# Railway Cloud Resource Management as a Service
## 3 Fault Management of Railway Cloud Resources
### Fault Management Use Cases
A callback notification check is performed which includes reachability test and authorization. The subscriber is informed about the reachability and authorization result. In the case of reachability success, the subscription is acknowledged by the CRFM service, and the subscription status is indicated to the railway cloud operator. Figure 1: Communication model of subscribing to alarm notifications. The same communication pattern is used when the subscriber wants to change its subscription. To change the subscription characteristics, the subscriber needs to delete the previous alarm subscription to create a new one. These two operations have to be executed in an atomic manner, which ensures that no alarms are missed between operations. A cloud resource may encounter two types of faults, a fault A, which can be remediated by the cloud resource itself, or a fault B, which cannot be resolved by the cloud resource. In the case of a fault occurrence, the cloud resource logs the alarm internally. For example, a fault of type A is the class of faults that might be handled autonomously, e.g., route re-selection to a resource that has become inaccessible (due to congestion, network segment outage, or attack), data recovery (by backup service), etc. Unfortunately, the type B faults still require human intervention (rocks on the rails, balise malfunction, and the like). The railway cloud platform evaluates what faults must become alarms; for example, an alarm is raised for a fault of type B only. Optionally, the CRFM service may perform alarm analysis, alarm correlation, and alarm escalation based on alarm priority and alarm frequency. The CRFM service logs the alarm and evaluates the alarm criteria. The alarm is reported by the CRFM service to the CM application. If the fault is cleared by the cloud resource, the fault clearance is reported. The CRFM service determines which alarm needs to be cleared by the fault clearance. The alarm may be cleared by the RMAO or by the CRFM service. Next, the alarm clearance is logged and reported to the CM application with active subscription. Alarm conditions experienced by a cloud resource may be managed or cleared. A management entity in the RMAO may requests alarm acknowledgement/clearance. The CRFM service may also clear alarms autonomously. Some alarms can be cleared manually while others can be cleared automatically (alarms related to faults of type A). Alarm acknowledgement is required in case of a necessity of human intervention (alarms associated with faults of type B). Based on the cloud resource type, an alarm can be manually cleared after it has been raised. The railway operator or the RMAO initiates an alarm acknowledgement/clear request, which is sent to the CRFM service. The CRFM service performs the alarm acknowledgement/clear on the logged alarm. In the case of a successful alarm acknowledgement/clearance, a success response is returned. If the alarm does not exist or the acknowledgement/clearance failed due to unexpected condition, a response is sent to the requester. The alarm acknowledge/clear status is reported and a notification is sent. If the CRFM service initiates an alarm clear, a notification of a successful alarm clear operation is sent by the CRFM service to the CM application. A failed alarm clear operation, autonomously initiated by the CRFM service, is not reported. Figure 2 shows the communication model of alarm acknowledgement/clear. An alarm can be suppressed until a specific period of time has elapsed, which prevents alarm storms during a specific set of conditions. The purpose is to allow the railway operator or the RMAO to activate the suppression of alarm notifications under the suppression criteria and to deactivate the alarm suppression. Upon a request for alarm suppression activation, the CRFM service processes the request and activates the alarm suppression. The CRFM service returns a response back to the requesting entity including the configured alarm suppression criteria.