From Smart Dust to Reliable Networks

Kris Pister

Prof. EECS, UC Berkeley

Founder & CTO, Dust Networks

Outline

• Background– The Science Project

• Market– The Hype

• Technology– Challenges– Status

• Applications

• Open Research Problems

Grand Challenge

Reliably, at low power

AB

C

Smart Dust Goalc. 1997

Smart Dust, 2002

16 mm3 total circumscribed volume~4.8 mm3 total displaced volume

SENSORS ADC FSMRECEIVER

TRANSMITTER

SOLAR POWER1V 1V 1V 2V3-8V

PHOTO 8-bits

375 kbps

175 bps

1-2V

OPTICAL IN

OPTICAL OUT

UCB “COTS Dust” Macro Motes

Small microcontroller

- 8 kb code, 512 B data

Simple, low-power radio

- 10 kbps

EEPROM storage (32 KB)

Simple sensors

WeC 99James McLurkin MS Mica 02

NEST open exp. platform

128 KB code, 4 KB data

50 KB radio

512 KB Flash

comm accelerators

Dot 01

Demonstrate scale

Rene 00

Designed for experimentation

-sensor boards

-power boards

Networking

Services

TinyOS

David Culler, UCB

University Demos – Results of 100 man-years of research

Intel Developers Forum, live demo800 motes, 8 level dynamic network,

Seismic testing demo: real-time data acquisition, $200 vs. $5,000 per node

vs.

50 temperature sensors for HVAC deployed in 3 hours. $100 vs. $800 per node.

Motes dropped from UAV, detect vehicles, log and report direction and velocity

Source: InStat/MDR 11/2003 (Wireless); Wireless Data Research Group 2003; InStat/MDR 7/2004 (Handsets)

0

100

200

300

400

500

600

700

800

2003 2004 2005 2006 2007

Un

its

(M

illio

ns

)

Wi-Fi nodesHandsetsWireless Sensor Nodes

Sensor Networks Take Off!

$8.1B market for Wireless Sensor Networks in 2007

Industry Analysts Take Off!

Decision Systems

Analog Sensorsand Actuators

Digital Sensors and Actuators

Serial Devices

MonitoringSystems

ControlSystems

EnterpriseApplications

Physical World

• Significant reduction in the cost of installing sensor networks

• Enables new class of services

• Increases sensor deployment

Wireless Sensor Networking

WDRG, 2003

$748,000,000 in ‘03

Cost of Sensor Networks

Time

$

Computing Power

Sensors

Installation, Connection and Commissioning

Mesh Networking

Low Data Rate WPAN Applications (Zigbee)

RESIDENTIAL/LIGHT

COMMERCIAL CONTROL

CONSUMER ELECTRONICS

TVVCRDVD/CDremote

securityHVAClighting controlaccess controllawn & garden irrigation

PC & PERIPHERALS

BUILDING AUTOMATION

securityHVAC

AMRlighting controlaccess control

mousekeyboardjoystick

PERSONAL HEALTH CARE

patient monitoring

fitness monitoring

INDUSTRIALCONTROL

asset mgtprocess control

environmentalenergy mgt

Mesh Systems

Add: MoteIV, Arch RockMerged: •Chipcon/Figure8 TI/Chipcon•Integration Associates/CompXs

Dust Networks

• Founded July 2002– Angels, In-Q-Tel, ~$1.5M– 28 employees in Jan 04

• Series A Feb 2004– Foundation– IVP

• Series B Feb 2005– Crescendo– Cargill

Network Architecture

• Goals– High reliability– Low power consumption– No customer development of embedded software– Customer visibility into all aspects of network

operation/status/health– Minimal/zero customer RF/networking expertise

necessary

• Challenges– 1W emitters in regulated but unlicensed RF bands– Extreme computation and communication resource

constraints• MIPS, RAM, bps

What do OEMs and SIs want?

• Reliability• Reliability• Reliability• Low installation and ownership costs

– No wires; >5 year battery life– No network configuration– No network management

• Typically “trivial” data flow– Regular data collection

• 1 sample/minute…1 sample/day?

– Event detection• Threshold and alarm

^ and scientists and and engineersand startups and grad students and….

Reliability

• Hardware– Temperature, humidity, shock– Aging– MTBF = 5 centuries

• Software– Linux yes (manager/gateway)– TinyOS no (motes)

• Networking– RF interference– RF variability

Goals

• Networks must be– Reliable

• count the 9s!

– Scalable• thousands to tens of thousands of nodes

– Low Power• Self forming, self healing

• Zero wires

– Flexible• Monitoring, maintenance, log file transfer, …

• Battery only or powered infrastructure

Challenges

• RF environments are dynamic– Time-varying multi-path– Time-varying interference

• Sensor Networking is challenging– Traditional traffic models don’t apply

• Internet, WiFi

• Cell phones

– Computational resources are limited

Implications of RF Challenges

• “Transmit and forget” is unreliable– Lost packets

• Single-path networks (trees) are very dangerous– Lost motes

• Single-channel networks are fatal– Lost networks

RF Solutions

• Temporal Diversity– Don’t quit until you get an acknowledgement

• Spatial Diversity– Multiple paths from every mote

• Frequency Diversity– Frequency hopping in addition to direct

sequence spread spectrum

IEEE 802.15.4 & WiFiOperating Frequency Bands

868MHz / 915MHz PHY

2.4 GHz

868.3 MHz

Channel 0 Channels 1-10

Channels 11-26

2.4835 GHz

928 MHz902 MHz

5 MHz

2 MHz

2.4 GHz PHY

Gutierrez

900 MHz cordless phone

-20dBm-50dBm

Solid motesignal

Zigbee 1.0

• Single channel networks are built into standard. This will be fatal for reliability.

• Tree-based routing recommended by standard will likely not be adopted, especially given the single-channel radio.

• No definition of duty cycling routers– Assumes powered routers, battery powered leaf

nodes– No explicit prevention of router duty cycling –

Zigbee 2.0?

Full function device

Reduced function device

Communications flow

Clustered stars - for example,cluster nodes exist between roomsof a hotel and each room has a star network for control.

Cluster-tree Topology

Techno-Rant

• Reduced function devices are a non-starter for most applications

• Tree-based routing is fatal

• Cluster-tree combines both

• Mesh != multi-hop– Mesh = path diversity

• Fixed frequency is fatal

• Wireless means no wires

Radio Reliability in a Crowded Spectrum

• UWB?– Unclear potential for duty cycling

• DSSS doesn’t cut it– Helpful, but only about 10dB

• +20 dBm doesn’t cut it– Helpful, but expensive in batteries– 802.11 & cordless phones

• Must frequency hop– Time synchronization required… …but you probably needed that anyway.– Lots of channels, lots of bandwidth, better

scaling, …

Spatial effect of multipath

Beware of static measurements and RF pathloss simulations

• Site surveys need to be done over at least 24 hours

• Simulation tool results need much more speckle

Pictures from www.wirelessvalley.com

Path stability vs. Received Signal Strength

Distance vs. Received Signal Strength

-100 -90 -80 -70 -60 -50 -400

20

40

60

RSSI and distance for Consolidated network

RSSI [dBm]

Dis

tan

ce [

me

ters

]

1/R2?1/R4?

Frequency dependent fading and interference

From: Werb et al., “Improved Quality of Service in IEEE 802.15.4 Networks”, Intl. Wkshp. On Wireless and Industrial Automation, San Francisco, March 7, 2005.

M Tu W Th F M Tu

Real RF links

• Indoor propagation – not well modeled by R^k for any k– Attenuation ~

Free space (R2)

+ Uniform(0,30) dB

+ rand(t) * uniform(0,30) dB

– Not symmetric, time varying

• PER is not due to gaussian BER

Transmitter efficiency

• Transmitter slope efficiency is typically 10—50% but…

• Transmitter overhead is typically >10x the max output power, so…

• Changing transmit power may be useful for interference reasons, but it has little effect on battery life

Pin [mW]

Transmitter efficiency

20 250

1

Pout

[mW]

Energy per packet

Lpayload [bits]

Energy per packet

0 102…103 0

Etx

[uJ]

• Energy spent in turning on the transmitter and sending packet overhead (preamble, start symbol, headers and footers) typically exceeds the energy cost of the payload, often by 10x

• The same is true for the receiver, but how do you know when to turn it on?

Network Types

Powered mesh infrastructure

Star-Mesh Full Mesh

Star-connected sensors

No infrastructure

Mesh-connected sensors

Star

X X

Why not use 802.11?

Time Diversity

• Link-level acknowledgement– Keep trying until you get

confirmation of success

• Assume packet error rate, PER=20%=0.2

• Try N times• Overall failure probability

is (PER)N

• Overall success probability is 1- (PER)N

N Probability of failure

Probability of success

1 0.2 0.8

2 0.04 0.96

3 0.008 0.992

4 0.0016 0.9984

5 0.00032 0.99968

Path diversity

• Assume overall reliability is 99% on each of k paths– Probability of success on at least one path is

1 - (1-0.99)k

– k=2 99.99%

• Path diversity allows smooth recovery from unexpected events– Alarms are generated in network and flow to

manager– Manager takes appropriate action (e.g. add

bandwidth, new parent, …)

Min_Parents = 2

Power-optimal communication

• Assume all motes share a network-wide synchronized sense of time, accurate to ~1ms

• For an optimally efficient network, mote A will only be awake when mote B needs to talk

A

B

Expected packet start time

A wakes up and listens

B receives ACKA transmits ACK

Worst case A/B clock skew

B transmits

Packet transmission and acknowledgement

MoteCurrent

Radio TX startup

Packet TX

Radio TX/RX turnaround

ACK RX

Energy cost: 295 uC

Fundamental platform-specific energy requirements

• Packet energy & packet rate determine power– (QTX + QRX )/ Tpacket

– E.g. (300 uC + 200 uC) /10s = 50 uA

Idle listen (no packet exchanged)

MoteCurrent

ACK RXRadio RX startup

Energy cost: 70 uC

Scheduled Communication Slots

• Mote A can listen more often than mote B transmits• Since both are time synchronized, a different radio frequency can

be used at each wakeup• Time sync information transmitted in both directions with every

packet

A

B

Ch 3

B TX, A ACK

Ch 6Ch 4 Ch 5 Ch 7 Ch 8

Latency reduction

• Energy cost of latency reduction is easy to calculate:– Qlisten / Tlisten

– E.g. 70uC/10s = 7uA

• Low-cost “virtual on” capability• Latency vs. power tradeoff can vary by mote, time of day, recent traffic, etc.

A

BB TX, A ACKTlisten

Latency reduction

• Global time synchronization allows sequential ordering of links in a “superframe”

• Measured average latency over many hops is Tframe/2

A

B

G

Superframe

T1, ch x

T2, ch y

People draw digraphs

A

C

B

A

C

B

A

C

B

A

C

B

Graph

MultiGraph

DiGraph

MultiDiGraph

Time and Frequency

•Graphs & Links are abstract, with no explicit time or frequency information. •Frames and slots are more concrete•Time synchronization is required•Latency, power, characteristic data rate are all related to frame length•Relative bandwidth is determined by multiplicity of links

A

C

B

CB

BA

BA

Time

Freq902.5 MHz

903 MHz

…

927.5 MHz

One Cycle of the Black Frame

One Slot

Time and Frequency

• Every link rotates through all RF channels over a sequence of NCH cycles• 32 slots/sec * 16 ch = 512 cells/sec• Sequence is pseudo-random

BA

CB

BA

Time

Cha

nnel

BA

CB

BA

BA

BA

CB BA

Cycle N Cycle N+1 Cycle N+2 A

C

B

50 channels, 900 MHz

900MHz 930MHz

16 channels, 2.4 GHz

2.4GHz 2.485 GHz

Configure, don’t compile

SmartMesh Manager

Mote

IP NetworkXML

SmartMeshTM

Console

~100 ft

Reliability: 99.99%+Power consumption: < 100uA average

50 motes, 7 hops3 floors, 150,000sf

>100,000 packets/day

Scalability: Outdoor Test Network

Interferer(PosA)

10

SmartMeshManager

2

SmartMeshManager

1

SmartMeshManager 9.5

4.5

8

4.5

OPEN SPACE DEPLOYMENT

Netw ork deployed at 1 Thayer Road, Santa Cruz, CA, on roughpasture. Modifications to Implementation plan due to deployment fitinto "thin and hourglass" shape of site (no minimum plan distancescompromised). All measurements given in meters, and accurate to

w ithin +/-25 centimeters (gopher hole offsets).

025

Mote

16

619

Mote

053

Mote

8

6

038

Mote

037

Mote

6

4.5

060

Mote

059

Mote

8

3

8

10

13

13

002

Mote8 8

3

050

Mote

004

Mote

13

005

Mote

13

054

Mote

061

Mote

001

Mote

6

003

Mote10

006

Mote

13

13

10

049

Mote

8

84.5

013

Mote

052

Mote

056

Mote6

6

235

Mote

233

Mote

232

Mote

88

234

Mote

8

231

Mote

8

8

12.5

9

11.5

4.5

4.5

4.5

11.5

10.5

3

8

014

Mote8

9

4

SmartMeshManager

148

Mote

4.5

147

Mote

8

015

Mote

16

190

Mote

8

4.5

8

187

Mote

188

Mote

189

Mote

016

Mote

018

Mote6 6

3.5

017

Mote

019

Mote

021

Mote

020

Mote

023

Mote

6

3.5

6

3.5

3.5

022

Mote

3.5

6

024

Mote6

3.5

151

Mote

154

Mote

3.5

159

Mote

3.5

150

Mote

155

Mote

3.5

158

Mote

3.5

156

Mote

153

Mote

66

6

6

6

66 6

149

Mote6

157

Mote6

152

Mote6

160

Mote6

3.5

3.5

3.5

3.5

165

Mote

163

Mote6 6

3.5

164

Mote

172

Mote

170

Mote

171

Mote

178

Mote

6

3.5

6

3.5

3.5

179

Mote

3.5

6

177

Mote6

3.5

162

Mote

173

Mote

3.5

176

Mote

3.5

166

Mote

169

Mote

3.5

180

Mote

3.5

168

Mote

174

Mote

66

6

6

6

66 6

167

Mote6

183

Mote6

161

Mote6

186

Mote6

3.5

3.5

3.5

3.5

3.5

3.5

3.5

3.5

3.5

3.5

3.5

182

Mote6

3.5

181

Mote6

175

Mote6

3.5

185

Mote6

184

Mote

3.5

3.5

3.5

16

4.5

026

Mote

242

Mote

8

4.5

9.5

031

Mote

241

Mote

243

Mote

4.5

236

Mote

237

Mote

238

Mote

8

8

239

Mote

8

240

Mote

8

8

19

19

4.5

4.5

255

Mote

Interferer(PosD)

Interferer(PosC)

4.5

4.5

027

Mote

285

Mote 4.5

3

304

Mote

286

Mote

303

Mote

302

Mote

3.5

3

4.5

3

287

Mote

3

4.54

279

Mote

278

Mote

3

277

Mote

3

262

Mote

4.5

4.5

4.54.5

261

Mote 4.5

263

Mote 4.5

267

Mote 4.5

4.5

3

3

288

Mote 4.54.5

4.5

301

Mote

289

Mote

300

Mote

299

Mote

5

4.5

4.5

4.54.5

290

Mote

4.5

4.55.5

4.5

276

Mote

275

Mote

4.5

274

Mote

4.5

265

Mote

4.5

4.5

4.54.5

264

Mote 4.5

291

Mote 4.56

4.5

4.5

3

4.53

33

273

Mote 4.5

4.5

266

Mote 4.5

4.5

6

298

Mote

4.5

250

Mote

029

Mote

4

4

3

249

Mote

030

Mote

251

Mote

028

Mote

252

Mote

4

4

307

Mote

282

Mote

253

Mote

254

Mote

3

8

8

269

Mote 4.5

4.5

293

Mote 4.5

4.5

271

Mote 4.5296

Mote

4.5

4.5

268

Mote 4.5

4.5

292

Mote 4.5

4.5

272

Mote 4.5297

Mote

4.5

4.5

3

33

3

260

Mote 4.5284

Mote 4.5

280

Mote 4.5305

Mote

3

33

3

259

Mote 4.5283

Mote 4.5

281

Mote 4.5306

Mote

294

Mote 4.5

4.5

270

Mote 4.5295

Mote

4.5

4.5

258

Mote

8

248

Mote

247

Mote

256

Mote

8

8

245

Mote

246

Mote

257

Mote244

Mote

8

8

88

13

10.5

6

3

4.5

3

4.5

309

Mote

310

Mote

311

Mote

312

Mote

313

Mote

314

Mote

315

Mote

4.5

9

4.5

8

9.59.5

Interferer(PosE)

Interferer(PosB)

7

SmartMeshManager

6

SmartMeshManager

5

SmartMeshManager

4.5

4.5

322

Mote

321

Mote

4.5

320

Mote

4.5

325

Mote

3

4

3.5 3.5

326

Mote4

4.5

319

Mote

318

Mote

4.5

317

Mote

4.5

328

Mote

4.5

5.5

5 5

327

Mote4.5

316

Mote

4.5

4.5

4.54.5

329

Mote5.5

4.5

4.5

453

Mote

518

Mote

512

Mote

511

Mote

331

Mote

337

Mote

335

Mote

338

Mote

339

Mote

336

Mote

334

Mote

333

Mote

340

Mote

341

Mote

342

Mote

343

Mote

344

Mote

345

Mote

346

Mote

355

Mote

354

Mote

353

Mote

352

Mote

351

Mote

350

Mote

349

Mote

356

Mote

357

Mote

358

Mote

359

Mote

360

Mote

361

Mote

362

Mote

371

Mote

370

Mote

369

Mote

368

Mote

367

Mote

366

Mote

365

Mote

372

Mote

373

Mote

374

Mote

375

Mote

376

Mote

4.5

4.5

4.5

4.5

4.5

4.5

3-6m 3-6m 3-6m 4.5

4.5

4.54.5 4.5 4.5

4.54.5

4.54.5

4.5

4.5 4.54.5 4.5 4.5

4.5

4.5

4.5

4.5

4.5

4.5

4.5

4.5

4.5

4.5

4.5 4.5 4.54.5

4.5 4.5 4.5 4.5

4.54.5

4.54.5

4.5

4.5 4.5 4.54.5 4.5

3-6m 3-6m 3-6m 3-6m 3-6m

4.5 4.54.5 4.5 4.5

4.54.5

4.54.5

383

Mote8

392

Mote16

391

Mote

393

Mote

403

Mote

404

Mote

405

Mote

406

Mote

415

Mote

416

Mote

417

Mote

418

Mote

429

Mote

430

Mote

431

Mote

4.5 4.54.5

4.5 4.54.5

4.5 4.5 4.5

4.5

4.5

4.5

4.5

4.5

4.54.5

4.54.5 4.5 4.5

438

Mote

448

Mote

452

Mote

465

Mote

1414

14 14

464

Mote

478

Mote

477

Mote

476

Mote

490

Mote

489

Mote

488

Mote

487

Mote

502

Mote

501

Mote

500

Mote

4 4 4

44

4

4 4 4

4.54.5

4.5

4.5 4.5

4.5 4.54.5 4.5

466

Mote

467

Mote

475

Mote

499

Mote

463

Mote

479

Mote

486

Mote

503

Mote

462

Mote

480

Mote

485

Mote

4.5 4.54.5

4.54.5 4.5 4.5

4.54.5

4.5

4 4 4

44

4 44

390

Mote432

Mote

419

Mote

4.5

4.5

4.5

4.54.5

510

Mote

513

Mote

517

Mote

522

Mote

14 1414

14

523

Mote

382

Mote

380

Mote

384

Mote

4.5

4.5

521

Mote

520

Mote

386

Mote

4.5

455

Mote

389

Mote

388

Mote

407

Mote

408

Mote

409

Mote

412

Mote

413

Mote

414

Mote

433

Mote

434

Mote

4.5 4.54.5

4.5 4.54.5

4.5

4.5

4.5

4.5

4.5

4.5 4.5

4.5 4.5 4.5 4.5

387

Mote435

Mote

4.5

4.5

4.54.5

397

Mote

396

Mote

399

Mote

400

Mote

401

Mote

420

Mote

421

Mote

422

Mote

425

Mote

426

Mote

4.5 4.5 4.5

4.5 4.5 4.5

3-6m

4.5

4.5

4.5

4.5

4.5

395

Mote

427

Mote

4.5

4.5

3-6m3-6m

394

Mote

402

Mote 4.54.5

4.5 4.5

428

Mote

4.5

4.5

4.54.5 4.5 4.5

410

Mote

411

Mote4.5

4.5 4.5

436

Mote

4.5

4.5

504

Mote4

4.5

460

Mote

461

Mote

482

Mote

481

Mote

484

Mote

483

Mote

506

Mote

505

Mote

44 3-6m

44 4

4.5

4.5

4.5

4.5

4.5 4.5

4.5

4.5

468

Mote

469

Mote

474

Mote

473

Mote

472

Mote

493

Mote

492

Mote

491

Mote

498

Mote

497

Mote

4.5 4 4

4 4 4

4

4.5

4.5

4.5

4.5

4.5 4.5

4.5 4.54.5 4.5

470

Mote

496

Mote

4.5

4.5

44

471

Mote

494

Mote4

4.5 4.5

495

Mote

4.5

4

519

Mote

323

Mote

347

Mote

377

Mote

348

Mote

4.5

364

Mote

308

Mote332

Mote

524

Mote

4.5

398

Mote

525

Mote

4.5

424

Mote

527

Mote

526

Mote

446

Mote

440

Mote

4.5

4.5

449

Mote

437

Mote

450

Mote

1414

1414

14 1414

14

451

Mote

363

Mote

379

Mote457

Mote

445

Mote

507

Mote

508

Mote

515

Mote4.5

4.5

456

Mote

442

Mote

9.5

459

Mote

458

Mote

441

Mote

4.5

443

Mote

444

Mote

4.5

423

Mote

378

Mote

385

Mote

381

Mote

8 16

16447

Mote

439

Mote

454

Mote

1414 14

14 509

Mote14

514

Mote

516

Mote

1414 14

330

Mote

324

Mote

8

8

10.5

8

8

7

8

4.5

8

4.5

4.5

4.5

4.5

4.5

4.5

4.5 4.54.5

4.5

4.5

4.5

6.5

4.5

8

16.5

9.5

4.5

9.5

16

9.5

6

033

Mote10

055

Mote

032

Mote6

3

571

Mote

6.5

034

Mote

035

Mote8

4.5

8

036

Mote

16

528

Mote

16

Tree

N

16

058

Mote

620

Mote

13

039

Mote

621

Mote10

13

11.5

Forest Edge

19

16

TreeTrunk

9

SmartMeshManager

661

Mote

057

Mote

646

Mote

665

Mote

663

Mote6 6

664

Mote

658

Mote

657

Mote

044

Mote

651

Mote

6

3

5

33

652

Mote

3

5

650

Mote6

3

662

Mote

659

Mote

3

649

Mote

3

666

Mote

656

Mote

3.5

653

Mote

3

655

Mote

660

Mote

55

5

5

6

66 6

625

Mote6

654

Mote6

622

Mote6

648

Mote6

333

3

641

Mote

643

Mote6 5

3

642

Mote

634

Mote

636

Mote

635

Mote

043

Mote

5

3

6

33

628

Mote

3

6

629

Mote5

3

644

Mote

633

Mote

3

630

Mote

3

640

Mote

637

Mote

3

627

Mote

3

638

Mote

632

Mote

56

5

5

6

66 6

639

Mote6

040

Mote6

645

Mote6

623

Mote5

33

3

3

3 3 33 33

624

Mote6

3

626

Mote6

631

Mote6

3

042

Mote5

041

Mote

3 33

669

Mote

671

Mote

8

667

Mote

668

Mote

670

Mote

672

Mote

673

Mote

679

Mote

678

Mote

045

Mote

677

Mote

676

Mote

675

Mote

674

Mote

680

Mote

046

Mote

047

Mote

048

Mote

681

Mote

682

Mote

683

Mote

690

Mote

689

Mote

688

Mote

687

Mote

686

Mote

685

Mote

684

Mote

691

Mote

692

Mote

693

Mote

694

Mote

695

Mote

696

Mote

697

Mote

703

Mote

702

Mote

701

Mote

700

Mote

699

Mote

6 5 6 6

6656

56

6 5

6 5 6 5 6 6

665656

6 5

3-6m

6 5

3-6m 3-6m

6 6

3-6m

3 3 3 3 3 3 33333333

3 3 3 3 3 3 3

3 3 3 3 3 3 3

3-6

m

3-6

m

3-6

m

3-6

m

3-6

m

698

Mote

647

Mote4.5

16

TreeStump

TreeStump

3 Trees

Stump"Well"

3

SmartMeshManager

107

Mote

051

Mote

064

Mote

065

Mote6 6

3

008

Mote

069

Mote

071

Mote

070

Mote

077

Mote

6

3

6

33

076

Mote

3

6

078

Mote6

3

007

Mote

068

Mote

3

079

Mote

3

063

Mote

072

Mote

3

075

Mote

3

073

Mote

067

Mote

66

6

6

6

66 6

062

Mote6

074

Mote6

066

Mote6

080

Mote6

333

3

087

Mote

085

Mote6 6

3

086

Mote

093

Mote

092

Mote

009

Mote

098

Mote

6

3

6

33

099

Mote

3

6

097

Mote6

3

084

Mote

010

Mote

3

096

Mote

3

088

Mote

091

Mote

3

100

Mote

3

090

Mote

094

Mote

66

6

6

6

64.5 6

089

Mote6

103

Mote6

083

Mote6

106

Mote6

33

3

3

3 33 33 33

102

Mote6

101

Mote3

095

Mote6

3

105

Mote6

104

Mote

3 33

011

Mote

012

Mote

66

112

Mote

111

Mote

110

Mote

109

Mote

108

Mote

113

Mote

114

Mote

115

Mote

116

Mote

117

Mote

118

Mote

119

Mote

126

Mote

125

Mote

124

Mote

123

Mote

122

Mote

121

Mote

120

Mote

127

Mote

128

Mote

129

Mote

130

Mote

131

Mote

132

Mote

133

Mote

141

Mote

140

Mote

139

Mote

138

Mote

137

Mote

136

Mote

135

Mote

142

Mote

143

Mote

144

Mote

145

Mote

146

Mote

3 3 333

33

33

3333

3 3 3 3 333 33 3

3

33

3

33

33

33

6 6 6 6

66 6 6 6 6

66 6 6 6 6

66 6 6 6 6

6 6 6 6 6 6

666666

081

Mote

082

Mote

134

Mote

4.5

9.5

19

16

15

BrushPile

StumpTree

4.5

4.5

4.5

1,100 m

600 m

-1400 Motes -20 Managers - 32 Acres

Approaching 8 mote-centuries

Communication Abstraction

• Packets flow along independent digraphs• Digraphs/frames have independent periods• Energy of atomic operations is known, (and can

be predicted for future hardware)– Packet TX, packet RX, idle listen, sample, …

• Capacity, latency, noise sensitivity, power consumption models match measured data

• Build connectivity & applications via xml interface

SmartMesh Manager

IP NetworkXML

AnalogI/O

DigitalI/O

SerialPort

NetworkServices

ConfigurableData Filter/Control

A

CB

E

GF

H

Multiple graphs Multiple frames

BA

CA

BA

Time

Cha

nnel

BA

CA

BA

BA

BA

CA

BC

CB

AC

CA

BA

BA

BC

CB

A

CB

Cycle M of red frame Cycle M+1

Frames overlayed

BA

CB CA

BA

Time

Cha

nnel

BC

BA

CA

BA

BA

BA

AC

CA

CA

BA

CB

BA

A

C

B

• Packet collisions avoidable with integer-multiple length frames (here Tred = 3Tblack) or• Use mutually prime frame lengths to randomize• Infrequent scheduling collisions will occur - all but RX/RX can be solved by frame priority - mote w/ RX/RX will expect some packet collision

Plenty of Time and Frequency Diversity

GE

BA

FE CB CA

FE BA

EC

Time

Cha

nnel E

C

BC

GE

BA

FE

CA

FE

BA

FE

BA

EC

GE

BA

FE

AC

CA

FE

CA

FE

BA

EC

CB

GE

BAA

C

B

E

G

F

• Many links can share the same time slot (channel diversity)• >1000 links/second in same RF space•~100 payload bytes/link• Path limit: ~3k payload bytes/s• Network limit: ~150k payload bytes/s (w/ no frequency re-use)

Subnetworks: single-hop, low latency

G

CB

E

AF

H

Black superframe• All motes• 200 slots• Maintains time synch• Data, Health reports up• Control info downRed superframe• Mote F is light switch• Mote A is light• 1 slot, ~30ms latencyBlue superframe• Mote H is temp sensor• Mote B is HVAC control point• 30 slots, ~1second latency

Motes A and B are likely poweredAll frames on all the timeAll other motes run at <100uA

Subnetworks 2: reliable multi-hop control

G

CB

E

AFH

Black superframe• All motes• 10s period• Maintains time synch• Data, Health reports up• Control info downRed superframe• ~2s latency• Mote H is industrial process sensor• Mote A is industrial process controller

Both frames on all the timeAll motes run at <100uA

Subnetworks 3: high speed links

Black superframe• All motes• Maintains time synch• Data, Health reports up• Control info downRed superframe• Mote G is a microphone sending real-time

compressed voice• 2 slots, 1 payload delivered to A every 2 cycles• ~12kbpsBlue superframe• Mote H is a camera transferring an image• 2 slots, 1 payload delivered to A per cycle• ~25kbps

Red & Blue frames are only on occasionallyAll motes run at <100uA under “normal” conditionsMotes on active high speed frames burn 25% to 50%

of (Irx+Itx)/2Zero collisions, zero lost packets

A

CB

E

GF

H

Without black graph

Subnetworks 3, et cetera

G->E E->C

C->AA

CB

E

GH

H->B H->C

C->A B->A

Red frame:1 packet delivered from G to D every other slot

Blue frame:1 packet delivered from H to A every slot

P

RQ

S

D

F

Z

Y

X

W

W->X X->Y

Y->Z

H->B H->C

C->A B->A

Gold frame:1 packet delivered from W to Z every other slot

Green frame:1 packet delivered from S to P every slot

Many Knobs to Turn

• Trade performance and power– Sample & reporting rate– Latency– High bandwidth connections

• Tradeoffs can vary with– Time– Location– Events

• Use power intelligently if you’ve got it

Available data

• Connectivity– Min/mean/max RSSI

• Path-by-path info:– TX: attempts, successes

– RX: idle, success, bad CRC

• Latency (generation to final arrival)• Data maintained

– Every 15 min for last 24 hours

– Every day for last week

– Lifetime

• Available in linux log files or via XML

SmartMesh Manager

IP NetworkXML

Micro Network Interface Card

NIC• No mote software development• Variety of configurable data

processing modules• Integrators develop applications, not

mesh networking protocols• For compute-intensive applications,

use an external processor/OS of your choice.

AnalogI/O

DigitalI/O

SerialPort

NetworkServices

ConfigurableData Filter/Control

Energy Monitoring Pilot

• Honeywell Service: monitor, analyze and reduce power consumption

• Problem: >> $100/sensor wiring cost• Solution:

– Entire network installed in 3 hours (vs. 3-4 days)

– 9 min/sensor– Software developed in 2 weeks (XML

interface)– 18 months, 99.99%

Chicago Public Health – Dust, Tridium, Teng

Temperature and power monitoring

Tridium NiagraAX

Micro Network Interface Card

NIC• No mote software development• Variety of configurable data

processing modules• Integrators develop applications, not

mesh networking protocols• For compute-intensive applications,

use an external processor/OS of your choice.

AnalogI/O

DigitalI/O

SerialPort

NetworkServices

ConfigurableData Filter/Control

SensoruP

Perimeter Security

Passive IR and Camera

Passive IR

MEMS and GPS

2.5 in

1.5 in

2.5 in

Border Monitoring System, Kirtland AFB

SAICDust Networks

SAICDust Networks

SAICDust Networks

SAICDust Networks

Oil Refinery – Double Coker Unit

• Scope limited to Coker facility and support units spanning over 1200ft

• Expanded to 27 units, implemented 14 to start

• No repeaters were needed to ensure connectivity

• Gateway connected via Ethernet port in control room to process control network

• Electrical/Mechanical contractor installed per wired practices

GW

14 unit Network expanded to 27-- Expanding to 50+ in ‘06

PublicSafety

PublicInformation

ResourceMetering

TrafficMonitoring

ParkingManagement

ConditionedMaintenance

Applications

Basic Enforcement Operation

Sensor nodes are deployed along streets

Sensor nodes detect the arrival, presence and departure of vehicles.

Information is collected via the low power mesh, and relayed back to a central database over cellular data networks.

The central database maintains an up-to-the-minute map of parking events and violations for the entire city.

PCOs are dispatched in efficient routes to ticket violations.

Detailed historical and statistical information on parking is used to improve policy and operations over time.

1

2

3

4

5

6

Basic Enforcement Operation

Medium Access Approaches

• Medium Access (MAC)– How do motes share the radio spectrum?– How many can co-exist?

• Aloha

• Slotted Aloha

• CSMA (sometimes CSMA/CA)

• CSMA/CD

• TDMA

• TDMA/CA

Aloha

• Simplest MAC protocol– talk when you want to!– Standard for early wireless sensor networks

• Fine for very light traffic (5%)• Chaotic collapse above ~10%• Theoretical throughput limit ~18% (1/e2)

G

B

A

Aloha!

Aloha!

Aloha! Aloha!

Aloha!

Aloha!

Aloha!

Aloha!

Slotted Aloha

• Packets sent in time slots– Still collisions, but fewer

• Requires time synchronization• Theoretical throughput limit ~37% (1/e)

G

B

A

Aloha!

Aloha!

Aloha! Aloha!

Aloha!

Aloha!

Aloha!

Aloha!

CSMA

• CSMA = Carrier Sense Multiple Access– Listen before talk– Only transmit if the channel is clear– “Carrier” is actually RF energy and/or valid symbols

G

B

A TX packet ACK

A listens to channel: idle TX

TX packet ACK

B listens (busy) B listens (idle)

?

? ?

CSMA Challenges

• A, B listen at the same time

• Both detect an idle channel

• Both begin to transmit, and collide

• ~10% of packet time w/ 802.15.4 radios

G

B

A TX packet ACK

A listens (idle)

TX packet ACK

B listens (idle)

?

?

CSMA Challenges

• A, B listen at the same time

• Both detect an idle channel

• Both begin to transmit, and collide

• ~10% of packet time w/ 802.15.4 radios

G

B

A TX packet ACK

A listens (idle)

TX packet ACK

B listens (idle)

?

?

Collision!

CSMA Challenges

• A, B both listen, detect a packet

• At end of packet, both transmit and collide

G

B

A TX packet ACK

TX packet ACK

?

?

X

? ?

TX packet ACK?? ?

? ? ?

CSMA Challenges

• A, B both listen, detect a packet

• At end of packet, both transmit and collide

G

B

A TX packet ACK

TX packet ACK

?

?

X

? ?

TX packet ACK?? ?

? ? ?

Collision!

CSMA Challenges

• A, B can’t hear each other

• “Hidden node” or “Hidden terminal” problem

• In the limit, reduces CSMA to Aloha

G

B

A TX packet ACK?

TX packet ACK?

CSMA Challenges

• A, B can’t hear each other

• “Hidden node” or “Hidden terminal” problem

• In the limit, reduces CSMA to Aloha

G

B

A TX packet ACK?

TX packet ACK?

Collision!

CSMA Solutions

• Many approaches– Random exponential backoff– P-persisent CSMA– RTS/CTS– Slotted CSMA– Synchronized CSMA

• Hot topic in academia– MACA, B-MAC, S-MAC, T-MAC, …

Good packets vs. attempted transmits, Aloha

TDMA

• TDMA = Time Division Multiple Access• Divide time into slots

– With 802.15.4, a slot is ~10ms– ~100 slots/second

• Like Aloha, but with assigned TX time slots– Unique TX slots means no collisions– Many motes can receive if desired

G

B

A

BG AG CBDC BG

TDMA with multiple channels

• Assign each mote a time slot and channel to transmit.– All channels can be used simultaneously– Big increase in available bandwidth– 802.15.4 gives ~ (100 slots/s)(16chan) = 1600 cells/sec– Uniquely assigned no collisions

• RX need to be scheduled now too• No TX, no RX sleep!

G

B

AAG

CBDC

BG

AG

CBDC

BG

Ch0

Ch1

Ch2

Ch3

TDMA Challenges

• Time synchronization

• Cell scheduling

• Dynamic Bandwidth Allocation

TDMA with CSMA• Backbone TDMA network

– Baseline connectivity and time synchronization– Guaranteed bandwidth– ~10% of cells in a 10,000 mote network

• All or some of remaining cells are “open listens”– Slotted Aloha by default– Fancier algorithms possible

• All motes can listen, or just those with power

G

B

AAG

CBDC

BG

AG

CBDC

BG

Ch0

Ch1

Ch2

Ch3

TDMA with CSMA

• Backbone TDMA network– Baseline connectivity and time synchronization– Guaranteed bandwidth– ~10% of cells in a 10,000 mote network

• All or some of remaining cells are “open listens”– Slotted Aloha by default– Fancier algorithms possible

• All motes can listen, or just those with power

G

B

AAG

CBDC

BG

AG

CBDC

BG

Ch0

Ch1

Ch2

Ch3

A?

E?

D?

F? A-Z?

A-Z?

A-Z?

A-Z?

A-Z?

A-Z?

A-Z?

A-Z? A?

E? F?

D?

Flexibility of hybrid TDMA/CSMA

• TDMA provides framework– 50 uA baseline current for synchronization and

control– Static bandwidth allocated efficiently– Collision free

• CSMA or Slotted Aloha for dynamic bandwidth– Accurate timing improves all algorithms

• Power/performance tradeoffs in filling the cell matrix– Use powered infrastructure where you find it

Technology directions

• Reliable– Four 9s today

– Moving beyond six 9s

• Scalable– Thousands per site today

– Tens of thousands per site

• Low Power– A decade on a D cell today

– >10x reduction in radio power demonstrated in academia

• Flexible– Configurable networks today

– Dynamically move along optimal power/performance curves

Standards

• IEEE 802.15.4

• Zigbee

• Wireless HART

• ISA/SP100

~2 mm^2 ASIC

Mote on a Chip? (circa 2001)

• Goals:– Standard CMOS– Low power– Minimal external components

uP SRAM

RadioADC

Temp

Ampinductor

crystal

battery

antenna

~$1

UCB Hardware Results ~2003

• 2 chips fabbed in 0.25um CMOS– “Mote on a chip” worked, missing radio

RX– 900 MHz transceiver worked

• Records set for low power CMOS– ADC

• 8 bits, 100kS/s

• 2uA@1V

– Microprocessor• 8 bits, 1MIP

• 10uA@1V

– 900 MHz radio• 100kbps, “bits in, bits out”

• 20 m indoors

• 0.4mA @ 3V

Chipcon cc2430

Chipcon cc2430• Key Features

• 32 MHz single-cycle low power 8051 MCU• 2.4 GHz IEEE 802.15.4 compliant RF transceiver• 32, 64, and 128 kByte in-system programmable flash• Ultra low power: Ideal for battery operated systems• Prevailing development tools• Industry leading ZigBee(TM) protocol stack (Z-Stack) available• 8 kByte SRAM, 4 kByte with data retention in all power modes• RoSH compliant 7 mm x 7 mm QLP48 package• Powerful DMA functionality• Four flexible power modes for reduced power consumption• AES security coprocessor• Programmable watchdog timer• Power on reset/Brown-out detection• One IEEE 802.15.4 MAC timer, one general 16-bit timer and two 8-bit timers• Two programmable USARTs for master/slave SPI or UART operation• True random number generator• Digital RSSI/LQI support• Digital battery monitor• On-chip temperature sensor• Hardware debug support• Reference design with external PA providing +10 dBm output power available 

2.4GHz Radio in 0.13um CMOS

• Cook et al, ISSCC ’06

• Goal: ISM, frequency hopping, fast startup, lowest power

TX Performance

NF vs. Power ConsumptionMeasured at RSSI Output

CC2420 NF, 55mW

Die Photo

• 2.2mmx2.2mm

• Active Area:

800µm2

Radio Performance

200k Bit rate (bps)100k 300k

I RX (

mA

)

5

10

20

15

25

X cc1000

Molnar 04 (0.4mA)

X

X cc2420

XOtis 05 (0.4mA)

Cook 06 (300 W)

X

With software:10 years D cell

With software:10 years coin cell

~4 mm^2 ASIC

Mote on a Chip

• Goals:– Standard CMOS– Low power– Minimal external components

uP SRAM

RadioADC

Temp

Ampinductor

crystal

battery

antenna

Security

Location

Time

Zero

Die area, power, 20052009

• ADC– 10-12 bits, zero area, zero power

• Digital– 32 bit uP 1mm2 0.25mm2– Crypto - ~ uP– Dedicated datapath?– 0.25mW/MHz 50uW/MHz

• Memory– ROM & Flash 128kB/mm2 0.5MB/mm2– RAM 16kB/mm2 64kB/mm2– ~mW/MHz ~ uW/MHz

• RF– 2mm2 1mm2– 10s of mW 100s of uW

• Leakage– 10s uA @ 85C? <1uA @ 85C (circuit solutions; processes get

worse)

Sago Mine Accident (Jan 2006)

• Lack of good sensor information

• Limited knowledge of worker location

• Wired communication system

Worker Location

Explosion

Wired phone to surface

650 m

Bandwidth and Multipath

• Increasing BW only helps if 1/BW is similar to path difference

RF Geolocation Performance

• 1 m of measurement error = 3.3 ns

Security Goals

• Encryption– Make sure that no one can see the data

• Integrity– Make sure that no one can fake the data, fake control

packets, screw up the network with replay of old packets, screw up the network with random packets

– Make sure that random bit errors don’t screw up the network

• Certification– Networks only accept trusted motes– Motes only join trusted networks

• Binding– Motes only join the right network

Threat models

• Easy– No access to hardware– No crypto expertise

• Medium– Access to hardware outside the network (demo network)– Single PC– College students– Competitors

• Hard– Access to active hardware in the network– PC cluster (~hundreds of 2006 to 2020 vintage PCs)– Theft, sabotage, industrial espionage, hacking

• Ocean’s 11• Osama, Putin, Chirac• Unocal China• David Wagner, UCB

People are almost always the weakest link.

Public Key & Shared Key

• Shared key, or symmetric key– Encryption of payloads, authentication of headers

– Block ciphers: AES, DES, XTEA, …

– In software on 8bit micros ~ 10 ms

– In hardware on 802.15.4 chips ~ 1us

– Issues: key storage, key exchange

• Public key– Certification of identity of motes, managers

– Key exchange for shared key systems

– Seconds to minutes on 8 bit micros

– Export concerns?

Shared-key Encryption & Integrity

• Authenticate payload & headers using AES128 CBC-MAC– Generates “secure checksum” Message Integrity Code – 4 or 8 bytes

• Encrypt payload and MIC with AES128 CTR

• Append a 2 byte checksum– Redundant, less strong, less secure than the MIC

– That’s what 802.15.4 forces us to do

• On reception– Verify CRC

– Decrypt payload, MIC

– Verify message integrity (calculate MIC over received packet and compare to transmitted MIC)

PHY header

MAC header

NET header

APP payload MIC CRC

Encrypt in place

Authenticate integrity

Checksum

ACK

A

B

Packet

Public Key Certification - Use Cases

• One supplier/integrator• One supplier, separate integrator• Multiple suppliers, one integrator• Multiple suppliers, multiple integrators, multiple

neighboring customers

Building 2•HVAC network•Security Network•Fire network•Tenant networks

Building 1•HVAC network•Security Network•Fire network•Tenant networks

Newmote

??

?

Mote XCx

Simplest public key system for identity certification

• Messages encrypted with the private key can only be decrypted with the public key

• At manufacture, a mote gets a ‘signed’ copy of its ID– Encrypted with the manufacturers private key

• On joining, the mote presents its ID and the signed copy of the ID

• The network verifies that the signature is valid by decrypting it with the public key and checking to see if it is the right ID

Manufacturer ASecret key Sa---------------------Public key Pa

Network/ManagerPublic key ring: Pa, Pb,…

Mote YCy

Cy=E(Sa, Y)

Y, CyVerify D(Pa,Cy) = Y ?

Verify D(Pb,Cy) = Y ?

From manufacture to 3AM join

ManufacturingPC

Mote N Mote P1 Mote P2 Manager

Data/advertpacket

Protocol version#Mote IDJoining KeySigned(ID, JK)

Data/advertpacket

Join requestSigned(ID,JK)

Manager verifies signatureOperator accepts new mote

Activate childPath key encrypted with P1 keyPath key encrypted with JKMote N key encrypted with JK

Configure?Path key encrypted with JKMote N key encrypted with JK

configACKEncrypted with Path Key

Add link N->P2Path key encrypted with P2 key

Add link N->P2Path key encrypted with N key

Store/sleep

Manager Mores

• Prudish– Never

• Prudent

• Promiscuous– Any mote, anywhere, any time

Manager Mores

• Prudish– Never

• Prudent– meets some combination of criteria:

• Mote has valid certificate

• Mote on access control list

• Manager accepted this mote before

• Human/higher-authority approval– Console/web

– Button

– PDA (RF or cable)

• Single-hop from manager w/ specified minimum signal strength

• Promiscuous– Any mote, anywhere, any time

Key length and security

Crypto strength

(n)

Symmetric Cipher

ECC key size

RSA key size

MIPS-years to crack

NIST expiry date

80 Triple DES (80)

160 1024 8x1011 2010

128 AES 128 256 3072 2x1026 >2030

256 AES 256 512 15,000 6x1052

1 million Pentiums running for 1 year is ~ 109 MIPS-years1 billion (Pentium x1000) running for 1 century is ~ 1017 MIPS-years

Open Problems, Hardware

• None.

SensorsADCuPRadioRF RangingIntegration

Open Problems, Software

• Definitions, metrics, and optimization of reliability and power consumption for Academically Dull Applications (low rate data collection and control)– Simple models are fine (until proven otherwise)

• Interference, multi-path, radio power, etc.• Start w/ reliability >99.9%, duty cycle <10% and improve

• Time synchronization• Powered Infrastructure w/ 802.11• Certification, Binding, Commisioning• Reducing barriers to access

– Interfacing to PDAs, cell phones, web