CAN, termed CAN XL, and studies how interoperability can be ensured with Ethernet. Likely, composite CAN XL-Ethernet networks are the key for getting the best of both worlds, not only in the automotive domain but also for sensing and control in scenarios like building automation, wired sensor networks, and low-cost networked embedded systems with real-time constraints.

The ability to reliably predict the future quality of a wireless channel, as seen by the media access control layer, is a key enabler to improve performance of future industrial networks that do not rely on wires. Knowing in advance how much channel behavior may change can speed up procedures for adaptively selecting the best channel, making the network more deterministic, reliable, and less energy-hungry, possibly improving device roaming capabilities at the same time. To this aim, popular approaches based on moving averages and regression were compared, using multiple key performance indicators, on data captured from a real Wi-Fi setup. Moreover, a simple technique based on a linear combination of outcomes from different techniques was presented and analyzed, to further reduce the prediction error, and some considerations about lower bounds on achievable errors have been reported. We found that the best model is the exponential moving average, which managed to predict the frame delivery ratio with a 2.10% average error and, at the same time, has lower computational complexity and memory consumption than the other models we analyzed.

Lifetime of motes in wireless sensor networks can be enlarged by decreasing the energy spent for communication. Approaches like time slotted channel hopping pursue this goal by performing frame exchanges according to a predefined schedule, which helps reducing the duty cycle. Unfortunately, whenever the receiving radio interface is active but nobody in the network is transmitting, idle listening occurs. If the traffic pattern is known in advance, as in the relevant case of periodic sensing, proactive reduction of idle listening (PRIL) noticeably lowers energy waste by disabling receivers when no frames are expected for them. Optimal PRIL operation demands that, at any time, the transmitter and receiver sides of a link have a coherent view of its state (either enabled or disabled). However, this is not ensured in the presence of acknowledgment frame losses. This paper presents and analyzes some strategies to cope with such events. An extensive experimental campaign has been carried out through discrete event simulation to determine what consequences above errors may have from both a functional and performance viewpoint. Results show that, although no strategy is optimal in all circumstances, different solutions can be profitably adopted depending on the specific operating conditions.

Embedding a programming language in a QR code is a new and extremely promising opportunity, as it makes devices and objects smarter without necessarily requiring an Internet connection. In this paper, all the steps needed to translate a program written in a high-level programming language to its binary representation encoded in a QR code, and the opposite process that, starting from the QR code, executes it by means of a virtual machine, have been carefully detailed. The proposed programming language was named QRscript, and can be easily extended so as to integrate new features.One of the main design goals was to produce a very compact target binary code. In particular, in this work we propose a specific sub-language (a dialect) that is aimed at encoding decision trees. Besides industrial scenarios, this is useful in many other application fields. The reported example, related to the configuration of an industrial networked device, highlights the potential of the proposed technology, and permits to better understand all the translation steps.

Communication quality of wireless links unavoidably varies over time, for a number of reasons that are mostly unknown in the design phase of distributed systems. This is a severe limitation when such network technologies are employed to connect devices and subsystems in industrial applications, where high reliability and timeliness are customarily demanded. The ability to foresee, to some extent, the quality of a link in the near future is likely to provide clear benefits in many such cases.In this paper, we analyzed and compared the performance of two approaches, based on simple moving averages and artificial neural networks, respectively, to carry out predictions for a real Wi-Fi link. Results confirm that reliable estimates about the packet delivery ratio can be obtained in realistic operating conditions by averaging the recent past, and that the use of machine learning may improve prediction further.

Open-source software firewalls are becoming a viable solution to protect industrial networked systems and critical infrastructures. In fact, the adoption of technologies and devices originally conceived for general purpose computer networks and the consumer market has been proven to both reduce costs and enhance performance also in the industrial scenario. The goal of this paper is to start investigating the behavior of Linux IPFire in the light of its possible adoption in industrial applications and to provide a baseline for the development of techniques designed to improve the filtering capabilities in multi-firewall networks.

Controller Area Network is still the most popular solution for in-vehicle communications in automotive scenarios. Recent solutions like CAN FD and CAN XL manage to reduce the performance gap with Ethernet-based solutions. Nevertheless, the priority-based access mechanism they rely on is not completely adequate to support fragmented transfers of large blocks of data, as happens, e.g., for driver assistance and the Internet of Things. In this paper, a slight modification is proposed for the basic CAN access mechanism that permits a group of objects to be served by the network with about the same quality of service. This provides fair treatment to a number of block transfers initiated by different nodes and taking place contextually over the bus.

The use of white and black listing techniques in Wireless Sensor Networks (WSN), and in particular those which are based on the Time Slotted Channel Hopping (TSCH) op-erating mode of IEEE 802.15.4, permits to improve reliability and latency by performing transmissions on the best channels. Techniques that operate on a per-link basis are deemed quite effective, but proper operation requires that the two end points involved in the communication agree on the channels to be used for transmission. On the contrary, communication in the network can be prevented, eventually leading, in the worst cases, to the disconnection of part of the nodes. This paper presents CONSIP, a technique aimed to ensure strict consistency in the information exchanged between the nodes and used to drive communication, by preventing a priori the aforementioned problem from occurring. Results show a slight increase in energy consumption, due to the use of a backup cell, whereas communication latency does not worsen. The effectiveness of CONSIP was assessed by means of an experimental campaign, and the only drawback we found is that the backup cell, which is required to be reserved per link, may limit the number of nodes in dense networks.

Firewalls are popular cyber-security countermea-sures that are increasingly used in industrial environments to protect the network infrastructure from attacks and malicious behavior. Unfortunately, they can also become inadvertent bot-tlenecks when the traffic load they have to filter grows larger. Among the different solutions that have been proposed to mitigate this aspect and improve performance of devices, rule migration looks appealing also in industrial multi-firewall systems because, differently from other techniques appeared in the literature, it neither requires interventions on the network topology nor it is based on non-standard packet formats and protocols. This paper is aimed at presenting some preliminary results about performance achievable with the rule migration approach, when it is applied to the popular Iptables open source firewall, in the light of its possible adoption in industrial application scenarios.

Among the application layer protocols that support the Internet of Things, a very popular option is MQTT. Its main advantages reside in the inherent simplicity, which makes it suitable for embedded devices too, and the publisher-subscriber model it relies on, which decouples data sources and sinks and enables efficient multicast streaming over the Internet. In this paper a proposal is described that exploits redundant MQTT brokers, deployed in different geographic locations, whose aim is to provide uninterrupted service in spite of failures that may be affecting both the servers executing the middleware and the Internet core. Unlike routing algorithms and protocols, seamless redundancy features zero intervention time, making this solution suitable for critical infrastructures where timings are relevant, like public utilities and some large enterprises.

Saving motes energy as much as possible is a main requirement in wireless sensor networks. Time Slotted Channel Hopping (TSCH) is an effective solution, as the radio module of receivers is enabled only when a frame reception is scheduled. Unfortunately, this often leads to non-negligible idle listening, i.e., the receiving interface is switched on but no incoming frame is detected. In cases where the traffic pattern can be somehow predicted, Proactive Reduction of Idle Listening (PRIL) techniques can reduce energy wastes significantly by temporarily switching receivers off. In this paper two specific strategies are proposed, which are aimed at improving PRIL robustness in the case acknowledgment frames are lost, hence causing the transmitter and receiver to have different perceptions of the link state. They were encoded by means of a discrete event simulator and their behavior analyzed. Results obtained through an extensive experimental campaign show that there is no clear winner. Instead, each proposed strategy is suitable for specific application contexts.

The past few decades saw factory and process automation move from monolithic to fully distributed architectures, where the communication system plays a key role in providing higher flexibility and availability, yet fitting the peculiar requirements of such contexts. As part of the Industry 4.0 (r)evolution, the Industrial Internet of Things is meant to achieve full convergence toward well-agreed non-proprietary digital networking technologies. In this scenario, OPC UA is becoming increasingly relevant as a high-level protocol to exchange information in heterogeneous distributed industrial applications. In this paper, the performance of OPC UA has been evaluated by means of an experimental measurement campaign carried out on real devices connected to real networks. In particular, we analyzed how much the end-to-end notification latency achieved by the subscription mechanism is affected by the position and interconnection of devices, their specific implementation, and configuration parameters. Outcomes can be helpful in designing systems where industrial devices interact with local workstations, the edge, and the cloud, to understand whether or not timing constraints of applications will be met.

Among the many enabling technologies Industry 4.0 relies on, the Industrial Internet of Things is a relevant one that enables both horizontal and vertical integration in modern enterprises, to accomplish complex functions that exploit either cloud or edge processing. In particular, the OPC UA protocol is knowing an ever increasing attention for interconnecting devices, equipment, and facilities in next-generation plants. This work focuses on the characterization of the notification latency in distributed systems that rely on the OPC UA publish-subscribe paradigm for interactions. In particular, starting from a black-box experimental evaluation carried out on real setups, we tried to explain the seemingly peculiar behavior of some popular solutions by means of theoretical models complemented with code inspection.

Time slotted channel hopping provides reliable and deterministic communication in IEEE 802.15.4 mesh networks. Although slotted access is able to lower energy consumption drastically by reducing the duty cycle of the radio module, it usually leads to significant idle listening experienced by receivers, which makes it a sub-optimal solution when ultra low-power wireless is sought for.In this paper a listening suspension mechanism is described, which operates at the MAC layer and is part of a more general approach aimed at cutting down energy consumption by proactively reducing idle listening. Links can be temporarily disabled, that convey slow-rate data streams whose characteristics, e.g., the generation period, are either known in advance to some extent or can be inferred by traffic inspection.

The dynamic redistribution of filtering rules between firewalls, which are located in the same network, is a technical solution that can cope with temporary changes in the traffic load processed by the firewalls themselves. This paper presents a novel formal model for networks including multiple cascaded firewalls, that can be leveraged to enable the transfer of a set of rules from a firewall to its downstream neighbors when the changes in the input traffic profile suggest to do so. With respect to other solutions appeared in the literature a formal approach, besides providing unambiguous specifications and mathematical proofs of correctness, also enables the computation of theoretical bounds for the expected performance before the proposed scheme is actually deployed in the target network. The underlying mechanism, on which our approach is based, is the reduction of the average number of rules checked per packet in order to increase the packet processing rate. Our network model takes into account both the system topology and firewall characteristics. A suitable transformation algorithm is then introduced, which is able to preserve the security integrity of the network while moving rules between cascaded firewalls and allowing tangible performance improvements in terms of packets processing rate for a given traffic profile. Correctness of the proposed solution has been formally proven and validated by means of simulation. Performance figures have also been obtained by running the proposed algorithm in a laboratory experimental test-bed.

TSCH is emerging as a reliable access mechanism for wireless sensor networks that, thanks to time slotting, suits the needs of battery-powered devices deployed in industrial scenarios. To take into account the traffic needs of the different links in a mesh network and the related variability, in such a way to prevent instability and butter overruns, overprovisioning can be exploited. It consists in allocating more cells than strictly needed for communication between a node and its neighbors. Unfortunately, overprovisioning in TSCH leads to higher power consumption, because of idle listening. In this paper, two approaches for saving energy are proposed, which temporarily disable listening when no packets are available at the transmitter. Such mechanisms show good backward compatibility with existing TSCH devices, and may coexist with them.

Industrial Internet of Things demands high reliability and determinism on the one side, and easy interconnection with the existing network infrastructures on the other. A very promising class of solutions combines IEEE 802.15.4 Time Slotted Channel Hopping, to meet above communication requirements, and IPv6, to provide universal connectivity. Products compliant to this approach have recently begun to appear off-the-shelf.In this paper, two such solutions have been taken into account, namely SmartMesh IP and 6TiSCH. Their performance has been experimentally evaluated by taking into account metrics relevant to industrial applications. Since we aimed at providing a practical feedback to designers of industrial systems, devices were tested using their default configuration. Results provide valuable experimental figures on what engineers can expect from these technologies, which includes seamless connectivity and a reasonably high resilience to interfering traffic.

The Industrial Internet of Things is currently gaining momentum in production plants as a way to efficiently support a number of functions, e.g., preventive maintenance. To this extent, a number of solutions have been proposed in the past few years, which typically rely on a layered approach. In this paper, a general-purpose architecture is presented for factory automation systems, which mimics the industrial networks used at the shop-floor. In particular, it relies on a modular structure for devices and protocols aimed at reducing implementation effort, so as to ease its adoption in real-world applications. A preliminary experimental testbed based on such architecture has been set up, and it operations verified.

Preventive and reactive maintenance require the collection of an ever-increasing amount of information from industrial plants and other complex systems such as those based on robotized cells, a need that can be fulfilled by means of a suitable event notification mechanism. At the same time, timing and delivery reliability requirements in those scenarios are typically less demanding than those in other cases, thus enabling the adoption of best-effort notification approaches. This paper presents, evaluates, and compares some of those approaches, based on either standard Controller Area Network (CAN) messaging or a recently proposed protocol extension called CAN with eXtensible in-frame Reply (CAN XR). In the second case, the combined use of Bloom filters is also envisaged to increase flexibility. Results show that the latter approaches are advantageous in a range of event generation rates and network topologies of practical relevance.

In distributed control systems where devices are connected through Wi-Fi, direct access to low-level medium access control (MAC) operations may help applications to meet their timing constraints. In particular, the ability to timely control single transmission attempts on air, by means of software programs running at the user space level, eases the implementation of mechanisms aimed at improving communication timeliness and reliability. Relevant examples are deterministic traffic scheduling, seamless channel redundancy, rate adaptation algorithms, and so on. In this paper, a novel architecture is defined, we call software-defined MAC (SDMAC), which in its current embodiment relies on conventional Linux PCs equipped with commercial Wi-Fi adapters. Preliminary SDMAC implementation on a real testbed and its experimental evaluation showed that integrating this paradigm in the existing protocol stacks constitutes a viable option, whose performance suits a wide range of applications characterized by soft real-time requirements.

Seamless redundancy layered atop Wi-Fi has been shown able to tangibly increase communication quality, hence offering industry-grade reliability. However, it also implies much higher network traffic, which is often unbearable as the wireless spectrum is a shared and scarce resource. To deal with this drawback, the Wi-Red proposal includes suitable duplication avoidance mechanisms that reduce spectrum consumption by preventing transmission on air of inessential frame duplicates. In this paper, the ability of such mechanisms to save wireless bandwidth is experimentally evaluated. To this purpose, specific post-analysis techniques have been defined, which permit assessment on a simple testbed that relies on plain redundancy and require no changes to the adapters' firmware. As the results show, spectrum consumption decreases noticeably without communication quality is impaired. Further saving can be obtained if a slight worsening is tolerated for latencies.

Applying link-level seamless redundancy to Wi-Fi noticeably ameliorates communication quality, but also doubles spectrum consumption. The adoption of mechanisms, operating at runtime, aimed at preventing the transmission on air of inessential frame copies, permits to lower the generated traffic tangibly and also improves behavior further. In this paper, a prototype setup is described, based on redundant Wi-Fi, which carries out reactive duplication avoidance completely in software. This makes it mostly independent from wireless adapters hardware. An experimental evaluation of its performance showed that, although implementation is preliminary, this solution is able to outperform plain seamless redundancy.

Reliability and determinism of Wi-Fi can be tangibly improved by means of seamless redundancy, to the point of making this technology suitable for industrial environments. As pointed out in recent papers, the most benefits can be achieved when no phenomena can simultaneously affect transmissions on all channels of a redundant link. In this paper, several aspects are analyzed which, if not properly counteracted, may worsen seamless redundancy effectiveness. Effects they cause on communication have been experimentally evaluated in real testbeds, which rely on commercial Wi-Fi devices. Then, practical guidelines are provided, which aim at preventing joint interference through a careful system design. Results show that measured communication quality can be made as good as expected in theory.

The availability of performance studies and simple models for firewalls able to deal with industrial application-layer communication protocols, such as Modbus/TCP, is crucial when the impact of these devices has to be estimated, even roughly, before their actual deployment in industrial networks. Unfortunately, most manufacturers do not provide this kind of information for commercial off-the-shelf available products. Thus, a viable solution is the development and experimental validation of simple models that can be used by designers to predict those firewall characteristics not explicitly related to their security capabilities. As an example, latency introduced on message forwarding is an aspect of significant interest in many industrial control systems, where delays and jitters in data delivery can severely impact on the effectiveness of the control actions. This paper reports on our experience in developing a performance model for a commercial device able to perform advanced application-layer filtering, in particular of Modbus/TCP traffic. A set of ad hoc designed experiments, performed by means of a purposely developed laboratory testbed, enabled both model development and validation, confirming a good correspondence of the estimated performance with the device actual behavior.

Two emerging architectural paradigms, i.e., Software Defined Networking (SDN) and Network Function Virtualization (NFV), enable the deployment and management of Service Function Chains (SFCs). A SFC is an ordered sequence of abstract Service Functions (SFs), e.g., firewalls, VPN-gateways, traffic monitors, that packets have to traverse in the route from source to destination. While this appealing solution offers significant advantages in terms of flexibility, it also introduces new challenges such as the correct configuration and ordering of SFs in the chain to satisfy overall security requirements. This paper presents a formal model conceived to enable the verification of correct policy enforcements in SFCs. Software tools based on the model can then be designed to cope with unwanted network behaviors (e.g., security flaws) deriving from incorrect interactions of SFs in the same SFC.

Controller area network (CAN) has been the de facto standard in the automotive industry for the past two decades. Recently, CAN with flexible data-rate (CAN FD) has been standardized, which achieves noticeably higher throughput. Further improvements are still possible for CAN, by exploiting its peculiar physical layer to carry out distributed operations among network nodes, implemented as atomic transactions mapped on quasi-conventional frame exchanges. In this paper, a proposal is made for an extension to the CAN protocol, termed CAN with eXtensible in-frame Reply (CAN XR), which enables upper protocol layers to define new custom services devoted to, e.g., network management, application-specific functions, and high-efficiency data transfer. The key point is that CAN XR retains full backward compatibility with CAN, therefore, there is no need to change the protocol specification once again.

Seamless redundancy can be profitably exploited to improve predictability of wireless networks in general and, in particular, IEEE 802.11. According to this approach, packets are transmitted by senders on two (or more) channels at the same time and duplicate copies are discarded by receivers. As long as the behavior of physical channels is uncorrelated, communication quality improves noticeably, in terms of both transmission latencies and percentage of dropped frames. In this paper, communication over redundant links has been analyzed by means of a thorough experimental campaign, based on measurements carried out on real devices. Results confirm that, under typical operating conditions, the assumption of independence among channels in properly designed systems is verified reasonably well. Indeed, in our experiments, measured link quality indices did not differ more than$10\%$from what we expected from theory. This grants for redundant solutions tangible advantages over conventional Wi-Fi networks.

Communication over the ether is by nature erratic, and thus wireless networks are often deemed unsuitable to support time-critical distributed control applications, like those at the shop-floor of industrial plants. However, scheduling techniques derived from real-time operating systems, along with channel redundancy and runtime retransmission management, can be profitably applied to wireless networks to improve their determinism tangibly. This paper presents a novel approach that combines such solutions. A preliminary prototype implementation, which relies on IEEE 802.11 (Wi-Fi), has been set up to assess feasibility and performance of the approach. Results show that determinism of data exchange can be improved to a degree that makes wireless networks actually suitable for many soft real-time applications.

Industrial distributed control systems would greatly benefit from the adoption of wireless communication technologies, if only guarantees could be provided on timing of time-critical data delivery over the ether. This paper presents solutions to handle single-hop deadline-constrained periodic traffic, which combine centralized transmission scheduling according to earliest deadline first (EDF) and automatic repeat request (ARQ). For each solution, an admission control test is provided, which guarantees a configurable number of retries to each data instance within its deadline, statically addressing both timeliness and reliability on a per-instance basis. Dynamic bandwidth management strategies are also introduced that use runtime information about unperformed guaranteed retries and reassign them, as extra retries, to failed instances whose deadline has not yet expired. Simulation results show that significant benefits can be obtained, in terms of both determinism and improved performance, by a careful static/dynamic management of the available communication resources.

Seamless redundancy has been recently proven to increase the quality of wireless links communication noticeably. As such, it can be exploited to improve Wi-Fi reliability and make it suitable for industrial environments. Higher benefits can be achieved when phenomena affecting transmissions on the two channels of a redundant link are independent. In this paper, a number of aspects that may lead to a reduction of the effectiveness of seamless redundancy are analyzed. In particular, the quality of communication has been experimentally evaluated in a real testbed made up of conventional Wi-Fi devices. Guidelines are then provided, which are aimed at preventing joint interference through a careful system design.

The connection of control and process networks to company infrastructures and the Internet, besides offering undeniable advantages, also imposes the adoption of adequate security countermeasures. Specialized firewalls, able to recognize and inspect traffic concerning peculiar communication protocols such as Modbus, which are commonly adopted in industrial applications, are beginning to spread on the market. However, several industrial control systems (ICSs) must satisfy critical performance and timing requirements and the impact of introducing such a kind of devices in an existing network should be evaluated carefully. In this paper we present a simple approach based on ordinary equipment and open source software, which can help system designers and managers to get approximate but useful information about effects produced by including an industrial firewall in their system. The proposed technique, though quite simple, has the advantage of circumventing the need of ad-hoc measurement instrumentation and can be used also by non-experts, virtually with little or no effort, to get rough guess indications about the extent the firewall insertion in the network can be tolerated.

The current version of IEEE 802.11, based on EDCA, is unable to support fine-grained assignments of priorities to messages. Instead, such an ability could be advantageous in distributed real-time control systems communicating over the air, as it would enable the exploitation of feasibility analysis to assess whether or not timing constraints are met. In this paper, a proposal is made for implementing a simple fixed-priority access scheme on conventional, commercial Wi-Fi devices. Basically, this is obtained by disabling the random backoff mechanism and suitably managing interframe gaps only. In particular, each real-time message is assigned a unique gap duration, so as to help in preventing collisions. An experimental campaign has been carried out on real devices aimed at assessing the performance this approach can achieve.

Controller Area Network (CAN) has been the de facto standard in the automotive industry for the past two decades, and recently CAN with flexible data-rate has been standardized, which achieves higher speed. Further improvements are possible by exploiting the peculiar physical layer of CAN to perform distributed operations among network nodes. In this paper a proposal is made for an extension to the CAN protocol, denoted CAN with eXtensible in-frame Reply (CAN XR), which enables upper protocol layers to define new custom services devoted to, e.g., network management, application-specific functions, and high-efficiency data transfer. Since CAN XR retains full backward compatibility with CAN FD, there is no need to change the protocol specification.

Communication over the ether is by nature erratic and, consequently, wireless networks are unsuitable for hard real-time distributed control applications typical of industrial plants. However, scheduling strategies employed by real-time operating systems, along with channel redundancy and advanced bandwidth management, can be used to improve their determinism and make them suitable for soft real-time applications. This paper presents an approach that combines such techniques and a preliminary implementation, which relies on IEEE 802.11 (Wi-Fi), employed to assess its feasibility. Results show that data exchange determinism can be substantially improved towards the level required by many soft real-time applications.

Seamless redundancy can be profitably exploited to improve predictability of wireless networks, including IEEE 802.11. Packets are sent on two channels at the same time and duplicate copies are discarded by receivers. As long as behavior of channels is reasonably uncorrelated, both transmission latencies and the frame loss ratio improve noticeably. In this paper, such an assumption has been analyzed by means of experimental measurements carried out on real devices. Results confirm that, in typical operating conditions, independence reasonably holds.

The adoption of wireless communications and, in particular, Wi-Fi, at the lowest level of the factory automation hierarchy has not increased as fast as expected so far, mainly because of serious issues concerning determinism. Actually, besides the random access scheme, disturbance and interference prevent reliable communication over the air and, as a matter of fact, make wireless networks unable to support distributed real-time control applications properly. Several papers recently appearing in literature suggest that diversity could be leveraged to overcome this limitation effectively. In this paper, a reference architecture is introduced, which describes how seamless link-level redundancy can be applied to Wi-Fi. The framework is general enough to serve as a basis for future protocol enhancements, and also includes two optimizations aimed at improving the quality of wireless communication by avoiding unnecessary replicated transmissions. Some relevant solutions have been analyzed by means of a thorough simulation campaign, in order to highlight their benefits when compared with conventional Wi-Fi. Results show that both packet losses and network latencies improve noticeably.

Worst-case synchronization error is probably the most interesting performance index of clock synchronization protocols when used in real-time control applications. It depends on several factors, among which jitters on timestamp measurements and thermal variations in oscillators, which are very difficult to replicate in real systems. As a consequence, it makes little sense comparing the errors measured in different experiments, which means that assessing synchronization quality in real-time systems in a meaningful way is not a trivial task. In this paper, a methodology is described that permits different clock discipline algorithms to be experimentally evaluated and reliably compared. It was applied to a testbed where the reference broadcast infrastructure synchronization protocol is implemented over Wi-Fi, and permitted to define some guidelines for the optimal selection of the algorithm and its parametrization.

Timeliness and reliability are two major requirements of control systems and this true, in particular, in many industrial application areas which make use of solutions distributed over a network. Moreover, with the adoption of wireless communication technologies in industrial environments, granting timeliness and reliability for transmissions over the wireless error-prone channel has become a challenge of primary importance. This paper presents a new technique which is able to grant the feasibility of a set of real-time periodic data exchanges over a wireless network in presence of retransmissions. Thanks to a dynamic bandwidth reassignment strategy, our solution is also able to cope with retransmissions efficiently, so as to improve the system performance in terms of overall data delivery success probability and without negatively affecting the real-time guarantees.

The bit stuffing mechanism adopted in controller area networks leads to unwanted jitter on frame reception times, which worsens timing accuracy, even if countermeasures are adopted to avoid contentions on the bus. Several solutions have been proposed so far for dealing with stuff bits in the payload of messages, but they are not effective for the cyclic redundancy check. In this paper, a mechanism is presented that prevents the occurrence of stuff bits in the whole frame completely. It makes the duration of frame transmissions fixed and, hence, it achieves very accurate reception times. An optimized codec has been implemented to demonstrate that this approach is feasible and can be profitably adopted in low-cost networked embedded systems with demanding timing constraints.

This paper describes reference broadcast infrastructure synchronization (RBIS), a clock synchronization protocol for IEEE 802.11 infrastructure wireless networks. The protocol is especially tailored for industrial and home automation networks, and in many application contexts, it offers several advantages compared with other solutions targeted at similar purposes. RBIS has been conceived to rely on conventional Wi-Fi equipment and, in particular, on unmodified access points. It is based on the master/slave approach and follows the receiver/receiver paradigm. An implementation of RBIS-carried out completely in software and based on timestamps taken at the interrupt handler level-has been developed, which achieves a synchronization error below 3 μs. Then, a simple distributed hard real-time control application has been setup, which consists in two PCs running real-time application interface for Linux (RTAI) and connected through Wi-Fi. The actuation error, measured on the generation of synchronous pulses, is strictly below 13 μs.

Access control is a necessary building block in the security of any kind of cyber system and, in this sense, industrial networked systems (INSs) make no exception. Typically, access control policies are specified at a high implementation-independent level of abstraction and then mapped onto the real system by leveraging available policy enforcement mechanisms. Unfortunately, different from general-purpose ICT systems, enforcement mechanisms are generally very basic in INS. As a consequence, verifying the correctness of policy implementation becomes a crucial task, especially cumbersome when it needs to be carried out entirely by hand. This paper presents a new methodology, which also serves as the basis of a purposely developed software tool conceived to cope with the lack of policy enforcement mechanisms in INS and to allow semiautomatic verification of policy implementation. Our approach is based on a twofold system model that enables both the abstract specification of access control policies and the detailed description of the target physical system. These two separate views are then combined to automatically determine whether the current system implementation matches the policy specification.

The papers in this special section focus on the deployment of distributed data processing in industrial applications. The main objective is both bringing together ideas of the worldwide research community about one common platform and presenting the latest advances and developments in design, modeling, programming, management, and innovative implementations of distributed information systems, including the latest works related to industrial communication technologies to be used in the future.

The flexibility and reconfigurability requirements of factories and manufacturing plants of the future can be partially met by adopting technologies and solutions already available for testing and experimentation. Openness and adherence to international standards are becoming increasingly important in modern distributed production and automation systems, especially when they have to cope with ever-increasing product differentiations and short product lifecycles. However, the increased flexibility and openness should not come to detriment of the system real-time characteristics. This paper deals with a pilot mechatronic architecture for agile transport systems, which has been specifically developed to enable the study of the aforementioned aspects in the framework of the “Factory of the Future” Italian flagship project. In particular, the paper focuses on possible bottlenecks and pitfalls at the operating system and communication levels, and provides preliminary indications on how to address or mitigate them by means of solutions already available on the market.

Wireless communications suffer from disturbance and interference, which prevent reliable data exchanges and preclude their adoption in the real-time applications found at the lower levels of factory automation systems. This is particularly true for Wi-Fi, for which mechanisms like channel hopping and blacklisting are not available. Several solutions were defined in the past few years, which range from the adoption of general-purpose redundancy protocols over conventional communication equipment to proposals like Wi-Red, which offers link-level redundancy. In this paper, an enhancement is presented for the latter solution, which achieves better performance by deferring transmission of duplicate frames. The net effect is a sort of load balancing between wireless channels, which reduces network traffic and increases reliability further.

Nowadays, industrial control networks are no longer conceived as isolated systems, being them exposed to the same kind of security threats affecting traditional office and business networks. For this kind of systems, the main security requirement is availability, thus the protection measures used to secure industrial control networks must take into account also performance aspects, such as latency and jitters, usually not critical in traditional networks. For this reason, knowing the delays introduced by devices used to protect the network is of paramount importance, in order to evaluate whether the timing constraints of the communication are still satisfied. This paper presents an experimental evaluation of the communication latency introduced by a firewall for industrial control networks built around the Tofino Industrial Security Solution. Experiments have been carried out in three main working conditions of the firewall, that is when 1) it is plugged in the network with all the protection modules disabled (decommissioned mode); 2) it implements basic security policies only; 3) it adopts complex filtering mechanisms allowing the deep inspection of Modbus TCP packets.

Although the Controller Area Network (CAN) technology is very mature, the behavior of real CAN controllers under marginal operating conditions is still of practical interest as CAN is being deployed in a variety of application domains. In this paper, we propose a test software architecture able to extensively investigate the reaction of a typical CAN controller when subject to various kinds of error and different timing scenarios. Both the analysis technique and the test software use a black-box approach and do not require any modification of, or access to, the internal structure of the controller itself. They are therefore readily applicable with low effort to different hardware. Possible applications include diagnostic and reliability analysis tools for CAN.

The controller area network (CAN) bit stuffing mechanism, albeit essential to ensure proper receiver clock synchronization, introduces a significant, payload-dependent jitter on message response times, which may worsen the timing accuracy of a networked control system. Accordingly, several approaches to overcome this issue have been discussed in literature. This paper presents a novel software payload encoding scheme, which is able to guarantee that no stuff bits will ever be added to the data field by the CAN controller during transmission and, hence, lessens jitters considerably. Particular care has been put in its practical implementation and its subsequent evaluation to show how the simplicity and inherent high performance of the scheme make it suitable even for low-cost, embedded architectures.

Although awareness is constantly rising, that industrial computer networks (in a very broad sense) can be exposed to serious cyber threats, many people still think that the same countermeasures, developed to protect general-purpose computer networks, can be effectively adopted also in those situations where a physical system is managed/controlled through some distributed Information and Communication Technology (ICT) infrastructure. Unfortunately, this is not the case, as several examples of successful attacks carried out in the last decade, and more frequently in the very recent past, have dramatically shown. Experts in this area know very well that often the peculiarities of industrial networks prevent the adoption of classical approaches to their security and, in particular, of those popular solutions that are mainly based on a detect and patch philosophy. This paper is a contribution, from the security point of view, to the assessment of the current situation of a wide class of industrial distributed computing systems. In particular, the analysis presented in this paper takes into account the process of ensuring a satisfactory degree of security for a distributed industrial system, with respect to some key elements such as the system characteristics, the current state of the art of standardization and the adoption of suitable controls (countermeasures) that can help in lowering the security risks below a predefined, acceptable threshold.

Bit stuffing in CAN is likely to cause jitters on message reception that, in specific cases where timing accuracy is relevant, may worsen the quality of the control algorithm noticeably. Several solutions have appeared in the past years that are aimed to tackle this issue, which are based on a suitable encoding of the payload of the message carried out in s/w by the transmitting node. In this paper, two efficient approaches are considered, namely XOR masking and 8B9B encoding, and their performance evaluated by means of both theoretical analysis and experimental campaigns. In particular, jitter reduction capability and encoding efficiency were taken into account and compared to the case when plain CAN is adopted.

The effectiveness and quality of several distributed control loops are heavily affected by the ability to reduce jitters. This goal can hardly be achieved without understanding all possible causes that can introduce time fluctuations in the communication path between the processor, running the control algorithms, and the (remote) peripheral devices. This is because any of them, in fact, may worsen the timing accuracy of the system as a whole. After the most well-known sources of jitters are put under control, other aspects become more and more important for the overall behavior of the system. This paper tackles the problem of time fluctuations introduced by the interface between the Central Processing Unit (CPU) and the CAN controller in a typical off-the-shelf, single-chip microcontroller and shows why and how they should be considered and handled carefully.

In this paper the RBIS synchronization protocol is presented, which has been specifically conceived for industrial infrastructure WLANs. It combines the concepts of the sender/receiver and receiver/receiver approaches: similarly to RBS, timestamps are recorded only on received frames while, like IEEE 1588, it permits slaves to synchronize to the same master clock. Compared to RBS, RBIS has several advantages. Every single wireless sub-network, in fact, can be easily synchronized with an external time source located on the wired backbone. Moreover, when software implementations are considered that rely on unmodified conventional WiFi equipment, RBIS is able to feature noticeably better timing accuracy than IEEE 1588.

EtherCAT is a real-time Ethernet protocol conceived explicitly for industrial applications. It is characterized by high communication efficiency, which permits control loops to be closed with short cycle times, and is provided with a suitable mechanism, known as distributed clock (DC), that enables synchronized operations to take place across the controlled system. These features can be profitably adopted, for instance, to support motion control applications. In this paper, the performance of the DC mechanism is evaluated by means of a thorough campaign of experimental measurements carried out on a real network setup. A number of factors have been taken into account that can affect accuracy and precision, and their effects studied in depth.

The importance of safe communications in industrial environments has been steadily increasing over the past years and several special-purpose solutions have been developed to this purpose. However, the prevalent trend nowadays is the adoption of standard transmission technologies to support both safe and non-safe data exchanges over the same medium. This exposes safety-aware protocols to the same security threats experienced in conventional communication networks. This paper deals with some security aspects of a popular safety-oriented communication solution, namely Safe-tyNETp. Its main contribution is showing that safety protocols too suffer from security threats and can even make things simpler in carrying out certain types of attacks such as denial of service (DoS).

At present, two important trends in industrial environments are the adoption of Ethernet-based technologies to interconnect devices and the use of PCs provided with open-source real-time operating systems to execute control applications. This makes the implementation of distributed control systems easier and inexpensive. In these cases, it is of utmost importance that response times concerning the messages exchanged over the network be deterministically bounded. In this paper, the contribution to the end-to-end transmission delay which is due to the latencies introduced by the local protocol stack is analysed through experimental evaluation. In particular, two popular stacks have been taken into account, that is the one provided in conventional Linux and RTnet.

At present, an increasing number of distributed control systems are based on platforms made up of conventional PCs running open-source real-time operating systems. Often, the need arises in these systems to have networked devices supporting synchronized operations. In this paper, an inexpensive solution is introduced, described, implemented and evaluated that relies on standard software and protocols such as RTAI, RTnet and IEEE 1588. The main goals of this architecture are reducing design and development costs, ensuring adequate synchronization accuracy, and easing the porting of control applications to different H/W and S/W configurations.

EtherCAT is a popular, real-time Ethernet network that features very high communication efficiency. However, because of the ring topology it relies on, cycle times increase when the network size grows larger (considering both the amount of process data and the network extension). In this paper a solution based on commonly available off-the-shelf switches is presented and analyzed that can improve performance for large automation systems. Such an approach (almost) does not require new custom h/w to be purposely developed.

Nowadays, wireless communication technologies are being employed in an ever increasing number of different application areas, including industrial environments. Benefits deriving from such a choice are manifold and include, among the others, reduced deployment costs, enhanced flexibility and support for mobility. Unfortunately, because of a number of reasons that have been largely debated in the literature, wireless systems cannot be thought of as a means able to fully replace wired networks in production plants, in particular, when real-time behavior is a key issue. In this paper, an analysis of the real-time performance that can be achieved in quality-of-service (QoS)-enabled 802.11 networks has been carried out. In particular, a detailed analysis of latencies and packet loss ratios for a typical enhanced distributed channel access (EDCA) infrastructure wireless local area network (WLAN) is presented, obtained through numerical simulations. A number of aspects that may affect suitability for the use in control systems have been taken into account, including the Transmission Opportunity (TXOP) mechanism, the internal architecture of the AP, the use of a time-division multiple access (TDMA)-based communication scheme as well as the adoption of broadcast communications.

EtherCAT is a popular Ethernet-based solution conceived for connecting devices at the shop floor in industrial environments. Even though it features very high communication efficiency, that permits thousands of I/O points to be periodically exchanged between controlling devices and decentralized periphery with cycle times well below 1 ms, it is not able to cope in a proper way with event-driven systems, where lots of devices may be producing asynchronous information in a sporadic and unpredictable way. In this paper, some modifications to the basic EtherCAT protocol are proposed which enable CAN-like arbitrations to take place in such networks, so as to achieve a true priority-based access scheme.

Nowadays, industrial communication systems are experiencing the introduction of wireless technologies at all levels of automated factories. The benefits that derive from such a choice are manifold, including reduced deployment costs, enhanced flexibility and support for mobility. Unfortunately, because of a number of reasons, wireless systems can not be thought of as a complete replacement of wired networks at the field level. In this paper, the performance that can be achieved by QoS-enabled WLANs to support communication in industrial environments is analyzed. In particular, a detailed analysis of latencies in infrastructure networks is presented, obtained through numerical simulations, that takes into account both media access and queuing delays. Moreover, the impact of the internal architecture of the access point on performance is evaluated as well.

In modern factories, personal computers are starting to replace traditional programmable logic controllers, due to cost and flexibility reasons, and also because their operating systems now support programming environments even suitable for demanding real-time applications. These characteristics, as well as the ready availability of many software packages covering any kind of needs, have made the introduction of PC-based devices at the factory field level especially attractive. However, this approach has a profound influence on the extent of threats that a factory computing infrastructure shall be prepared to deal with. In fact, industrial personal computers share the same kinds of vulnerabilities with their office automation counterparts. Then, their introduction increases the risk of cyber-attacks. As the complexity of the network grows, the problem rapidly becomes hard to tackle by hand, due to the subtle and unforeseen interactions that may occur among apparently unrelated vulnerabilities, thus bearing the focus on the full automation of the analysis. Going into this direction, this paper presents a software tool that, given an accurate and machine-readable description of vulnerabilities, detects whether or not they are of concern and evaluates consequences in the context of a factory network.

EtherCAT is a very popular solution for connecting control applications to field devices in industrial environments, which is based on Ethernet transmission technology. Even though EtherCAT features a very high level of communication efficiency, that permits thousands of I/O points to be periodically exchanged between the controlling device and the decentralized periphery with cycle times well below lms, it is not able to cope in a proper way with event-driven systems, where lots of devices may be producing asynchronous information sporadically and unpredictably. In this paper, a modification to the basic EtherCAT access scheme is proposed, which enables a CAN-like arbitration to take place in such networks in order to select the most urgent event pending for transmission.

Abstract This paper addresses the problem of representing the intruder’s knowledge in the formal verification of cryptographic protocols, whose main challenges are to represent the intruder’s knowledge efficiently and without artificial limitations on the structure and size of messages. The new knowledge representation strategy proposed in this paper achieves both goals and leads to practical implementation because it is incrementally computable and is easily amenable to work with various term representation languages. In addition, it handles associative and commutative term composition operators, thus going beyond the free term algebra framework. An extensive computational complexity analysis of the proposed representation strategy is included in the paper.

Large diffusion of wireless communications is a trend that will soon involve industrial environments, too, and in particular those applications where granting limited response times is of utmost importance. This paper analyzes the impact of a number of causes, besides the medium access technique, on the performance of real 802.11g networks. In particular, the extent to which beacon frames and traffic on nearby channels can decrease the communication performance is taken into account, as well as the effect of the adapter's and access point's overheads on frame transmission latencies.

The adoption of wireless communication technologies in industrial environments for supporting (soft) real-time applications heavily depends on the ability to grant bounded response times for messages, at least from a probabilistic point of view. This aspect is particularly important in factory automation systems, where response times are considered much more significant than other performance indices, such as throughput, that are usually considered in different application areas. The ever-increasing availability on the market of products and solutions based on the IEEE 802.11 standard and the introduction of the 802.11e amendment for enhancing the quality of service (QoS) and prioritizing traffic make this kind of communication technology interesting also for adoption in (loosely coupled) distributed control systems. This paper reports on some experimental measures and the related analysis that have been carried out on real 802.11g/e networks for better understanding the statistical distribution of response times and can be of help in characterizing these solutions when used to support noncritical real-time traffic.

Flexible time division multiple access (FTDMA) is a medium access mechanism that some modern popular networks for use in passenger vehicles, such as Byteflight and FlexRay, rely on. Its development was driven explicitly by the new needs of automotive x-by-wire systems, which could not be satisfied by the existing solutions. The FTDMA technique was conceived primarily to overcome the limitations of controller area network and, in particular, for supporting high performance real-time communications. Even though this access scheme is mainly suitable for asynchronous transmissions, it can be adopted profitably for synchronous exchanges as well. In this paper, the main features of FTDMA are analyzed, and its performance is evaluated for different kinds of communications that have to be supported in today's vehicles.

At present, a number of platforms are becoming available for the implementation of intelligent field devices, which are based on low-cost microcontrollers and open-source real-time operating systems. To take full benefit from these platforms and to ease the task of developing and porting the application software, a standard interface has to be provided to cope with communication facilities. In this paper an application programming interface for CANopen is introduced that relies on the well-known socket paradigm. Despite its inherent simplicity, it is very flexible and offers the programmer all the functionalities foreseen by the CANopen specification

This paper presents some theoretical and experimental results concerning the introduction of advanced sensors in the design and development of a new generation of presses for plastic material injection used to produce washing machine tubs. The architecture of the control system for the presses is based on a distributed solution and relies on fieldbus communications to obtain a graceful migration path to the adoption of sensors of a new generation. This enables a dramatic decrease in both the cabling complexity and cost, together with a significant improvement in the performance of the whole machine. The adoption of the field network to connect sensors and actuators to the controller has been carefully evaluated by means of a preliminary theoretical analysis. Then, two test systems have been implemented to collect data and performance figures by carrying out experiments and measures on some of the real devices selected for the design of press control equipment.

In this paper a new technique is introduced that enables the communication efficiency of CANopen networks to be increased above its current limit. In particular, significant improvements can be achieved in all those cases where the application master needs to poll whole groups of input devices or process data have to be sampled at different rates. The new mechanism does not require any modification to the hardware of CAN controllers, but only slight changes to the CANopen protocol stack. Thus, it can be implemented easily and inexpensively by simply upgrading the firmware of the existing devices.

Testing equivalence is a powerful means for expressing the security properties of cryptographic protocols, but its formal verification is a difficult task because of the quantification over contexts on which it is based. Previous articles have provided insights into using theorem-proving for the verification of testing equivalence of spi calculus specifications. This article addresses the same verification problem, but uses a state exploration approach. The verification technique is based on the definition of an environment-sensitive, labeled transition system representing a spi calculus specification. Trace equivalence defined on such a transition system coincides with testing equivalence. Symbolic techniques are used to keep the set of traces finite. If a difference in the traces of two spi descriptions (typically a specification and the corresponding implementation of a protocol) is found, it can be used to automatically build the spi calculus description of an intruder process that can exploit the difference.

Even though the controller area network (CAN) protocol is particularly suitable to support communications in real-time environments, it may exhibit unfair behaviour under heavy traffic conditions. Medium-utilisation state tracking (MUST) is a novel technique which achieves fair round-robin access in CANs and requires few changes to the original protocol. Furthermore, it preserves full compatibility with the existing devices and applications developed for CANs. In this paper, the combined use of conventional CAN and MUST devices is analysed, and the performance improvements which can be obtained have been evaluated. In addition, some hints are given on possible implementations of the MUST technique in real CAN controllers.

The integration of different formal description techniques is an important feature in the design of communication protocols and concurrent systems. In this paper we address the problem of translating Petri nets with inhibitor arcs into basic LOTOS specifications, which is an important step in the direction of integrating these two commonly used formalisms. A mapping which preserves strong bisimulation equivalence is formally defined and illustrated by means of an example. The definition of the mapping enables us also to state a new result about the expressive power of the basic LOTOS subset which constitutes the mapping range.

Performance analysis and formal correctness verification of computer communication protocols and distributed systems have traditionally been considered as two separate fields. However, their integration can be achieved by using formal description techniques as paradigms for the development of performance models. This paper presents a novel extension of LOTOS, one of the two formal specification languages that were standardized by ISO. The extension is specifically conceived to integrate performance analysis and formal verification. The extended language syntax and semantics are formally defined, along with a mapping from extended specifications to performance models, The mapping preserves the specified observable behavior. Two simple examples, a stop-and-wait protocol and a time-sharing system, are used to concretely demonstrate the new approach and to validate it.>

Abstract A new tool for generating implementation prototypes of communication protocols and concurrent systems specified using the ISO LOTOS language is presented in this paper. A brief introduction to LOTOS and a discussion of the main problems related to the efficient execution of specifications written in LOTOS are presented first. The design and implementation of the tool are then considered: LOTOS specifications are analysed and translated into C functions which are executed by co‐operating processes in the Unix environment. The set of LOTOS process definitions is first translated into a suitable number of extended finite‐state machines (EFSMs). The method proposed allows the problem of deriving unbounded EFSMs to be circumvented and a sort of control on the process number/size trade‐off to be obtained at the same time. The problem of implementing the LOTOS multi‐way rendezvous mechanism for process synchronization is solved by using an algorithm based on message‐passing techniques. An example of prototype derivation is also described, showing the form of C code generated by translating a simple specification. Finally, some performance figures are presented.

A generative model for extending algebraic protocol specifications with probabilities is presented. The approach associates a simple probabilistic characterization with each algebraic operator occurrence in a behavior expression. The result is a compact notation in which the assignment of probabilities is more straightforward than with transition-based models. It is shown that an equivalent state machine with probabilities attached to transitions can be constructed automatically from an algebraic specification with probabilistic characterizations attached to operators. Specifically, it is shown how a probabilistic state machine can be derived from a basic LOTOS expression enriched by a probabilistic characterization. As an application example, a stop-and-wait protocol is examined.>

A study of the throughput and time characteristics of double-ring networks is presented, assuming that the two channels are used for balancing the traffic (when both are working) and for synchronous traffic generated according to a generic but periodic pattern. In addition, reconfiguration using portions of both rings to circumvent faulty elements in a double ring network is shown to be equivalent to the single ring configuration already studied. Examples of applications of the results are also illustrated.>

A network based on a reduced protocol profile is well suited for industrial applications that require cheap and fast communications. A pilot project whose aim is to demonstrate the practical feasibility of such an environment is presented. The implementation approach is described, pointing out the advantages coming from the solution adopted, which is based on the availability of multiple processes carrying out different protocol functions that the user can see as a collection of procedures linked together forming a common library. Some significant manufacturing message service (MMS) services are also described, and their performance is discussed in terms of response times.>

Two timed token protocols, the IEEE 802.4 and FDDI (fiber distributed data interface), are considered. Although IEEE 802.4 and FDDI have similar protocol rules, the different method of measuring the duration of the generic token rotation has imposed separate analyses for the two protocols. Presented is a general proof of equivalence between IEEE 802.4 and FDDI networks, where both consist of queues belonging to two priority classes. Having proved this equivalence, it is possible to extend results formally demonstrated for one protocol to the other. In particular, the results regarding the bounds on mean and maximum token rotation time derived for FDDI by Sevcik and Johnson (1987) can also be extended to IEEE 802.4 networks.>

It is noted that the implementation of the multiway rendezvous mechanism of the International Standards Organization (ISO) LOTOS specification language for protocols is very important in the development of tools for the execution of LOTOS. It involves problems such as global knowledge in a distributed environment and distributed agreement. The authors propose a novel algorithm which fully implements the multiway rendezvous of LOTOS within a distributed execution model based on a number of parallel processes. The processes are organized in a hierarchical topology and communicate with each other only by message transfers. The performance of the proposed algorithm is evaluated and is shown to be better than that achieved by other algorithms proposed in the literature. A formal specification of the algorithm in LOTOS is provided.>

Timed-token protocols are used to handle, on the same local area network, both real-time and non-real-time traffic. The authors analyze this type of protocol, giving worst-case values for the throughput of non-real-time traffic and the average token rotation time. Results are obtained for synchronous traffic generated according to a generic periodic pattern under heavy conditions for non-real-time traffic and express not only theoretical lower bounds but values deriving from the analysis of some real networks. A model which addresses the asynchronous overrun problem is presented. The influence of introducing multiple priority classes for non-real-time traffic on the total throughput of this type of message is shown. It is also shown that the differences between the values obtained under worst-case assumptions are close to those obtained under best-case assumptions; the method may therefore be used to provide important guidelines in properly tuning timed-token protocol parameters for each specific network installation.>

Timed token protocols are both used to handle, on the same local area network, both real-time and non-real-time traffic. The authors analyze this type of protocols, giving worst-case values for the throughput of non-real-time traffic and the average token rotation time. The results were obtained for synchronous traffic generated according to a generic periodic pattern, under heavy traffic conditions. Finally, it is shown that the difference between the values obtained under worst-case assumptions are close to those obtained under best-case assumptions. Therefore, the method presented here may be used to provide important guidelines so as to properly tune timed token protocol parameters for each specific network installation.>

Timed-token protocols are used in local area networks to achieve bounded access times for a class of messages referred to as synchronous. An analysis is made of the behavior of this type of access protocol in a network with one redundant channel. Stations connected to both rings and stations connected to either ring are considered. A method of computing the minimum guaranteed throughput for asynchronous messages is shown, assuming that the two channels are used for balancing the traffic (when both are working) and for synchronous traffic generated according to a generic but periodic pattern.>

The problem of authenticating the users of a computer network in order to protect the shared resources against unauthorized use is discussed. Since intruders could enter the network and try to use services they have no right to access, the host implementing the service (or server) has to check the user's identity and access rights by searching in the relevant database. The author presents a method of carrying out such checks efficiently. The basic idea is that a suitable interface process is associated with each user-server connection in order to filter out unauthorized requests, thus implementing a sort of cache with parallel search where the working set of the whole database is stored and explored. The use of the interface process enables the system to exploit the hardware support for capability checking provided by new microprocessors. In particular, an implementation using iAPX432-based hosts is illustrated and performance issues are discussed.>

Abstract Communication protocols form a language which can be recognized by extended finite automata, and compiler generating tools can help with its implementation. This paper presents a project for implementing the ISO OSI layers which are most relevant to LANs. Taking advantage of modular and repetitive OSI architecture, a layer implementation model is proposed, introducing sharp distinctions between protocol layer‐dependent and independent modules, so that the implementation effort can be largely reduced. It is also shown that layer‐dependent modules can be generated automatically by using software tools developed for compiler construction. It is assumed that the protocols to be implemented have already been verified and validated in their abstract forms using other techniques, since these aspects are not covered by the method proposed. Measures of program sizes and execution speeds obtained following the approach proposed are reported; they show that most of the layer code can be produced by automatic tools and the overall software complexity enables the OSI architecture to be implemented for single‐board microcomputers.

Robotic manufacturing cells are heterogeneous systems consisting of such different components as machine tools, robots and programmable logic units. The efficient management of a cell depends on the integration of these different elements. This paper discusses the challenging problems and perspectives relating to the use of advanced communication and programming methodologies which rely on the local area network as the interconnection structure for the cell components.