Radio Spectrum Analysis for Frequency Agile Wireless Networks

Analyse van het radiospectrum voor frequentie-adaptieve draadloze netwerken

Wei Liu

Promotoren: prof. dr. ir. I. Moerman, prof. dr. ir. E. De PoorterProefschrift ingediend tot het behalen van de graad van

Doctor in de ingenieurswetenschappen

Vakgroep InformatietechnologieVoorzitter: prof. dr. ir. D. De Zutter

Faculteit Ingenieurswetenschappen en ArchitectuurAcademiejaar 2016 - 2017

ISBN 978-90-8578-945-1NUR 986Wettelijk depot: D/2016/10.500/77

Ghent UniversityFaculty of Engineering and ArchitectureDepartment of Information Technology

Promotors: prof. dr. ir. Ingrid Moermanprof. dr. ir. Eli De Poorter

Jury members: prof. dr. ir. Gert De Cooman (chair)prof. dr. ir. Ingrid Moerman(promotor)prof. dr. ir. Eli De Poorter(promotor)prof. dr. ir. Wout Joseph (secretary)prof. dr. ir. Spilios Giannoulis (Ghent University)prof. dr. ir. Luiz Da Silva (Trinity Colledge Dublin, Ireland)prof. dr. ir. Sofie Pollin (KU Leuven)

Ghent UniversityFaculty of Engineering and Architecture

Department of Information TechnologyiGent Tower, Technologiepark 15 B-9052 Gent, Belgie

Tel.: +32-9-331.49.00Fax.: +32-9-331.48.99

Dissertation to obtain the degree ofDoctor of Engineering

Academic year 2016-2017

Acknowledgments

Rome is not built in one day, and neither by one man. With these words, I wouldlike express my gratitude towards many colleagues, friends, and families, whohave supported me during my 6-year-long PhD journey.

Before traveling back in time, I would like to thank the examination board:Luiz Da Silva, Sofie Pollin, Spilios Giannoulis, Wout Joseph, and Jan Vanflete-ren, for taking their time to read this dissertation, and providing very constructivefeedback.

When I was 21 year old, I made an important life decision — to go study inBelgium, the center of Europe, which turned out to be a correct one and led to aunique experience. During my study in Leuven, I was integrated into a group ofyoung and open-minded international students, and we managed to stay in contacteven long after I moved to Ghent. Here I would like to thank my friends fromthe GroepT time: Li Qian, Yang Yang, Toon Goris, Patchara Piampongsant, Su-pinya Piampongsant, Ashish Vaidya, Sovathya Koun, Can Hoang, Zhang Yuchen,Alexandria Somirs, Andy Van Woensel, for the exciting Karaoke parties, pump-kin race, ski trips, and many fun activities we had throughout the years. I wouldalso like to thank my host in Leuven, Griet and Raf Goossens, not only did theyprovide me with comfort accommodation, but also integrated me into their family,and presented me the rich culture of the local life, for which I am truly grateful.

Educating international students is not an easy task, mostly due to the diffe-rences in backgrounds, plus the language issue. This was a common challengefaced by the professors at GroepT. Many of them made extra efforts for internatio-nal students, among whom, the effort from one professor — Luc Bienstman, wentway beyond average. He cared about students personally, and provided additionalassistance to many of us long after the working hours, and entirely out of his freewill. I would like to take this opportunity to thank Luc for his devotion in educa-tion, for his patience and persistence in my master thesis, for his consideration ofmy future, and for convincing me that “hard working can be fun”.

The co-supervisor of my master thesis, Bart jooris, was my personal bridgebetween Leuven and Ghent. He raised an interesting subject, which triggered aseries of thesis projects for more than 3 generations of GroepT students. Here mythesis partner Yang Yang deserves another acknowledgment, for his companionand contribution in the work. To avoid spoiling the book, curious readers arereferred to App. B for the details. Afterwards, I came into contact with prof.Ingrid Moerman, and prof. Piet Demeester. I am very grateful that they acceptedme as a PhD student, and that was the official starting point of my PhD journey.

ii

For my main promoter Ingrid, although she was very busy, she always madetime for me whenever necessary. Thanks to the fact that Ingrid has a vast rangeof collaborators, both at national and European level, I was actively involved inmany research projects, and had the opportunities to work on different tasks andcollaborate with people across the world.

Speaking of projects, the Cognitive Radio Experimental World (CREW) ranthrough my entire PhD, I consider myself to be the most loyal crew member ofthe CREW project. It was also a special project for me, as at the time I started,our group did not have people specializing in Software-Defined Radio, hence lotsof expertise was obtained externally from the CREW partners. Here I would liketo thank the CTVR research group of Trinity College Dublin for helping me tostart with USRP, Peter Van Wesemael and Sofie Pollin for getting me familiarwith the basic RF knowledge, Mikołaj Chwalisz and Carolina Fortuna for sharingtheir Python related programming experiences and contributing to my 2nd journalpaper, which is included as the 3rd chapter of this book.

The first two years of my PhD was guided by Opher Yaron, from whom Iobtained the basic skills of scientific writing and literature studies. The remainingyears of my PhD was supervised by Eli De Poorter. I would like to thank himfor picking me up when I was lost, for trying to help me plan my PhD againand over despite that many plans ended up adapting to reality, and for sharingvaluable experiences regarding many practical issues. At the end of my PhD, Isuffered from several unexpected surprises. Luckily, each time I had Daan Pareitto consult. Apart from repeatedly resolving my panicking situations during thePhD submission period, I would also like to thank Daan for his assistance with myfirst response letter to the reviewers, where I was truly impressed by the level ofpoliteness one can achieve with words. In addition, I would like to thank StefanBouckaert, Peter De Valk, and Dirk Deschrijver for the smooth and productivecooperation in projects.

I have been informed by my juries that experimental work is one of the stron-gest point of my dissertation. To be honest, more than 50% of my experimentsare performed on the w-iLab.t testbed. Here I would like to thank the w-iLab.tteam, Bart Jooris, Pieter Becue and Vincent Sercu, for their tolerance of my slow-start learning curve, my large-scale (brutal-force) testbed usage style, and for theirsupport in various experiments, demos, and events.

FORWARD is another important project on the course of my PhD. It broughtme opportunities to visit and do experiments in the production environments ofseveral local factories. I would like to thank Jeroen Hoebeke for the efficient coo-rdination, and for contributing the initial idea of using centralized signal emulator,which served as the foundation of my 3rd journal paper (the last chapter of thisbook). I would like to thank Emmeric Tanghe and Wout Joseph for sharing theirstatistical and physical layer expertise, and for the suggestions they made duringthe long review process of the paper. I would like to thank Jetmir Haxhibeqirifor reverse engineering Siemens devices and mastering the “PLC roaming”relateddemo in a short time, which greatly offloaded me in the deadline period. I wouldlike to thank Michael Mehari, who not only tested but also helped to improve my

iii

solution — and yes, I could not wish for a better user!I would like to thank Tarik Kazaz for giving me important inspiration while I

was struggling to find a way to present my findings in Chapter 4. Then, the finaltouch on this chapter provided by Merima Kulin, using her expertise in machinelearning, literally transformed it to a different level. In addition to their profes-sional contribution, Merima and Tarik also deserve my acknowledgment for theirpassionate and persistent promotion of Bosnia, for the excellent BBQ service, fortheir (mainly Tarik’s) mysterious confidence in Bosnian football and all the funjokes we made from that. I would like to thank Pieter Willemen for providing methe most useful thesis results in my personal record, and his honest opinion of mywork later on. I would like to thank Vasilis Maglogiannis for the efficient introduc-tion of the LTE protocol, the free rides to the student resto, and many suggestionsfor traveling in Greece. I would like to thank Jiao Xianjun for helping me to com-bat the critical comments from reviewers, for getting me acquainted with technicalterminologies in Chinese, and for the useful tips of selecting eatable chestnuts inthe technology park. I would like to thank Dries Naudts for sharing his knowledgeof mobile wireless operators in Belgium. I would like to thank Girum Ketema,Abdulkadir Karaagac for taking the courage to compete against Chinese in ‘pingpong’ and feather ball.

I would like to thank Peter Ruckebusch for rescuing me on the MOBAN labsessions during the first year of my PhD study, for integrating me with the rest ofthe research group, and the numerous considerate thoughts and talks. I would liketo thank Floris Van den Abeele for the great organization of many activities amongcolleagues, for the compassion and determination to become a vegetarian out ofpure ethical reasons. I would like to thank Elnaz Alizadeh for the ultimate duoperformance (together with Merima) on my birthday party, and for bringing thewarm and happy atmosphere wherever she goes. I would like to thank Jen Rosseyfor his dedication in Asian food, and his generosity to share recipes. I would liketo thank Enri Dalipi for his curiosity about China, for his fair support in political-related-ultra-heavy lunch discussions, and for showing me how to defend one’sPhD with armor and sword. I would like to thank Jono Vanhie-Van Gerwen for thefree demo and trial session of the unicycle. I would like to thank Matteo Ridolfi,Irfan Jabandzic, Adnan Shahid for the organization and participation of footballmatches between our offices, though not for the scores of the match ;) I wouldlike to thank Tom Van Haute for being my comrade to fight against the same PhDsubmission deadline. In addition, I am also glad to have met Isam Ishaq, DavidCarels, Pieter De Mil, and Lieven Tytgat throughout the years of my PhD.

Outside of the mobile and wireless research group, I would like to thank AndyVan Maele for his clear explanation during the labs, and later on his trust in me totutor the labs, as well as his willingness to share knowledges, from a broad rangeof interests. I would like to thank Thomas Demeester for helping international re-searchers to practice Dutch at lunch time. I would like to thank Domenico Spinafor the Italian coffee smell in the kitchen on the 11th floor, Ye Yinghao and GongXu for the cozy chats in Chinese from time to time. I would like to thank Sa-hel Sahhaf and Cui Qianjing for the companion of nearly 2 year’s evening Dutch

iv

classes. I would like to thank Patrick Van Torre, and Luigi Vallozzi for grantingme access to the anechoic chamber for experiments. I would like to thank EricVanhauwaert, Jelle Nelis, Marlies Van der Wee, Sofie Lambert and Minh NguyenHuu for the fearless badminton battles, and the fun but not very lucky poker/gamenights. In addition, I would also like to thank Martine Buyse, Davinia Stevens,Jonathan Moreel, Simon Robots, Joeri Casteels, Brecht Vermeulen for their helpin many practical issues over the years.

Apart from PhD, I also harvest a relationship in Ghent. I met my husbandMaarten Steenhuyse first as a colleague in the mobile and wireless research group,who even had to grade my lab notes at that time. Luckily my lab results wereokay, and later on fate brought him one step closer to me. I would like to thankMaarten for his inherent Chinese stomach, for his understanding when I neededto work extra hours, and for all his free technical advices and emotional support.In addition I would like to thank Maarten’s dad Johan Steenhuyse, and sister LienSteenhuyse for the cozy family gathering every Sunday, and for providing me aplace to call home far away from China.

Finally, my deepest gratitude goes to my mother Deng Xiaowei and my fatherLiu Qinglin. I was born in a rapid-changing period of China, and my generation isthe first one to catch the one-child policy. I am grateful that they raised me up ina sensible way despite the drastic changes in the society. They provided me withthe best education condition they could find, they tried to grasp and cultivate everytalent I ever showed, and they helped me through the fierce competition of thecollege entrance exam, among many other challenges in my youth. I would alsolike to thank my stepfather Zhang Ruitang for his excellent cooking skills, andhis kindness towards me and my mother. The support and bond continued after Icame to Belgium, video call on every Saturday morning is my weekly routine tillnow. The achievement I made today would not be possible without my familiesand friends in China (here omitting many many Chinese names), I would like tosay “谢谢” to them from the bottom of my heart.

Ghent, October 2016Wei Liu

Table of Contents

Acknowledgments i

Samenvatting xxv

Summary xxix

1 Introduction 11.1 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.1.1 The scarcity of radio spectrum . . . . . . . . . . . . . . . 11.1.2 The underutilized licensed spectrum . . . . . . . . . . . . 21.1.3 The advances in radio technologies . . . . . . . . . . . . 31.1.4 The road towards open spectrum . . . . . . . . . . . . . . 3

1.2 Business model . . . . . . . . . . . . . . . . . . . . . . . . . . . 41.2.1 Licensed technology . . . . . . . . . . . . . . . . . . . . 41.2.2 Unlicensed technology . . . . . . . . . . . . . . . . . . . 41.2.3 Cognitive technology . . . . . . . . . . . . . . . . . . . . 5

1.3 Challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.3.1 Detection of transient signals . . . . . . . . . . . . . . . . 51.3.2 Data compression . . . . . . . . . . . . . . . . . . . . . . 61.3.3 Inter-working of heterogeneous devices . . . . . . . . . . 61.3.4 Technology recognition . . . . . . . . . . . . . . . . . . 61.3.5 Interference prevention . . . . . . . . . . . . . . . . . . . 61.3.6 Cost considerations . . . . . . . . . . . . . . . . . . . . . 7

1.4 Basic terminologies . . . . . . . . . . . . . . . . . . . . . . . . . 71.4.1 PSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71.4.2 Spectrogram . . . . . . . . . . . . . . . . . . . . . . . . 71.4.3 RSSI . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71.4.4 PDF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81.4.5 Emulation vs Simulation . . . . . . . . . . . . . . . . . . 8

1.5 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81.6 Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.6.1 Publications in international journals(listed in the Science Citation Index) . . . . . . . . . . . . 11

1.6.2 Publications in international conferences(listed in the Science Citation Index) . . . . . . . . . . . . 11

vi

1.6.3 Publications in other international conferences . . . . . . 12References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2 Advanced spectrum sensing with parallel processing based on Software-Defined Radio 172.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182.2 Analysis of existing platforms . . . . . . . . . . . . . . . . . . . 20

2.2.1 Spectrum analyzers . . . . . . . . . . . . . . . . . . . . . 202.2.1.1 ROHDE & SCHWARZ FSVR . . . . . . . . . 222.2.1.2 Tektronix RSA6000 . . . . . . . . . . . . . . . 232.2.1.3 Summary . . . . . . . . . . . . . . . . . . . . . 23

2.2.2 Low cost USB devices . . . . . . . . . . . . . . . . . . . 242.2.3 Sensor devices . . . . . . . . . . . . . . . . . . . . . . . 242.2.4 Sensing solution overview . . . . . . . . . . . . . . . . . 25

2.3 Our sensing solution . . . . . . . . . . . . . . . . . . . . . . . . 252.3.1 Design constraints . . . . . . . . . . . . . . . . . . . . . 252.3.2 The hardware platform . . . . . . . . . . . . . . . . . . . 262.3.3 The software architecture . . . . . . . . . . . . . . . . . . 282.3.4 Configurations and important features . . . . . . . . . . . 31

2.3.4.1 Continuous FFT mode vs Swept FFT mode . . . 312.3.4.2 Measurement types . . . . . . . . . . . . . . . 312.3.4.3 Sensing efficiency . . . . . . . . . . . . . . . . 322.3.4.4 Time resolution . . . . . . . . . . . . . . . . . 332.3.4.5 Channel Configuration . . . . . . . . . . . . . . 342.3.4.6 Output format . . . . . . . . . . . . . . . . . . 342.3.4.7 Resolution bandwidth and FFT size . . . . . . . 342.3.4.8 Performance comparison with existing sensing

solutions . . . . . . . . . . . . . . . . . . . . . 352.4 Experiments & Results . . . . . . . . . . . . . . . . . . . . . . . 36

2.4.1 The w-iLab.t testbed . . . . . . . . . . . . . . . . . . . . 382.4.2 Wi-Fi Beacon experiment . . . . . . . . . . . . . . . . . 38

2.4.2.1 Measurements using continuous FFT mode . . . 392.4.2.2 Measurements in swept FFT mode . . . . . . . 40

2.4.3 Bluetooth experiment . . . . . . . . . . . . . . . . . . . . 422.5 Conclusions & Future work . . . . . . . . . . . . . . . . . . . . . 42References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

3 Heterogeneous spectrum sensing: challenges and methodologies 473.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483.2 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

3.2.1 Storage Format . . . . . . . . . . . . . . . . . . . . . . . 503.2.2 Measurement resolution . . . . . . . . . . . . . . . . . . 513.2.3 Calibration . . . . . . . . . . . . . . . . . . . . . . . . . 513.2.4 Processing methods . . . . . . . . . . . . . . . . . . . . . 52

3.3 Methodologies for realizing heterogeneous sensing . . . . . . . . 52

vii

3.3.1 Common data format . . . . . . . . . . . . . . . . . . . . 533.3.1.1 Experiment abstract . . . . . . . . . . . . . . . 533.3.1.2 Meta-information . . . . . . . . . . . . . . . . 553.3.1.3 Experiment iteration(s) . . . . . . . . . . . . . 55

3.3.2 Measurement resolution . . . . . . . . . . . . . . . . . . 563.3.3 Calibration . . . . . . . . . . . . . . . . . . . . . . . . . 563.3.4 Processing . . . . . . . . . . . . . . . . . . . . . . . . . 58

3.3.4.1 Heterogeneous sensitivity analysis . . . . . . . 583.3.4.2 Heterogeneous accuracy analysis . . . . . . . . 59

3.4 Reference implementation and experimentation . . . . . . . . . . 603.4.1 Common data format implementation . . . . . . . . . . . 60

3.4.1.1 CDF experiment description . . . . . . . . . . . 603.4.1.2 CDF data structure . . . . . . . . . . . . . . . . 613.4.1.3 CDF toolbox . . . . . . . . . . . . . . . . . . . 61

3.4.2 Calibration and resolution . . . . . . . . . . . . . . . . . 623.4.2.1 Overview of sensing devices . . . . . . . . . . 623.4.2.2 Calibration experiment . . . . . . . . . . . . . 64

3.4.3 Reference experiment for heterogeneous sensitivity analysis 673.4.4 Reference experiment for heterogeneous accuracy analysis 67

3.5 Conclusions and future work . . . . . . . . . . . . . . . . . . . . 71References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

4 Wireless technology recognition based on RSSI distribution at sub-Nyquist sampling rate 774.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784.2 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

4.2.1 Technology-specific detections . . . . . . . . . . . . . . . 794.2.2 Existing studies of the distribution of RSSI . . . . . . . . 804.2.3 Existing application of RSSI in technology recognition . . 80

4.3 The cause of multi-modal distribution of RSSI . . . . . . . . . . . 814.3.1 Discontinuous transmission . . . . . . . . . . . . . . . . 824.3.2 Variable subcarriers . . . . . . . . . . . . . . . . . . . . . 834.3.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . 86

4.4 Characterization of real-life signals . . . . . . . . . . . . . . . . . 864.4.1 Signal selection . . . . . . . . . . . . . . . . . . . . . . . 884.4.2 Experiment with spectrum analyzer . . . . . . . . . . . . 894.4.3 Experiment with small-scale RF device . . . . . . . . . . 89

4.5 Automatic signal recognition . . . . . . . . . . . . . . . . . . . . 914.5.1 Feature space design . . . . . . . . . . . . . . . . . . . . 914.5.2 Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . 934.5.3 Validation . . . . . . . . . . . . . . . . . . . . . . . . . . 94

4.5.3.1 Analysis for N=20, T=1 second . . . . . . . . . 954.5.3.2 Analysis for variable N . . . . . . . . . . . . . 964.5.3.3 Analysis for variable T . . . . . . . . . . . . . 974.5.3.4 Summary . . . . . . . . . . . . . . . . . . . . . 97

viii

4.6 Conclusions and future work . . . . . . . . . . . . . . . . . . . . 99References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

5 Assessing the coexistence of heterogeneous wireless technologies withan SDR-based signal emulator: a case study of Wi-Fi and Bluetooth 1035.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1045.2 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

5.2.1 Coexistence solutions . . . . . . . . . . . . . . . . . . . . 1065.2.2 Network planning . . . . . . . . . . . . . . . . . . . . . . 1065.2.3 SDR applications . . . . . . . . . . . . . . . . . . . . . . 106

5.3 Design of the emulator . . . . . . . . . . . . . . . . . . . . . . . 1075.3.1 General concept . . . . . . . . . . . . . . . . . . . . . . 1075.3.2 Implementation platform . . . . . . . . . . . . . . . . . . 109

5.3.2.1 Hardware . . . . . . . . . . . . . . . . . . . . 1095.3.2.2 Software . . . . . . . . . . . . . . . . . . . . . 109

5.3.3 High-level design of the emulator . . . . . . . . . . . . . 1105.3.4 Processing blocks of the emulator . . . . . . . . . . . . . 112

5.3.4.1 Complex matrix . . . . . . . . . . . . . . . . . 1125.3.4.2 Padded matrix . . . . . . . . . . . . . . . . . . 1135.3.4.3 Windowed matrix . . . . . . . . . . . . . . . . 1135.3.4.4 Time domain signal . . . . . . . . . . . . . . . 114

5.4 Bluetooth Emulation . . . . . . . . . . . . . . . . . . . . . . . . 1145.4.1 Bluetooth characteristics . . . . . . . . . . . . . . . . . . 1145.4.2 Generate the complex matrix . . . . . . . . . . . . . . . . 114

5.4.2.1 Define the resolution and dimension . . . . . . 1145.4.2.2 Basic emulation . . . . . . . . . . . . . . . . . 1155.4.2.3 Topology control . . . . . . . . . . . . . . . . . 1155.4.2.4 Traffic control . . . . . . . . . . . . . . . . . . 116

5.4.3 Define the dimension of Padded matrix . . . . . . . . . . 1165.4.4 Select the window coefficients . . . . . . . . . . . . . . . 117

5.5 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1175.5.1 Devices and configurations . . . . . . . . . . . . . . . . . 1175.5.2 Experiment in the anechoic chamber . . . . . . . . . . . . 1185.5.3 Experiment in w-iLab.t testbed . . . . . . . . . . . . . . . 119

5.5.3.1 Experiment setup . . . . . . . . . . . . . . . . 1205.5.3.2 Physical layer inspection . . . . . . . . . . . . 1215.5.3.3 Network layer inspection . . . . . . . . . . . . 1225.5.3.4 Impact range . . . . . . . . . . . . . . . . . . . 125

5.6 Conclusions and future work . . . . . . . . . . . . . . . . . . . . 127References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

6 Conclusion 1356.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366.2 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366.3 Future directions . . . . . . . . . . . . . . . . . . . . . . . . . . 138

ix

A Robust distributed sensing with heterogeneous devices 141A.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142A.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

A.2.1 Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . 143A.2.2 Hardware used . . . . . . . . . . . . . . . . . . . . . . . 144A.2.3 Calibration . . . . . . . . . . . . . . . . . . . . . . . . . 144A.2.4 Processing . . . . . . . . . . . . . . . . . . . . . . . . . 145

A.3 Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145A.3.1 Measurement Setup . . . . . . . . . . . . . . . . . . . . . 145A.3.2 Measurement Results . . . . . . . . . . . . . . . . . . . . 145

A.4 Heterogeneity of the devices . . . . . . . . . . . . . . . . . . . . 147A.5 Number of devices . . . . . . . . . . . . . . . . . . . . . . . . . 148

A.5.1 Homogeneous device analysis . . . . . . . . . . . . . . . 149A.5.2 Heterogeneous device analysis . . . . . . . . . . . . . . . 149

A.6 Heterogeneity of locations . . . . . . . . . . . . . . . . . . . . . 151A.6.1 LOS vs NLOS . . . . . . . . . . . . . . . . . . . . . . . 151A.6.2 Line location group . . . . . . . . . . . . . . . . . . . . . 151

A.7 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

B FPGA-based wireless link emulator for wireless sensor network 157B.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158B.2 System implementation . . . . . . . . . . . . . . . . . . . . . . . 159

B.2.1 Requirements for a wireless network emulator . . . . . . 159B.2.2 A new proposal : the wired emulator to test a wireless

network . . . . . . . . . . . . . . . . . . . . . . . . . . . 160B.2.3 The low level protocol . . . . . . . . . . . . . . . . . . . 162B.2.4 The physical implementation . . . . . . . . . . . . . . . . 163B.2.5 Timing considerations . . . . . . . . . . . . . . . . . . . 165

B.3 Physical layer emulation . . . . . . . . . . . . . . . . . . . . . . 166B.3.1 Quantized SNR and its link to bit error rate . . . . . . . . 166B.3.2 Bit error generation . . . . . . . . . . . . . . . . . . . . . 167B.3.3 Topology Control and Interference Generation . . . . . . 168

B.4 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170B.4.1 Emulation of indoor and outdoor environment by BER es-

timation . . . . . . . . . . . . . . . . . . . . . . . . . . . 170B.4.2 Emulation of microwave oven interference by direct con-

figuration . . . . . . . . . . . . . . . . . . . . . . . . . . 172B.4.3 Testing at MAC layer . . . . . . . . . . . . . . . . . . . . 173

B.5 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174B.6 Conclusion and future work . . . . . . . . . . . . . . . . . . . . . 175References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

List of Figures

1.1 Overview of the radio spectrum [2]. . . . . . . . . . . . . . . . . 21.2 Schematic position of the different chapters in this dissertation. . . 10

2.1 Swept mode of a spectrum analyzer. The center frequency of thespectrum analyzer is continuously incremented (‘swept’), leadingto potentially missed signals. The figure is adapted from [8]. . . . 21

2.2 FFT based spectrum analyzer: in the upper part, FFT processingtime is longer than sampling time, resulting in discontinuous sam-pling and missed transient signal; in the lower part, the analyzer iscapable of detecting the transient signal thanks to increased pro-cessing speed and continuous capturing. This figure is adaptedfrom [8]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

2.3 USRP Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . 272.4 Parallel processing for seamless spectrum sensing. . . . . . . . . 292.5 High level description of the software for seamless spectrum sensing. 302.6 Wireshark IO graph derived from a packet trace between the USRP

and the host machine. Only packets with length smaller than 1514are displayed. The y axis is the packet rate and the x axis is thetime in ms accuracy. . . . . . . . . . . . . . . . . . . . . . . . . . 33

2.7 USRP deployment in iMinds w-iLab.t testbed. . . . . . . . . . . . 382.8 Spectrogram of Wi-Fi beacon signal in continuous FFT mode. . . 392.9 Spectrogram of 13 Wi-Fi channels over 12 seconds in swept FFT

mode, with various samples per buffer settings. . . . . . . . . . . 412.10 Number of detections with different threshold settings. . . . . . . 412.11 Probability of interception in sweep mode . . . . . . . . . . . . . 43

3.1 Conceptual workflow towards heterogeneous spectrum sensing. (i)Uniform CDF experiment descriptions are translated into devicespecific configuration scripts. (ii) The collected results are con-verted into a common data format. (iii) The results are furtherprocessed based on the common data formant. . . . . . . . . . . . 53

3.2 The architecture of the CDF. (i) experiment abstract, (ii) meta in-formation and (iii) experiment iterations containing data traces. . . 54

3.3 Replace wireless medium with coaxial cable and splitters. . . . . . 643.4 Offset vs Device . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

xii

3.5 Raw spectra (a) vs calibrated spectra with common frequency res-olution (b) showing 22 MHz wide -60 dB OFDM signal. . . . . . 68

3.6 Example ROC plot obtained with heterogeneous devices. . . . . . 69

3.7 Experiment setup and “Cluster” of locations adapted from [32]. . 70

3.8 The path loss models of LOS and NLOS clusters. . . . . . . . . . 71

4.1 An example RSSI trace of discontinuously transmitted signal (onthe left) and the corresponding PDF (on the right). . . . . . . . . 82

4.2 An example RSSI trace of signal modulated with variable amountof subcarriers (on the left) and the corresponding PDF (on the right). 82

4.3 The packet structure used in the example OFDM transceiver inGNU Radio . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

4.4 The RSSI of OFDM signals generated by GNU Radio, with vari-able amount of subcarriers in the last symbol of a packet (indicatedin the title of the graphs), the first row displays RSSI measure-ments over time, while the corresponding normalized histogramsare displayed in the second row. . . . . . . . . . . . . . . . . . . 84

4.5 The categories of signals and the corresponding PDF. . . . . . . . 86

4.6 The normalized histograms of RSSI (first row) and the spectro-grams (second row) for Wi-Fi, LTE and DVB-T signals. All graphsare obtained by post processing of raw IQ samples collected by theAnritsu 2690A spectrum analyzer at the rate of 10 MHz. . . . . . 87

4.7 The normalized histograms of RSSI for Wi-Fi, LTE, and DVB-Tsignals obtained by USRP B200 mini with the sample rate of 1 MHz. 90

4.8 An illustration of the features extracted from the distribution ofRSSI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

4.9 The true positive rate versus the average interval of RSSI mea-surements for T=1 second. Because the IQ samples are acquiredat 1 MHz, the interval N

1MHz has the same numeric value as thewindow size N in µs. . . . . . . . . . . . . . . . . . . . . . . . . 97

4.10 The true positive rate versus the total observation time, for N=160. 98

5.1 Emulation concept: replacing the Network To-be-Deployed (NTD)by the emulator to examine its impact on the original network or‘System Under Test’ (SUT). . . . . . . . . . . . . . . . . . . . . 107

5.2 The WARP SDR platform, with virtex-4 FPGA and 4 radio slots. . 110

5.3 (a) The high level block diagram vs (b) the details of the design. . 110

5.4 Using the concept of resource block in LTE to emulate multipleconcurrent signals with different duration and intensity. . . . . . . 111

xiii

5.5 The processing blocks of the emulator. (i) First, a complex matrixis generated to describe the spectrogram of the desired signal. (ii)Next, the complex matrix is streamed to the FPGA on WARP, anda padded matrix is generated according to the signals’ bandwidthand transmission time. (iii) Signals with more realistic power spec-trum are created through the use of windowing technique. (iv) Fi-nally, the samples are transformed to time domain via IFFT, andtransmitted by the radio. . . . . . . . . . . . . . . . . . . . . . . 112

5.6 Using window coefficients to obtain more realistic spectrum envelop.113

5.7 The shift between transmission slots from independent piconets. . 115

5.8 The ‘window coefficient’ derived from the RRC filter with a roll-off factor of 0.4. . . . . . . . . . . . . . . . . . . . . . . . . . . 117

5.9 The measurement environments: (i) the anechoic chamber (left)and (ii) the w-iLab.t testbed (right). . . . . . . . . . . . . . . . . . 118

5.10 (a) The relative received signal strength of the emulated piconets,the horizontal axis indicates the appearance order of the piconets inreal Bluetooth measurements; (b) The boxplot of Wi-Fi through-put, impacted by X real and X emulated piconets (X = 1, 2, 3),with fixed traffic load of 1 Mb/s. . . . . . . . . . . . . . . . . . . 119

5.11 The experiment topology: (a) 20 Bluetooth piconets and 1 Wi-Filink; (b) 1 WARP SDR, 1 Wi-Fi link, and measurement locationsof the portable Wi-Fi link. . . . . . . . . . . . . . . . . . . . . . 120

5.12 The spectrogram of (a) 10 real piconets, each produces 1 Mb/straffic, versus (b) 10 emulated piconets, with the same traffic load.The unit of the color axis is dB. . . . . . . . . . . . . . . . . . . . 121

5.13 Wi-Fi throughput performance under the impact of the real andthe emulated Bluetooth traffic. The legend “dat” denotes the datapoints of individual throughput measurements, while “mdl” refersto the derived mathematical model. . . . . . . . . . . . . . . . . . 123

5.14 The subplot (a) shows the ratio between the MSE of the Wi-Fithroughput influenced by the real Bluetooth network, and the MSEof Wi-Fi throughput affected by the corresponding emulated Blue-tooth network. The subplot (b) shows the ratio of STD in a similarapproach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

5.15 Wi-Fi jitter performance under the impact of the real and the emu-lated Bluetooth traffic. The legend “dat” denotes the data points ofindividual jitter measurements, while “mdl” refers to the derivedmathematical model. . . . . . . . . . . . . . . . . . . . . . . . . 125

5.16 The subplot (a) shows the ratio between the MSE of the Wi-Fi jitterinfluenced by the real Bluetooth network, and the MSE of Wi-Fijitter affected by the corresponding emulated Bluetooth network.Subplot (b) shows the ratio of STD in a similar approach. . . . . . 126

xiv

5.17 Throughput of the portable Wi-Fi link under the impact of 10 emu-lated piconets with 250 kb/s traffic load at different locations, withrespect to the distance to the emulator (top axis) and the SINR(bottom axis). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

A.1 Experimental set-up and location group . . . . . . . . . . . . . . 146A.2 least squares and robust fit . . . . . . . . . . . . . . . . . . . . . 147A.3 Least squares regression for individual devices . . . . . . . . . . . 148A.4 Homogeneous device reference . . . . . . . . . . . . . . . . . . . 150A.5 Heterogeneous device reference . . . . . . . . . . . . . . . . . . 150A.6 LOS vs NLOS pathloss estimation . . . . . . . . . . . . . . . . . 152A.7 Line groups pathloss estimation . . . . . . . . . . . . . . . . . . 153

B.1 The orignal TelosB node versus the modified node . . . . . . . . . 158B.2 The real wireless network versus the emulated wireless network . 159B.3 The full mesh topology versus the bus topology . . . . . . . . . . 161B.4 The star topology versus the ring topology . . . . . . . . . . . . . 161B.5 Frame sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . 162B.6 Normal data frame versus configuration or status frame . . . . . . 163B.7 The 4 pair UTP cable connection between nodes . . . . . . . . . . 164B.8 Detailed timing diagram of the data on the ring . . . . . . . . . . 164B.9 Block diagram of the slave node . . . . . . . . . . . . . . . . . . 165B.10 Quantized BER . . . . . . . . . . . . . . . . . . . . . . . . . . . 168B.11 Approximated BER curve . . . . . . . . . . . . . . . . . . . . . . 169B.12 Path loss vs distance . . . . . . . . . . . . . . . . . . . . . . . . 171B.13 PER indoor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171B.14 PER outdoor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172B.15 Throughput vs Senders . . . . . . . . . . . . . . . . . . . . . . . 173B.16 Deviation vs physical topology . . . . . . . . . . . . . . . . . . . 174

List of Tables

1.1 An overview of the contributions per chapter in this dissertation. . 10

2.1 Overview of existing sensing solutions. . . . . . . . . . . . . . . 252.2 Performance comparison with existing sensing solutions. . . . . . 37

3.1 Overview of the sensing solutions, ∗ indicates that the entry is con-figurable, only a typical value is entered. . . . . . . . . . . . . . . 65

4.1 The features versus technologies. . . . . . . . . . . . . . . . . . . 924.2 Confusion matrix of the measurement results, for N=20, T=1 second. 96

5.1 The main characteristic of the WARP SDR platform. . . . . . . . 1095.2 The mean and standard deviation of Wi-Fi throughput under the

impact of the real and the emulated Bluetooth traffic in the ane-choic chamber. . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

5.3 The model of the Wi-Fi throughput under the impact of the realand the emulated Bluetooth traffic. . . . . . . . . . . . . . . . . . 124

5.4 The model of the Wi-Fi jitter under the impact of the real and theemulated Bluetooth traffic. . . . . . . . . . . . . . . . . . . . . . 125

A.1 Mean Squared Error per device. . . . . . . . . . . . . . . . . . . 149A.2 Location heterogeneity overview. . . . . . . . . . . . . . . . . . . 152

List of Acronyms

A

ACK Acknowledgment

ACL Asynchronous Connection Link

ADC Analog-to-Digital Converter

ADSL Asymmetric Digital Subscriber Line

AFH Adaptive Frequency Hopping

AP Access Point

B

BER Bit Error Rate

BNEP Bluetooth Network Encapsulation Protocol

BS Base Station

C

CCA Clear Channel Assessment

CDF Common Data Format

CDMA Code Division Multiple Access

CFA Constant False Alarm

COR Channel Occupation Ratio

CPU Central Processing Unit

CR Cognitive Radio

CRC Cyclic Redundancy Check

xviii

CREW Cognitive Radio Experimental World

CSMA Carrier Sense Multiple Access

CSV Comma Saperated Values

D

DAC Digital-to-Analog Converter

dB Decibel

DSA Dymamic Spectrum Access

DSP Digital Signal Processing

DSSS Direct Sequence Spread Spectrum

DVB-T Digital Video Broadcasting - Terrestrial

E

ETSI European Telecommunications Standards Institute

F

FCC Federal Communications Commission

FDD Frequency Division Duplex

FDMA Frequency Division Multiple Access

FEC Forward Error Correction

FFT Fast Fourier Transform

FHSS Frequency Hopping Spread Spectrum

FIFO First In First Out

FPGA Field Programmable Gate Array

G

GCC GNU Compiler Collection

GHz Gigahertz

xix

GPIO General Purpose Input and Output

GPP General Purpose Processor

GSM Global System for Mobile Communications

I

IC Integrated Circuit

IDT Inverse Distance Weighting

IEEE Institute of Electrical and Electronics Engineers

IETF Internet Engineering Task Force

IF Intermediate Frequency

IFFT Inverse Fast Fourier Transform

IO Input and Output

IP Internet Protocol

IQ In-phase and Quadrature-phase

ISM Industrial Scientific and Medical

J

JSON JavaScript Object Notation

K

kbps kilobit per second

kHz kiloherts

L

LAN Local Area Network

LOS Line-Of-Sight

LTE Long Term Evolution

LVDS Low Voltage Differential Signaling

xx

M

MAC Medium Access Control

MAN Metropolitan Area Network

MCS Modulation and Coding Scheme

MHz Megaherts

MIMO Multiple Input and Multiple Output

MSE Mean Square Error

Msps Mega Samples per Second

MTU Maximum Transfer Unit

N

NGWN Next Generation Wireless Networks

NLOS None Line-Of-Sight

NTD Network To-be-Deployed

NTP Network Time Protocol

O

OFDM Orthogonal Frequency Division Multiplexing

OFDMA Orthogonal Frequency Division Multiple Access

OMF cOntrol Management Framework

OQPSK Offset Quardrature Phase Shift Keying

P

PAWS Protocol to Access White-Space

PC Personal Computer

PCB Printed Circuit Board

PDF Probability Density Function

PER Packet Error Rate

xxi

PLB Processor Local Bus

PLL Phase Locked Loop

PPC Power PC

PRR Packet Reception Rate

PSD Power Spectral Density

PTPd Precision Time Protocol daemon

Q

QoS Quality of Service

QPSK Quadrature Phase Shift Keying

R

RAM Random Access Memory

RBW Resolution Bandwidth

REM Radio Environment Map

RF Radio Frequency

RMS Root Mean Square

ROC Receiver Operating Characteristic

RRC Root Raised Cosine

RSSI Received Signal Strength Indicator

RST Reset

S

SDR Software-Defined Radio

SFD Start Frame Delimiter

SINR Signal to Interference-plus-Noise Ratio

SNR Signal-to-Noise Ratio

SPI Serial Peripheral Interface

SSID Service Set Identifier

STD STandard Deviation

xxii

SUT System Under Test

T

TDMA Time Division Multiple AccessTV Television

U

UDP User Datagram ProtocolUE User EquipmentUHD Universal Hardware DriverUHF Ultra High FrequencyUMTS Universal Mobile Telecommunications SystemUSB Universial Serial BusUSRP Universal Software Radio PeripheralUTP Unshielded Twisted Pair

V

VHDL VHSIC Hardware Description LanguageVHF Very High FrequencyVHSIC Very High Speed Integrated Circuit

W

WARP Wireless open-Access Research PlatformWi-Fi Wireless FidelityWiMAX Worldwide Interoperability for Microwave AccessWLAN Wireless Local-Area Network

X

XML eXtensible Markup Language

Samenvatting– Summary in Dutch –

Als gevolg van de snelle groei van draadloze communicatiemogelijkheden, is hetbeschikbare radiospectrum ofwel toegekend aan gebruikers met een licentie, of-wel gebruikt door een groot aantal toepassingen in de frequentiebanden zonderlicentie. Het tekort aan capaciteit binnen het draadloos spectrum is daardoor uit-gegroeid tot een van de grote uitdagingen van draadloze communicatie. Een ma-nier om dit tekort aan te pakken is het beschikbare spectrum uit te breiden naarhogere frequenties met technologieen zoals millimetergolven, gecombineerd metde inzet van ‘massive Multiple Input and Multiple Output (MIMO)’ oplossingen.Als alternatief kan de efficientie van de inzet van het huidig spectrum onder deloep genomen worden. Voornamelijk in de gelicentieerde banden is er vaak nogcapaciteit beschikbaar. Er werden reeds talrijke pogingen ondernomen om dezevrije capaciteit te benutten zonder de communicatiekwaliteit van de primaire ge-bruikers in de weg te staan. Dit principe staat ook bekend als het verticaal delenvan het spectrum, en wordt typisch gerealiseerd gebruik makende van CognitiveRadio (CR) oplossingen. Anderzijds ontwikkelt zich een trend om licenties uit tereiken voor frequenties die gedeeld kunnen worden door verschillende technolo-gieen. Bestaande technologie zoals Wireless Fidelity (Wi-Fi), Zigbee en Bluetoothdelen al dezelfde frequentiebanden. Hier spreekt men van een horizontaal delenvan het spectrum. Tegenwoordig breiden meer en meer technologieen uit naar debanden zonder licentie om de vrij beschikbare capaciteit te benutten. LTE-U, eenuitbreiding van Long Term Evolution (LTE) die opereert in de vrije 5 GHz Indu-strial Scientific and Medical (ISM) band om de capaciteit te verhogen, is hiervaneen goed voorbeeld.

In de brede zin verwijst CR naar draadloze communicatie die flexibel om-springt met het draadloos spectrum, door middel van zowel verticaal als horizon-taal delen van de beschikbare frequenties. De fundamentele voorwaarde voor CRis de mogelijkheid om het draadloos spectrum te monitoren en correct te karakteri-seren. Een manier om dit te bewerkstelligen is het aanleggen van een databank metde locaties en het zendbereik van de primaire zenders. Een alternatief voor dezeeerder statische aanpak maakt gebruik van lokale inschattingen van het radiospec-trum. Deze laatste methode springt beter om met dynamische scenario’s en vormtde focus van dit werk. Aangezien draadloze toestellen typisch gebruik maken vaneen radio interface, moet de inschatting van het draadloos kanaal afgewisseld wor-den met de datatransmissies. Het afwisselen tussen verzenden en het monitoren

xxvi SAMENVATTING

van het kanaal is echter niet altijd praktisch haalbaar. Bovendien heeft afwisse-lende monitoring van het draadloos kanaal heeft beperkingen: datatransmissiesvan korte duur kunnen over het hoofd gezien worden. Om dit te vermijden kun-nen afzonderlijke toestellen ontwikkeld voor spectrum monitoring ingezet worden:de zogenaamde ‘sensing engine’ toestellen. Deze toestellen hoeven de draadlozemonitoring niet te onderbreken bij een datatransmissie en hebben meer flexibeleconfiguratie-instellingen wat betreft hun frequentiebereik en hun meetnauwkeu-righeid. Helaas slagen zelfs dure sensing engines er niet in om continu metingenuit te voeren over een lange periode, voornamelijk omwille van hun beperkte ver-werkingssnelheid. Om dit probleem op te lossen werd een specifieke kanaalmo-nitoringsmethode ontworpen op een commercieel Software-Defined Radio (SDR)platform, waarbij deze beperkingen werden oplost door middel van hierarchischeparallelle processing. Deze oplossing is bijgevolg in staat een breedband spectrumcontinu te analyseren en biedt tegelijkertijd voldoende configuratieflexibiliteit. Devoorgestelde oplossing heeft twee grote voordelen: een correcte, continue inschat-ting van het kanaalgebruik en de mogelijkheid om kortstondige signalen, zoalsBluetooth, te detecteren.

De vermelde oplossing verbetert de spectrum monitoring mogelijkheden inhet tijdsdomein door een betere detectie van kortdurende signalen. Het volgendeluik van dit werk stelt methodologieen voor om verschillende spectrum inschat-tingsmiddelen te combineren om zo een grotere ruimtelijke precisie te verkrijgen.Hiertoe is een gedistribueerde oplossing noodzakelijk opdat spectrale informatiekan worden vergaard over een grote oppervlakte. Door meerdere heterogene spec-trum informatiebronnen te combineren kunnen de algemene monitoringprestatiesworden geoptimaliseerd tegen een lagere kost. Elk van deze bronnen biedt flexi-biliteit wat betreft Radio Frequency (RF) front-ends, monitoring snelheid en pre-cisie, en varieert in de manier waarop samples verwerkt en bewaard worden. Omte bepalen op welke betekenisvolle manier deze heterogene resultaten te verge-lijken en te combineren zijn werd een set van methodologieen afgeleid op basisvan experimenten. De voorgestelde methodologieen handelen over volgende as-pecten: (i) het bewaren van experiment beschrijvingen en heterogene resultatenin een gemeenschappelijk dataformaat; (ii) het kunnen omgaan met verschillendemeetresoluties (in tijd- en frequentiedomein); (iii) kalibreren van toestellen onderstrikt gecontroleerde condities; (iv) verwerkingstechnieken voor het efficient ana-lyseren van de bekomen resultaten. Deze methodologieen bieden een belangrijkeeerste stap naar een gestandaardiseerde en systematische aanpak van heterogenespectrum meettechnieken.

In sommige gevallen is enkel het detecteren van een signaal niet voldoende,maar is het ook belangrijk om de gebruikte technologie te achterhalen. Het her-kennen van het type technologie heeft verschillende voordelen. In de context vanverticaal spectrum delen, moet de secundaire gebruiker onmiddellijk de transmis-sie staken indien een primair signaal gedetecteerd wordt, maar mag de gebruikerde transmissie verderzetten indien het een ander type signaal betreft. In het ge-val van horizontaal delen van het spectrum, biedt technologiedetectie inzichten diehelpen om interferentie te voorkomen. Bijvoorbeeld, een Wi-Fi signaal dat moet

SUMMARY IN DUTCH xxvii

concurreren met de LTE-U technologie, kiest beter een ander kanaal dan terug tegrijpen naar een eenzijdige carrier sensing en back-off. Echter, omwille van degrote complexiteit van technologie specifieke herkenningsalgoritmes, bestaan erweinig communicatiesystemen die signalen afkomstig van andere technologieenkunnen herkennen. Het volgende luik van dit werk toont aan dat de ReceivedSignal Strength Indicator (RSSI) van verschillende technologieen karakteristiekeeigenschappen prijsgeeft, die het mogelijk maken om signaaltypes te classifice-ren. Er werd een reeks experimenten uitgevoerd om de RSSI te observeren vandrie representatieve technologieen: Wi-Fi, LTE en Digital Video Broadcasting -Terrestrial (DVB-T). De resultaten tonen aan dat de RSSI-metingen afkomstigvan kleinschalige toestellen met een samplefrequentie van 1 MHz voldoende ken-merken bevat om deze breedbandige technologieen van elkaar te onderscheiden.Aangezien de analyse van RSSI eenvoudig, technologie-onafhankelijk en weinigveeleisend is wat betreft samplefrequentie, is de voorgestelde aanpak ideaal voorde implementatie van technologieherkenning met behulp van goedkope toestellen.

Spectrum sharing resulteert wel in een efficienter gebruik van de RF-bandsmaar verhindert niet volledig dat de technologieen in dezelfde RF-band interfe-reren. Draadloze netwerkinstallaties groeien vaak organisch en nieuwe technolo-gieen worden gradueel geıntroduceerd. Netwerkplanning is typisch gelimiteerd tothet optimaliseren van een technologie, wat dus leidt tot een latere manifestatie vanproblemen ten gevolge van de co-existentie van verschillende technologieen. Hetoplossen van deze problemen na de initiele investeringen is typisch zeer duur. Omonverwachte netwerkdegradatie en investeringen te voorkomen, biedt het laatsteluik van dit werk een oplossing om de impact te bepalen van nieuwe netwerk-technologieen op bestaande netwerken voor de eigenlijke uitrol. Hiervoor wordende signalen van het potentieel draadloos netwerk geemuleerd met een software-defined radio. Om de doeltreffendheid van deze emulator te evalueren, wordt decoexistentie van Bluetooth en Wi-Fi als referentiescenario vooropgesteld. Eenreeks van experimenten werden uitgevoerd om de impact van Bluetooth verkeerop een Wi-Fi netwerk te observeren. Dezelfde experimenten werden uitgevoerd,ditmaal samen met het geemuleerde Bluetooth verkeer. Er werd aangetoond datde emulator een betrouwbare indicatie aangeeft van de te verwachten impact. Opdeze manier bieden we een eenvoudige, kost-efficiente en betrouwbare oplossingom de impact van een draadloos netwerk in te schatten voor de eigenlijke uitrol.

Samenvattend behandelt dit onderzoek verschillende fundamentele aspectenvan frequentie-flexibele radio-oplossingen. Startend van baanbrekende spectrum-monitoringsoplossingen, tot het voorkomen van interferentie tussen concurrerendetechnologieen, bevat dit werk de bouwstenen die gebruikt kunnen worden voor eenbeter gecoordineerd draadloos spectrum voor een heterogene set van draadlozetechnologieen.

Summary

Due to the quick growth of wireless communications, the radio spectrum resourcesare either claimed by various licensed users, or heavily loaded by applications inthe unlicensed bands. The shortage of spectrum resource has become a key lim-itation of wireless communication. One way to resolve the issue is to extend theapplicable spectrum towards higher frequency range, using technologies such asmillimeter wave assisted by massive MIMO; another way is to improve the ef-ficiency of the current radio spectrum, which is typically underutilized in the li-censed bands. There have been many efforts to enable opportunistic access oflicensed spectrum without compromising the incumbents’ communication quality.This is a well-known application scenario of Cognitive Radio (CR), also referred toas the vertical spectrum sharing approach. In parallel, a trend has been going on torelease licensed spectrum so that it can be shared by multiple technologies. Exist-ing technologies such as Wi-Fi, Zigbee, Bluetooth are already sharing spectrum insuch an approach, which is referred to as the horizontal spectrum sharing. In orderto take advantage of the free spectrum, more and more technologies are expandinginto the unlicensed bands. The LTE-U — an unlicensed version of Long TermEvolution (LTE) operating in the 5 GHz Industrial Scientific and Medical (ISM)band to boost cell coverage — is the best example here.

In a broad sense, CR refers to the combined efforts towards frequency agile ra-dio communications, including both the horizontal and vertical spectrum sharingapproach. The fundamental requirement of CR is the ability to correctly examinethe radio environment. One way to accomplish this goal is to register the primarytransmitters’ locations and power coverage into a centralized database. As thissolution is rather static, an alternative based on local spectrum assessment is pro-posed to cope with more dynamic scenarios. The latter becomes the first focus ofthis research. As wireless devices typically possess one radio interface, it is nec-essary to interleave the channel assessment and data transfer activities. However,fragmenting data transmission into predefined intervals is not always practical, andinterrupted channel assessment tends to fail at detecting transient signals. Thisis where devices dedicated to spectrum monitoring, termed as “sensing engine”,come into play. Sensing engines do not need to interrupt channel assessment fordata transmission, and generally provide more flexibilities, such as configurablefrequency span, measurement resolutions. However, even for high-end sensingengines (e.g., spectrum analyzers), performing long term measurements continu-ously is still a challenge, largely due to the lack of processing speed. To remedythis situation, a dedicated channel assessment tool is designed on a commercial

xxx SUMMARY

Software-Defined Radio (SDR) platform, which overcomes the speed bottleneckby using hierarchical parallel processing. As a result, it is capable of continuouswide-band spectrum analysis, and offers sufficient flexibilities for configuration atthe same time. The solution has successfully demonstrated two advantages of con-tinuous spectrum monitoring: the accurate assessment of channel occupancy, andthe capability of detecting transient signals such as Bluetooth.

The previous solution improves spectrum sensing performance in the time do-main by enhancing the interception rate of transient signals. The next part ofthis dissertation provides methodologies to combine different spectrum assessmenttools, in order to improve the precision of measurement over space. Distributedanalysis is necessary to obtain spectral information over a large area. An increas-ing amount of heterogeneous sensing solutions are incorporated, to enhance theoverall sensing performance at lower cost. Although the concept of combining thestrengths of diversified sensing devices is promising, the question of how to com-pare and combine the heterogeneous sensing results in a meaningful way is stillopen. To this end, a set of methodologies are derived from several experimentsusing heterogeneous sensing solutions. Each of the solutions offers different Ra-dio Frequency (RF) front-end flexibility, sensing speed and accuracy, and varies inthe way the samples are processed and stored. The proposed methodologies coverthe following aspects: (i) storing experiment descriptions and heterogeneous re-sults in a common data format; (ii) coping with different measurement resolutions(in time or frequency domain); (iii) calibrating devices under strictly controlledconditions; (iv) processing techniques to efficiently analyze the obtained results.These methodologies provide an important first step towards a standardized andsystematic approach of heterogeneous sensing solutions.

Sometimes merely detecting the signals’ presence is not sufficient, it is alsoimportant to identify the technology types. The benefit of recognizing coexistingtechnologies is evident: in the context of vertical spectrum sharing, if the detectedsignal is primary, the secondary user should immediately back off, otherwise theuser may continue with the transmission; in the context of horizontal spectrumsharing, recognizing the technology provides extra insights to counteract the inter-ference: e.g., for a Wi-Fi network, if the concurrent technology is LTE-U definedby Qualcomm, it would be more effective to maximize the usage of the period-ical off time of the LTE traffic than relying on the normal carrier sensing andback-off approach. However, due to the complexity of recognition algorithms, andthe strict condition of sampling speed, communication systems capable of recog-nizing signals other than its own type are extremely rare. The next part of thisdissertation proves that multi-model distribution of the Received Signal StrengthIndicator (RSSI) is related to the signals’ modulation schemes and medium accessmechanisms, and different technologies may exhibit highly distinctive features intheir probability distributions of RSSI. A series of experiments are conducted toobserve the RSSI of three representative technologies, i.e. Wi-Fi, LTE, and Dig-ital Video Broadcasting - Terrestrial (DVB-T). The result shows that even thehistogram of RSSI acquired at sub-Nyquist sampling rate is able to provide suf-ficient features to differentiate technologies. As the analysis of RSSI distribution

SUMMARY xxxi

is straightforward, technology independent, and less demanding in terms of sys-tem requirements such as sample rate, it is highly valuable for achieving widebandtechnology recognition on constrained RF devices.

Just like a double-edged sword, spectrum sharing improves the utilization ofa given RF band, but at the same time brings us a new challenge: how to preventtechnologies competing for the same spectrum band from interfering each other?Wireless network deployments often grow organically with new technologies in-troduced over time. Network planning is typically limited to optimizing a singletechnology based network, which causes the coexistence issues to manifest them-selves at a later stage. Such kind of problems are usually costly to resolve, asthe investment has already been made. To avoid unexpected network performancedegradation and unnecessary costs, the last part of this dissertation presents a solu-tion to assess the impact of additional wireless network on an existing one beforethe actual deployment, by emulating the signals of the potential wireless networkwith a single SDR platform. To evaluate the emulator’s performance, the coexis-tence of Bluetooth and Wi-Fi is considered as the reference scenario. A series ofexperiments are conducted to observe the impact of Bluetooth traffic on a Wi-Finetwork, and the corresponding measurements are repeated under the emulatedBluetooth signals. In addition, the experiments are performed at two representa-tive locations, which validates that the proposed solution is not limited to a specificexperiment setting, but broadly applicable to any environment and network topol-ogy. It is shown that the use of the emulator is a reliable indicator of the expectedimpact. As such, we provide a simple, cost efficient, flexible and reliable solutionto assess the impact of a wireless network prior to its deployment.

Starting from pioneering spectrum monitoring techniques, to preventing inter-ference among concurrent technologies, this research covers several fundamen-tal aspects of frequency agile radio solutions, which serve as important buildingstones towards the next generation wireless networks.

1Introduction

“And understand that scarce spectrum is used today for example for cell phoneoperators, they have to pay for the airwaves they use, for their services.”

–Robert McChesney (1952 - )

The word “spectrum” made its first appearance in the 16th century, and has beenconsidered ever since then as an entire range, over which some measurable prop-erty of a physical system or phenomenon can vary.

In contrary, the term “radio” has a much shorter history. Its meaning and usageadvance in parallel with the developments in the field of communications. In 1865,James Clerk Maxwell published his theories and mathematical proofs, indicatingthat light and many other phenomenon were variants of electromagnetic wavespropagating through free space. A series of subsequent experiments conducted byHeinrich Rudolf Hertz, proved the existence of Maxwell’s electromagnetic waves,using a frequency belonging to what would later be called the “radio spectrum”.

1.1 Context

1.1.1 The scarcity of radio spectrum

The radio spectrum covers part of the electromagnetic spectrum, ranging from 3Hz to 3000 GHz (3 THz) [1]. From ordinary mobile phones to vital public safetyservices, from satellite broadcasting to Wireless Local-Area Network (WLAN),

2 CHAPTER 1

Figure 1.1: Overview of the radio spectrum [2].

almost every wireless technology relies on the Radio Frequency (RF) spectrum.However, access to RF spectrum has been strictly regulated since the early 20thcentury.

It is widely acknowledged that unknown transmission will cause interferenceupon the existing RF signals. Consequently, operators are obligated to obtain ex-clusive licenses from the government. An overview of the radio spectrum alloca-tion is given in Figure 1.1. With the fast growth of wireless technologies duringthe past decades, virtually all usable RF spectrum are assigned to either commer-cial operators or government organizations [3]. This leads to the so called “spec-trum drought” [4], in the words of former U.S. Federal Communications Commis-sion (FCC) chair William Kennard. In fact, the lack of spectrum has been so severethat it even delayed the deployment of cellular phone service for over two decades,which was first demonstrated in 1949 [5].

1.1.2 The underutilized licensed spectrum

On one hand, governments all over the world are in shortage of radio spectrum;on the other hand, the allocated bands are underutilized. When looking at Figure1.1, it is not hard to notice that radio applications are concentrated at the “sweetspot”, which is where the unlicensed 800 MHz and 2.4 GHz bands are situated.The majority of the radio spectrum is assigned to individual operators, providingservices such as TV and radio broadcasting. These radio activities are typicallyrestricted to certain timespan and geographic area, yielding significant amount ofspectral resources allocated but not used.

A spectrum policy task force, organized by the FCC, reports that even denseurban areas contain licensed bands that are quiet most of the time. One studyfound that only 4 out of the 18 Ultra High Frequency (UHF) television channelswere used in Washington, D.C. [5]. The situation in Very High Frequency (VHF)bands are even worse. After the close down of analog TV stations, the vast portion

INTRODUCTION 3

of the VHF spectrum is licensed but no longer utilized [6]. In fact, the amountof wasted spectrum in the TV bands is so severe, that the early efforts to enableopportunistic access of licensed spectrum in the literatures, are almost elusivelysituated in the context of “TV white space” [7–10].

1.1.3 The advances in radio technologies

The striking advances in radio technologies are visible in many aspects. First, therange of applicable radio frequencies has been drastically extended. Once upona time, 60 MHz was considered as the upper bound of RF spectrum, while to-day transmission at 60 GHz is demonstrated successfully in various measurementcampaigns [11–14].

Secondly, modern technologies can squeeze higher capacity out of the samepiece of spectrum, and make the communication more robust against interference.Digital modulation is the main driving force of this improvement. Technologies,such as spread spectrum, no longer require high transmit power, but use wide-bandsignals to achieve robust connections [15].

Finally, the invention of Software-Defined Radio (SDR) brought revolutionaryimpact on the radio industries [16]. Radio devices are no longer closed by man-ufacturers, but open to the public for exploitation. Instead of decoded bits andpackets, one has direct access to raw samples from an SDR device. Therefore,the same radio device can be used to watch TV, listen to radio, and experimentwith new waveforms and modulation schemes. The freedom provided by SDRhas soon made its ground among radio hobbyists as well as academists. Today,SDR is closely related to many research fields in wireless communication, and itis especially popular for radio solutions where flexibilities are desired [17].

To some extent, the advances of radio technologies have transformed the reg-ulation policies, that was once intended to protect the communication qualities,into artificial restrictions, which are harming the efficiency of the spectrum usageinstead.

1.1.4 The road towards open spectrum

Two factors are responsible for the spectrum scarcity we are facing today: thestatus of the radio technology and the regulations of spectrum access. Fortunately,at the time of today, both constraints are going through revolutionary changes.

Today’s digital technologies are smart enough to distinguish between signals,allowing users to share the airwaves without exclusive licensing. Instead of treat-ing spectrum as a scarce physical resource, we could make it available to all as acommons, an approach known as “open spectrum.”

–Kevin Werbach (1970 - )

4 CHAPTER 1

Despite the evident benefit of open spectrum, legacy technologies will not dis-appear in one day, and the world of open spectrum will not arrive tomorrow. Infact, for some functionalities, such as the emergency public services, strict regula-tions might remain as the most suited approach. The world will have both systems,licensed and unlicensed, coexisting side by side for a considerate amount of time.The regulations will gradually adapt to the new world, by setting aside more spec-trum for unlicensed use, and promoting efficient spectrum sharing mechanisms.

In this context, Cognitive Radio (CR) is proposed as a hybrid solution, allowingopportunistic access of licensed spectrum while maintaining the protection of theincumbents [18]. Over the time, the concept of CR has been broadened to includegeneral wireless solutions, which are capable of examining the radio environmentand adapting to it accordingly. Without doubt, the emergence of CR is the startingpoint of dynamic spectrum access, and it will continue to play an important role inthe world of open spectrum.

1.2 Business model

Though open spectrum allows more efficient and creative use of the limited re-source, it triggers another question: who is going to make the effort for it? Acompany will only invest in new technologies if there is an expected profit.

1.2.1 Licensed technology

In the traditional spectrum paradigm, operators purchase licenses from the govern-ment, and make investment to deploy and maintain infrastructures. Users need topay for the product and services, including the cost of spectrum access. As boththe government and operators receive profit, new technologies are often the resultof joined efforts, where government leads the standardization, and the industryconducts trials, production, and commercialization activities. The cellular systemof today is the best illustration of this scenario [19].

1.2.2 Unlicensed technology

The evolution of technologies in unlicensed spectrum, on the other hand, is solelydriven by industry, as government no longer receives income from the spectrumaccess. For example, the popular WLAN technology Wi-Fi in the unlicensed ISMbands, is manged entirely by the Wi-Fi Alliance organization, which consists ofmore than 600 member companies worldwide, but not a single government orga-nization [20].

INTRODUCTION 5

1.2.3 Cognitive technology

The nature of CR is something in between the licensed and unlicensed technolo-gies, which makes it fascinating for both scientific research and marketing stud-ies [21]. The benefit of free spectrum access comes at the price of extra complex-ities. Instead of licensing cost, industries now have to make investments to obtaintechniques such as accurate spectrum assessments. On the government side, ratherthan issuing licenses, authorities are established to certify technologies which arequalified for opportunistic spectrum access. To some extent, the success of CR hasa strong interdependency with the means of spectrum analysis. When the bene-fit of dynamic spectrum access outweighs its costs, we believe both governmentsand industries will take the lead to foster the commercialization of the technology,which will trigger major shifts in investment, business models, and services.

1.3 Challenges

As stated previously, dynamic spectrum access requires highly qualified and prefer-ably low-cost solutions to monitor the spectrum. Though static approaches, suchas registering primary transmitters in a centralized database, do exist, this researchis dedicated to local spectrum monitoring, for its advantage to cope with inter-ference in a dynamic radio environment. The overall challenges tackled in thisresearch are listed below.

1.3.1 Detection of transient signals

There are two phases in spectrum analysis: (i) perform sampling over certain fre-quency and time span and (ii) process the collected samples to get meaningfulspectral information. When it takes longer to process the samples than to collectthem, one need to stop sampling once in a while, so that the processing phase cancatch up. The regularly occurring interruptions of sampling phase negatively affectthe signal detection rate, especially for the case of transient signals. By applyingappropriate trigger conditions, these signals can be captured in a short burst ofsamples. However, the story is different for long term monitoring, where breakingthe bottleneck of processing speed and achieving continuous monitoring wouldbe inevitable for accurate signal interception. At the time when this research isstarted, solutions capable of continuous sampling and processing in real time arevery rare and extremely costly. Though over time, quite some effort is visible inthis area [22, 23], we believe there is still a room for more dedicated improvementin the context of CR technology.

6 CHAPTER 1

1.3.2 Data compression

Accurate spectrum analysis usually leads to data explosion, which burdens themeasurement devices and prevents information from being exchanged in an ef-ficient way [24]. How to reduce the amount of data without compromising thequality of the measurement is an intriguing question, which we aim to provide ananswer in this work.

1.3.3 Inter-working of heterogeneous devices

The lack of individual sensitivity in spectrum sensing can be compensated by co-operation among multiple devices [25]. These devices can be installed as part ofthe infrastructure for the sole purpose of spectrum sensing [26], or existing userdevices can be involved through crowdsourcing approach [27]. In both cases, thedevices involved in the collaborative spectrum sensing are likely to be heteroge-neous, thus performing heterogeneous spectrum sensing

Unlike spectrum sensing using homogeneous devices, heterogeneous sensingis more challenging due to the fact that it involves high to low-end sensing devices,and their corresponding approaches to process or store the results. Although theconcept of combining the strengths of various sensing devices is promising, thequestion of how to compare and combine the heterogeneous sensing results in ameaningful way is still open.

1.3.4 Technology recognition

Spectrum monitoring, in its most basic form, is the measurement of energy in arange of frequency bands. Comparing to energy detection, recognizing the tech-nology type will not only indicate if the band is free, but also tell how the band isbeing utilized, and if it would be feasible to share. Regrettably, most wireless sys-tems in real life only recognize its own signal, because it is very costly and com-plex to implement multiple technology-specific algorithms on one system [28].In addition, existing algorithms typically require Nyquist sampling rate to rego-nize a given technology, which rules out the possibility for recognizing widebandtechnologies on narrowband devices. Therefore how to identify concurrent tech-nologies in a generic and simple approach, with limited bandwidth requirement,remains as a challenge.

1.3.5 Interference prevention

Spectrum sharing brings opportunities, and challenges alike. As the conventionalwireless network planning is dedicated to optimizing performance of a single tech-nology [29–31], it makes the network vulnerable to interference from other wire-less systems competing for the same spectrum. Even if no problem occurs during

INTRODUCTION 7

the deployment phase, additional devices introduced later on will likely to bringthe vulnerability to the surface. Resolving problems at this stage is extremely dif-ficult and expensive. Hence, preventing potential interference is a valuable featurefor wireless network planning, which we aim to cover in this work.

1.3.6 Cost considerations

The trade-off between cost and performance is vital for the market success of CRtechnology. It is not only limited to the price range of hardware platforms, but alsoconcerns whether a solution is simple to configure, easy to maintain, and portableon multiple operating environments. All these considerations must be taken intoaccount while tackling the aforementioned challenges.

1.4 Basic terminologies

A few regularly occurred terminologies in this dissertation are briefly introducedbelow. Comparison between the general concept and context-dependent usage inthis work are included wherever applicable to avoid ambiguity while reading.

1.4.1 PSD

The power spectral density describes how power of certain signal is distributedin the frequency domain [32]. In this dissertation, PSD is computed using FastFourier Transform (FFT), where a vector is produced to characterize the signal’samplitude at each frequency bin.

1.4.2 Spectrogram

Spectrogram is used to observe the spectrum of frequencies in a signal as it varieswith time or other variables [33]. In this dissertation, spectrogram is a visualpresentation of a sequential collection of PSD. It has two dimensions, namely fre-quency and time.

1.4.3 RSSI

The received signal strength indicator is offered by many commercial radio chipsto assess the quality of the signal, or the status of the wireless medium. Eachvendor has its own approach to obtain RSSI, and often the value is uncalibrated,since absolute accuracy in power level is not important. Therefore calibration isrequired when using such kind of RSSI for the purpose of cooperative spectrumsensing, as addressed in Chapter 3.

8 CHAPTER 1

Some chipsets only produce RSSI after a packet is successfully decoded, whichmakes the obtained RSSI technology-specific. The RSSI contained in the Radiotapheader [34] of a Wi-Fi packet falls exactly into this category. For SDR devices, thetype of RSSI is subject to implementation. In Chapter 4, we compute RSSI valuefrom a continuous range of In-phase and Quadrature-phase (IQ) samples capturedby an SDR platform, without any technology specific filtering or processing, henceit is generic.

1.4.4 PDF

The probability of a random variable appearing within certain range is expressed asthe integral of its probability density function between the corresponding interval[35]. In practice, PDF is approximated by normalized histogram, which is scaledin such a way that the total area under the histogram is equal to 1. This is becauseprobability may not exceed 100%, and the integral of a PDF over the entire spaceis always 1.

1.4.5 Emulation vs Simulation

Both simulation and emulation are used to replace a complicated system in prac-tical studies. Emulation focuses on imitating external behavior of a system, whilesimulation is based on modeling. Usually, simulation is associated with software,where a set of input is given and output is produced accordingly. Emulation is of-ten involved in testing with hardware, where the interaction between the emulatedblock and the implemented system is examined.

1.5 Outline

This dissertation is composed of a number of publications that were realized withinthe scope of this PhD. The selected publications provide an integral and consistentoverview of the work performed. The complete list of publications that resultedfrom this work is presented in Section 1.6. Within this section we give an overviewof the remainder of this dissertation, with the main contributions highlighted inbold font.

We start with a comparison of different sensing solutions in Chapter 2, fromwhich we observe that the lack of processing speed is the root cause for disconti-nuity in spectrum monitoring. An optimized solution is then designed to over-come the bottleneck through the use of parallel processing technique, offeringhighly accurate spectral assessment over time.

Now we have a more performant sensing design, however, a single solution isinsufficient and unreliable to monitor the spectrum over a large space. Hence, the

INTRODUCTION 9

robustness of propagation condition estimated by multiple, heterogeneous devices,at diverse locations is thoroughly investigated in Appendix A. The experience ofoperating various spectrum monitoring solutions leads to a systematic study ofinter-working among heterogeneous sensing devices in Chapter 3.

Given the previous efforts to improve spectrum assessment over a longer pe-riod of time and larger area in space, we are still limited to a binary answer ofwhether a piece of spectrum is free or not. However, depending on the technologytypes, sharing the spectrum could be beneficial, or a sheer risk of chaos. Thoughidentifying technologies is a valuable feature, its practical application is restrictedby relatively complex algorithms, technology-specific implementations, and thestrict system requirement such as sample rate. The study in Chapter 4 showsthat the probability distribution of the received signal strength acquired atsub-Nyquist sampling rate is subject to the types of modulation and MediumAccess Control (MAC). A generic and simple approach for technology identi-fication is then proposed based on this finding.

Till this point, the work has been focusing on spectrum monitoring solutionsto facilitate dynamic spectrum access. However, the transform of wireless net-work cannot be achieved without the corresponding update of its development andplanning tools. Mainstream network design solutions cannot cope with hetero-geneous interference; similarly, unexpected interference in wireless experimentscauses measurement failures, and drastically slows down the development cycle.To alleviate the interference related problems, Chapter 5 presents a solution thatuses emulated RF signals to examine an existing network’s tolerance of ato-be-deployed network, while Appendix B emulates the behavior of wirelessmedium via customized hardware design, to obtain strictly controlled radio envi-ronment for experimentation purposes.

Figure 1.2 positions the different contributions that are presented in each chap-ter (Ch.) and appendixes (App.). From the top level, two types of contributions aremade for realizing dynamic spectrum access: (i) the improvement of radio envi-ronment monitoring, and (ii) the adaptation of wireless network design solutions.Within the scope of spectrum monitoring, Chapter 2 and Chapter 3 are related toenergy detection, the former is dedicated to optimizing sensing solution in the timedomain, while the latter provides methodologies to achieve sensing accuracy overspace. Chapter 4 focuses on wireless technology recognition — a complimentaryapproach to energy detection — to further enhance the quality of dynamic spec-trum access. Finally, Chapter 5 utilizes emulated RF signals to assess the impactof a to-be-deployed network on an existing one, providing a measure to anticipateinterference in the network planning phase.

Table 1.1 shows the challenges highlighted in Section 1.3, and indicates whichchallenges are targeted per chapter. Besides the main objectives, Chapter 2 andChapter 3 also contribute to mechanisms of data compression. For instance, the

10 CHAPTER 1

Figure 1.2: Schematic position of the different chapters in this dissertation.

use of channel occupation ratio is proposed to reduce measurement resolution overtime, while preserving the visibility of transient signals. Cost is a common consid-eration throughout this dissertation, thus the general preference for generic, simpleimplementations upon the commercial off-the-shell SDR platforms.

Table 1.1: An overview of the contributions per chapter in this dissertation.

Ch.2 Ch.3 Ch.4 Ch.5Measurement of transient signals •Data compression • •Inter-working of heterogeneous devices •Technology recognition •Interference prevention •Cost consideration • • • •

1.6 Publications

The results obtained during this PhD research have been published in scientificjournals and presented at a series of international conferences. The following listprovides an overview of the publications.

INTRODUCTION 11

1.6.1 Publications in international journals(listed in the Science Citation Index 1 )

1. Wei Liu, Daan Pareit, Eli De Poorter and Ingrid Moerman. Advanced spec-trum sensing with parallel processing based on Software-Defined Radio.Published in EURASIP Journal on Wireless Communications and Network-ing, 2013.1 (2013): 1-15.

2. Mostafa Pakparvar, David Plets, Emmeric Tanghe, Dirk Deschrijver, WeiLiu, Krishnan Chemmangat Manakkal Cheriya and Ingrid Moerman A cog-nitive QoS management framework for WLANs. Published in EURASIPJournal on Wireless Communications and Networking, 2014.1 (2014): 1-18.

3. Wei Liu, Mikolaj Chwalisz, Carolina Fortuna, Eli De Poorter, Jan Hauer,Daan Pareit, Lieven Hollevoet and Ingrid Moerman Heterogeneous spec-trum sensing: challenges and methodologies. Published in EURASIP Jour-nal on Wireless Communications and Networking, 2015.1 (2015): 1-15.

4. Wei Liu, Eli De Poorter, Jeroen Hoebeke, Emmeric Tanghe, Wout Joseph,Pieter Willemen, Michael Mehari, Xianjun Jiao and Ingrid Moerman As-sessing the coexistence of heterogeneous wireless technologies with an SDR-based signal emulator: a case study of Wi-Fi and Bluetooth. Submitted toIEEE Transactions on Wireless Communications.

1.6.2 Publications in international conferences(listed in the Science Citation Index 2 )

1. Christoph Heller, Christian Blumm, Stefan Bouckaert, Wei Liu, Ingrid Mo-erman, Peter van Wesemael, Sofie Pollin, Tomaz Solc and Zoltan Padrah.Spectrum sensing for cognitive wireless applications inside aircraft cabins.Published in the proceedings of IEEE-AIAA Digital Avionics Systems Con-ference, 2012.

2. Wei Liu, Stratos Keranidis, Michael Mehari, Jono Vanhie-Van Gerwen, Ste-fan Bouckaert, Opher Yaron and Ingrid Moerman. Various detection tech-niques and platforms for monitoring interference condition in a wireless

1The publications listed are recognized as ‘A1 publications’, according to the following definitionused by Ghent University: A1 publications are articles listed in the Science Citation Index Expanded,the Social Science Citation Index or the Arts and Humanities Citation Index of the ISI Web of Science,restricted to contributions listed as article, review, letter, note or proceedings paper.

2The publications listed are recognized as ‘P1 publications’, according to the following definitionused by Ghent University: P1 publications are proceedings listed in the Conference Proceedings Ci-tation Index - Science or Conference Proceedings Citation Index - Social Science and Humanities ofthe ISI Web of Science, restricted to contributions listed as article, review, letter, note or proceedingspaper, except for publications that are classified as A1.

12 CHAPTER 1

testbed. Published in Lecture Notes in Computer Science, 7586, p.43-60,2013.

3. Jetmir Haxhibeqiri, Michal Mehari, Wei Liu, Eli De Poorter, Wout Joseph,Ingrid Moerman, Jeroen Hoebeke. Wireless handover performance in in-dustrial environment: a case study. Published in the proceedings of IEEEEmerging Technologies and Factory Automation (ETFA) 2016.

4. Wei Liu, Merima Kulin, Tarik Kazaz, Ingrid Moerman, and Eli De Poorter.Wireless technology recognition based on RSSI distribution at sub-Nyquistsampling rate. Submitted to IEEE International Symposium on DynamicSpectrum Access Networks (DySPAN) 2017.

1.6.3 Publications in other international conferences

1. Danny Finn, Justin Tallon, Luiz Da Silva, Peter Van Wesemael, Sofie Pollin,Wei Liu, Stefan Bouckaert, Jono Vanhie-Van Gerwen, Nicola Michailow,J Hauer, Daniel Willkomm and Christoph Heller. Experimental assess-ment of tradeoffs among spectrum sensing platforms. Published in proceed-ings of Wireless Network Testbeds, Experimental Evaluation and Charac-terization, 6th ACM International workshop, Las Vegas, NV, USA, ISBN:9781450308670, 2011.

2. Wei Liu, Opher Yaron, Ingrid Moerman, Stefan Bouckaert, Bart Jooris,Piet Demeester. Real-time wide-band spectrum sensing for Cognitive Radio.Published in the 18th IEEE Symposium on Communications and VehicularTechnology in the Benelux (SCVT), Ghent, Belgium, ISBN: 9781457712883,2011.

3. Peter Van Wesemael, Wei Liu, Mikolaj Chwalisz, Justin Tallon, DannyFinn, Zoltan Padrah, Sofie, Pollin, Stefan Bouckaert, Ingrid Moerman andDaniel Willkomm. Robust distributed sensing with heterogeneous devices.Published in the proceedings of Future Network & Mobile Summit, ISBN:9781905824298, 2012.

4. Wei Liu, Luc Bienstman, Bart Jooris, Opher Yaron, and Ingrid Moerman.FPGA-based wireless link emulator for wireless sensor network. Publishedin the 8th International ICST Conference, TridentCom, Thessanoliki, Greece,Online ISBN: 9783642355769, 2012.

5. Wei Liu, Stefan Bouckaert, Ingrid Moermann, Sofie Pollin, Peter Van We-semael, Christoph Heller, Danny Finn, Daniel Willkomm, Jan Hauer, Miko-laj Chwalisz, Nicola Michailow, Tomaz Solc and Zoltan Padrah A set ofmethodologies for heterogeneous spectrum sensing. Published in the Wire-less Innovation Forum Europe, Brussels, Belgium, 2012.

INTRODUCTION 13

6. Wei Liu, Michael Mehari, Stefan Bouckaert, Lieven Tytgat, Ingrid Moer-man and Piet Demeester Demo abstract: a proof of concept implementa-tion for cognitive wireless sensor network on a large-scale wireless testbed.Published in the 10th European Conference on Wireless Sensor Networks(EWSN), Ghent, Belgium, ISBN: 9783642366710, 2013.

7. Ingrid Moerman, Wei Liu, and Peter De Valck Wireless experimentation: anexperimenter’s viewpoint. Published in the 2nd International Workshop onMeasurement-based Experimental Research, Methodology and Tools (MER-MAT), 2013.

8. Wei Liu, Eli De Poorter, Pieter Becue, Bart Jooris, Vincent Sercu, IngridMoerman, Jeroen Vanhaverbeke, Carl Lylon and John Gesquiere Demo: acognitive solution for commercial wireless conferencing system. Publishedin the proceedings of the 20th annual international conference on Mobilecomputing and networking (Mobicom), Maui, Hawaii, USA, ISBN: 978-1-4503-2783-1, 2014.

9. Luiz A. DaSilva, Mikolaj Chwalisz, Wei Liu and Adnan Bekan Hands-onexperimentation with cognitive radio enabled systems. Published in the pro-ceedings of Global Communications Conference (Globecom), San Diago,CA, USA, 2015.

14 CHAPTER 1

References

[1] Nomenclature of the frequency and wavelength bands used in telecommuni-cations. Available from: http://www.itu.int/rec/R-REC-V.431/en.

[2] J. P. C. L. Miranda. Multi-standard context-aware cognitive radio: sensingand classification mechanisms. PhD thesis, Technische Informationsbiblio-thek und Universitatsbibliothek Hannover (TIB), 2012.

[3] M. Cave, C. Doyle, and W. Webb. Essentials of modern spectrum manage-ment. Cambridge University Press Cambridge, 2007.

[4] S. M. Yano. Investigating the ultra-wideband indoor wireless channel. InVehicular Technology Conference, 2002. VTC Spring 2002. IEEE 55th, vol-ume 3, pages 1200–1204. IEEE, 2002.

[5] G. Staple and K. Werbach. The end of spectrum scarcity [spectrum allocationand utilization]. Spectrum, IEEE, 41(3):48–52, 2004.

[6] S. Pagadarai, A. M. Wyglinski, and R. Vuyyuru. Characterization of va-cant UHF TV channels for vehicular dynamic spectrum access. In VehicularNetworking Conference (VNC), 2009 IEEE, pages 1–8. IEEE, 2009.

[7] S. J. Shellhammer, A. K. Sadek, and W. Zhang. Technical challenges forcognitive radio in the TV white space spectrum. In Information Theory andApplications Workshop, 2009, pages 323–333. IEEE, 2009.

[8] A. B. Flores, R. E. Guerra, E. W. Knightly, P. Ecclesine, and S. Pandey. IEEE802.11 af: a standard for TV white space spectrum sharing. CommunicationsMagazine, IEEE, 51(10):92–100, 2013.

[9] J. Van De Beek, J. Riihijarvi, A. Achtzehn, and P. Mahonen. TV white spacein Europe. Mobile Computing, IEEE Transactions on, 11(2):178–188, 2012.

[10] H.-S. Chen and W. Gao. Spectrum sensing for TV white space in NorthAmerica. Selected Areas in Communications, IEEE Journal on, 29(2):316–326, 2011.

[11] B. Razavi. A 60-GHz CMOS receiver front-end. Solid-State Circuits, IEEEJournal of, 41(1):17–22, 2006.

[12] P. Smulders. Exploiting the 60 GHz band for local wireless multimedia ac-cess: prospects and future directions. Communications Magazine, IEEE,40(1):140–147, 2002.

INTRODUCTION 15

[13] M. Peter, W. Keusgen, A. Kortke, and M. Schirrmacher. Measurement andAnalysis of the 60 GHz In-Vehicular Broadband Radio Channel. In VTCFall, pages 834–838, 2007.

[14] L. Rakotondrainibe, G. Zaharia, G. E. Zein, and Y. Lostanlen. Indoor channelmeasurements and communications system design at 60 GHz. arXiv preprintarXiv:0812.4710, 2008.

[15] A. J. Viterbi. CDMA: principles of spread spectrum communication. AddisonWesley Longman Publishing Co., Inc., 1995.

[16] W. H. Tuttlebee. Software defined radio: enabling technologies. John Wiley& Sons, 2003.

[17] F. K. Jondral. Software-defined radio: basics and evolution to cognitiveradio. EURASIP journal on wireless communications and networking,2005(3):275–283, 2005.

[18] S. Haykin. Cognitive radio: brain-empowered wireless communications. Se-lected Areas in Communications, IEEE Journal on, 23(2):201–220, 2005.

[19] W. H. Melody and W. Lemstra. 8 Liberalization in radio spectrum manage-ment1. International Handbook of Network Industries: The Liberalization ofInfrastructure, page 123, 2011.

[20] W. Lemstra, V. Hayes, and J. Groenewegen. The innovation journey of Wi-Fi:The road to global success. Cambridge University Press, 2010.

[21] P. Anker and W. Lemstra. Cognitive radio: How to proceed? An actor-centric approach. Communications & Strategies, (90):77–95, 2013.

[22] H. Ding and Z. Zhao. Continuous Spectrum Sensing in Cognitive RadioNetworks. In Business Computing and Global Informatization (BCGIN),2012 Second International Conference on, pages 625–628. IEEE, 2012.

[23] A. J. Braga, R. A. de Souza, J. P. C. da Costa, and J. D. Carreno. Continuousspectrum sensing and transmission in MIMO cognitive radio network. InCommunications (LATINCOM), 2014 IEEE Latin-America Conference on,pages 1–5. IEEE, 2014.

[24] I. F. Akyildiz, B. F. Lo, and R. Balakrishnan. Cooperative spectrum sensingin cognitive radio networks: A survey. Physical communication, 4(1):40–62,2011.

[25] R. Tandra, S. M. Mishra, and A. Sahai. What is a spectrum hole and whatdoes it take to recognize one? Proceedings of the IEEE, 97(5):824–848,2009.

16 CHAPTER 1

[26] C. F. Tomaz Solc and M. Mohorcic. Low-cost testbed development and itsapplications in cognitive radio prototyping. In Cognitive Radio and Net-working in Heterogeneous Wireless Networks. Springer, 2015.

[27] A. Nika, Z. Zhang, X. Zhou, B. Y. Zhao, and H. Zheng. Towards com-moditized real-time spectrum monitoring. In Proceedings of the 1st ACMworkshop on Hot topics in wireless, pages 25–30. ACM, 2014.

[28] H. Wang, G. Noh, D. Kim, S. Kim, and D. Hong. Advanced sensing tech-niques of energy detection in cognitive radios. Communications and Net-works, Journal of, 12(1):19–29, 2010.

[29] D. Plets, W. Joseph, K. Vanhecke, and L. Martens. Exposure optimization inindoor wireless networks by heuristic network planning. Progress In Electro-magnetics Research, 139:445–478, 2013.

[30] N. Liu, D. Plets, K. Vanhecke, L. Martens, and W. Joseph. Wireless in-door network planning for advanced exposure and installation cost mini-mization. EURASIP Journal on Wireless Communications and Networking,2015(1):1–14, 2015.

[31] P. Sebastiao, R. Tome, F. Velez, A. Grilo, F. Cercas, D. Robalo, A. Rodrigues,F. Varela, and C. Nunes. WLAN planning tool: A techno-economic perspec-tive. In Proceedings of COST 2100 TD (09) 935 meeting, pages 28–30,2009.

[32] P. Stoica and R. L. Moses. Introduction to spectral analysis, volume 1. Pren-tice hall Upper Saddle River, 1997.

[33] D. Banash. Steve Tomasula: The Art and Science of New Media Fiction.Bloomsbury Publishing USA, 2015.

[34] Radiotap. Available from: http://www.radiotap.org/.

[35] A. Kolmogorov. Foundations of the Theory of Probability.

2Advanced spectrum sensing with

parallel processing based onSoftware-Defined Radio

This chapter embarks on a brief survey of existing sensing solutions, which broughttwo observations to our attention: first, mainstream sensing solutions are inca-pable of monitoring spectrum continuously, making it less sensitive to transientsignals; and secondly, many solutions lack the flexibility and required perfor-mance, which restrict their applications in real-life measurements. The solutionproposed in this chapter is able to overcome both limitations. It is used as one ofthe solutions in the discussion of heterogeneous spectrum sensing in Chapter 3.

? ? ?

W. Liu, D. Pareit, E. De Poorter and I. Moerman

Published in EURASIP Journal on Wireless Communications and Network-ing 2013.1 (2013): 1-15.

Abstract Due to interference between co-located wireless networks, obtaining ac-curate channel assessment becomes increasingly important for wireless networkconfiguration. This information is used, amongst others, for cognitive radio solu-tions and for intelligent channel selection in wireless networks. Solutions such as

18 CHAPTER 2

spectrum analyzers are capable of scanning a wide spectrum, but are not dedicatedfor channel occupation assessment, because they are extremely costly and not ableto perform continuous recording for a longer period than a few seconds. On theother hand, low cost solutions lack the flexibility and required performance interms of configuration and sensing efficiency. To remedy the situation, this paperpresents an alternative for channel assessment on top of a commercial software-defined radio platform. Although software solutions for performing spectrum sens-ing on such platforms do exist, to the best of our knowledge, continuous spectrumsensing and long term recording remain challenging. We propose a pioneering so-lution that is capable of seamless spectrum sensing over a wide spectrum band andguarantees sufficient flexibility in terms of configurations. The proposed solutionis validated experimentally. We demonstrate two advantages of seamless spectrumsensing: the capability of accurate channel occupancy measurement and detectingtransient signals such as Bluetooth.

2.1 Introduction

As the density of co-located wireless networks grows, wireless systems are moreand more susceptible to mutual interference, leading to degraded network per-formance. At the same time, end-users demand high Quality of Service (QoS)from wireless networks. This conflict gains increased interest in both the indus-trial and academic world, resulting in several research projects [1, 2]. CognitiveRadio (CR) is a promising technology for solving the above problem. OriginallyCR is a frequency-agile radio, capable of accessing licensed spectrum without in-fluencing the primary users [3]. The concept of CR can be extended for moreefficient sharing of unlicensed band among heterogeneous technologies.

The fundamental requirement for CR is the ability to correctly examine thespectrum usage. One approach is to register primary user’s location and powercoverage into a central database, which obviously does not apply for dynamicenvironment. Another approach is to perform channel assessment locally, allowingfast reaction to changes in the spectrum.

The localized spectrum sensing approach appears to be more appealing thanksto its adaptivity to changing spectrum environment. Most wireless devices haveonly one radio module. Therefore, it is common to interleave the channel assess-ment and data transmission activity. How to find the optimal sensing frequency iscrucial to improve the system performance, and hence becomes a popular researchtopic on itself [4, 5]. However, it is not always convenient to limit transmission intopredefined intervals. Sensing a broad spectrum range with limited radio front-endcapability and processing resources results in limited sensing performance.

An alternative is to add a few more advanced devices dedicated for sensingabove the original network. Such devices are referred to as sensing engines [6].

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 19

Apart from the CR context, sensing engines can help operators of wireless tech-nology to better identify the location and characteristics of the interference. Inaddition, for wireless researchers, an accurate sensing engine can provide a moredetailed view on the physical layer. One use case could be a Medium Access Con-trol (MAC) layer researcher that needs to identify the inter-packet interval or theduty cycle of a channel.

One of the most crucial aspects of sensing engine is its efficiency. Becausediscontinuity in spectrum sensing often leads to inaccurate assessment and misseddetection of interference or primary usage. Spectrum sensing generally consists oftwo phases:

• The sampling phase, in which raw samples are collected from the air

• The processing phase, in which buffered samples are processed for spectrumanalysis

Depending on the processing speed, the processing phase can partially or com-pletely happen in parallel with the sampling phase. The time used for collectingsamples from the air is referred to as the sampling time, while the time requiredby the processing phase in addition to the sampling time is referred to as the pro-cessing time. The sensing efficiency is then defined as the ratio of the samplingtime and the summation of the sampling time and the processing time. Duringthe processing time, the sampling of the wireless medium is put onto hold, whichmeans the sensing engine is “blind”. It is possible that a number of transient sig-nals are missed during this period. The time interval when sampling activity is putonto hold, is referred to as the blind time. Ideally, the blind time should reduced tozero, meaning 100% sensing efficiency to achieve seamless detection.

Among the mainstream sensing solutions, spectrum analyzers are capable ofscanning a wide spectrum range, but are not dedicated for channel assessment andextremely costly. For instance, a spectrum analyzer usually can not do continuousrecording for a longer time period than a few seconds, and the recorded spectrumneed to have high frequency resolution for visualization purpose. However, theraw spectrum information still requires further processing to obtain the energyfor specified channels. On the other hand, low cost solutions are trimmed forsimple and steady recording, but lack the flexibility and required performance.For instance, they are not able to achieve seamless spectrum sensing, and usuallyhave non-configurable frequency span and resolution bandwidth.

The key requirements for channel assessment in the CR context are flexibility,reliability, and the capability of continuous recording. Energy per channel witha timestamp is the desired output format; an excessively fine frequency resolu-tion is generally not appreciated. To enable cooperative or distributed spectrumsensing, the measurement should be obtained with a relatively low-cost platform.Finally, from a developer’s point of view, the implementation should be flexible

20 CHAPTER 2

and transparent in order to achieve fast prototyping and testing. After realizing thegap between the capability of high-end spectrum analyzers and the need of cog-nitive radio researching, we decide to build an alternative — a simpler but morededicated sensing engine.

In summary, to achieve an advanced wireless system, we need sensing en-gines with relatively low cost and capable of continuous sensing and recording. Tothis end, this paper presents a solution that is built upon a commercial Software-Defined Radio (SDR) [7] platform. The solution is further extended on multipleSDR devices for cooperative and distributed spectrum sensing. While the de-veloped solution has less functionality than spectrum analyzers, it is also muchcheaper and dedicated for channel assessment. Above all, in contrast to most spec-trum analyzers, our solution is capable of continuous sampling and recording.

The remaining part of the paper is organized as follows: first we present anoverview of the most common sensing devices today; next we describe how wearrive at our solution and its advantages; finally the detailed software structure andconfigurations of the sensing software are presented. The proposed solution is ver-ified experimentally, with real-life wireless signals, such as Wi-Fi and Bluetooth.

2.2 Analysis of existing platforms

This section presents some of the most representative sensing solutions, startingfrom powerful but expensive spectrum analyzers to simple off-the-shelf sensordevices. The processing mechanism of high-end spectrum analyzers are discussedin depth, as it is needed for further sections.

2.2.1 Spectrum analyzers

The majorities of spectrum analyzers have two basic modes: swept mode andFast Fourier Transform (FFT) mode [8]. The swept mode is a traditional sensingmethod, where the Radio Frequency (RF) center frequency is incremented by asmall step very rapidly, hence the name “swept analyzer”. The signal obtainedat each step is passed through a resolution bandwidth filter (RBW filter). Theamplitude is then processed by a detector for display purposes. There exist severaltypes of detector, such as Root Mean Square (RMS), peak, and sample, the strengthof each type is discussed in [8]. The range of the sweep defines the frequency span.The time needed for the front-end to scan the entire frequency span is called thesweep time. The major disadvantage of a swept analyzer is that the spectrum canonly be measured at one frequency point at a time. Therefore, it is possible to missshort signal events during the sweeping, as illustrated in Figure 2.1.

FFT based spectrum analyzers do not need the sweeping of RF front-end. Thetransformation from time domain to frequency domain is achieved by FFT instead.

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 21

Figure 2.1: Swept mode of a spectrum analyzer. The center frequency of the spectrumanalyzer is continuously incremented (‘swept’), leading to potentially missed signals. The

figure is adapted from [8].

First a batch of samples are stored in memory, then by applying FFT, the timedomain samples are translated into spectrum information. The frequency span ofthe FFT based analyzer depends on the sample rate. Although no sweeping isactually performed, we inherit the term sweep time to describe the time betweentwo consecutive FFT results.

Some spectrum analyzers combine the swept mode and the FFT mode. Theresult of one sweep is then a combination of several FFT shots obtained at differentcenter frequencies. This is termed as the swept FFT mode.

The advantage of the FFT based analyzer is that it is possible to look at abroader range of the spectrum with one operation. However, FFT requires first theacquisition of a batch of samples and then followed by a processing step. Whathappens in between of subsequent acquisition phases is missed by the analyzer, asillustrated in the upper part of Figure 2.2.

To solve this problem, the analyzer needs to meet the following conditions:

• The processing speed should be faster than the acquisition speed

• The sample acquisition and sample processing should happen in parallel

The above requirements are also described in the lower part of Figure 2.2.Spectrum analyzers that are capable of seamless measurements are referred to as

22 CHAPTER 2

Figure 2.2: FFT based spectrum analyzer: in the upper part, FFT processing time islonger than sampling time, resulting in discontinuous sampling and missed transient

signal; in the lower part, the analyzer is capable of detecting the transient signal thanks toincreased processing speed and continuous capturing. This figure is adapted from [8].

real-time spectrum analyzer [8]. The exact features of real-time analyzers dependon the type of the device. To illustrate this, two specific spectrum analyzers aredescribed in more detail in the following section, the FSVR series of ROHDE &SCHWARZ and the RSA series of Tektronix. Although modern spectrum ana-lyzers also include the swept mode to increase the frequency range, here we onlyfocus on the FFT mode. The discussion below does not include implementation de-tails, but instead emphasizes the underlying processing mechanism and the amountof flexibility for the end users.

2.2.1.1 ROHDE & SCHWARZ FSVR

The FSVR is a popular series from R&S. The machine performs 250000 times1024-point FFT per second, resulting in one FFT shot every 4 µs. When usersconfigure the frequency span (sample rate), the amount of overlapping between ad-jacent FFT frames is automatically adjusted, as illustrated in Equation 2.1, whereFs is the sample rate and X is the amount of overlapping of samples betweenadjacent FFT frames in percentage.

1024/Fs ∗ (1−X) = 4us (2.1)

The obtained FFT shot can not be displayed directly, because the number ofFFT bins is generally greater than available pixels on the screen. Various detectors

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 23

are used to combine multiple FFT bins into one bin for visualization. Apart fromthe pixel limitation, most screens can only refresh 60 times per second, FSVRhence combines multiple FFT shots into one for display purposes, this is referredto as the trace detector. In spectrogram mode, the number of combined FFT shotsis defined by the parameter “sweep time”. To certain extent, users can lower thesweep time to increase time resolution. The resolution bandwidth however is de-pendent on the frequency span, due to the fixed FFT size.

2.2.1.2 Tektronix RSA6000

Unlike FSVR, RSA spectrum analyzer from Tektronix exposes more parametersto the end user. For instance, there is a parameter to specify the length of thetime interval during which samples are collected and analyzed seamlessly. BothFFT size and sample rate can be configured independently. This decouples theresolution bandwidth from the frequency span. Similar to FSVR, the final resultare trimmed by various detectors for displaying on the screen.

RSA provides highly flexible processing features, based on post processing ofraw samples in the memory. For instance, in the spectrogram mode, users canzoom in or zoom out on the time scale by adapting the amount of overlappingbetween FFT frames. However, when doing so, the machine needs to recalculatethe spectrogram, this may take a considerable amount of time depending on thequantity of samples. Between each block of continuous samples, a black line isused to indicate the discontinuity of the spectrogram.

2.2.1.3 Summary

Regardless the difference in processing style, the two analyzers do have one thingin common — the output is produced in a way that is best suited for displaying onthe screen. And in contrast with the fancy display features, the recording featuresof spectrum analyzers are relatively basic. Both FSVR and RSA are capable ofrecording raw samples and some amount of spectrogram, depending on the wave-form memory depth. Take the FSVR as an example, the waveform memory allowsuser to store maximum 200 million In-phase and Quadrature-phase (IQ) samples.This means a recording of 8 seconds with 25 Mega Samples per Second (Msps)sample rate, which is just wide enough to cover one Wi-Fi channel. Apart from thetime limitation, further processing on the raw IQ samples is still required to obtainthe energy in specific channels.

In short, the capability of spectrum analyzers are far beyond FFT or storingraw samples, it is however, optimized for fast visualization of spectrum and othersophisticated processing, and therefore not suitable for regular channel assessmentactivities in a CR network.

24 CHAPTER 2

2.2.2 Low cost USB devices

There are several commercial sensing solutions running on a regular computerwith a USB dongle. The USB dongle functions as the RF front-end while the hostcomputer provides the user interface and the visualization functionality. Some ofthe well-known devices are Wi-Spy [9] and Airmagnet [10].

The radio of Airmagnet has a 20-MHz Intermediate Frequency (IF) bandwidth.The Airmagnet spectrum analyzer makes use of the swept FFT mechanism to covera bandwidth that is wider than 20 MHz. For the 2.4 GHz Industrial Scientific andMedical (ISM) band, the entire frequency span is fixed to 83 MHz with 156 kHzresolution bandwidth. During each sweep, the radio increases its center frequencywith a step of 20 MHz and dwells on each center frequency for 30 ms. The sweeptime is fixed to 1 second. The fact that the frequency span is less than 5 times the IFbandwidth infers that each measurement of the 2.4 GHz ISM band contains maxi-mum 5 blocks of samples. This means the time to sample the wireless medium foreach sweep is at maximum 150 ms. Given the constant sweep time of 1 second,the actual sensing efficiency is only 15%.

The mechanism of Wi-Spy resembles the pure swept spectrum analyzer. Ituses a narrow-band RF receiver to scan across the interested band in tiny steps.The step width depends on the Wi-Spy model and the selected band of interest,ranging from about 50 kHz to over 600 kHz.

Compared to spectrum analyzers, the radio front-end of the USB devices isless advanced, resulting in lower sensitivity and narrower spectrum coverage. Be-sides the less advanced RF front-end, Universial Serial Bus (USB) based sensingsolutions relies on the host machine softwares for processing, which are typicallybound to certain operating systems. This further limits its usage. The feature oflong term recording is provided, but with very limited limited efficiency and flexi-bilities.

2.2.3 Sensor devices

Another option is to use cheap sensor devices for spectrum analysis. Here the sen-sor devices refer to the battery-operated, low-power wireless platforms [11], [12].Sensor chips are originally meant to form sensor networks for home automationor various monitoring purposes. It usually consists of integrated sensors, a micro-controller and a IEEE 802.15.4 (Zigbee) compliant radio module. The radio mod-ule provides built-in Clear Channel Assessment (CCA), which can be used to eval-uate the energy of the selected channel. With appropriate firmware, cheap sensordevices can also be programed into a swept spectrum analyzer.

It is evident that the CCA module can only sense one channel at a time, thefrequency resolution is as wide as the Zigbee channel width. Although there existsolutions for programming front-end to perform fast sweeping [13] in the 2.4 GHz

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 25

Table 2.1: Overview of existing sensing solutions.

Device name flexibility seamless long term costcapturing recording cost

Spectrum analyzer high yes no highUSB sensing devices medium no yes mediumSensor low no yes lowOur target solution high yes yes low

ISM band, its low resolution bandwidth limits the detection accuracy.

2.2.4 Sensing solution overview

Table 2.1 gives an overview of the advantages and disadvantages of different sens-ing solutions. Note that flexibility level is measured by whether parameters, suchas RBW, sweep time and amplification level, are configurable on a device, if ev-erything is tunable, it is classified as highly flexible, if at least one parameter isadjustable, its flexibility is medium, otherwise it is deemed to be inflexible. Theprice ranges for high, medium and low are High-cost solutions such as spectrumanalyzers are usually overkill for the targeted applications: many functionalitiesbuilt in spectrum analyzers are redundant for merely channel assessment. In ad-dition, these devices are not capable of long term and seamless recording and fastdata transfer. On the other hand, low cost devices have less bandwidth, limitedprocessing power and flexibility. To remedy this situation, we aim to design a lowcost solution that is capable of seamless recording and offers sufficient flexibility,as listed as the last entry of Table 2.1.

2.3 Our sensing solution

2.3.1 Design constraints

As discussed in Section 2.2.1, among the common spectrum analyzing approaches,the FFT mode is more advanced than the swept mode. Therefore our SDR basedsensing solution makes use of an FFT based sensing solution. Our solution has thefollowing design goals.

• Direct access to the IQ samples. This is strict requirement, since FFT relieson raw IQ samples instead of decoded bits or packets.

• Sufficient sample rate. The instantaneous frequency span is defined by sam-ple rate, which should cover bandwidth of common wireless technologies,

26 CHAPTER 2

such as the 20 MHz wide Wi-Fi channel.

• Flexibility. To be useful in a wide range of technologies, the solution shouldexpose sufficient flexibility to the end user. It should be possible to configurethe sensing engine to assess different sets of channels and to change thefront-end gain settings or FFT size.

• Ease of development. The design should be kept simple and transparent forfast prototyping and development.

• Platform independence. To overcome any limitations caused by operatingsystems, the software should be platform independent.

These requirements are the main motivation to use an SDR platform.

2.3.2 The hardware platform

SDR platforms allow traditional radio functions, such as decoding or encoding, tobe shifted from hardware to software. SDRs can be divided into two categoriesbased on the type of processor used for signal processing: the first category makesuse of a General Purpose Processor (GPP) in a regular computer; the second cate-gory relies on embedded processors on board.

The Universal Software Radio Peripheral (USRP) formally developed by Et-tus Research [14] falls into the first category. It is a commercial SDR platformthat utilizes a general purpose processor and has gained widespread usage. TheUSRP consists of two parts, a fixed mother board and a plug-in daughter board.The mother board contains Analog-to-Digital Converter (ADC)/Digital-to-AnalogConverter (DAC), an Field Programmable Gate Array (FPGA) for digital downconversion with programmable decimation rate and an interface connected to thehost PC. The daughter board provides basic RF front-end functionality. The USRPN210 — the network series of the second USRP generation — outperforms theoriginal series with its more powerful FPGA, faster ADC/DAC, Gigabit Ethernethost connection and complete remote configuration features. In addition, USRPhas a broad range of daughter boards that cover frequencies from nearly DC to al-most 6 GHz [15]. A simplified diagram of the USRP N210 is illustrated in Fig 2.3.Besides the hardware, Ettus Research also provides the Universal Hardware Driver(UHD) for the communicating between the USRP and the host PC [16]. It isentirely open source and available for all major operating systems, and can bebuilt with many popular compilers such as GNU Compiler Collection (GCC) [17].Users are able to use the UHD driver standalone or with third-party platforms suchas GNU Radio [18].

The Wireless open-Access Research Platform (WARP) is an example SDRplatform that falls into the second category. It has a powerPC [19] processor and

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 27

Figure 2.3: USRP Block Diagram

a large amount of programmable hardware resources [20]. Compared to USRP,WARP provides higher on-board processing capacity, but is also much more ex-pensive. The WARP programming environment relies on the Xilinx FPGA soft-ware, which is not free for use. The embedded processing power and rich FPGAresource make it possible to build a stand-alone sensing system, however due tothe hardware programming and embedded environment, it is also more difficultto design and debug. In addition there are less RF boards available in the WARPrepository than for the USRP.

Because of the above mentioned reasons, the USRP was selected to designour SDR sensing platform. The lack of processing power on the USRP can becompensated by connecting it to a powerful host machine. Though there is anoption to use GNU Radio like third-party platforms, our software is implementeddirectly above the UHD driver. This reduces the overhead of function calls, hencegives better performance and sensing efficiency. Apart from the UHD library, theBoost [21] and FFTW [22] libraries are also required. All of the required librarieswork on major operating systems, including UNIX and Windows variants, thusmaking our solution platform independent.

The sensing engine software is currently compiled and tested on 6 identical 16-core Linux servers. The choice of using a 16-core server does not strictly complyto the initial low cost requirement, however, it is necessary to achieve sufficientamount of parallel processing, as further explained in Section 2.3.3. The archi-tecture of the software can easily be ported to an FPGA platform. Note that theprice of one USRP and one server is still significantly lower than the price of onespectrum analyzer, therefore even the current approach is already an improvement

28 CHAPTER 2

in terms of overall financial cost.The servers are physically located within a large scale wireless testbed: the

w-iLab.t testbed [23]. Six USRPs with the desired daughter board XCVR2450are deployed in the testbed, each connected to one of the 16-core servers. Thew-iLab.t uses OMF (cOntrol Management Framework) as its testbed control andmanagement framework [24]. OMF allows experimenters to configure multipledevices simultaneously, providing easy data logging services. Therefore the mul-tiple USRPs can easily be setup as a distributed cooperative sensing system. Thisconfiguration will be used for the Bluetooth detection experiment in Section 2.4.3.

2.3.3 The software architecture

As stated in Section 2.2, it is important that the processing time is shorter than thesample acquisition time, in order to achieve continuous spectrum sensing.

When no parallelism is present, the sample acquisition alternates with the pro-cessing phase, and as such the blind time of the sensing engine is equal to theprocessing time (as illustrated in plot (a) of Figure 2.4).

When pipelining between sample acquisition and processing is introduced, af-ter the first batch of samples arrived, sampling and processing the samples obtainedin the previous time frame are happening in parallel. This is the first level of paral-lelism. The blind time is equal to the original processing time minus the samplingtime, as shown in plot (b) of Figure 2.4. However this is not sufficient to achieveseamless sampling if the processing time is longer than the sampling time. Tofurther reduce the processing time, we seak to add parallel processing within theprocessing phase itself. The processing phase consists of splitting samples intosmall frames, applying FFT operation on all frames sequentially, and combiningall the FFT result in one way or another. As FFT is a highly computational de-manding operation, instead of having one single FFT core working sequentially,we utilize multiple FFT cores to work simultaneously: the incoming samples aredivided among the multiple FFT cores for processing. Once the samples have beenreceived, the FFT cores work independently from each other, hence ideal for par-allelism. This is where the second level parallelism is introduced. We illustrate thecase of two FFT cores working in parallel in the plot (c) of Figure 2.4. More FFTcores could be added if it is necessary to achieve continuous spectrum sensing.

The sensing engine software relies on multi-threading to achieve parallel pro-cessing. There are two main threads running at any moment, one thread is respon-sible for collecting samples from the USRP (referred to as the sample-collectingthread), the other thread is responsible for processing the samples (referred to asthe sample-processing thread). The sample-processing process again generatesseveral sub threads to process the incoming samples in parallel. The sample pro-cessing in our solution calculates the FFT based Power Spectral Density (PSD)

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 29

Figure 2.4: Parallel processing for seamless spectrum sensing.

30 CHAPTER 2

Figure 2.5: High level description of the software for seamless spectrum sensing.

and the energy for specified channels. Once all sub threads finish processing, theyterminate and the original sample-processing thread outputs the result to either alocal file or the standard output. To simplify the collection of measurements inthe w-iLab.t testbed, the measurements are first printed to the standard output andthen piped to a predefined database using an OMF wrapper. The general structureis illustrated in Figure 2.5.

To achieve true parallel pipelining, two buffers are used to collect samples fromthe USRP. At any given moment, when one sample-collecting thread is writing toone buffer, the sample-processing thread will be reading from the other buffer.Therefore, once the first batch of samples have arrived, the two main threads workfully in parallel. To ensure that the two main threads do not read and write to thesame buffer at the same time, the sample-processing thread needs to work fasterthan the sample-collecting thread. Hence within the sample-processing thread,several sub threads are created to accelerate the processing. The number of threadsthat should be used to achieve best efficiency depends on how many samples thebuffer contains and the FFT size. During our experiments, 8 processing-threadsare sufficient to support a sample-collecting thread at the highest sample rate ofthe USRP (25 Msps). However, for configurations in which only a small amountof samples is collected, the overhead of creating multiple threads outweighs itsprocessing benefit, hence the sample-processing thread can no longer follow thesample-collecting thread. When this happens, the software detects the overflow ofsamples and return an error message.

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 31

2.3.4 Configurations and important features

The sensing engine software can be configured using various options, which aredescribed in detail in this section.

2.3.4.1 Continuous FFT mode vs Swept FFT mode

First of all, the sensing engine can be used in two modes: the continuous FFTmode and the swept FFT mode.

For the continuous FFT mode, the USRP front-end stays at the same frequencyand continuously samples the wireless medium. Similar to spectrum analyzers,users can control both the center frequency and the sample rate in order to definethe spectrum range.

For the swept FFT mode, the USRP will always collect samples at its max-imum sample rate of 25 Msps. The samples collected at a specific RF centerfrequency are called a block, while the compete measurement across several RFcenter frequencies is called one sweep. Between two adjacent blocks, the centerfrequency is incremented by a step of 20 MHz. Users can specify the center fre-quency of the beginning block, and how many blocks one sweep should contain.As such, by adding the swept FFT mode, the frequency span is no longer limitedby the sample rate.

2.3.4.2 Measurement types

The sensing engine can be configured to perform different types of measurement.(i) The sensing engine can measure the PSD in the required frequency range,

and thus calculates the amount of energy detected in each specified channel. Thisis referred as the PSD measurement. The PSD measurement has three variants:averaging, maxhold and minhold, comparable to the function of the detector forspectrum analyzers. Typically, the number of samples per buffer is a lot largerthan the FFT size, hence each buffer contains many FFT frames. For the PSDmeasurements, the software does either averaging, max hold or min hold acrossdifferent FFT frames, and the final FFT result is used for the power integrationfor the requested channels. The maxhold mode is useful to detect the signal’spresence, while minhold mode can be used for estimating the noise floor.

(ii) For the continuous FFT mode, the sensing engine can also measure howmuch portion of time the energy of the specified channels is above a certain thresh-old. This is referred as the duty cycle measurement. To realize this function, thesoftware investigates a particular channel and counts how many times its energy isabove a threshold, and then divide this number by the total number of FFT framesin the buffer. When the appropriate threshold is selected (a value that is slightlyabove the noise floor), the duty cycle mode can be a powerful tool to detect tran-sient signals.

32 CHAPTER 2

2.3.4.3 Sensing efficiency

Recall that the sensing efficiency is defined as the ratio of the sampling time and thesummation of sampling time and the additional processing time. In our case, theprocessing phase happens entirely in parallel with the sampling phase. Hence noadditional time is required by the processing phase. For the continuous FFT mode,the sensing efficiency is always 100%, since the USRP never stops sampling.

For the swept FFT mode, the sampling phase must be interrupted for channelswitching, which is the only cause for time loss. Hence the sensing efficiency forswept FFT mode is defined as:

λ =SamplingT ime

SamplingT ime+ ChannelSwitchingT ime(2.2)

Unfortunately, channel switching of the USRP is more complicated than onlytuning the radio front-end’s center frequency. The host machine needs to commu-nicate with the embedded processor on the USRP over the Ethernet interface. Theexact handling of channel switching depends on the firmware on the embeddedprocessor and the driver of the host machine.

To measure the channel switching time, Wireshark [25] was used to record thepackets between the USRP and the host machine. All configuration packets havea short packet length, while the packets containing IQ samples are typically 1514bytes long. By using a packet length based filter, only the configuration packetsused for channel switching and streaming commands can be displayed. Based onthis output, Wireshark can generate an IO graph, plotting the packet/ms vs the time,as shown in Figure 2.6. This graph gives an indication on how much time is spenton sampling and how much time is spent on channel configuration. The samplingtime is directly related to the requested number of samples by one stream com-mand. This is defined by the option “– spb” in the sensing software, standing forsample per buffer. The packet trace shown in Figure 2.6 is generated with 524288samples per buffer, the sampling time for each block is 524288/25Msps = 21ms,this result corresponds with Figure 2.6. The configuration time for channel switch-ing cannot be influenced by software options. It currently requires at maximum 19ms to switch a channel for the USRP. The channel switching time is a hardware anddriver issue, it can be reduced by improving the driver and firmware. Although thisis not the focus of this paper, it is an interesting direction for future improvements.

Up till now, we have identified the channel switching time, the sensing ef-ficiency in the swept FFT mode can be calculated by Equation 2.2. Increasingthe sampling time is an effective way to improve the sensing efficiency. Whenconfiguring the sensing engine with “spb” equal to 4194304, the sampling time is4194304/25000kHz = 168ms, the sensing efficiency is 168ms/(168+19)ms =

89.8%. With 5 blocks per sweep, the sensing engine can cover 100 MHz band-width and produce 1 sweep per second. Note that this configruation is very similar

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 33

Figure 2.6: Wireshark IO graph derived from a packet trace between the USRP and thehost machine. Only packets with length smaller than 1514 are displayed. The y axis is the

packet rate and the x axis is the time in ms accuracy.

to the measurement capabilities of Airmagnet, however the sensing efficiency ofAirmagnet is only 15%.

2.3.4.4 Time resolution

In the swept FFT mode, the sensing engine produces one line of output per sweep.The continuous FFT mode can be considered as a special case of the swept FFTmode, where the sweep consists of only one block of samples. We use the term“sweep time” to describe the time interval between two subsequent lines of mea-surements.

When measuring the PSD, the time resolution depends on the sweep time. Forthe continuous FFT mode, the sweep time is equivalent to the sampling time. For agiven sample rate, the sweep time is proportional to the sample per buffer —“spb”parameter. Reducing the “spb” parameter will reduce the sweep time, making theoutput more suitable for resolving short signal event.

For the swept FFT mode, the sweep time is equal to:

T = BlockPerSweep ∗ (ChannelSwitchingT ime+ SamplingT ime) (2.3)

Although for the swept FFT mode the sweep time depends on the channel switch-ing time and proportional to the number of blocks in a sweep, it still heavily relieson the sampling time. Hence, to a certain extent, we are able to improve the timeresolution by reducing the buffer size.

For the duty cycle measurement in the continuous FFT mode, the time to re-solve an event depends on the FFT size. This is because the entire buffer of samplesare divided into multiple FFT frames. The length of the FFT frame serves as thebasic unit for the channel occupation calculation.

Since commercial USB sensing solution typically have none or limited sweeptime configurations, our solution is clearly more flexible in this aspect.

34 CHAPTER 2

2.3.4.5 Channel Configuration

It is important to let the sensing engine know which channels to measure. Fourconfiguration options are used to complete this target:

• numofchannel: specifies the number of channels to be measured

• firstchannel: the center frequency of the first channel

• channelwidth: the bandwidth of each channel

• channeloffset: the difference between adjacent channels’ center frequency

At this moment, software only allows to specify channels that are uniformlyspaced and with identical bandwidth. This format is flexible enough to describethe channel specifications of the most popular wireless standard. As an example, tomeasure the 13 channels of Wi-Fi in the 2.4 GHz range, the following settings areused: “–numofchannels 13 –firstchannel 2412000000 –channelwidth 22000000 –channeloffset 5000000”. The above options tell the sensing engine to measure 13channels, with the first channel starting at 2412 MHz, each channel is 22 MHzwide, the center of all the channels are 5 MHz apart. This feature makes it easy toconduct measurements for different technologies.

2.3.4.6 Output format

The output of the sensing engine contains the following components:

• timestamp: a unix timestamp in microsecond precision

• usrpid: the id of the USRP used to collect samples

• energy or duty cycle array: an array that contains either the energy (in dBm)or duty cycle (in percentage) for all channels of interest

In contrast to the raw spectrum measurements from spectrum analyzers and someUSB based devices, the output format can directly be used for channel assessment.

2.3.4.7 Resolution bandwidth and FFT size

The choice for RBW depends on the purpose of measurement. To capture thevariation in time domain accurately, sweep time should be minimized. From thisperspective, coarse RBW settings are desired. When using swept analyzer, thecenter frequency and RBW filter could be configured to coincide the width of theinterested channel, so that no more post processing such as integration is neededfor obtaining the energy in the targeted band. However, the RBW of FFT based so-lution is calculated as the sample rate divided by the FFT size. The final frequency

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 35

resolution is defined by the number of channels and the channel’s bandwidth. Sothe RBW does not directly rely on the FFT size. However, it is still necessary forthe RBW of the underlying FFT to be sufficiently smaller than the interested chan-nel bandwidth, otherwise the integration boundaries for the specified channel willbe less accurate. Similar to the Tektronix RSA analyzer, users can also directlyspecify the FFT size and sample rate independently in our solution.

2.3.4.8 Performance comparison with existing sensing solutions

Having introduced the various configurations for our solution, this section com-pares the performance of our spectrum analyzing solution with commercially avail-able devices. A summery is available in Table 2.2. A few things need to be kept inmind to understand this table:

• Firstly, we are comparing a broad range of devices. For a fair comparison,we need to fix one set of parameters and observ the remaining parameters.However, due to the fact that some devices are less flexible than others, itis not feasible to configure all devices so that they achieve exactly the samesettings. To resolve this issue, a simple rule is applied: the most flexibledevices are configured to have the same settings as the most inflexible de-vice. For our comparison, Airmagnet is the most inflexible device amongthe presented solutions. Therefore all other devices are configured to thesame settings as Airmagnet.

• Secondly, the performance parameters are not completely independent. Wealready stated the trade-off between frequency resolution and time resolu-tion, which applies to all devices. Another example is device-specific: forthe FSVR spectrum analyzer, the ratio of the span over RBW is predefined,depending on which FFT window is selected. In Table 2.2 this ratio is 400,when the Rectangular window is applied [26]. Therefore we need to decidewhich parameters are controlled and which parameters are observed. Forthis comparison, sensing efficiency was chosen as the primary observingparameter. The entire frequency span is chosen to be the major control-lable parameter, listed as “span” in Table 2.2. Real-time span refers to whatbandwidth the sensing engine can cover without performing sweeping, themaximum real-time span usually depends on the hardware capability of theplatform. It is listed here for completion.

• When a parameter is configurable, it is marked with the “∗” sign. The set-tings presented in Table 2.2 are just one set of configurations, readers areencouraged to check the reference materials for more details.

• The continuous FFT mode and swept FFT mode of the USRP sensing engine

36 CHAPTER 2

are listed as two separate entries: “USRPSE(cont)” and “USRPSE(swept)”.This way, it is possible to fully evaluate the capability of our solution.

• When certain settings are unavailable for a specific device, the setting clos-est to the Airmagnet configuration is listed in the table. For instance, thespan for FSVR analyzer is listed as 40 MHz in Table 2.2, because this is itsmaximum real-time span in FFT mode. The same reason applies for putting25 MHz as the span of the USRP sensing engine in continuous FFT mode.

• When certain parameters are independent of the sensing efficiency, the op-timal performance of that device is listed. For instance, the sweep time ofFSVR is listed as 100 µs which is the shortest sweep time the device canachieve, and the same applies to the sweep time of the USRP in continuousFFT mode.

• The sensing efficiency of the USRP sensing engine has been discussed inSection 2.3.4.3. The efficiency of Airmagnet is derived in Section 2.2.2.For Wi-Spy, the concept of sensing efficiency is not applicable, because itoperates purely in sweeping mode. The rest of the values are obtained fromthe corresponding reference material [26], [10], [9].

Table 2.2 demonstrates the performance advantages of our solution. The con-tinuous FFT mode of the USRP sensing engine is the only solution which is ca-pable of 100% sensing efficiency and long term recording at the same time. Theswept FFT mode offers 89% sensing efficiency under similar configuration of Air-magnet, which only provides 15% sensing efficiency. Although the sweep time ofour solution is longer than the best record of the (more expensive) FSVR spectrumanalyzer, it is still much faster than Airmagnet and Wi-Spy devices.

2.4 Experiments & Results

This section focuses on experimental analysis for the proposed solution. We firstdescribe the experiment platform in Section 2.4.1, and then we present two experi-ments in depth in Section 2.4.2,2.4.3. In both experiments, we use our sensing en-gine solution for detecting certain types of signal and evaluating the performance.The difference is that the first experiment uses Wi-Fi beacon frames as target sig-nal, while the second experiment uses regular Bluetooth traffic. The reason thatwe choose the Wi-Fi beacon is that it appears periodically at a fixed frequencyband, so it is a well-defined signal. Bluetooth on the other hand uses random fre-quency hopping, therefore is one of the most challenging signals to detect in theISM bands.

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 37

Table 2.2: Performance comparison with existing sensing solutions.

solu

tion

real

-tim

esp

ansp

anR

BW

effic

ienc

ysw

eep

time

reco

rdle

ngth

FSV

Rm

ax40

MH

z∗40

MH

z10

0kH

z∗10

0%10

0us

∗10

sA

irm

agne

tfix

ed20

MH

z83

MH

z14

0kH

z15

%1

sec

nolim

itW

i-Sp

ym

ax60

0kH

z∗95

MH

z32

8kH

z∗N

A16

5m

sno

limit

USR

P(co

nt)

max

25M

Hz∗

25M

Hz

48kH

z∗10

0%

500

us∗

nolim

itU

SRP(

swep

t)m

ax25

MH

z∗10

0M

Hz∗

48kH

z∗89

%1

sec∗

nolim

it

∗co

nfigu

rabl

epa

ram

eter

s

38 CHAPTER 2

Figure 2.7: USRP deployment in iMinds w-iLab.t testbed.

Within each experiment, we first introduce the characteristics of the target sig-nal, and then describe what settings are used on our sensing engine to detect thetarget signal, followed by measurements and thorough analysis.

2.4.1 The w-iLab.t testbed

The experiments are conducted on the w-iLab.t testbed [23]. The topology of thetestbed is shown in Figure 2.7, where the locations of the USRPs are highlightedwith yellow stars. Apart from USRPs, the majority of the devices in the w-iLab.ttestbed are embedded PCs equipped with Wi-Fi interfaces, IEEE 802.15.4 sen-sor nodes and Bluetooth dongles. All devices are reachable over a wired networkinterface for management purposes. Each device can be fully configured by theexperimenters. When the wireless devices are configured via the same embeddedPC, they are said to be attached to one “node”. The regular nodes are indicatedwith blue dots in Figure 2.7. The rich combination of heterogeneous technologiesis ideal for testing the proposed sensing solution. As mentioned before, two rep-resentative wireless signals are used to test the performance of our sensing engine— the beacon of an Wi-Fi access point (AP) and regular traffic between a pair ofBluetooth devices. The locations of the Wi-Fi AP and the Bluetooth devices usedfor experiments are indicated in Figure 2.7.

2.4.2 Wi-Fi Beacon experiment

The Wi-Fi beacon appears periodically on a fixed channel. According to the IEEE802.11b standard, a beacon frame is transmitted at 1 Mb/s, though its length isvariable, depending on several implementation factors. The exact packet size of

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 39

Frequency (MHz)

time

(ms)

2402 2404 2406 2408 2410 2412 2414 2416 2418 2420 2422

0

50

100

150

200

250

300

350

−75

−70

−65

−60

−55

Figure 2.8: Spectrogram of Wi-Fi beacon signal in continuous FFT mode.

the beacon frames in the experiment is obtained by packet sniffing, which is 134bytes. Hence one beacon transmission takes 134∗8bit

1Mb/s = 1.072 ms. The beaconsare transmitted on channel 1 and the beacon interval is set to 100 ms. As such,the channel will be occupied for about 1% of the time. This well-defined signal isconvenient to validate the channel occupation measurement.

2.4.2.1 Measurements using continuous FFT mode

In order to resolve beacon frames, the buffer size was set to 32768. Given thesample rate of 25 MHz, the sampling time is around 1.3 ms, comparable to thebeacon transmission time. The sensing engine was then configured to sense theWi-Fi channel with 1 MHz resolution bandwidth in the continuous FFT mode.

A spectrogram is the best way to show the seamless capturing of the Wi-Fibeacons. The recorded spectrogram is shown in Figure 2.8. During 400 ms, 4 bea-cons are transmitted and they are all captured with their full signal strength. Thisclearly demonstrates the advantage of seamless capturing. Note that the presentedspectrogram is only 400 ms long, in reality the period of this recording can beindefinite.

The above measurement with extremely fine time resolution is only neededfor visualization purpose, but is not required for channel assessment. In order toreduce the output per second while still being able to reflect the actual usage ofa channel, the channel duty cycle was measured with -70 dBm as the detectionthreshold. Note that -70 dBm is slightly above the noise level measured by theUSRP for Wi-Fi channels, which gives the best probability of detection based onour experience. There are many theories related to the energy detection thresholdin order to improve the probability of detection. In the context of our experiment,

40 CHAPTER 2

all the nodes are in line-of-sight topology, hence the detection threshold is notcritical. The complexity of determining the optimal energy detection threshold isout of the scope of this paper.

When the “spb” parameter is set to 16777216, the sampling time is around 0.67second. The sensing engine measures that the selected Wi-Fi channel is occupiedbetween 0.95% to 1.05%. This corresponds to the calculated duty cycle. Thereason of the 0.1% fluctuation is because the sampling time is not a multiple of thebeacon interval, hence the exactly number of detected beacons per buffer varies.This measurement demonstrates that our sensing engine is capable of seamlesscapturing and performing accurate channel occupation assessments.

2.4.2.2 Measurements in swept FFT mode

For the measurement in the swept FFT mode, all 13 Wi-Fi channels in the 2.4 GHzare measured. The “spb” parameter is increased by a power of 2, from 131072 to4194304. The spectrograms of 12 seconds are shown in Figure 2.9. Note thatat the time of this experiment, apart from our test beacon on channel 1, there isanother external access point active on channel 10. This paper focuses only on theanalysis of the beacon signal on channel 1.

First, as expected, when the “spb” value is small, the sensing engine uses ashorter sweep time, hence the thinner horizontal lines in the spectrogram. Sec-ondly, beacon signals are not always detected with full signal strength, the strongestsignal appears to be around -50 dBm, while the weakest yet still distinguishablesignal is around -65 dBm. This is because when using the swept FFT mode, thesampling is not continuous, sometimes only part of the beacon packet is captured,leading to inaccurate power measurement. This observation is illustrated in Figure2.10, where the number of occurrences for the energy above various thresholdsare plotted. In addition, the total number of sweeps in the recording is drawn as areference. We observe that with the growth of “spb”, the probability of detecting abeacon signal with full signal strength increases. When the sampling time is largerthan the beacon interval, in each buffer of samples, at least one complete beaconis captured, hence all beacons that has been captured are displayed with correctsignal strength. This observation reveals that, for the swept FFT mode, there isa trade-off between the sensing efficiency and time resolution. It is obvious thatdecreasing the buffer size can improve the time resolution, however, at the sametime, the channel switching time becomes more important compared to the totalsweep time, which results in worse sensing efficiency.

We conclude that the swept FFT mode can effectively expand the frequencyspan, which helps to give a global view of the spectrum. Despite the trade-off withthe sensing efficiency, the time resolution can be conveniently configured usingthe “spb” parameter.

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 41

sample per buffer 131072

time(

ms)

2 4 6 8 10 12

0

5000

10000

sample per buffer 262144

time(

ms)

2 4 6 8 10 12

0

5000

10000

sample per buffer 524288

time(

ms)

2 4 6 8 10 12

0

5000

10000

sample per buffer 1048576

time(

ms)

2 4 6 8 10 12

0

5000

10000

sample per buffer 2097152

802.11 channel index

time(

ms)

2 4 6 8 10 12

0

5000

10000

sample per buffer 4194304tim

e(m

s)

2 4 6 8 10 12

0

5000

10000

−75

−70

−65

−60

−55

802.11 Channel

802.11 Channel

802.11 Channel 802.11 Channel

802.11 Channel

802.11 Channel

Figure 2.9: Spectrogram of 13 Wi-Fi channels over 12 seconds in swept FFT mode, withvarious samples per buffer settings.

0 0.5 1 1.5 2 2.5 3 3.5 4 4.5

x 106

0

10

20

30

40

50

60

70

80

90

100

Number of samples per buffer

Sw

eep

coun

t

Total number of entriesdetected with threshold −70 dBmdetected entries with threshold −65 dBmdetected entries with threshold −60 dBmdetected entries with threshold −55 dBm

Figure 2.10: Number of detections with different threshold settings.

42 CHAPTER 2

2.4.3 Bluetooth experiment

The Bluetooth technology utilizes Frequency Hopping Spread Spectrum (FHSS)modulation. There are 79 Bluetooth channels in the 2.4 GHz ISM band, each chan-nel has a 1 MHz bandwidth [28]. A Bluetooth device hops to a different frequencyevery 625 µs. For the experiment, two nodes were paired with the Bluetooth in-terface. An unidirectional UDP traffic with 1 Mb/s throughput is generated fromthe application layer on top of the Bluetooth stack. The Bluetooth activity wasmeasured with a cooperative spectrum sensing system formed by 4 USRPs. EachUSRP operates in the continuous FFT mode, covers 20 Bluetooth channels, assuch in total 80 MHz bandwidth is observed. All the nodes and USRPs have aline-of-sight connection.

To be able to assemble the spectrum from different USRPs into one completespectrum covering all Bluetooth channels, we need to synchronize the systemclock of the servers connected to USRPs. This was achieved by using the Pre-cision Time Protocol daemon (PTPd) [29]. PTPd allows computers within a localarea network to keep their clock synchronized to a common clock source, com-monly referred to as the master clock. In our system, the clock of server 1 isthe master clock. After some time, the offset from master to slave starts to set-tle down to around 30 µs. As each Bluetooth transmission slot lasts for 625 µs,the clock drifting is relatively small (5%) compared to the Bluetooth transmissiontime, hence will allow us to identify the packets correctly.

The experiment is conducted via the OMF framework, where a central scriptis executed to make sure all USRP sensing engines start at the same time. Thetime resolution is adjusted to 655 µs to better resolve the Bluetooth activity. Sinceall servers are synchronized to server 1, the timestamp from server 1 was used toderive the relative timestamp. The resulting spectrogram is shown in Figure 2.11.It is possible to observe short 1 MHz wide Bluetooth activities spread over thespectrum space. Additionally, it can be seen that there is no Bluetooth activitybetween 2423 MHz to 2446 MHz. In recent implementations, Bluetooth does notnecessarily use all the channels. As an example, the Adaptive Frequency Hopping(AFH) mechanism exclude channels with bad communication quality from thechannel list [30].

In conclusion, this measurement demonstrates the possibility to form a dis-tributed and cooperative sensing system with our sensing engine. The result canbe used to identify Bluetooth activity in the wireless spectrum.

2.5 Conclusions & Future work

In this paper we first presented a brief survey of various spectrum sensing solu-tions. We argue that continuous spectrum sensing is important for channel occu-

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 43

Frequency (MHz)

Tim

e (m

s)

2410 2420 2430 2440 2450 2460 2470 2480

0

200

400

600

800

1000

1200 −90

−85

−80

−75

−70

−65

−60

−55

−50

−45

−40

Figure 2.11: Probability of interception in sweep mode

pation assessment. However, a sensing engine capable of continuous sensing withsufficient flexibility is still missing amongst today’s sensing solutions.

To close this gap, we developed a new sensing engine based on a commercialSDR platform. Compared to most low cost sensing solutions, our solution providesmuch more flexibilities in terms of configuration. The most important feature isits capability of seamless capturing and long term recording. The implementa-tion is based on several open source libraries supported on major platforms. Thismakes our solution transparent and being able to run on a broad range of operatingsystems. Additionally, our solution can easily be extended into cooperative anddistributed sensing systems, as described in Section 2.4.3.

The solution we proposed relies on a standard PC for processing. On onehand, this makes it ideal for fast prototyping and development. On the other hand,it makes the solution less portable and not able to work in a stand-alone situation.How to migrate the software computational capability to an embedded platform isone of the remaining challenges. The basic idea is to shift the processing load fromsoftware to hardware. In this way, it will not require extensive processing poweron an embedded system.

The pipelined software architecture and seamless spectrum sensing functional-ities can be ported to an FPGA chip with minor effort, because independent hard-ware blocks works in parallel intrinsically. There exists a large amount of tools fortranslating software functionalities into hardware [31], [32], but attention shouldbe paid to issues such as processing time, power consumption etc. This is one ofthe on-going activities for future extension.

44 CHAPTER 2

AcknowledgmentThe research leading to these results has received funding from the EuropeanUnion’s Seventh Framework Programme FP7/2007-2013 under grant agreementsn 258301 (CREW project).

SPECTRUM SENSING WITH PARALLEL PROCESSING BASED ON SDR 45

References

[1] QoCON project. Available from: http://www.iminds.be/en/projects/qocon.

[2] Faramir project. Available from: http://www.ict-faramir.eu/.

[3] S. Haykin. Cognitive radio: brain-empowered wireless communications. Se-lected Areas in Communications, IEEE Journal on, 23(2):201–220, 2005.

[4] A. T. Hoang and Y.-C. Liang. Adaptive scheduling of spectrum sensing peri-ods in cognitive radio networks. In Global Telecommunications Conference,2007. GLOBECOM’07. IEEE, pages 3128–3132. IEEE, 2007.

[5] S.-C. Chen, C.-J. Chang, and R.-H. Gau. A two-phase and two-period spec-trum sensing scheme using high-layer information for cognitive radio net-works. In Computing, Communications and Applications Conference (Com-ComAp), 2012, pages 250–255. IEEE, 2012.

[6] S. Pollin, L. Hollevoet, P. Van Wesemael, M. Desmet, A. Bourdoux,E. Lopez, F. Naessens, P. Raghavan, V. Derudder, S. Dupont, et al. An inte-grated reconfigurable engine for multi-purpose sensing up to 6 GHz. In NewFrontiers in Dynamic Spectrum Access Networks (DySPAN), 2011 IEEESymposium on, pages 656–657. IEEE, 2011.

[7] E. Buracchini. The software radio concept. Communications Magazine,IEEE, 38(9):138–143, 2000.

[8] Tektronix. Fundamentals of Real-Time Spectrum Analysis, 2009.

[9] How Wi-Spy Works. Available from: http://blogs.metageek.net/blog/2011/01/how-wi-spy-works/.

[10] Fluck Corporation. AnalyzerAir User Manual, 2 edition, 2006.

[11] T. Sky. Ultra low power IEEE 802.15. 4 compliant wireless sensor module.Moteiv Corporation, 2006.

[12] Zolertia. Available from: http://zolertia.io/product/hardware/re-mote.

[13] C. Heller, S. Bouckaert, I. Moerman, S. Pollin, P. Van Wesemael, D. Finn,D. Willkomm, and J. Hauer. A performance comparison of different spec-trum sensing techniques. In Wireless Innovation Forum 2011: Europeanconference on Communications Technologies and Software Defined Radio(WinnComm 2011), 2011.

[14] Ettus Research. Available from: http://www.ettus.com/.

46 CHAPTER 2

[15] USRP RF daughter boards. Available from: https://www.ettus.com/product/category/Daughterboards.

[16] Universal Hardware Driver (UHD). Available from: http://files.ettus.com/manual/page uhd.html.

[17] GNU Compiler Collection (GCC). Available from: http://gcc.gnu.org/.

[18] GNURadio. Available from: http://gnuradio.org/redmine/projects/gnuradio.

[19] PowerPC processor. Available from: http://titancity.com/articles/ppc.html.

[20] WARP. Available from: http://warpproject.org/trac.

[21] Boost library. Available from: http://www.boost.org/.

[22] FFTw library. Available from: http://www.fftw.org/.

[23] S. Bouckaert, P. Becue, B. Vermeulen, B. Jooris, I. Moerman, and P. De-meester. Federating wired and wireless test facilities through Emulab andOMF: the iLab. t use case. In Testbeds and Research Infrastructure. Devel-opment of Networks and Communities, pages 305–320. Springer, 2012.

[24] T. Rakotoarivelo, M. Ott, G. Jourjon, and I. Seskar. OMF: a control andmanagement framework for networking testbeds. ACM SIGOPS OperatingSystems Review, 43(4):54–59, 2010.

[25] Wireshark packet sniffer. Available from: http://www.wireshark.org/.

[26] Rohde & Schwarz. FSVR Real-Time Spectrum Analyzer Specifications, 2010.

[27] D. Vassis, G. Kormentzas, A. Rouskas, and I. Maglogiannis. The IEEE802.11 g standard for high data rate WLANs. Network, IEEE, 19(3):21–26,2005.

[28] Bluetooth standard. Available from: https://www.bluetooth.com/.

[29] Precision Time Protocol daemon. Available from: https://github.com/ptpd/ptpd.

[30] M. C.-H. Chek and Y.-K. Kwok. On adaptive frequency hopping to combatcoexistence interference between Bluetooth and IEEE 802.11 b with practicalresource constraints. In Parallel Architectures, Algorithms and Networks,2004. Proceedings. 7th International Symposium on, pages 391–396. IEEE,2004.

[31] Berkeley Design Technology. The AutoESL AutoPilot High-Level SynthesisTool, 2010.

[32] Xilinx. Vivado Design Suite User Guide, 2014.

3Heterogeneous spectrum sensing:

challenges and methodologies

In the previous chapter, a dedicated sensing engine is designed to optimize thesensing performance in the time domain. In this chapter, we continue our ex-ploration of energy based spectrum analysis, by examining the methodologies tocombine and compare multiple heterogeneous sensing solutions. The driving forceof this study is the need to achieve sufficiently reliable sensing measurement overa large space, while keeping the investment reasonably small.

? ? ?

W. Liu, M. Chwalisz, E. De Poorter, C. Fortuna, J. Hauer, D.Pareit and I. Moerman

Published in EURASIP Journal on Wireless Communications and Network-ing 2015.1 (2015): 1-15.

Abstract Distributed sensing is commonly used to obtain accurate spectral infor-mation over a large area. More and more heterogeneous devices are being in-corporated in distributed sensing with the aim of obtaining more flexible sensingperformance at lower cost. Although the concept of combining the strengths ofvarious sensing devices is promising, the question of how to compare and combinethe heterogeneous sensing results in a meaningful way is still open. To this end,

48 CHAPTER 3

this paper proposes a set of methodologies that are derived from several spectrumsensing experiments using heterogeneous sensing solutions. Each of the solutionsoffers different radio frequency front-end flexibility, sensing speed and accuracy,and varies in the way the samples are processed and stored. The proposed method-ologies cover four fundamental aspects in heterogeneous sensing: (i) storing exper-iment descriptions and heterogeneous results in a common data format; (ii) copingwith different measurement resolutions (in time or frequency domain); (iii) cali-brating devices under strictly controlled conditions; (iv) processing techniques toefficiently analyse the obtained results. We believe that this paper provides an im-portant first step towards a standardized and systematic approach of heterogeneoussensing solutions.

3.1 Introduction

It has been shown that licensed spectrum is often underused in time and space. Asa concrete example, a 6-day measurement campaign in multiple cities of Europeindicates that the Ultra High Frequency (UHF) Television (TV) bands are less than62.2% utilized [1]. In order to improve spectrum usage, the research communityproposed the concept of Cognitive Radio (CR) [2, 3], which offers a mechanismfor unlicensed users (i.e. secondary users) to use the licensed spectrum in theabsence of the primary users. There are two fundamentally opposite approaches todetermine whether the primary user is active. In the first approach, the secondaryuser senses the spectrum [4] to decide whether it is available or not; while inthe second approach, a geo-location database built upon information of primarytransmitters and radio propagation models is accessed in order to locate spectrumopportunities [5]. The first approach tends to be less accurate while the second hasdifficulties adapting to dynamic scenarios. More recently, also hybrid geo-locationdatabases have been considered to improve accuracy [6].

While initially the Federal Communications Commission (FCC) only allowedopportunistic access to licensed spectrum via the geo-location database approach,in a recent revision, requirements for devices relying solely on spectrum sensinghave been included in the FCC regulation1. The new regulation states that sensingdevices must demonstrate a very high degree of confidence to avoid interferingwith the incumbents, and they must meet the minimum sensitivity requirementsfor several types of primary signal (i.e. -114 dBm for analog and digital TV signaland -107 dBm for low power auxiliary).

Currently, mainly due to cost considerations, these constraints are hard to sat-isfy for commercial devices. Fortunately, the lack of individual sensitivity canbe compensated by using cooperative sensing with multiple sensing devices [7].

1http://www.fcc.gov/encyclopedia/rules-regulations-title-47

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 49

These sensing devices can be installed as part of the infrastructure for the solepurpose of spectrum sensing [8], or existing user devices can be involved throughcrowdsourcing approach [9]. In both cases, the devices involved in the collabo-rative spectrum sensing are likely to be heterogeneous, thus performing hetero-geneous spectrum sensing. Unlike spectrum sensing using homogeneous devices,heterogeneous sensing is more challenging due to the fact that it involves high tolow-end sensing devices and their corresponding approaches to process or storethe results. More particularly, heterogeneous spectrum sensing experiments arefaced by the following challenges:

Storage format Spectrum sensing devices may record data in different formats.Each type of device has its own way of logging data, which could be plain text, ordifferent types of binary formats. Apart from the format of actual measurements,the lack of common configuration and well-defined meta information makes it hardto initialize the measurements and interpret the results. Therefore we need a uni-form and well-structured storage mechanism for heterogeneous sensing devices.

Measurement resolution In addition, measurements from heterogeneous de-vices may have different resolutions in time and frequency domains. Considerthe following example: two devices (A and B) are both monitoring the same rangeof spectrum; device A measures the power spectrum with a 1 MHz resolutionbandwidth updating each second, while device B measures with a resolution band-width of 10 kHz at the rate of two times per second. Obviously it is not possibleto directly compare or combine the results from A and B. When dealing with theoutput from heterogeneous devices, the situation in the above example often oc-curs. Thus, we need a method to obtain a common resolution before a meaningfulcomparison or combination of the heterogeneous data sources can be made.

Calibration Some devices, particularly the low-end ones, may be uncalibrated.Simple wireless devices typically provide the spectrum information using the ex-isting channel assessment module for the purpose of wireless Medium AccessControl (MAC). For MAC purposes, the output of the channel assessment moduleis used within the device, thus it only needs to be relatively correct, rather thanabsolutely. However, for the purpose of heterogeneous spectrum sensing, it is im-portant that sensing results are produced against a common reference, hence thereis a need for calibration. Though most high-end devices are calibrated individuallyby their manufactures, a uniform calibration process is still desired in case thereare noticeable differences in the factory calibration process or even individual dif-ferences among the same type of devices. For instance, prior to experiments, theauthors in [10] calibrate the internal noise level of multiple radio receivers of thesame type in a shielded environment. However, this approach cannot be used to

50 CHAPTER 3

calibrate heterogeneous devices, as internal noise level is one of the primary het-erogeneities among devices. In conclusion, there is a need for a uniform calibrationmechanism for heterogeneous spectrum sensing.

Processing methods Due to the use of different devices and complex experimentscenarios (i.e. distributed measurements, multiple iterations), heterogeneous spec-trum sensing usually generates a large amount of data. Efficient processing meth-ods are crucial to reach an objective conclusion in a reasonable amount of time.Although for certain performance metrics, well-accepted processing approachesexist, most of the time, it is not feasible to pursue a uniform processing mecha-nism for all experiments. A more pragmatic way is to simply make use of existingmethods when applicable. Thus, we believe there is a need to share experiencesrelated to processing heterogeneous data.

In this paper, we identify the challenges and discuss the methodologies of het-erogeneous spectrum sensing regarding to the following aspects: storage format,measurement resolution, calibration and processing methods. First, we proposea common data format for uniformly defining experiments and storing the results.Then we provide a set of methodologies regarding to measurements resolution, de-vice calibration, and data processing, which are implemented, validated and eval-uated on reference scenarios. Thus the main contributions of this paper are: thecommon data format, the methodologies, the validation and the evaluation.

The remainder of this paper is structured as follows: first, the related work isdiscussed in Section 3.2; after that, Section 3.3 describes the proposed method-ologies regarding to the aforementioned four challenges, while the performanceof these methodologies are verified with concrete implementations and real-lifeexperiments in Section 3.4. Finally we conclude this paper in Section 3.5.

3.2 Related work

This section gives an overview of related work for heterogeneous spectrum sens-ing. The following aspects are discussed: (i) the storage format, (ii) the measure-ment resolution, (iii) calibration methods and (iv) processing mechanisms.

3.2.1 Storage Format

The IEEE 1900.6 standard [11] defines spectrum sensing related parameters anddata structures, and as such may be considered as a guideline of data storage forspectrum sensing. Since this is also the main interest of our work, the terminolo-gies available in this standard have been considered and used whenever applicable.In comparison, the Internet Engineering Task Force (IETF) Protocol to Access

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 51

White-Space (PAWS) standard [12] is limited to the communication among TVwhite space devices and databases, thus it is less relevant to the challenges identi-fied in this paper.

Apart from existing standards, the authors in [13, 14] use heterogeneous spec-trum sensing to construct a Radio Environment Map (REM), which includes a ded-icated spectrum data server to collect heterogeneous sensing data. After the datacollection phase, the server fusion interface is used to communicate with otherprocessing units. It has been shown that the approach of splitting the storage andprocessing units performs well in real experiments and can be easily adapted aspart of the existing Long Term Evolution (LTE) network [15]. This work general-izes prior contributions such as [13, 14] in terms of data representation by using adata model that uses existing standards and, at the same time, is machine readable.The provided tools for common data storage focus on low level spectrum data andare not optimised for a particular application.

3.2.2 Measurement resolution

Measurement resolution is an important indication of the sensing capabilities of adevice. Advanced sensing devices usually have more flexibilities for configuringwhich resolution to use for the measurements.

A straightforward way to achieve a common resolution is to use common con-figurations at the measurement time (e.g. choose a resolution bandwidth that isavailable on all devices) [16]. When no common setting is available among theconsidered devices, the authors in [16] determine the settings for each device byperformance (e.g. choose a sweeping pattern or detector type after a number ofinitial trial measurements). While this approach is practical and reasonable, it isnot clear how experimenters can obtain data with common resolution for furtherprocessing when no common settings are available.

The authors of [17] use experimental measurements to illustrate how the choicesof measurement resolutions can influence the detection performance. However, themethodologies discussed in [17] do not take heterogeneous devices into account.In contrast, this paper proposes a post processing approach to derive data withcommon resolutions regardless of the settings chosen at the measurement time.

3.2.3 Calibration

As described in the previous section, the internal noise level used in [10] is not anideal metric for calibrating heterogeneous sensing devices, because it is expectedto be different. The authors of [7] propose to use satellite band signals for co-operative sensing devices to identify shadow effects. Since satellite signals haverelatively constant strength over a wide area, devices that receive weaker satellite

52 CHAPTER 3

signals have a higher probability to be shadowed by obstacles. Though this solu-tion is not directly related to calibration, the idea of using satellite band signals asreference could be used to calibrate devices in outdoor measurements. In general,for the calibration of heterogeneous devices, a known and constant power levelis needed as input reference [13, 14]. This is also the main principle of calibra-tion followed by our previous work [18]. Apart from a stable reference signal,calibration experiments need to be strictly controlled. In this paper, we share ourexperience of using coaxial-cable based experiments to achieve accurate calibra-tion solutions.

3.2.4 Processing methods

Unlike the previous challenges, the processing mechanism is very experiment spe-cific. For energy detection, the magnitude of the complex samples is calculatedto represent the received signal strength. Alternatively the magnitude of the out-put from the Fast Fourier Transform (FFT) could be used instead of time domainsamples [13, 14]. For the purpose of detection performance, a Receiver OperatingCharacteristic (ROC) plot is often used to observe the device’s sensitivity undervarious input conditions. The work in [13, 14] goes one step further by using theInverse Distance Weighting (IDT) technique to interpolate discrete energy mea-surements into a REM. Though it is not feasible to have a uniform processingapproach, we believe there is a need to share processing experience in order toimprove the efficiency.

3.3 Methodologies for realizing heterogeneous sens-ing

This section describes the methodologies for realising heterogeneous sensing withrespect to the challenges identified in the Introduction.

Conceptually, we propose the following workflow for heterogeneous spectrumsensing (see Figure 3.1). The initial phase for performing sensing experimentsconsists of configuring the heterogeneous devices, sending them the instructionsfor starting the sensing, and collecting the data. This involves creating a seriesof device specific scripts. As one of the contributions of this paper, we propose auniform way of providing the configuration to the devices and storing the data fromthe devices. We use a Common Data Format (CDF) for experiment description anddata storage that is device independent and machine readable. Spectrum sensingdescriptions and settings are defined using this common data format as depictedin Figure 3.1. In the first step, these uniform descriptions are then converted intodevice (or testbed/infrastructure) specific configurations and control scripts. Inthe second step, the results of the experiments are transformed into a common

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 53

Figure 3.1: Conceptual workflow towards heterogeneous spectrum sensing. (i) UniformCDF experiment descriptions are translated into device specific configuration scripts. (ii)

The collected results are converted into a common data format. (iii) The results are furtherprocessed based on the common data formant.

representation format. As the third and final step, the resulting uniformly describeddata is further processed by a set of tools to align the resolution, achieve calibrationand compute spectrum occupancy related metrics.

It should be noted that, the information needed in the calibration phase comesfrom separate experiments, which will be denoted as calibration experiments inthe remaining part of the paper. Calibration experiments are not necessarily partof every experiment iteration, but it should be at least performed once before thereal sensing measurements start.

3.3.1 Common data format

The proposed common data format has been developed to ease spectrum sensingexperimentation across devices and testbeds and contains three main parts. Thefirst part refers to the description of the experiment abstract, the second part refersto the spectrum sensing experiment, thus the so-called meta-data. The third partfocuses on the actual traces resulted from the experiment.

The experiment description provides a detailed description of the experiment,such as how it was performed and what kind of data was collected. From the toplevel, the description contains the following fields: experiment abstract, meta-information and experiment iteration(s). Below each field (except for experi-ment abstract), some sub fields are defined, as shown in Figure 3.2.

3.3.1.1 Experiment abstract

The experiment abstract is a high level description of the experiment, providinga basic idea of the experiment motivation, as well as the the expected output. It

54 CHAPTER 3

Figure 3.2: The architecture of the CDF. (i) experiment abstract, (ii) meta information and(iii) experiment iterations containing data traces.

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 55

is possible to relate to other experiments by adding relevant information. For in-stance, when experiment B is a scaled extension of experiment A, the followingsentence “repetition of experiment A on a larger scale” can be noted in the abstractof experiment B. In addition, we provide means to link to related documentations,such as publications that are based on a given experiment.

3.3.1.2 Meta-information

The meta-information is the information required for describing, understanding,and evaluating the experiment. All experimental details except the data itselfshould be described in this field. The most important items are: the descriptionof involved devices, physical setup of the experiment, the selected signal type andfrequency, as well as the description of the measurements.

The description of the involved devices is critical to reproduce the experiment.It should not be limited to only textual description, but also provide referencesto the relevant data-sheets. Moreover, we recommend to include information ofrelated software, and if necessary the operating system. The bottom line is that thecollected information must suffice to repeat the experiment from scratch, startingfrom finding the same devices to setting up the identical software environment.

The physical experiment setup mainly refers to the description of how devicesare positioned and connected. Ideally, there should be a location map to indicatethe topology of the devices. Wireless experiments are sensitive to environmentalfactors, such as if an experiment is conducted indoor or outdoor, or if an experi-ment is conducted under static or rather dynamic environment. Thus we recom-mend to document this information in the meta-information as well.

Furthermore, the operating frequency and the characteristics of the used signalsare noted as additional parameters. This creates a convenient way of indexingthe existing experiments, e.g., one can easily find all sensing experiments in theTV white space. Thus, it allows experimenters to reuse past experiments moreefficiently.

Finally, the measurement description contains a common description of therecorded data of all the experiment iterations, allowing experimenters to under-stand and process the data more smoothly. It specifies the configuration used byeach device (e.g.: gain settings, sample frequency) and the collected data types(e.g.: frequency, signal power, timestamp). In addition, each data type is associ-ated with a measurement unit (e.g.: Hz, dBm, µs). For more information related todefining measurement units, readers are referred to the IEEE 1900.6 [11] standard.

3.3.1.3 Experiment iteration(s)

The experiment iteration provides information that is related to the execution ofa particular round of experiments. There are two sub fields in each experiment

56 CHAPTER 3

iteration: the trace description and the trace file reference. The trace descriptionis similar to the description in the meta-information, but may extend or refinethe meta-information partially if necessary, as shown by the red line in Figure3.2. For instance, if a set of measurements is used to compare the influence ofdifferent Radio Frequency (RF) front-end gain settings, trace description is an idealplace to indicate what gain setting is used in each experiment iteration. This way,different settings among experiment iterations can be highlighted without the needof describing the entire experiment setup over and again. The trace file reference isa “pointer” towards the measurement data, which indicates where the measurementtrace is physically stored. A reference implementation of the CDF architecture ispresented in Section 3.4.1.

3.3.2 Measurement resolution

Typically, one spectrum sensing trace cannot be directly compared to another, dueto the differences in frequency and/or time domain. To overcome the heteroge-neous frequency resolution, the easiest and most straightforward approach is tointegrate the Power Spectral Density (PSD) in a certain frequency interval anduse the integrated power as the metric for comparison. This also implies that theselected interval for integration needs to be wider than the largest resolution band-width among all the sensing solutions.

There are different approaches to overcome the differences in time resolution.The easiest way is to apply averaging on the traces obtained in the same time du-ration. Alternatively, instead of using averaging, one can apply max-hold filtering,so the combined trace contains every transient signal that ever appeared in the ob-servation period. By using integration in the frequency domain, and averaging ormax-holding in the time domain, a common metric is derived from various rawspectra, which is referred to several times in the remainder of the paper. We pro-vide a reference implementation of this processing scheme in the CDF toolbox(pw integration function) .

3.3.3 Calibration

Calibration of heterogeneous devices essentially means comparing the receivedpower of each device to its corresponding input signal strength. The calibrationprocess consists of four steps. First, a set of reference signals has to be selected.Second, the path loss between the signal source and the devices under calibrationmust be strictly controlled. Third, a suitable metric for performing the calibrationhas to be identified and fourth, the offset between the reference signal and thesignals received by the devices has to be computed.

For the first step, it is generally advisable to use a set of diversified input signals(i.e., different bandwidth and signal strength) so that the calibration experiment is

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 57

general enough to cope with different types of input. Also the generated signalneeds to be continuous so that the recorded signal has a constant amplitude. Thisensures that the sensing performance in terms of timing does not affect the perfor-mance in terms of power accuracy. The produced signal strength needs to be tunedwithin the dynamic range of all devices. If the signal is too strong, it may saturatethe device under calibration, on the other hand, when it is too weak, the signalmight be buried by noise. Both situations should be avoided. Ideally, a high-endsignal generator should be used as the signal source to meet the above constraints.

For the second step, the most at-hand method is to use a coaxial cable forcontrolling the path loss between the signal source and the sensing devices. Analternative way would be to use an anechoic chamber where the path loss is notaffected by the multi-path effect.

In the third step, the received signal strength needs to be calculated from thepower spectral density, which comes down to performing integration over the inter-val where the signal is transmitted in frequency domain. If the integration intervalis not the same as the signal bandwidth, the obtained metric will rely partially onthe device’s noise floor instead of solely on the input signal, thus, not qualified forpower calibration.

Finally in the fourth step, the power offset is then computed according to Equa-tion 3.1, where the transmit power is denoted as Ptx, the received power is denotedas Prx, and the total attenuation caused by coaxial cables and splitters is denotedas Patten:

Poffset = Ptx − Patten − Prx (3.1)

In Equation 3.1, Poffset accounts for the combined heterogeneity of the RFfront-end, Analog-to-Digital Converter (ADC) and the processing unit. However,it does not include the influence of the antenna, as the antenna is replaced by thecoaxial cable connections. For devices using different types of antenna, the poweroffset needs to be readjusted with the antenna gain.

If the relative position of the transmitter and receiver is known, the influenceof the radiation pattern should also be taken into account. For omnidirectionalantenna, the radiation pattern changes with the elevation angle between the trans-mitter and receiver; while for directional antenna, the radiation pattern varies withboth horizontal and vertical angles [19]. When the relative position of transmitterand receiver is unknown, it is necessary to rotate the directional antenna severaltimes to cover the 360 [17].

In some cases, Poffset varies with the input signal strength and the settings ofthe sensing device (i.e., gain settings). For instance, it is mentioned in [14] that theRFX2400 daughter-board of USRP does not have a linear Input and Output (IO)relationship. In this case, more measurements need to be performed to cope withdifferent input signal strength and sensing configurations.

58 CHAPTER 3

3.3.4 Processing

Sensitivity and accuracy are two important metrics to compare spectrum sens-ing devices. For heterogeneous sensitivity analysis, experimenters tend to form amainstream processing style, which is discussed in the first part of this section. Asfor power accuracy, generally a high-end device (i.e. spectrum analyzer) is usedas benchmarker in various measurements. However, when it comes to large scaleheterogeneous measurements, this approach becomes very tedious. Thus there isa need to process data in a more elegant approach, which is what we discuss in thesecond part of this section.

3.3.4.1 Heterogeneous sensitivity analysis

The sensitivity of a sensing device is reflected by its noise floor. Unlike poweraccuracy, sensitivity cannot be evaluated by the common metric derived in Section3.3.2. This is because the noise floor is affected by the resolution bandwidth, thusthe integrated power metric will always be higher than the original noise floor.

The most straightforward way is to observe the mean and variance of the spec-trum trace when no signal is present. Alternatively, we can also use the receiveroperating characteristic. The ROC is obtained by expressing the probability ofdetection (Pd) as a function of the probability of false alarm (Pf ). Some papersutilize the probability of missed detection (Pm) which is simply given by 1− Pd.Despite of the heterogeneity in power spectra, ROC can be obtained via a commonapproach:

• Record spectrum traces when no signal is present.

• Vary Pf from 0% to 100 % in small steps and determine a detection thresh-old for each Pf based on the previously recorded trace.

• Apply a signal at the input of the sensing device and record spectrum traceagain.

• Compute Pd or Pm for all the detection thresholds determined in the secondstep from the trace recorded in the previous step

The advantage of ROC analysis is that it is device independent, as for a givenfalse alarm, each device can have its own threshold. The only constraint is that thedetection threshold should be calculated in an uniform approach for all devices.This is why it is commonly applied in the heterogeneous sensitivity studies [13,14, 18].

As for the method to obtain detection threshold, there are many optimizedvariants [20–22]. As an example, the Constant False Alarm (CFA) approach [10]is described in Euqation 3.2, where σn denotes the variance of the noise samples,

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 59

N denotes the number of spectrum samples, Pf denotes the target false alarm andλ denotes the calculated detection threshold respectively.

λ = σ2n(1 +

Q−1(Pf )√N/2

) (3.2)

3.3.4.2 Heterogeneous accuracy analysis

As stated previously, distributed heterogeneous measurements usually generate alarge amount of data, which need more efficient processing mechanisms. Whenprocessing a large dataset, the basic approach is to look at how the data is dis-tributed, which can be achieved by computation of several statistics (i.e., mean,variance). However, to gain more insights of the data (i.e., discover a commonbehaviour, or a group of data that displays similarity within the entire set), thenmore advanced techniques, such as correlation, possibly also linear regression al-gorithms need to be involved. Essentially, we recommend to use the basic tech-niques of data mining for analysing large scale heterogeneous sensing experi-ments, among which four most relevant techniques are exemplified as follows:

• Dependency modelling — the establishment of relationships between vari-ables. This could be that the detection probability depends on the targetsignal strength, or the distance between the transmitter and the sensing de-vice.

• Outlier detection — the identification of the unusual spectrum records, whichcould be caused by malfunctioning devices or other unknown interferences.

• Regression — is a statistical way to explore the relationship among variableswhich models the data with the least error.

• Clustering — is the task of discovering groups and structures in the datathat are in one way or another “similar”. For instance, in case of spectrumsensing, a group of sensing devices are shadowed by a common obstacle.

The outlier detection is a rather basic step, which can be achieved by manystatistical tools or simply manual observations. The procedure of “Clustering” and“Regression” are addressed with a concrete experiment in Section 3.4.4. For thedependency modelling, we find that the path loss model (the relationship betweenreceived signal strength and distance) is generally applicable for dependency mod-elling in the case of distributed sensing measurements. More particularly, the wellknown log-distance path loss model can be expressed by two parameters — thepath loss coefficient exponent α and the path loss offset β2:

PL(d) = 20× α× log10(d) + β (3.3)2β is normally distributed, denoted as N(0, σ), σ is environment dependent

60 CHAPTER 3

where d is the distance between the transmitter and the receiver. When usingthe logarithmic distance as the argument, the equation reduces to a simple linearexpression. Hence various approaches, such as least square regression, can be usedto estimate α and β.

The role of the path loss model is essentially a way to extract new parametersout of the raw data sets. It is a tool to correlate data from distributed locations.Although deriving the path loss model is not always easy or feasible, the basic ideaof correlating data to extract new parameters is generally applicable and highlyvaluable in our experience.

3.4 Reference implementation and experimentation

This section first presents the implementation of the common data format in Sec-tion 3.4.1, and then illustrates how to apply the methodologies defined in the pre-vious section with real-life experiments. More specifically, Section 3.4.2 describesa calibration experiment, which uses the method proposed in Section 3.3.2 to over-come the different measurement resolutions and then obtains the power offset fol-lowing the mechanisms proposed in Section 3.3.3. Section 3.4.3 and 3.4.4 presenttwo experiments that use the processing techniques discussed in Section 3.3.4 toevaluate two fundamental sensing performance metrics (sensitivity and accuracy)respectively.

3.4.1 Common data format implementation

The reference implementation of the CDF architecture consists of three parts: theCDF experiment description, the CDF data structure for common storage, and theCDF toolbox for additional functionalities such as conversion between formats andresult analysis.

3.4.1.1 CDF experiment description

The CDF experiment is described in Section 3.3.1 and can be easily translated intomodern markup languages such as XML and JSON. We made a design choice touse XML because (i) it can be read and processed by a large set of tools, and (ii) itis internally used by OMF — a testbed cOntrol and Management Framework [23]which is widely adopted by many modern wireless testbed facilities [24, 25]. Thegoal here is to ensure that the CDF experiment description can be easily translatedto testbed/device specific implementations. Additionally, we provide an XMLschema3 to validate the semantic correctness of an experiment description.

3Available at http://www.crew-project.eu/repository/

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 61

3.4.1.2 CDF data structure

The CDF data structure is one of the formats that the trace file field in the CDFexperiment description can reference to, it is meant to be a starting point whereusers can easily load data from different devices. The content of the CDF datastructure is illustrated below:

p = Common data format structurep.Name = Unique identifier of the sensing devicep.Location = Location of the sensing device (m)

e.g [x,y,z]p.CenterFreq = Array of center frequencies

corresponding to the columns ofthe power matrix (Hz)

p.BW = Bandwidth around each centerfrequency (Hz)

p.Tstart = Start time of the measurement in datestrformat e.g. ’24-Jan-2003 11:58:15’

p.SampleTime = Array of timestamps relative toTstart (s) corresponding to rows of thepower matrix (Hz)

p.Power = Matrix containing power measurements(dBm) row contains all frequencies forone timestamp

For FFT-based sensing devices, defining both “BW” and “CenterFreq” is un-necessary. However, for pure sweeping-based sensing devices, the resolution band-width depends on the width of the band pass filter at the RF frontend, which is notnecessarily the same as the distance between the consecutive RF center frequen-cies. Therefore, both fields are included in the data structure so that it is suitableto store results from all types of sensing devices.

The field “Location” is included in both the CDF experiment description andthe CDF data structure, because it is not only important as “meta-information”,but also needed in various types of calculations. Note that, the device location in“meta-information” is a description of the general experiment topology, while inthe CDF data structure, it has to be expressed in coordinates.

The remaining fields of the CDF data structure are self-explaining, hence omit-ted from further explanations.

3.4.1.3 CDF toolbox

The CDF toolbox is a set of functions implemented in Matlab to support the usageof the CDF data structure. We choose Matlab as the programming environment

62 CHAPTER 3

because it is powerful in matrix processing and widely used among researchersand academists. The most often used functions are listed below:

• The create structure function extracts information from the inputspectrum trace, and store the data in the CDF data structure.

• The pw integration computes the power of a certain frequency bandby integrating the PSD over the corresponding interval. It takes three inputparameters — the spectrum trace in the CDF data structure, the begin and theend of the frequency interval, and produces the integrated power as output.

• Several plotting and analysis tools are implemented based on the fields ofthe CDF data structure, which makes the CDF more attractive from practicalpoint of view.

Sample scripts of the CDF toolbox are made available online4. The scripts arecurrently only developed for devices used in the CREW5 project. However, theycan serve as valuable examples for other devices, given the fact that the existingexamples already cover a large variety of sensing devices and data formats. Al-though it is not yet a full-fledged toolbox for heterogeneous sensing analysis, webelieve it is one step towards the support of heterogeneous devices.

3.4.2 Calibration and resolution

This section first gives an overview of the devices involved in the experimentalevaluations of the entire Section 3.4, and then describes a calibration experimentusing the common metric derived in Section 3.3.2 and the instructions given inSection 3.3.3.

3.4.2.1 Overview of sensing devices

TelosB 6 is a sensor node developed at UC Berkeley. It is widely used by wire-less sensor network community. The platform uses the IEEE 802.15.4-compliantCC2420 transceiver7, which operates in the 2.4 GHz ISM band. The sensing ap-plication is built above TinyOS [26]. In our experiments, the device sweeps overthe target spectrum in steps of 2 MHz and measures RF energy in each step. Asingle Received Signal Strength Indicator (RSSI) is collected at every RF cen-ter frequency. The RSSI is transferred to the host computer via USB connectionin real-time. It takes around 2 ms to sweep over the entire 2.4 GHz ISM band.

4https://github.com/mchwalisz/crewcdf toolbox5Cognitive Radio Experimental World (CREW) is a project in European Unions Seventh Frame-

work Program FP7/2007-20136http://www.eecs.harvard.edu/ konrad/projects/shimmer/references/tmote-sky-datasheet.pdf7http://www.ti.com/product/cc2420

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 63

The collected RSSI value and its timestamp are stored in Comma Saperated Val-ues (CSV) file. TelosB has less flexibility towards spectrum sensing applications,both in processing algorithms and RF functionalities, however it has the lowestprice as well.

The metaGeek Wi-Spy 2.4x 8 and Airmagnet 9 are both low cost spectrumanalysing devices, and they both use USB dongles as the RF front-end. The sens-ing mechanism of Wi-Spy resembles TelosB in the sense that it also uses a narrow-band RF receiver to scan across the band of interest in tiny steps. The step widthranges from 50 kHz to over 600 kHz, depending on the width of the frequencyspan. This essentially determines the resolution bandwidth of the spectrum trace.In our experiments, the Wi-Spy is used jointly with the Kismet Spectools [27] inLinux environment, instead of the standard “Chanalyzer” software. By doing so,the power spectrum trace can be stored in a non-proprietary format, which is moreconvenient for further processing. Unlike Wi-Spy, Airmagnet relies on FFT basedsensing algorithm. The radio of Airmagnet has a 20-MHz instantaneous band-width. It performs sweeping in steps of 20 MHz to cover a bandwidth that is widerthan the instantaneous span. For 2.4 GHz ISM band, it has a fixed span of 83 MHzwith 156 kHz resolution bandwidth. The PSD of Airmagnet can be stored witheither CSV format or other proprietary formats.

USRP 10 is a relatively low-cost SDR platform that consists of two parts —a fixed motherboard and a removable daughterboard. The motherboard containsADC and Digital-to-Analog Converter (DAC), an Field Programmable Gate Array(FPGA) for digital down sampling and an interface connected to a host computer.The daughterboard provides RF front-end functionalities. There are many third-party software platforms, such as GNU Radio [28] and Iris SDR platform [29],which can communicate with the USRP. Thus, spectrum sensing applications canbe implemented in many ways. In our measurements, Iris was the selected plat-form.

The imec sensing engine [30] is an integrated sensing device based on a customdesign that targets for low-power and hand-held devices. Hence it is powered andconfigured over a single USB connection. Similar to USRP, it has a separate PCBfor the RF front-end functionality. The imec sensing engine has a very wide RFfrequency range (from 100 MHz up to 6 GHz) and a programmable instantaneousbandwidth between 1 MHz and 40 MHz. Additionally, it uses a dedicated Inte-grated Circuit (IC) for signal processing instead of using the host computer. There

8http://www.metageek.net/blog/2011/01/how-wi-spy-works9http://airmagnet.flukenetworks.com/assets/datasheets/AirMagnet Survey Datasheet.pdf

10http://www.ettus.com/

64 CHAPTER 3

Figure 3.3: Replace wireless medium with coaxial cable and splitters.

are several pre-defined modes in the IC, including sensing based on FFT and sens-ing based on fast sweeping over a set of consecutive RF frequencies. The hostapplication of imec sensing engine is written in C, therefore the storage format isalso flexible. The overview of the devices are summarized in Table 3.1.

3.4.2.2 Calibration experiment

For the first step, the reference signals are defined as continuous OFDM sig-nals with two different bandwidths (22 MHz and 5 MHz), transmitted on threedifferent channels (Wi-Fi channel 1,6,11 for the 22 MHz signal and Zigbee chan-nel 11,16,26 for the 5 MHz signal), with three input signal strength (-60 dBm, -70dBm, -80 dBm). The 22 MHz and 5 MHz bandwidth are selected to emulate Wi-Fiand Zigbee signals respectively. A Rohde & Schwarz signal generator is used asthe signal source.

The signal generator is connected to the sensing devices with coaxial cablesand splitters as shown in Figure 3.3. The idle terminals are properly connected toterminators with matching impedance (50 Ω). The calibration experiment consistsof two simultaneous operations: continuous RF signal is produced by the signalgenerator, and at the same time all devices record the sensing data to cover thesame frequency span (2.4 GHz ISM band) for the same amount of time (1 minute).This process is repeated for all the predefined reference signals, which means 18iterations in total (2 types of bandwidth, 3 input levels, 3 channels).

After the recording, the raw spectra traces are converted to the CDF data struc-ture. Then the received power within the transmitted signal bandwidth is calcu-lated from the raw PSD. More particularly, the create structure and thepw integration functions within the CDF toolbox are used to perform theseoperations. As the input signal has a constant amplitude, and the devices are con-figured to sense for the same amount of time, averaging the Prx over the entire

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 65

Table 3.1: Overview of the sensing solutions, ∗ indicates that the entry is configurable,only a typical value is entered.

Dev

ice

Res

olut

ion

Freq

uenc

yPr

oces

sing

Swee

ping

cost

nam

eba

ndw

idth

span

step

Telo

sB2

MH

z2.

4G

Hz

ISM

band

RSS

I2

MH

zm

ediu

mW

i-Sp

y2.4

x50

to60

0kH

z2.

4G

Hz

ISM

band

RSS

I50

to60

0kH

zm

ediu

mA

irm

agne

t15

5kH

z2.

4an

d5

GH

zIS

Mba

nds

FFT

20M

Hz

low

USR

P48

kHz∗

RF

boar

dde

pend

ent

FFT

20M

Hz∗

med

ium

imec

se78

kHz∗

100

MH

zto

6G

Hz

FFT

20M

Hz∗

high

66 CHAPTER 3

telosB wispy imecse airmagnet usrp −8

−6

−4

−2

0

2

4

6

8

10

offs

et (

dB)

Figure 3.4: Offset vs Device

sensing duration is the most logical way to compute the common metric. Finallythe power offset of each device against each reference signal is calculated accord-ing to Equation 3.1.

The minimum, maximum, and average value of the measured offsets are plot-ted in Figure 3.4. The results indicate that the USRP solution has the largest offset,most likely due to the fact that it is a general research platform and the output ofthe customized software is not strictly calibrated. Airmagnet and Wi-Spy are bothcommercial USB spectrum devices, but Airmagnet has much bigger variationsduring the measurements (seen by the difference between the maximum and mini-mum offset values). We believe that this is most likely caused by the difference insensing approach — Airmagnet uses FFT based processing approach while WiSpyrelies on pure narrow band sweeping (see Table 3.1). As this paper does not focuson the performance of sensing devices, the exact cause of the different offsets isnot examined. However, the fact that heterogeneous devices have very differentoffsets confirms the need for calibration.

Finally we would like to examine the calibration result by looking at the spec-tra of different devices with the same resolution bandwidth. To do so, we firstsubtract the mean Poffset from the collected raw spectra, and then divide the en-tire 2.4 MHz ISM band into a set of 2 MHz wide consecutive intervals (2 MHz isthe largest resolution bandwidth among the considered devices, see Table 3.1), andperform integration over each of these intervals using the CDF toolbox. This oper-ation essentially brings all spectra to the same frequency resolution. For compari-son, the original raw spectra and the resulting spectra of the measurement obtainedunder one type of reference signal (22 MHz OFDM on Wi-Fi channel 1 with -60dBm input power) are shown in plot(a) and (b) of Figure 3.5 respectively. Plot(a)shows that devices with larger resolution bandwidth have higher level of PSD thandevices with finer resolution bandwidth. This behaviour can be best illustratedwhen comparing the raw spectra of TelosB and imec sensing engine. Compared

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 67

to plot(a), the spectra in plot(b) are much smoother due to the coarser resolutionbandwidth, and more close to each other within the interval where the signal ispresent, which is the expected behaviour after the calibration and resolution con-version. At the same time, we notice that there is still big difference between thespectra where the signal is not present. This difference is no longer linked to theinfluence of resolution bandwidth, but solely reflects the internal noise level of de-vices. Finally, the envelope of the 22 MHz OFDM signal is slightly shifted to theright for the case of TelosB, this is because the resolution bandwidth of TelosB isnot fine enough to resolve the exact boundary of the OFDM signal in frequencydomain.

3.4.3 Reference experiment for heterogeneous sensitivity anal-ysis

This section describes an experiment for sensitivity analysis following the instruc-tions in Section 3.3.4.1. The experiment setup involves an MS3700A signal gen-erator, placed 9 meters away from the rest of the sensing devices. This experimentdoes not include the Airmagnet device due to practical limitations at the time ofthis measurement. All devices are placed on the same horizontal level, with noobstacles in between.

First, samples are recorded when devices are shielded away from external sig-nals. Then recordings are made when an 8 MHz wide OFDM signal is transmittedwith various signal strength. The raw traces are converted to the CDF data struc-ture via the create structure function in the CDF toolbox. In the next step,the detection thresholds for a set of Pf are calculated according to Equation 3.2,and finally the corresponding Pd values are computed.

The ROC plot obtained under -4 dBm signal strength is displayed in Figure3.6. It shows that imec sensing engine and Wi-Spy have better sensitivity thanUSRP and TelosB. The lack of sensitivity for TelosB is clearly caused by the lim-itation of its large resolution bandwidth. For USRP, the low sensitivity is due toinsufficient amplification applied at the time of the experiment, which is resolvedby subsequent sensing implementations [31].

3.4.4 Reference experiment for heterogeneous accuracy analy-sis

This section uses an experiment to illustrate how the processing mechanisms de-scribed in Section 3.3.4.2 can be used in power accuracy analysis. The experi-mental setup is shown in Figure 3.7, where 23 measurement locations and onetransmitter’s location are chosen within an indoor cafeteria. During the measure-ment, the signal generator transmits a constant 20 MHz wide OFDM signal on

68 CHAPTER 3

2.4

2.41

2.42

2.43

2.44

2.45

2.46

2.47

2.48

2.49

x 10

9

−14

0

−12

0

−10

0

−80

−60

Fre

quen

cy (

Hz)

PSD (dBm)

(a)

Wi−

Spy

Tel

osB

imec

seA

irmag

net

usrp

2.4

2.41

2.42

2.43

2.44

2.45

2.46

2.47

2.48

2.49

x 10

9

−14

0

−12

0

−10

0

−80

−60

Fre

quen

cy (

Hz)

PSD (dBm)

(b)

Wi−

Spy

Tel

osB

imec

seA

irmag

net

usrp

Figure 3.5: Raw spectra (a) vs calibrated spectra with common frequency resolution (b)showing 22 MHz wide -60 dB OFDM signal.

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 69

Figure 3.6: Example ROC plot obtained with heterogeneous devices.

WiFi channel 8 (2.447 GHz), with 3 dBm transmit power. Each of the aforemen-tioned sensing devices is configured to record the spectrum at all locations for aduration of minimum 30 seconds.

As stated in 3.3.4.2, the simple logarithmic path loss model is used for de-pendency modelling. Based on Equation 3.2, path loss model is characterized bytwo parameters: the path loss exponent α and offset β. Therefore the dependencymodelling is realized by estimating the two parameters with the distributed powermeasurements. Only one measurement from WiSpy device is identified as out-lier due to the fact that its output was abnormal, the rest of the measurements areconsidered valid.

Two types of regression techniques are applied for the estimation: the leastsquare regression and the robust regression. The least square regression attributesan equal weight to all input data so that the resulting α and β give the minimummean squared error over the input dataset. On the other hand, the robust regressioniteratively attributes weights to different ranges of the dataset, so that the impactof potential outliers is minimized.

Finally the measurement locations are grouped into different clusters so thatthe locations which have a Line-Of-Sight (LOS) topology with respect to the trans-mitter, are separated from those that are in a None Line-Of-Sight (NLOS) condi-tion (shadowed by the coffee machine). The resulting path loss models estimatedwith the least square regression for both location clusters are shown in Figure 3.8.Compared to LOS model, NLOS has a smaller slope but higher offset. As imme-diately after the coffee machine, there is a sudden increment in path loss, however,

70 CHAPTER 3

Figure 3.7: Experiment setup and “Cluster” of locations adapted from [32].

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 71

101

50

55

60

65

70

75

80

85

90

Distance (m)

Pat

h Lo

ss (

dB)

LOSNLOSALLMeasurement

11 2 14 8 7 16 6 12 4 19 20 22

1 15 10 3 13 17 9 18 5 21 23Location nr

Figure 3.8: The path loss models of LOS and NLOS clusters.

when moving further away from the machine, the path loss growth caused by dis-tance is somewhat compensated by the diffraction phenomenon. This analysisgives extra insight on the impact of shadowing and diffraction in the power accu-racy measurement, thanks to the “cluster” of devices. More technical details aboutthis experiment and its result analysis are presented in [32], which is also includedas Appendix A.

3.5 Conclusions and future work

In this paper, we identify and address several challenges in heterogeneous spec-trum sensing. First, we provide a common data format (CDF) (consisting of datastructure and toolbox) to configure sensing devices and store measurement resultsin a uniform approach. We show that the use of CDF can effectively reduce theexperiment overhead, however its implementation requires device-specific scripts.

Second, we apply aggregation techniques to raw spectra in both frequencyand time domain (through CDF toolbox) to overcome heterogeneous measurement

72 CHAPTER 3

resolution. We show that this technique can be used to compare heterogeneousspectra conveniently, however, it cannot be applied in sensitivity analysis, sincesensitivity and resolution are related.

Third, we propose the use of a strict calibration process: replace the wirelessmedium by coaxial cables, use high-end signal generator as reference, derive thepower offsets among devices and perform calibration. We validate experimentallythat this approach is highly reliable and repeatable. The drawback is that the usageof coaxial cable leaves the antenna out of the calibration system. This can beresolved by adjusting the measured power offset with the consideration of antennagains, radiation patterns as well as the impact of polarization.

Finally, we share our experience of analyzing two fundamental heterogeneoussensing metrics. More particularly, a well-accepted common procedure is appliedto heterogeneous devices to achieve fair sensitivity analysis; basic data-miningtechniques are used to extract new parameters concerning distributed power accu-racy analysis. It can be seen that these techniques greatly improve the processingefficiency and trigger profound understanding of the measurements. Though pro-cessing mechanisms generally vary with experiment details, sharing these to thecommunity will lead to a quicker harmonization of approaches.

In the future, before extending the CDF to support more devices, the device-specific implementation can be simplified and validated via standard procedures.Also more advanced aggregation techniques could be explored in order to meet theneeds of different analysis and the influence of the antenna could be studied morein depth to improve the calibration accuracy.

AcknowledgmentThe research leading to these results has received funding from the EuropeanUnion’s Seventh Framework Program FP7/2007-2013 under grant agreement n258301 (CREW project).

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 73

References

[1] V. Valenta, R. Marsalek, G. Baudoin, M. Villegas, M. Suarez, and F. Robert.Survey on spectrum utilization in Europe: Measurements, analyses and ob-servations. In Cognitive Radio Oriented Wireless Networks & Communica-tions (CROWNCOM), 2010 Proceedings of the Fifth International Confer-ence on, pages 1–5. IEEE, 2010.

[2] S. Haykin. Cognitive radio: brain-empowered wireless communications. Se-lected Areas in Communications, IEEE Journal on, 23(2):201–220, 2005.

[3] J. Walko. Cognitive radio. IEE review, 51(5):34–37, 2005.

[4] T. Yucek and H. Arslan. A survey of spectrum sensing algorithms for cog-nitive radio applications. Communications Surveys & Tutorials, IEEE,11(1):116–130, 2009.

[5] H. R. Karimi. Geolocation databases for white space devices in the UHF TVbands: Specification of maximum permitted emission levels. In New Frontiersin Dynamic Spectrum Access Networks (DySPAN), 2011 IEEE Symposiumon, pages 443–454. IEEE, 2011.

[6] J. Zander, L. K. Rasmussen, K. W. Sung, P. Mahonen, M. Petrova, R. Jantti,and J. Kronander. On the scalability of cognitive radio: assessing the com-mercial viability of secondary spectrum access. Wireless Communications,IEEE, 20(2):28–36, 2013.

[7] R. Tandra, S. M. Mishra, and A. Sahai. What is a spectrum hole and whatdoes it take to recognize one? Proceedings of the IEEE, 97(5):824–848,2009.

[8] C. F. Tomaz Solc and M. Mohorcic. Low-cost testbed development and itsapplications in cognitive radio prototyping. In Cognitive Radio and Net-working in Heterogeneous Wireless Networks. Springer, 2015.

[9] A. Nika, Z. Zhang, X. Zhou, B. Y. Zhao, and H. Zheng. Towards com-moditized real-time spectrum monitoring. In Proceedings of the 1st ACMworkshop on Hot topics in wireless, pages 25–30. ACM, 2014.

[10] D. Cabric, A. Tkachenko, and R. W. Brodersen. Experimental study of spec-trum sensing based on energy detection and network cooperation. In Pro-ceedings of the first international workshop on Technology and policy foraccessing spectrum, page 12. ACM, 2006.

74 CHAPTER 3

[11] M. Murroni, R. V. Prasad, P. Marques, B. Bochow, D. Noguet, C. Sun,K. Moessner, and H. Harada. Ieee 1900.6: spectrum sensing interfaces anddata structures for dynamic spectrum access and other advanced radio com-munication systems standard: technical aspects and future outlook. Commu-nications Magazine, IEEE, 49(12):118–127, 2011.

[12] V. Chen, V. Das, L. Zhu, J. Malyar, and P. McCann. Protocol to querya White Space Database, 2011. Available from: http://tools.ietf.org/html/draft-caufield-paws-protocol-for-tvws-01.

[13] D. Denkovski, V. Rakovic, M. Pavloski, K. Chomu, V. Atanasovski, andL. Gavrilovska. Integration of heterogeneous spectrum sensing devices to-wards accurate REM construction. In Wireless Communications and Net-working Conference (WCNC), 2012 IEEE, pages 798–802. IEEE, 2012.

[14] V. Atanasovski, J. van de Beek, A. Dejonghe, D. Denkovski, L. Gavrilovska,S. Grimoud, P. Mahonen, M. Pavloski, V. Rakovic, J. Riihijarvi, et al. Con-structing radio environment maps with heterogeneous spectrum sensors. InNew Frontiers in Dynamic Spectrum Access Networks (DySPAN), 2011IEEE Symposium on, pages 660–661. IEEE, 2011.

[15] J. Van De Beek, T. Cai, S. Grimoud, B. Sayrac, P. Mahonen, J. Nasreddine,and J. Riihijarvi. How a layered rem architecture brings cognition to today’smobile networks. Wireless Communications, IEEE, 19(4):17–24, 2012.

[16] T. F. TRL, F. C. TRL, S. S. TRL, and W. Workpackage. Flexible and Spec-trum Aware Radio Access through Measurements and Modelling in CognitiveRadio Systems. Evaluation, 5:2.

[17] M. Lopez-Benıtez and F. Casadevall. Methodological aspects of spectrumoccupancy evaluation in the context of cognitive radio. European Transac-tions on Telecommunications, 21(8):680–693, 2010.

[18] D. Finn, J. C. Tallon, L. A. DaSilva, P. Van Wesemael, S. Pollin, W. Liu,S. Bouckaert, J. Vanhie-Van Gerwen, N. Michailow, J. Hauer, et al. Ex-perimental assessment of tradeoffs among spectrumsensing platforms. InProceedings of the 6th ACM international workshop on Wireless networktestbeds, experimental evaluation and characterization, pages 67–74. ACM,2011.

[19] W. L. Stutzman and W. A. Davis. Antenna theory. Wiley Online Library,1998.

[20] Y. Liu, C. Zeng, H. Wang, and G. Wei. Energy detection threshold opti-mization for cooperative spectrum sensing. In Advanced Computer Control

HETEROGENEOUS SPECTRUM SENSING: CHALLENGES AND METHODOLOGIES 75

(ICACC), 2010 2nd International Conference on, volume 4, pages 566–570.IEEE, 2010.

[21] W. Zhang, R. K. Mallik, and K. Letaief. Cooperative spectrum sensing op-timization in cognitive radio networks. In Communications, 2008. ICC’08.IEEE International Conference on, pages 3411–3415. IEEE, 2008.

[22] N. Wang, Y. Gao, and X. Zhang. Adaptive Spectrum Sensing Algorithm Un-der Different Primary User Utilizations. 2013.

[23] T. Rakotoarivelo, M. Ott, G. Jourjon, and I. Seskar. OMF: a control andmanagement framework for networking testbeds. ACM SIGOPS OperatingSystems Review, 43(4):54–59, 2010.

[24] S. Bouckaert, P. Becue, B. Vermeulen, B. Jooris, I. Moerman, and P. De-meester. Federating wired and wireless test facilities through Emulab andOMF: the iLab. t use case. In Testbeds and Research Infrastructure. Devel-opment of Networks and Communities, pages 305–320. Springer, 2012.

[25] V. Handziski, A. Kopke, A. Willig, and A. Wolisz. TWIST: a scalable andreconfigurable testbed for wireless indoor experiments with sensor networks.In Proceedings of the 2nd international workshop on Multi-hop ad hoc net-works: from theory to reality, pages 63–70. ACM, 2006.

[26] P. Levis, S. Madden, J. Polastre, R. Szewczyk, K. Whitehouse, A. Woo,D. Gay, J. Hill, M. Welsh, E. Brewer, et al. TinyOS: An operating system forsensor networks. In Ambient intelligence, pages 115–148. Springer, 2005.

[27] J. Bock and M. Lynn. Hacking Exposed Wireless. McGraw-Hill, Inc., 2007.

[28] E. Blossom. GNU radio: tools for exploring the radio frequency spectrum.Linux journal, 2004(122):4, 2004.

[29] P. D. Sutton, J. Lotze, H. Lahlou, S. A. Fahmy, K. E. Nolan, B. Ozgul, T. W.Rondeau, J. Noguera, and L. E. Doyle. Iris: an architecture for cognitiveradio networking testbeds. Communications Magazine, IEEE, 48(9):114–122, 2010.

[30] S. Pollin, L. Hollevoet, P. Van Wesemael, M. Desmet, A. Bourdoux,E. Lopez, F. Naessens, P. Raghavan, V. Derudder, S. Dupont, et al. An inte-grated reconfigurable engine for multi-purpose sensing up to 6 GHz. In NewFrontiers in Dynamic Spectrum Access Networks (DySPAN), 2011 IEEESymposium on, pages 656–657. IEEE, 2011.

[31] W. Liu, D. Pareit, E. De Poorter, and I. Moerman. Advanced spectrum sens-ing with parallel processing based on software-defined radio. EURASIPJournal on Wireless Communications and Networking, 2013(1):1–15, 2013.

76 CHAPTER 3

[32] P. Van Wesemael, W. Liu, M. Chwalisz, J. Tallon, D. Finn, Z. Padrah,S. Pollin, S. Bouckaert, I. Moerman, and D. Willkomm. Robust distributedsensing with heterogeneous devices. In Future Network & Mobile Summit(FutureNetw), 2012, pages 1–9. IEEE, 2012.

4Wireless technology recognition

based on RSSI distribution atsub-Nyquist sampling rate

In Chapter 2 and 3, investigations are made to optimize the performance of spec-trum sensing over time and space respectively. As the previous work is confinedto detecting signals’ presence, a complementary solution is proposed in this chap-ter, which identifies the signal’s technology type in addition to its appearance. Webelieve this technique is important to further optimize dynamic spectrum sharingamong heterogeneous technologies implemented on constrained devices.

? ? ?

W. Liu, M. Kulin, T. Kazaz, I. Moerman, and E. De Poorter

Submitted to IEEE International Symposium on Dynamic Spectrum AccessNetworks 2017

Abstract Driven by the fast growth of wireless communication, the trend of shar-ing spectrum among heterogeneous technologies becomes increasingly dominant.Identifying concurrent technologies is an important step towards efficient spectrumsharing. However, due to the complexity of recognition algorithms, and the strictcondition of sampling speed, communication systems capable of recognizing sig-nals other than its own type are extremely rare. This work proves that multi-model

78 CHAPTER 4

distribution of the Received Signal Strength Indicator (RSSI) is related to the sig-nals’ modulation schemes and medium access mechanisms. Different technolo-gies may exhibit highly distinctive features in the probability distribution of RSSI.Experimental study of three prospective technologies in the context of dynamicspectrum access, i.e. Wi-Fi, LTE, and DVB-T, shows that even the histogram ofRSSI acquired at sub-Nyquist sampling rate is able to provide sufficient featuresto differentiate technologies. Based on this observation, an algorithm is proposedand evaluated under various settings, more than 90% accuracy is achieved withthe appropriate configuration. As the analysis of RSSI distribution is straightfor-ward and less demanding in terms of system requirements, we believe it is highlyvaluable for recognition of wideband technologies on constrained devices.

4.1 Introduction

Due to the quick growth of wireless communications, radio spectrum bands areeither already claimed by licensed users, or heavily loaded by applications in theunlicensed bands. The shortage of spectrum resource has become a key limitationof wireless communications. One way to resolve the issue is to extend the spec-trum towards higher frequency band via new technologies, such as millimeter wavecommunication [1] assisted by massive MIMO [2]; another way is to improve theefficiency of the already allocated frequency bands by allowing Dymamic Spec-trum Access (DSA) [3].

DSA essentially means sharing spectrum among heterogeneous technologies,which can be achieved either “horizontally” [4] or “vertically” [5]. Vertical spec-trum sharing refers to the opportunistic access of licensed bands without compro-mising the incumbents’ communication quality, while horizontal spectrum sharingrefers to the access of unlicensed bands by multiple technologies with equal privi-leges. Several technologies (e.g., Wi-Fi, Zigbee, Bluetooth) are already sharing theIndustrial Scientific and Medical (ISM) bands in the horizontal style. Attracted bythe free spectrum, licensed technologies are also considering to operate in the unli-censed bands. The LTE-U — a recent enhancement of LTE to boost cell coveragevia the operation in 5 GHz ISM band — is the best example here [6]. In the nearfuture, communication above 60 GHz is foreseen to meet the throughput demandof the Next Generation Wireless Networks (NGWN). Hyper dense deployment ofsmall cells will be necessary to compensate for higher path loss in these frequencyranges. In this scenario, exclusive frequency assignment per technology is beyondfeasibility, thus, the need for autonomous DSA mechanisms.

Detecting signals of other technologies is the prerequisite of DSA. The moststraightforward approach is to sense the presence of energy in the medium, com-monly referred to as energy detection [7, 8]. Sometimes merely detecting thesignal’s existence is not sufficient, it is also crucial to identify the technology type.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 79

In the context of vertical spectrum sharing, if the detected signal is primary, thesecondary user should back off, otherwise the delay is unnecessary. For horizontalspectrum sharing, recognizing the technology provides extra insights to counter-act the interference: e.g., for a Wi-Fi network, if the concurrent technology isLTE-U [9], it would be beneficial to maximize the usage of the periodical off-time1. From a broader perspective, real-time technology recognition is essentialfor the interoperability among multiple radio access technologies (multi-rat) in theNGWN [10, 11].

Mainstream technology identifiers often share the following limitations:(i) therequirement for a priori knowledge of the target technology, making it difficultto distinguish multiple technologies in a single implementation; (ii) the require-ment for the RF signal to be sampled above Nyquist frequency, else certain partof the signal will be “cut off”, making it impractical to be identified by techniquessuch as matched filtering or preamble detection; (iii) the involvement of long termobservation and intensive computation is not suitable for real-time applications.

To overcome these constraints, this work presents an approach to identify tech-nologies based on the probability distribution of RSSI. As the analysis of RSSI dis-tribution is straightforward, technology independent, and less demanding in termsof system requirements such as sample rate, it is ideal for achieving technologyrecognition on constrained devices. The remainder of this chapter is organizedas follows: Section 4.2 discusses the related work; Section 4.3 explains how theproperties of signals affect the characteristics of RSSI distribution; next, the RSSIof three representative technologies (Wi-Fi, LTE and DVB-T) are explored in Sec-tion 4.4; then, a simple algorithm of signal classification is proposed and experi-mentally validated in Section 4.5; Finally, Section 4.6 concludes this chapter andproposes directions for future work.

4.2 Related work

4.2.1 Technology-specific detections

Matched-filtering, waveform-based sensing, and cycle-stationary feature detectionare the most known technology-specific detections [12, 13]. Matched filter is com-monly applied at the early stage of a wireless decoder to maximize the signal-to-noise (SNR) ratio. It outperforms energy detection in terms of sensitivity, howeveronly for a given technology. Known patterns such as preambles, are often utilizedin wireless systems for the receivers to achieve coherence with the transmitters.Detection based on these patterns are highly precise, though some level of timingand carrier synchronization has to be achieved beforehand. Cycle-stationary fea-ture detection exploits the built-in periodicity of modulated signals, which often

1LTE-U switches off traffic periodically so that Wi-Fi can share the medium.

80 CHAPTER 4

involves autocorrelation or spectral correlation function [14]. The main advantageis its robustness to uncertainty in noise. However, it is computationally complexand requires significantly long observation time [12]. [15] leverages on the factthat modulated signals follow Rayleigh distribution while noise follows Gaussiandistribution, transmitters are identified by extracting Rayleigh and Gaussian sub-components from the raw spectra. Though, the primary goal of [15] is to establish aspectrum inventory for regulators, the utilization of sophisticated machine learningtechniques and off-line observation, makes it unsuitable for real-time applications.Given the state-of-art of technology-specific recognition, there is still a need tofurther reduce complexity, and to break the interdependency between algorithmsand technologies.

4.2.2 Existing studies of the distribution of RSSI

In contrast to the common assumption that RSSI follows Gaussian distribution,there are many circumstances causing RSSI to form bimodal or even multi-modalprobability distributions. [16, 17] simply mention this phenomenon without speci-fying causes. [18] suggests that fading is related to the irregular RSSI distribution.More concrete causes for this phenomenon are stated in [19], including the orien-tation of antenna, the presence of moving objects or human. These studies haveone thing in common, the research is driven by RSSI-based localization in Wi-Finetwork. Hence, the signal strength is computed based on successfully decodedWi-Fi packets, which are primary beacons from Access Points. While these obser-vations are certainly true, they are limited to the Wi-Fi technology, and focusingon alleviating the instability in signal strength rather than investigating it.

The study of RSSI in this chapter is based on raw In-phase and Quadrature-phase (IQ) samples captured by an Software-Defined Radio (SDR) device. Itproves that multi-modal probability distribution of RSSI is also related to the char-acteristics of the signal itself, causing the distribution to form stable and distinctivepatterns. From this aspect, RSSI can be used for technology recognition, which isanother contribution of this work.

4.2.3 Existing application of RSSI in technology recognition

RSSI is readily available on many commercial radio chipsets, hence several pi-oneering studies in technology recognition on small-scale devices make use ofRSSI due to practical advantages. [20] proposes to identify technologies with dif-ferent Medium Access Control (MAC) mechanisms by observing the transmissionand idle period in the time series of RSSI. Two types of classifiers are presentedand experimentally validated to identify sub-categories of Wi-Fi standards. Buildsupon the observation of transmission interval, authors of [21] introduce peak-to-average power ratio and hardware-specific features. For instance, the presence of

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 81

microwave oven is identified when the RSSI of the chip CC2420 drops below thenoise floor, which is likely caused by saturation in the receiver chain. The intrin-sic periodicity extracted by a simplified version of spectral correlation functionproposed by [22], and the characteristics of the spectrum trace obtained by com-mercial Wi-Fi card proposed by [23], are used in combination with features ofRSSI series (such as idle and transmission time) to distinguish technologies in the2.4 GHz ISM band. Although each of these work has its own strength in certainapplication scenarios, the common interdependency on features from time domainof RSSI series, such as packet duration and inter-packet gap, implies that they lackthe capability to distinguish technologies with stable transmission, such as LTEand DVB-T.

This work is complimentary to existing RSSI-based technology recognitionsolutions, in the sense that the targeted technologies and application scenarios aredifferent. The scope of this work is to achieve DSA in general NGWN instead ofonly the ISM bands. Eventually, existing solutions can be combined with this workto extend the range of recognizable technologies and reduce complexities. To thebest knowledge of the authors, this work is the first effort (i) to explain the multi-modal distribution of RSSI with the properties of the signals, other than externalfactors such as fading, and (ii) to realize technology recognition solely based onthe features extracted from the probability distribution of RSSI.

4.3 The cause of multi-modal distribution of RSSI

RSSI can be obtained in various approaches. Many wireless chipsets calculateRSSI for individual received packets to indicate the link quality between certaindevices. As each vendor has its own method to compute RSSI, this makes RSSIvalues technology and/or device specific. In this chapter, RSSI is calculated asthe average of the squared magnitude of samples in logarithmic scale, as shownbelow:

y[n] = 10× log10(1

N

N∑i=1

x[i]2) (4.1)

where y[n] denotes an RSSI value, x[i] denotes the amplitude of the received sam-ple, and N indicates the amount of samples used to compute one RSSI. The unitof y[n] is dB, because it is uncalibrated. As the RSSI is obtained from a contin-uous range of samples from the Analog-to-Digital Converter (ADC), without anyfiltering in favor of a specific technology, therefore it is generic.

In practice, the Probability Density Function (PDF) is approximated by thenormalized histogram. Empirically, bimodel or multi-modal like irregular RSSIdistribution is linked to the sudden change of signal strength. It could be causedby external factors such as shading, or variation in the signal itself, which can be

82 CHAPTER 4

Figure 4.1: An example RSSI trace of discontinuously transmitted signal (on the left) andthe corresponding PDF (on the right).

Figure 4.2: An example RSSI trace of signal modulated with variable amount ofsubcarriers (on the left) and the corresponding PDF (on the right).

further divided into: (i) discontinuous transmission in the time domain and (ii) thechange of the amount of allocated carriers in the frequency domain.

4.3.1 Discontinuous transmission

Discontinuous transmission is often observed from technologies in the unlicensedbands, where carrier sensing is generally required before a packet is transmit-ted, resulting randomly inserted pauses between consecutive packets. An exampleRSSI of discontinuous signal and the corresponding PDF are shown in Figure 4.1.The received signal strength reaches a stronger level (denoted as K1) when pack-ets are being transmitted, and falls back to a weak level (denoted as K2) whenonly noise is present. Consequently, the PDF contains two peaks: the peak on theleft side is caused by noise, while the peak on the right is resulted from the signal.Additional peaks may appear in the PDF when packets are transmitted by differentdevices or with different power. Generally speaking, the PDF of discontinuoustransmission contains multiple peaks which are situated relatively apart, and thepeak at the leftmost side coincides with the distribution of the noise.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 83

Figure 4.3: The packet structure used in the example OFDM transceiver in GNU Radio

4.3.2 Variable subcarriers

The second cause of the multi-modal RSSI distribution is the variation of theamount of subcarriers. Driven by the high throughput requirement, multi-carriermodulation has gradually become the dominant modulation scheme in moderncommunication systems. The Orthogonal Frequency Division Multiplexing (OFDM)is undoubtedly the most popular multi-carrier modulation technique. Similar tosingle-carrier modulations, an OFDM symbol is transmitted for a certain amountof time; however, it has an extra degree of freedom — each OFDM symbol mayoccupy different amount of subcarriers2. The change in the quantity of occupiedsubcarriers causes the signal to be stronger in one OFDM symbol time than theother. An illustration of the OFDM signal in time domain and the correspondingPDF are shown in Figure 4.2. The example RSSI plot has two levels of averagesignal strength, namely K3 and K4, as a result, the PDF exhibits bi-modal dis-tribution. Intuitively, the OFDM symbol containing more subcarriers would haverelatively stronger signal strength. This assumption is validated experimentally inthe next section.

Experiment

A simple experiment is conducted to investigate how exactly the quantity of carri-ers are influencing the signal strength. The experiment involves two USRP B200mini devices [25]. It is a small-scale SDR platform, used in combination withthe GNU Radio software [26] installed on a host computer. GNU Radio providesan example implementation of OFDM transceiver, which is used to generate theOFDM signals for this experiment. The two USRP’s are used as transmitter andreceiver, respectively. To eliminate the possibility of fading, the receiver is con-nected via a coaxial cable to the transmitter with a 30 dB attenuator in between.

Figure 4.3 illustrates the OFDM packet structure in GNU Radio, where each

2The amount of occupied subcarriers in an OFDM symbol corresponds to the number of null sub-carriers at the input of Inverse Fast Fourier Transform (IFFT), after which a cyclic prefix is added toform the complete OFDM symbol.

84 CHAPTER 4

010

2030

40

−52

.5

−52

−51

.5

−51

−50

.5

−50

−49

.5

Tim

e (m

s)

RSSI (dB)

12 c

arrie

rs

−52

.5−

52−

51.5

−51

−50

.5−

50−

49.5

0

0.51

1.52

2.53

RS

SI (

dB)

Normalized histogram

010

2030

40

−52

.5

−52

−51

.5

−51

−50

.5

−50

−49

.5

Tim

e (m

s)

RSSI (dB)

28 c

arrie

rs

−52

.5−

52−

51.5

−51

−50

.5−

50−

49.5

0

0.51

1.52

2.53

RS

SI (

dB)

Normalized histogram

010

2030

40

−52

.5

−52

−51

.5

−51

−50

.5

−50

−49

.5

Tim

e (m

s)

RSSI (dB)

44 c

arrie

rs

−52

.5−

52−

51.5

−51

−50

.5−

50−

49.5

0

0.51

1.52

2.53

RS

SI (

dB)

Normalized histogram

Figure 4.4: The RSSI of OFDM signals generated by GNU Radio, with variable amount ofsubcarriers in the last symbol of a packet (indicated in the title of the graphs), the first row

displays RSSI measurements over time, while the corresponding normalized histogramsare displayed in the second row.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 85

row denotes an OFDM symbol in time and each column denotes a subcarrier.There are 64 subcarriers in total, among which 52 are occupied while the rest areidle. The first two OFDM symbols are used for preamble transmission (indicatedby yellow grids in Figure 4.3), the third symbol is used to transmit the header ofthe packet, while the remaining symbols contain the payload data. Except for thepreamble, all the OFDM symbols contain 4 pilot carriers, as indicated by the redgrids. The packets are successfully decoded by the receiver, which guarantees thatthe signal is properly transmitted.

The simple OFDM transmitter does not have medium access control, hencepackets are transmitted continuously. Furthermore, the packet size is static, andthere is no bits padded at the end of a packet. This means that the number ofoccupied carriers in the last OFDM symbol of a packet is dependent on the payloadsize. By applying the payload size of 123, 127, and 131 bytes, there are 12, 28,and 44 subcarriers occupied in the last OFDM symbol, respectively. The samplesare transmitted at the rate of 200 kHz. The same rate is used to capture samples bythe receiver side. An RSSI is calculated with Equation 4.1 for N = 160.

The RSSI traces are shown in the first row of Figure 4.4. These plots illus-trate that the RSSI fluctuate periodically over time, and the period corresponds tothe duration of a single packet3. It is observed that the signal strength of the lastOFDM symbol in a packet is weaker than the rest of the packet. Additionally,the magnitude of variations becomes smaller when more subcarriers are occupied.The same conclusion can be drawn from the histogram in the second row of Figure4.4. The histograms of “12 occupied carriers” and “28 occupied carriers” exhibitbimodal distribution, where the peak on the left side and right side represent thesignal strength of the last OFDM symbol and the remainder of the packet respec-tively. The peak on the left side gradually moves towards the main peak with theincrement of the number of occupied carriers, and eventually merges with the mainpeak, as shown in the normalized histogram for the case of “44 occupied carriers”.

In conclusion, this simple experiment proves that for multi-carrier modulatedsignals, the more carriers are occupied, the stronger the signal strength gets. Thoughunlike the situation in non-continuous transmission, the peaks are situated rela-tively close to each other (only a few dB difference in between). This is because theimpact on signal strength of the amount of subcarriers is significantly smaller thanthe impact of burst transmission. Multi-modal RSSI distribution may be formedwhen more flexible subcarrier allocation schemes are applied, such as the usage ofresource block in LTE, which will be explained in the following sections.

86 CHAPTER 4

Figure 4.5: The categories of signals and the corresponding PDF.

4.3.3 Summary

The situations where RSSI obey Gaussian distribution or irregular multi-modaldistributions are summarized in Figure 4.5. On the top level, a difference is madebetween signals and noise, where signals refer to human generated electromag-netic waves, and noise refers to any uncontrollable disturbance in the RF system.Next, signals are divided based on whether the number of modulated carriers areconstant or not. Note that the single-carrier modulated signal is considered as aspecial case of signals with constant amount of carriers. Then, the signal mod-ulated with constant amount of carriers are further divided based on whether thetransmission is continuous. The conclusion is that, RSSI forms Gaussian distribu-tion when signal is not present, or it is modulated with constant amount of carriersand continuously transmitted; in all other cases, bimodal or multi-modal distribu-tion is observed instead.

4.4 Characterization of real-life signals

A set of experiments are performed to explore how RSSI can be used to character-ize real-life signals. First, the selected technology types are introduced in Section4.4.1. Then the RSSI measurements obtained by both a high-end spectrum ana-lyzer and a small-scale SDR device are observed in Section 4.4.2 and Section 4.4.3respectively.

3Including the header and preamble, a packet contains 14 OFDM symbols, each symbol has 80samples, including 16 samples for cyclic prefix, hence a packet lasts for 80*14/200 kHz = 5.6 ms.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 87

RS

SI (

dB)

-90

-80

-70

-60

-50

-40

Normalized histogram

0

0.2

0.4

0.6

0.8

Wi-

Fi

Tim

e (m

s)0

510

1520

2530

Freq (MHz)5536

5538

5540

5542

5544

RS

SI (

dB)

-90

-80

-70

-60

-50

-40

Normalized histogram

0

0.2

0.4

0.6

0.8

LT

E

Tim

e (m

s)0

510

1520

2530

Freq (MHz)802

804

806

808

810

RS

SI (

dB)

-90

-80

-70

-60

-50

-40

Normalized histogram

0

0.2

0.4

0.6

0.8

DV

B-T

Tim

e (m

s)0

510

1520

2530

Freq (MHz)478

480

482

484

486

Figure 4.6: The normalized histograms of RSSI (first row) and the spectrograms (secondrow) for Wi-Fi, LTE and DVB-T signals. All graphs are obtained by post processing of raw

IQ samples collected by the Anritsu 2690A spectrum analyzer at the rate of 10 MHz.

88 CHAPTER 4

4.4.1 Signal selection

The experiments target on three technologies, which are actively involved in thecontext of spectrum sharing, and representative in terms of modulation and mediumaccess mechanisms: (i) the IEEE 802.11a compliant Wi-Fi signal, (ii) the down-link signal of the LTE technology used by the 4G cellular network and (iii) theDigital Video Broadcasting-Terrestrial (DVB-T) signal.

All three technologies use OFDM as modulation scheme. The IEEE 802.11g/acompliant Wi-Fi performs padding at the end of a packet to ensure that the payloadsize is the multiples of the amount of data carriers. Thus all OFDM symbolsin a Wi-Fi packet contain the same number of carriers. Moreover, Wi-Fi usesCarrier Sense Multiple Access (CSMA) to avoid collision [27], which leads totransmission in random bursts. The LTE standard fragments the spectrum and timeplain into very fine resource blocks and resource elements4 [28]. Some resourceblocks are periodically used for control and broadcasting purposes, whereas othersare available to carry user data. There are 16 resource elements in a resource blockused to transmit cell-specific reference signals, which are always present no matterif the resource block is allocated for data transmission or not. Thus the LTE signalis modulated with variable amount of carriers and transmitted in very fine andregular intervals. In contrast to LTE and Wi-Fi, DVB-T is a relatively simplestandard, the signal is continuously transmitted in its own licensed band, with novariation in carrier allocation and interruption for the purpose of medium access.In short, the characteristic of the three signals are summarized below:

• Wi-Fi (IEEE 802.11a): Signal transmitted in random bursts, modulated withconstant amount of carriers;

• LTE: Signal transmitted in very fine and regular intervals, modulated withvariable amount of carriers;

• DVB-T: Signal transmitted continuously and modulated with constant amountof carriers.

The Wi-Fi signal is captured in an office environment, including two Access Points(AP’s) at 5540 MHz (channel 108), and on average 20 associated work stations.The LTE signal is captured from a nearby base station, operating in FDD modeat 806 MHz, around the Ghent area of Belgium. Finally, the DVB-T signal iscollected from the local TV broadcasting station at 482 MHz.

4Each resource block is 180 kHz wide and 0.5 ms long, consisting of 12 subcarriers and 7 OFDMsymbols, where a single carrier in an OFDM symbol is referred to as a resource element.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 89

4.4.2 Experiment with spectrum analyzer

An Anritsu MS 2690A spectrum analyzer [29] is used to capture samples of eachof the aforementioned signal types. The samples are collected at the rate of 10MHz for a duration of 1 second. The RSSI is calculated using Equation 4.1 forN = 200. In total 50k RSSI values are obtained. The first row of Figure 4.6contains the normalized RSSI histograms of the three selected technologies, andthe spectrograms are shown at the corresponding position of the second row. Thetime span of the spectrogram is limited to 30 ms for visualization purposes.

As anticipated, the Wi-Fi signal appears as short and random bursts in thespectrogram. Since the signals belong to multiple stations and AP’s, the histogramcontains several peaks between -50 dB and -75 dB, corresponding to signals trans-mitted by nearby and remote stations respectively. Note that the histogram varieswith the traffic load of the Wi-Fi network, and the distance to the stations and AP’s.However, due to the nature of contention based collision avoidance, there is alwaysa significant amount of noise samples present in the time frame of 1 second. Hencethe high peak on the left side of the histogram contributed by noise always exists.

The LTE signal has the most versatile spectrogram, which is primarily occu-pied by the frequently occurring reference signals in the idle resource blocks. The1 MHz wide signal occurring every 5 ms at the center of the LTE band is thesynchronization sequence. The remaining parts of the spectrogram with higher in-tensity are the resource blocks active for data transmission. The histogram of theLTE signal contains multiple peaks spreading out from -80 dB to -55 dB. Unlikethe histogram of Wi-Fi, it is rather difficult to map the peaks to the exact causesfor LTE. Moreover, the LTE signal is highly sensitive to the instant throughputdemands of the users, thus the magnitude of the peaks varies from one moment toanother. What remains unchanged is the extremely wide range of variation in thesignal strength and the large number of peaks present in the histogram.

The DVB-T’s spectrogram shows that it is highly stable in both time and fre-quency domain. This is because the current DVB-T standard only allows contin-uous transmission, and does not contain flexibility in carrier allocation. Thereforeits histogram simply matches the characteristic of Gaussian distribution — onlyone narrow peak is present. Sometimes, fading may cause some tiny peaks to ap-pear next to the main one. In general, the RSSI’s histogram from DVB-T signalhas the minimum number of peaks, and the least amount of variation in signalstrength among the three technologies.

4.4.3 Experiment with small-scale RF device

The previous experiment gives promising results for RSSI based signal recogni-tion. However, the results are obtained by a spectrum analyzer, which is capable ofmuch more advanced and accurate signal analysis, the added value of RSSI based

90 CHAPTER 4

−80

−70

−60

−50

−40

−30

0

0.050.1

0.150.2

0.250.3

0.350.4

RS

SI (

dB)

Normalized histogram

Wi−

Fi

−80

−70

−60

−50

−40

−30

0

0.050.1

0.150.2

0.250.3

0.350.4

RS

SI (

dB)

Normalized histogram

LTE

−80

−70

−60

−50

−40

−30

0

0.050.1

0.150.2

0.250.3

0.350.4

RS

SI (

dB)

Normalized histogram

DV

B−

T

Figure 4.7: The normalized histograms of RSSI for Wi-Fi, LTE, and DVB-T signalsobtained by USRP B200 mini with the sample rate of 1 MHz.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 91

signal recognition for such a high-end device is rather trivial. Additionally, doingmeasurements with a spectrum analyzer is not always practical and cost-efficient.Therefore the preferred implementation platform is small-scale and low-cost RFdevices. Though this rises another doubt: will the RSSI measurements obtainedby low-end devices have sufficient diversities for signal recognition? In fact, the10 MHz sample rate used in the last experiment is above the limit of many cheapdevices (e.g., Zigbee sensors or Bluetooth dongles).

To answer this question, we repeat the previous experiment with a small-scaleSDR device (USRP B200 mini) at the sample rate of 1 MHz. The amount ofsamples used to compute a single RSSI (denoted by N in Equation 4.1) is scaleddown to 20. In total, 50k RSSI measurements are collected during the time frameof 1 second. Since a spectrogram of 1 MHz wide contains limited information,only the histograms of the RSSI measurements are displayed in Figure 4.7.

At the first sight, the RSSI measurements from the USRP is stronger than theones from the spectrum analyzer. Taking the most static signal DVB-T as an ex-ample, the average RSSI measured by USRP is around -54 dB while only -72 dBis obtained by the spectrum analyzer. Since the RSSI measurements are not cali-brated, many factors (e.g. hardware, gain) can contribute to the difference, whichare out of the scope of this chapter. The important message here is that the his-tograms obtained by USRP at a lower sample rate are highly consistent with theircounterparts obtained by the spectrum analyzer. Therefore, RSSI measurementsobtained at a much lower sampling rate, by small-scale devices, also have poten-tials to be applied for signal recognition.

4.5 Automatic signal recognition

This section aims to automatically identify technologies based on the findings fromprevious sections. First, the extracted features are listed in Section 4.5.1; then, asimple algorithm is proposed to identify the technologies in Section 4.5.2; finally,additional measurements are obtained to evaluate the algorithm’s performance inSection 4.5.3.

4.5.1 Feature space design

The selected features for automated technology recognition are illustrated in Fig-ure 4.8 and explained as follows:

• std dev: the standard deviation measures how much the data deviate fromthe mean value. It indicates the range of the variation in the signal strength.

• npks: the number of peaks in the histogram of RSSI is a simple way todescribe the shape of the distribution. A point in the histogram is recognized

92 CHAPTER 4

Figure 4.8: An illustration of the features extracted from the distribution of RSSI.

Table 4.1: The features versus technologies.

XXXXXXXXXXFeaturesTech

Wi-Fi LTE DVB-T

std dev Variable High Low

npks Variable High Low

noise peak High Not visible Not present

as a peak when it is above its two neighboring points.

• noiseloc: the average power level of the noise corresponds to the location ofthe leftmost peak in the histogram, it should be situated to the left of certainthreshold, denoted as ‘THR NL’ in Figure 4.8.

• noisepeak: the amplitude of the noise peak in the RSSI histogram is propor-tional to the amount of time the signal is interrupted. It is identified whenthe peak corresponding to noiseloc is above ‘THR NP’.

Note that the above features are solely derived from the histograms, which isrelatively easier to obtain and has no hard constraints for sample rate. Spectrogramis, on the other hand, highly demanding in terms of both processing power andsample rate. The dependence on spectrogram will potentially limit the applicationson low-end devices, hence the preference of features from histograms only.

The relationship between the selected features and the technologies are sum-marized in Table 4.1. As each of the technologies has at least one stable feature,the road towards automated signal recognition should be clear.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 93

4.5.2 Algorithm

The algorithm for signal classification is summarized in the pseudo code below.First, Wi-Fi is recognized if the RSSI contains large amount of noise and has suf-ficient standard deviation, the latter condition is used to distinguish Wi-Fi signalfrom noise. Next, the LTE signal is identified when the standard deviation is abovea predefined threshold. Then, when the previous condition is not met, and thenumber of peaks in the RSSI histogram is below certain threshold, the signal isconsidered to be DVB-T; otherwise it is classified as unknown.

algorithm 1: RSSI-based technology identification

Input:−→R // a vector of RSSI measurements

Output: sig // the identified signal typeVariables:−→H ← Histogram(

−→R )

stddev ← StdDeviation(−→R )

noiseloc← LocOfLeftmostPeak(−→H )

noisepeak ← AmpOfLeftmostPeak(−→H )

npks← TotalNumOfPeaks(−→H )

Function:if noiseloc ≤ THR NL & noisepeak ≥ THR NP then

if stddev ≥Wi-Fi.mindev thensig ←Wi-Fi

elsesig ← noise

end ifelse

if stddev ≥ ( LTE.mindev + DVB-T.maxdev )/2 thensig ← LTE

elseif npks ≤ DVB-T.maxpks then

sig ← DVB-Telse

sig ← unknownend if

end ifend if

The algorithm involves several thresholds in the decision making process, whichare determined as follows:

• THR NL is the upper bound of average noise level, obtained by the maxi-mum ‘noise loc’ in the collected Wi-Fi traces plus the standard deviation of

94 CHAPTER 4

the ‘noise loc’.

• THR NP determines the minimal amount of noise present in the Wi-Fi’sRSSI measurements. It is calculated by the smallest ‘noise peak’ minus thestandard deviation of the noise peaks in the Wi-Fi’s RSSI measurements.

• Wi-Fi.mindev denotes the minimum standard deviation among the collectedRSSI measurements of Wi-Fi, which is used to differentiate Wi-Fi fromnoise.

• ( LTE.mindev + DVB-T.maxdev )/2 denotes the medium of the minimumand the maximum standard deviation of LTE and DVB-T’s RSSI measure-ments, respectively. It is used to differentiate LTE and DVB-T signal.

• DVB-T.maxpks denotes the maximum number of peaks in the histogramsof the RSSI measurements of DVB-T. It is used to exclude unknown signalsfrom the DVB-T signals.

4.5.3 Validation

Additional measurements are collected at 3 locations, in the early afternoon of2 consecutive days. The target signals are identical as before, namely the Wi-Fioffice network at 5540 MHz, the LTE downlink signal at 806 MHz and the DVB-T signal at 482 MHz. All measurements are conducted in an office building of12x80m. To increase the diversity of signal strength, the measurement locationsare placed on the north, east, and west side of the building respectively. Each day,10 traces are collected per location and per technology. A trace contains 1×106 IQsamples, obtained by USRP for a duration of 1 second, at the ADC sample rate of1 MHz. Note that 1 MHz falls within the bandwidth capability of common small-scale wireless devices, such as Zigbee (above 2 MHz) and Bluetooth (1 MHz). Intotal 180 traces are collected, consisting of 60 traces per technology.

RSSI is derived according to Equation 4.1. First, the performance for N = 20,during the observation time of 1 second, is analyzed. Then we extend the eval-uation for N ∈ [20, 320], incremented at the step of 20. In our solution, largeN corresponds to a longer average interval, hence lower update frequency of theRSSI measurements. The analysis for variable N is important, as developers onconstrained devices usually do not have direct access to the raw IQ samples, RSSIis provided by accessing a register or other types of interface towards hardwaremodules, which have a limited access rate. For instance, the TelosB sensor plat-form allows the RSSI register to be read at the rate of 32.15 kHz after customiza-tion [21], while the solution in [22] only refreshes RSSI at 11.3 kHz5. Therefore,

5Note that this is the rate at which the RSSI register can be accessed, it is not the sample rate usedby the ADC on the RF front-end.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 95

how often RSSI needs to be updated, has a strong impact on the feasibility of im-plementing the solution on constrained devices. Additionally, we also evaluate theimpact of the total observation time — the time interval during which the RSSIseries are derived, denoted as T — on the detection accuracy. This is helpful toexplore the minimum waiting time needed for the algorithm to achieve a givenrecognition accuracy.

We use 3-fold cross-validation to evaluate performance for all the chosen Nand T settings. In each round of the validation, the RSSI traces of a given technol-ogy are divided into two parts: 70% of the data are used as training data to derivethresholds used in the algorithm, while the remaining 30% are used to validate ifthe signal is correctly classified. This process is repeated three times, each timedifferent portions of the traces are used for training and validation, respectively.

4.5.3.1 Analysis for N=20, T=1 second

The recognition results are averaged over three rounds, and presented in the formof a confusion matrix in Table 4.2, where a row represents the actual technologytype of a given RSSI trace, and a column represents a technology type determinedby the algorithm. For all three technologies, the probability of true positive in theconfusion matrix is above 90%, which proves that the predicted technology typesare highly consistent with the actual ones. All RSSI traces of LTE signals arecorrectly classified, whereas 1.85% of the DVB-T and 1.85% of WiFi traces arefalsely predicted as LTE, leading to in total 3.7% false positives for LTE. This in-dicates that the thresholds for determining std dev and noisepeak can be improvedto more accurately distinguish LTE from the other technologies.

In Table 4.2, the most prediction errors appear for the case of Wi-Fi. This isbecause Wi-Fi is an indoor technology, consisting of multiple transmitters spreadover the measurement sites, making its RSSI most sensitive to the influence oflocations. As a matter of fact, one measurement location is relatively far from theAP’s, and has no work station in the immediate surrounding. Consequently, theRSSI traces obtained at this location have smaller standard deviation. When noneof the traces from this location is included in the training data, the probabilityto classify them as noise increases, which explains the high false positive rateof noise. Likewise, when the training data primarily consists of RSSI obtainedat a remote location, the percentage of noise samples in the training data rises,leading to a higher THR NP. The increased threshold is likely to exclude the tracesobtained at busier Wi-Fi areas, causing them to be further classified as either LTEor unknown signal.

96 CHAPTER 4

Table 4.2: Confusion matrix of the measurement results, for N=20, T=1 second.

PPPPPPPPActPre

Wi-Fi LTE DVB-T Noise Unknown

Wi-Fi 92.6% 1.85 % 0% 3.70% 1.85%

LTE 0% 100% 0% 0% 0%

DVB-T 0% 1.85% 98.15% 0% 0%

Noise 0% 0% 0% 0% 0%

Unknown 0% 0% 0% 0% 0%

4.5.3.2 Analysis for variable N

Previous analysis details the performance of the algorithm in the form of a con-fusion matrix. Ideally, confusion matrices for each case of N (i.e. the number ofIQ samples used to derive an RSSI) should be presented for a full-scale analysis.However, that would introduce too much details and make it hard to perform effec-tive comparison. Hence, only the true positive rate of each technology is plottedin Figure 4.9. All results are obtained when T=1 second. Given the 1 MHz ADCsample rate, the average interval N

1MHz has the same numerical value as N in µs.

Despite some local fluctuations, there is a clear trend of performance degra-dation due the increment of N . This is because larger average interval filters outthe fast changes of RSSI in time domain. As a result, the standard deviation isreduced, which is the main feature used to identify LTE and Wi-Fi. When theaveraging interval reaches 160 µs (approximately 2 times the LTE symbol time6),the recognition accuracy for LTE starts to drop drastically, due the incapability todistinguish signal variations between symbols. The detection rate for Wi-Fi re-mains above 90% until the interval reaches 280 µs, which is approximately halfof the duration of a Wi-Fi beacon packet. The large average window blurs theboundary between noise and signal, which makes noisepeak in the histogram lesspronounced, and consequently the recognition of Wi-Fi becomes more difficult.As DVB-T’s signal is stable in time domain, its recognition performance is leastaffected by the averaging length. However, for a range of IQ samples collectedin a given time frame, larger average windows reduce the quantity of RSSI mea-surements. From the statistical point of view, training processes based on smallerpopulation are less reliable. Hence, the recognition rate of DVB-T also decreaseseventually.

6An OFDM symbol time in LTE can last for 71.4 µs with normal cyclic prefix, or 83.3 µs withextended cyclic prefix.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 97

0 50 100 150 200 250 300 35070

75

80

85

90

95

100

RSSI average interval (us)

Tru

e po

sitiv

e ra

te (

%)

wifiltedvbt

Figure 4.9: The true positive rate versus the average interval of RSSI measurements forT=1 second. Because the IQ samples are acquired at 1 MHz, the interval N

1MHzhas the

same numeric value as the window size N in µs.

4.5.3.3 Analysis for variable T

Figure 4.10 depicts the true positive rate of each technology with respect to thetotal observation time T for N=160. T is varied exponentially, according to T =

( 12 )n second, where n = 0, 1, .., 9. Generally speaking, the recognition accuracy

decreases when the observation time is shortened. When a comparison is madeamong technologies, the recognition rate of Wi-Fi is most sensitive to the variationof T . This is logical, as Wi-Fi signal consists of random bursts, during a shorterinterval, the chances to capture Wi-Fi packets reduce, hence the higher probabilityof being categorized as noise. The shrinking of observation time does not seemto hinder LTE’s recognition until it hits 2 ms, which is equal to the duration of2 LTE subframes, and represented by merely 12 RSSI data points7. In this case,the RSSI sequence does not have sufficient diversity to make a distinction betweenLTE and DVB-T any more. DVB-T’s recognition is rather independent from theobservation time, again thanks to its stable feature in time domain. Although thereare some local fluctuations, due to the fact that it is more difficult to do reliableprediction based on smaller amount of RSSI data points in a short duration.

4.5.3.4 Summary

In general, the experimental validation gives promising results for identifyingwide-band technologies on narrow-band devices. The detailed study of the con-

7For N=160, round(2ms/160µs) = 12

98 CHAPTER 4

10−3

10−2

10−1

100

20

30

40

50

60

70

80

90

100

Total observation time (s)

Tru

e po

sitiv

e ra

te (

%)

wifiltedvbt

Figure 4.10: The true positive rate versus the total observation time, for N=160.

fusion matrix exposes some limitations of the proposed algorithm, including thedifficulty to cope with the variations of Wi-Fi signal in the indoor environment.These limitations indicate the importance of including sufficient diversities in thetraining data, and eventually the need for more dynamic algorithms.

The analysis of true positive rate with respect to N and T , unveils the condi-tions for the algorithm to function properly, which is when the average interval ofRSSI is kept below 200 µs, and the observation time is above 50 ms. Recall thatthe sensor platforms used by [22] and [21] allows RSSI to be collected at 11.3 kHzand 31.25 kHz, respectively. The 200 µs ( 1

200µs = 5kHz) requirement can clearlybe supported on these devices. [21] states a minimum observation time of 2.9 ms,which suffices for the purpose of identifying only Zigbee signal8. Solutions aimingfor classification of multiple technologies generally rely on longer observation pe-riod, ranging from 100 ms [23] to several seconds [22], or multiple days for nonereal-time applications [15]. Therefore the period of 50 ms is considerably shorterthan most existing solutions, and hence suitable for making real-time decisions inthe context of dynamic spectrum sharing.

Note that we deliberately choose not to involve direct comparison of recogni-tion accuracy, because there is no fair way to compare solutions aiming to distin-guish different sets of technologies. Instead, we focus on the system requirements(e.g., ADC sample rate, RSSI update interval), to demonstrate the feasibility ofintegrating the features proposed in this work into existing solutions.

8The minimum packet interval of Zigbee is 2.8 ms.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 99

4.6 Conclusions and future workThis work shows that the received signal strength is not only affected by the dis-continuity of signals in time domain, but also by the variation of carriers in fre-quency domain. Due to the diverse modulation schemes and medium access con-trol mechanisms, probability distributions of RSSI from many real-life technolo-gies exhibit highly distinctive features. Experimental studies show that these fea-tures remain visible when RSSI is computed from samples acquired at sub-Nyquistsampling rate, which is ideal for narrow-band devices to recognize wideband tech-nologies. Based on this observation, an algorithm is proposed to distinguish threerepresentative technologies (i.e., Wi-Fi, LTE, and DVB-T), all of which are ac-tively involved in the context of dynamic spectrum access. The algorithm is val-idated experimentally, the results show that more than 90% recognition accuracycan be reached under the condition of 1 MHz ADC sample rate, 5 kHz RSSI col-lection rate, and 50 ms observation time. Literature studies show that these settingsare supported by several small-scale and narrow-band devices, which fulfills theinitial target of this work.

The limitations of this work can be addressed from two aspects: (i) the em-ployed algorithm relies on several predetermined thresholds in the decision mak-ing process, which could be dynamically adjusted by involving machine learningtechniques; (ii) the study of RSSI’s probability distribution should be extended toaddress more technologies, which is certainly an action point for the subsequentwork. Though for technologies with both similar modulation schemes and mediumcontrol mechanisms, the features extracted solely from probability distribution ofRSSI may no longer suffice, in this case, other characteristics, such as inter-packetinterval [20], should be integrated.

In the scope of RSSI-based technology recognition, this work is complimen-tary to previous solutions in the sense that, we consider a different set of technolo-gies, and use different features. More generally speaking, the probability distri-bution of RSSI is generic and easy to analyze, yet the derived features are highlyflexible in terms of hardware and system requirements. We believe these findingsare valuable to identify wideband technologies on constrained devices, for the op-timization of spectrum sharing in the next generation wireless networks.

AcknowledgmentThe research leading to these results has received funding from the EuropeanUnion’s Seventh Framework Programme FP7/2007-2013 under grant agreementn 258301 (CREW project).

100 CHAPTER 4

References

[1] C. Park and T. S. Rappaport. Short-range wireless communications for next-generation networks: UWB, 60 GHz millimeter-wave WPAN, and ZigBee.Wireless Communications, IEEE, 14(4):70–78, 2007.

[2] E. Larsson, O. Edfors, F. Tufvesson, and T. Marzetta. Massive MIMO for nextgeneration wireless systems. Communications Magazine, IEEE, 52(2):186–195, 2014.

[3] M. Song, C. Xin, Y. Zhao, and X. Cheng. Dynamic spectrum access:from cognitive radio to network radio. Wireless Communications, IEEE,19(1):23–29, 2012.

[4] L. Berlemann and S. Mangold. Cognitive Radio and Dynamic SpectrumAccess. Wiley Online Library, 2009.

[5] J. Kruys. Co-existence of dissimilar wireless systems. Cisco Systems report,2003.

[6] R. Zhang, M. Wang, L. X. Cai, Z. Zheng, and X. Shen. LTE-unlicensed: thefuture of spectrum aggregation for cellular networks. Wireless Communica-tions, IEEE, 22(3):150–159, 2015.

[7] A. S. Kozal, M. Merabti, and F. Bouhafs. An improved energy detectionscheme for cognitive radio networks in low SNR region. In Computers andCommunications (ISCC), 2012 IEEE Symposium on, pages 000684–000689.IEEE, 2012.

[8] K. Kim, Y. Xin, and S. Rangarajan. Energy detection based spectrum sensingfor cognitive radio: An experimental study. In Global TelecommunicationsConference (GLOBECOM 2010), 2010 IEEE, pages 1–5. IEEE, 2010.

[9] H. Zhang, X. Chu, W. Guo, and S. Wang. Coexistence of Wi-Fi and hetero-geneous small cell networks sharing unlicensed spectrum. CommunicationsMagazine, IEEE, 53(3):158–164, 2015.

[10] W. Mansouri, K. Mnif, F. Zarai, M. S. Obaidat, and L. Kamoun. A newmulti-rat scheduling algorithm for heterogeneous wireless networks. Journalof Systems and Software, 115:174–184, 2016.

[11] O. Galinina, A. Pyattaev, S. Andreev, M. Dohler, and Y. Koucheryavy. 5Gmulti-RAT LTE-WiFi ultra-dense small cells: performance dynamics, archi-tecture, and trends. IEEE Journal on Selected Areas in Communications,33(6):1224–1240, 2015.

TECHNOLOGY RECOGNITION BASED ON RSSI DISTRIBUTION 101

[12] I. F. Akyildiz, W.-Y. Lee, M. C. Vuran, and S. Mohanty. A survey on spectrummanagement in cognitive radio networks. Communications Magazine, IEEE,46(4):40–48, 2008.

[13] H. Arslan. Cognitive radio, software defined radio, and adaptive wirelesssystems, volume 10. Springer, 2007.

[14] W. A. Gardner. Signal interception: a unifying theoretical framework forfeature detection. Communications, IEEE Transactions on, 36(8):897–906,1988.

[15] M. Zheleva, R. Chandra, A. Chowdhery, A. Kapoor, and P. Garnett. TxMiner:Identifying transmitters in real-world spectrum measurements. In DynamicSpectrum Access Networks (DySPAN), 2015 IEEE International Symposiumon, pages 94–105. IEEE, 2015.

[16] A. Haeberlen, E. Flannery, A. M. Ladd, A. Rudys, D. S. Wallach, and L. E.Kavraki. Practical robust localization over large-scale 802.11 wireless net-works. In Proceedings of the 10th annual international conference on Mobilecomputing and networking, pages 70–84. ACM, 2004.

[17] K. Kaemarungsi. Distribution of WLAN received signal strength indicationfor indoor location determination. In Wireless Pervasive Computing, 20061st International Symposium on, pages 6–pp. IEEE, 2006.

[18] J. Luo and X. Zhan. Characterization of smart phone received signal strengthindication for WLAN indoor positioning accuracy improvement. Journal ofNetworks, 9(3):739–746, 2014.

[19] Y. Chapre, P. Mohapatra, S. Jha, and A. Seneviratne. Received signal strengthindicator and its analysis in a typical WLAN system (short paper). In LocalComputer Networks (LCN), 2013 IEEE 38th Conference on, pages 304–307.IEEE, 2013.

[20] S. A. Rajab, W. Balid, M. O. Al Kalaa, and H. H. Refai. Energy detectionand machine learning for the identification of wireless MAC technologies. In2015 International Wireless Communications and Mobile Computing Con-ference (IWCMC), pages 1440–1446. IEEE, 2015.

[21] X. Zheng, Z. Cao, J. Wang, Y. He, and Y. Liu. ZiSense: towards interferenceresilient duty cycling in wireless sensor networks. In Proceedings of the 12thACM Conference on Embedded Network Sensor Systems, pages 119–133.ACM, 2014.

102 CHAPTER 4

[22] M. Hou, F. Ren, C. Lin, and M. Miao. HEIR: Heterogeneous interferencerecognition for wireless sensor networks. In World of Wireless, Mobile andMultimedia Networks (WoWMoM), 2014 IEEE 15th International Sympo-sium on a, pages 1–9. IEEE, 2014.

[23] S. Rayanchu, A. Patro, and S. Banerjee. Airshark: detecting non-WiFi RFdevices using commodity WiFi hardware. In Proceedings of the 2011 ACMSIGCOMM conference on Internet measurement conference, pages 137–154. ACM, 2011.

[24] K. Pahlavan and A. H. Levesque. Wireless information networks, volume 93.John Wiley & Sons, 2005.

[25] E. Research. USRP, Last accessed in March 2016. Available from: http://ettus.com/.

[26] GNURadio, Last accessed in March 2016. Available from: http://gnuradio.org/redmine/projects/gnuradio/wiki.

[27] J. H. Kim and J. K. Lee. Performance of carrier sense multiple access withcollision avoidance protocols in wireless LANs. Wireless Personal Commu-nications, 11(2):161–183, 1999.

[28] H. G. Myung. Technical overview of 3GPP LTE. Polytechnic University ofNew York, 2008.

[29] Anritsu MS2690A Analyzer, Last accessed in March 2016. Avail-able from: http://www.anritsu.com/en-US/Products-Solutions/Products/MS2690A.aspx.

5Assessing the coexistence of

heterogeneous wireless technologieswith an SDR-based signal emulator:a case study of Wi-Fi and Bluetooth

Just like a double-edged sword, the efficiency gained by spectrum sharing comeswith the risk of being interfered by co-located wireless networks. Previously, wefocus on signal detection techniques, which are used to trigger reaction towardsinterference after it is detected. Jet, when the wireless medium is saturated, thesetechniques can no longer prevent connection failures, as the capacity of the phys-ical channel is simply insufficient to meet the demand. In this chapter, we proposeto take ‘proactive’ measures during the planning phase of a network, so that theaforementioned situation can be prevented. We believe, interactions among hetero-geneous technologies are unavoidable in a shared medium, therefore, both reactivemeasures in real time, and proactive measures in the network design phase, shouldbe employed to maximize the benefit of dynamic spectrum access.

? ? ?

W. Liu, E. De Poorter, J. Hoebeke, E. Tanghe, W. Joseph, P.Willemen, M. Mehari, X. Jiao and I. Moerman

Submitted to IEEE Transactions on Wireless Communications

104 CHAPTER 5

Abstract Wireless network deployments in industry often grow organically withnew technologies added over time, among which many use the non-licensed spec-trum to avoid licensing costs. As a result, technologies competing for the samespectrum end up deployed in the same area, causing coexistence problems to man-ifest themselves at a later stage. To avoid unexpected performance degradation,there is a need to evaluate the impact of additional wireless technologies on an ex-isting network before the actual deployment. This work proposes to simplify theimpact assessment by emulating the signals of the potential wireless network witha single Software-Defined Radio (SDR). To evaluate the emulator’s performance,the impact of Bluetooth on Wi-Fi technology is considered as the reference sce-nario. A series of real-life experiments with configurable traffic load and networkscale are conducted to estimate the impact of Bluetooth network on a Wi-Fi link,and the corresponding measurements are repeated with the emulated Bluetoothsignals. To the best knowledge of the authors, we are the first to propose such asolution, and it is shown that the use of our emulator gives a reliable indication ofthe expected impact at the location of the Wi-Fi link. As such, this work providesan important step towards a simple, cost efficient, and reliable solution, to assessthe impact of a wireless network prior to its deployment.

5.1 Introduction

Industrial manufacturing processes utilize an increasing amount of wireless tech-nologies to automate and streamline their production processes, as well as to fa-cilitate stock monitoring in warehouses [1–4]. Typically, wireless technologies areadopted because of their advantages regarding cost, installation time and flexibil-ity, allowing mobile machinery and staff members to stay connected during theproduction process.

However, integrating wireless communication systems in industrial environ-ments is challenging: most industrial network applications have stringent require-ments in terms of stability, robustness, and reaction speed. Moreover, the industrialenvironment is harsh for wireless systems due to the presence of machinery, con-tainers, generally highly reflective metal objects and moving objects or humans [5].Therefore the deployment of wireless networks in industrial environments requirescareful planning. A common work flow for network deployment is depicted as fol-lows: (i) determine the optimal placement of the network infrastructure based onsignal coverage and throughput requirements [6–8]; (ii) deploy the hardware; (iii)use the network; (iv) monitor of the performance; (v) solve the problem if there isany, and partially redesign the network if necessary.

A major shortcoming with this approach is that, the existing network plan-ning tools are typically designed for optimizing a single technology based net-work, and do not take into account the interactions with coexisting heterogeneous

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 105

technologies. In practice, a network usually grows organically with new wirelesstechnologies being introduced over time: for instance, the original Wi-Fi networkis complemented with wearable devices such as Bluetooth headphones or Wire-lessHART monitoring sensors [9]. Since these additional technologies operate inthe same frequency band, they may affect the performance of existing networksin a way that was not foreseen. As such, it is generally difficult (if not impossi-ble) to prevent wireless network issues caused by the coexistence of heterogeneouswireless technologies in the planning phase. Consequently, network problems areoften detected after investments in new devices have been made. These issues areundesired and especially costly for industries, due to the potential interruption ofmanufacturing processes.

Ideally, the assessment of potential network problems of introducing new tech-nologies should take place before rolling out more devices. However, conductinga large-scale test is a complex and costly process, requiring the purchase, deploy-ment and configuration of a large quantity of devices. In conclusion, there is ademand for a simple and cost efficient method to facilitate such kind of testingprior to extending the network. This chapter proposes to simplify the assessmentby reproducing the to-be-deployed network through emulation. The implementa-tion is achieved on an SDR platform [10], which is selected for its flexibility. Themain contributions of this chapter are as follows:

• A novel solution for signal emulation is proposed, capable of generatingRadio Frequency (RF) signals with configurable bandwidth, duration andintensity.

• Multiple signals can be produced by the use of a single radio, offering thepossibility to assess the impact of a distributed network locally.

• The proposed solution is implemented and experimentally validated by eval-uating a coexistence scenario of Wi-Fi and Bluetooth.

The remainder of this chapter is structured as follows: Section 5.2 discussesrelated work from a broad perspective. The basic working principle and the designof the emulator on an actual SDR platform is discussed in Section 5.3. Section5.4 illustrates how Bluetooth signals may be generated using the emulator. After-wards, Section 5.5 presents a series of real-life experiments to estimate the impactof Bluetooth traffic on a Wi-Fi link, the corresponding measurements are repeatedunder the emulated Bluetooth traffic to evaluate the performance of the emulator.Finally, the chapter is concluded in Section 5.6.

106 CHAPTER 5

5.2 Related work

5.2.1 Coexistence solutions

Many studies based on either simulations or experiments have revealed the serious-ness of coexistence problems in the unlicensed wireless spectrum band. For exam-ple, the authors of [11] performed a thorough study of the interactions between Wi-Fi and Zigbee, showing that up to 60% packet loss can be introduced in the Wi-Finetwork due to Zigbee’s interference, depending on the physical topologies, chan-nel overlapping conditions as well as the traffic load of both technologies. Manytechniques are proposed in [12], [13], [14], and [15] to solve the mutual inter-ference between Bluetooth and Wi-Fi, among which applying interference-awarechannel scheduling is most commonly used. To some extent, these techniques alleffectively mitigate the interference caused by other technologies. However, theyare designed from the perspective of individual standard/technology, and are hencemore suitable to use as amendments of these technologies, rather than optimizing anetwork or anticipating cross technology interference in a particular environment.

5.2.2 Network planning

Wireless network planning tools are used to determine the optimal network place-ment and configuration given a range of constraints. The common objectives ofthese tools are the optimization of network capacity, signal coverage and powerconsumption. Examples of planning tools include [16–18] for optimizing the lay-out of Wi-Fi access points while [19] focuses more on cellar networks. Method-ologies in [20] take area, terrain and population information as input to determinethe optimal configurations of a wireless network via simulations. In addition tomodeling physical layer aspects, [21, 22] improve the planning techniques by in-cluding the network layer statistics. Although a wide range of commercial andresearch oriented tools exist, they typically lack the capability to predict the im-pact of multiple interfering technologies.

5.2.3 SDR applications

SDRs can be used to implement different technologies thanks to their reconfig-urability. The authors from [25] presents a Zigbee implementation in GNU Radio,while [23, 24] introduce comparable implementations for Wi-Fi. Apart from build-ing existing standards, SDRs can also be used as tools for spectrum analysis [26]and device testing. For instance, the Multi-UE TM500 product family [27] re-leased by Aeroflex specializes in Base Stations (BS) testing. Built upon a flexibleSDR platform, a single TM500 device can produce signals from up to 32 UserEquipments (UE), and it can simulate the fading environment per UE. There are

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 107

Figure 5.1: Emulation concept: replacing the Network To-be-Deployed (NTD) by theemulator to examine its impact on the original network or ‘System Under Test’ (SUT).

two fundamental differences between TM500 and the emulator proposed in thiswork: (i) TM500 is targeted for lab testing, i.e. the BS should be directly con-nected to the TM500 via cables, otherwise the controlled fading environment willlose its validity; while the emulator is meant for measurements in real environ-ments (such as a factory), the emulated signals travel wirelessly to the network un-der test, which is kept untouched in their working condition; as a result, the chan-nel impairments are introduced by the wireless medium directly; (ii) the TM500is used to test devices from the same technology, hence the signals are formed byreal packets; on the contrary, the emulator is designed for impact analysis on het-erogeneous technologies, its signal will not be decoded by any device, thus it issimply emulated by a burst of energy during certain frequency and time interval;it is also thanks to this simplicity that the emulator can be reconfigured to generatedifferent types of signals. In short, though the TM500 product family is capable ofproducing signals from multiple devices, it does have a different purpose and re-alization approach than this work. To the best of our knowledge, SDR devices arenot yet used for physical layer emulation and nor for network planning in general.

5.3 Design of the emulator

This section focuses on the design aspects of the emulator. First, the general con-cept of the emulator is presented. Next, the selected SDR platform is introduced.Then, the basic working principle of the design is given, and finally the data pro-cessing blocks of the emulator are described comprehensively.

5.3.1 General concept

The general concept of the emulator is depicted in Figure 5.1. The overall networkconsists of the network to be deployed (NTD) and the existing network, referred toas the System Under Test (SUT). The NTD is emulated and its impact on the SUT

108 CHAPTER 5

is assessed. In order for the emulation approach to be successful, the followingrequirements must be fulfilled:

• simplicity: the effort to set up the emulated network should be limited andthe usage should be straight-forward;

• cost efficiency: the cost to purchase and set up such an emulated networkshould be significantly lower than purchasing and configuring the NTD;

• flexibility: the emulator should be reconfigurable to emulate different net-work scales, traffic scenarios;

• reliability: from the perspective of the SUT, the emulated network mustsufficiently resemble the NTD so that the observed impact on the SUT isveracious.

Considering flexibility, SDR devices are ideal platforms for implementing the em-ulator. Nowadays, large varieties of commercial SDR devices exist on the market,making it financially feasible to emulate the NTD with SDR platforms.

As for simplicity, the advantage of a centralized emulator is evident. However,due to the difference in power distribution, propagation and channel impairments(e.g., multipath and fading), the signal from a single transmitter will never be thesame as what is generated by distributed devices. Consequently the impact of theemulated network will also not be identical to the NTD. Though, this does notmean that the centralized emulation approach is of no use:

(i) Concerning power distribution, as long as the impact of the emulator iscomparable to the NTD on SUT devices in its vicinity, it is sufficient to state thatthe emulator can cause equivalent local impact. In many cases, this local effect canbe extrapolated to the entire SUT: if the emulator has an impact in certain area, thedistributed NTD will likely have an impact over larger area; the other way aroundis not necessarily true, if there is no impact from the emulator at one location, itdoes not mean that SUT can tolerate the impact of a large-scale deployment. In thelatter case, measurements may be conducted at multiple locations to enhance thereliability of the interference tolerance test. Additional intelligence can be appliedto fine tune the measurement locations, among other settings, to obtain a moreaccurate prediction of the global impact on the existing network. The bottom lineis that, the number of devices for emulation is significantly lower than the numberof devices in the NTD, ensuring the benefit of using the emulator.

(ii) Concerning the channel and propagation impairments, the emulated signalsare exposed to the same environment as the NTD, as a result, they will experiencesimilar channel conditions; though some effects, such as multipath, are very sen-sitive to locations. In this aspect, a centralized emulator has rather different effect

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 109

Table 5.1: The main characteristic of the WARP SDR platform.

RF range Sample rate FPGA Processor

2.4 & 5 GHz ISM 40 Msps Virtex-4 2 PowerPCs

than the distributed NTD. Essentially, these impairments cause the signal to fluc-tuate and disperse in the frequency and time domain, which are arguably unim-portant for a system that is not decoding the signal. Additionally, the prerequisiteof introducing realistic impairments is accurate measurements of the channel con-dition. In practice, characterizing effects such as multipath requires professionalinstruments and large amount of statistical analysis, which is not always feasible,and incompatible with the simplicity requirement. Without accurate measurement,introducing artificial defects into the emulated signal may eventually lower the re-liability of the emulation rather than improving it.

In short, despite the differences in power distribution, propagation, and chan-nel conditions, it is still advantageous to have a centralized SDR-based emulator asa simple, flexible, and cost efficient solution. The remainder of this chapter inves-tigates whether a single SDR can emulate the impact of a network with multipledevices at a given location in a reliable way.

5.3.2 Implementation platform5.3.2.1 Hardware

The Wireless open-Access Research Platform (WARP) [28] contains amongst oth-ers a Xilinx Virtex-4 (XC4VFX100) Field Programmable Gate Array (FPGA)[29], with 2 dedicated PowerPC (PPC) [30] CPU’s, and a Gigabit-Ethernet periph-eral. Additionally, there are 4 expansion slots for radio boards, and 1 expansionslot for a clock board, as shown in Figure 5.2. The main characteristics of theboard are summarized in Table 5.1.

5.3.2.2 Software

The implementation is based on the WARPLab v6.3 reference design [28]. It usesthe WARP board as a node in a private IP network to transmit and capture burstsof samples. The high level diagram of the system is shown in Figure 5.3-a. TheWARP Lab buffer is a hardware block implemented on FPGA to exchange datawith the radio board. The host interface is achieved with the C language. Thecommands issued by the host PC are parsed by the firmware on the PPC and thenexecuted. In short, the reference design is an embedded system that can interactwith a host computer. From a developer’s point of view, there are three parts tobe implemented: the hardware built on FPGA, the firmware running on the PPC

110 CHAPTER 5

Figure 5.2: The WARP SDR platform, with virtex-4 FPGA and 4 radio slots.

Figure 5.3: (a) The high level block diagram vs (b) the details of the design.

processor, and the commands running on the host PC. The System Generator soft-ware [31] is used to facilitate high level modifications of peripherals implementedon the FPGA, in particular the WARP Lab buffer illustrated in Figure 5.3.

5.3.3 High-level design of the emulator

The high level design of the emulator is inspired by the concept of resource blocksin the Long Term Evolution (LTE) technology [32]. An emulated RF signal isrealized by a finite range of OFDM symbols and subcarriers, just like a resourceblock in LTE. In this way: (i) the bandwidth of the signal can be controlled by

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 111

Figure 5.4: Using the concept of resource block in LTE to emulate multiple concurrentsignals with different duration and intensity.

the number of continuously occupied subcarriers; (ii) the duration of the signal isdefined by the amount of OFDM symbols; (iii) the concurrent signals on differentchannels can be generated as separate groups of occupied subcarriers; (iv) thecombined power from signals that appear simultaneously on the same frequency iscalculated as sum of the magnitude of the individual subcarriers; (v) similarly, theintensity of the signals can be controlled by the magnitudes of the different groupsof subcarriers. Thus, the emulator is not limited to any specific type of signal, andis capable of emulating the behavior of multiple transmitters.

Figure 5.4 displays the Power Spectral Density (PSD) of two emulated signalswith different magnitude and timespan. The duration of a symbol (∆t), and thespacing between the adjacent subcarriers (∆f ), are the resolution of the emulatedsignal’s transmission time and bandwidth, respectively. As the boundaries betweendifferent OFDM symbols are invisible to the SUT, the observed power spectrumin time domain is simply the dashed orange rectangle. Similarly, when ∆f issmaller than the resolution bandwidth of the SUT, the PSD observed by the SUTin frequency domain becomes a continuous envelope, as illustrated by the dashedred rectangle.

OFDM uses Inverse Fast Fourier Transform (IFFT), which is inserted in themodified WARP Lab buffer as shown earlier in Figure 5.3-a. A 1024-point IFFThas been implemented, it offers 25.6 µs long ∆t and 39 kHz wide ∆f , whichare considerably smaller than the packet length and resolution bandwidth of thecommon wireless technologies (typically 194 µs and 312 kHz for Wi-Fi, 126 µsand 1 MHz for Bluetooth, 352 µs and 2 MHz for Zigbee). In addition, morecustomized blocks are added into the WARP Lab buffer, as depicted Figure 5.3-b,where the tx data buffer serves as the entrance of data on the FPGA.

112 CHAPTER 5

Figure 5.5: The processing blocks of the emulator. (i) First, a complex matrix is generatedto describe the spectrogram of the desired signal. (ii) Next, the complex matrix is streamed

to the FPGA on WARP, and a padded matrix is generated according to the signals’bandwidth and transmission time. (iii) Signals with more realistic power spectrum are

created through the use of windowing technique. (iv) Finally, the samples are transformedto time domain via IFFT, and transmitted by the radio.

5.3.4 Processing blocks of the emulator

Data flows through the emulator as follows. First, the host computer producesa complex matrix to describe the spectrogram of the desired signal. Next, thecomplex matrix is streamed from the host PC to the FPGA on the WARP board,and a padded matrix is generated according to the bandwidth and transmission timeof the target technology. Then, signals with more realistic spectrum is obtainedthrough the use of windowing technique. Finally, IFFT is used to transform thedata into time domain samples, which are transmitted by the radio. Each of thesesteps is illustrated in Figure 5.5 and discussed in the next sections.

5.3.4.1 Complex matrix

First, a matrix is used to describe the target signal, where each column representsa fixed bandwidth and each row represents a fixed timespan. The elements ofthe matrix are complex, which is consistent with the input format of the WARPplatform, The squared magnitude of the complex number controls the intensity ofan emulated signal. When no signal is present, ‘0’ is entered at the corresponding

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 113

Figure 5.6: Using window coefficients to obtain more realistic spectrum envelop.

location of the matrix.

5.3.4.2 Padded matrix

Next, the complex matrix is written into the tx data buffer in the FPGA (see Figure5.3-b). The tx data buffer is a dual port random access memory (RAM), one portis accessible by the host PC while the other port is used to provide data for fur-ther processing on the FPGA. The addr generator produces address for the tx databuffer with two levels of repetitions. The first level (M times repetition of a col-umn) ensures that the emulated signal has the correct bandwidth. After this levelrepetition, a row is padded so that its length is equal to the IFFT size. The secondlevel (N times repetition of a padded row) ensures that the signal is transmitted forthe expected time duration. The values of M and N are controlled by registers,which are readily configurable from the host computer, offering the flexibilities toemulate signals with different bandwidth and duration. The addr generator resetsthe output when the padded matrix is completely generated. The period of thenon-repeated transmission depends on the dimension of the padded matrix and thedepth of the tx data buffer, which is 128 k in the current design.

5.3.4.3 Windowed matrix

Due to the first level repetition, the subcarriers within an emulated signal haveidentical amplitudes, leading to a squared spectrum envelop, as shown in Figure5.6-a. Since most wireless technologies apply certain pulse shaping techniques,the squared spectrum does not match envelops of the real signals. To resolve thisissue, the M subcarriers are scaled with M coefficients independently, as shownin Figure 5.6-b. The coefficients are stored in the envelop coefficient buffer (seeFigure 5.3-b), which is also a dual-port RAM accessible by both host PC and thehardware logic on the FPGA.

114 CHAPTER 5

5.3.4.4 Time domain signal

Finally the windowed matrix is fed into the IFFT row by row. The time domainsamples produced by IFFT are converted to analog signal, and transmitted by theradio.

5.4 Bluetooth Emulation

There are two motivations to select Bluetooth as the emulation target: first, thecoexistence problem of Wi-Fi and Bluetooth is commonly observed in daily life[11–13]; secondly, the Frequency Hopping Spread Spectrum used by Bluetooth isideal to demonstrate the precise control of the emulated signal in both frequencyand time domain.

5.4.1 Bluetooth characteristics

The emulation target is confined to Bluetooth 3.0 [34]. There are in total 79 Blue-tooth channels, each occupies 1 MHz wide spectrum. Bluetooth transceivers mayhop to a new channel every 625 µs, which is the base of the transmission slot. Agroup of connected Bluetooth devices is referred to as a ‘piconet’, which has aspecific frequency hopping sequence [35]. In a piconet, one device is designatedas the master, while the remaining devices, referred to as the slaves, synchronizewith the master’s clock. Time division is used to separate transmission within apiconet. However, devices belonging to different piconets may send at the sametime, or even on the same channel if the hopping sequence converges. Dependingon the type, a packet may occupy one or more transmission slots. The radio re-mains on the same channel when sending a multi-slot packet. A slave waits uponthe reception of a POLL packet from the master to transmit data, which is heldupon the same channel as the received POLL packet; in case of no data to send,a NULL packet is generated instead. POLL packets are sent approximately every20 ms to keep the slaves synchronized. Bluetooth piconets rely on different fre-quency hopping sequences to share the medium, instead of the carrier sensing andback-off mechanisms, commonly adopted by many technologies. For this reason,the emulation is achieved without carrier sensing modules.

5.4.2 Generate the complex matrix

5.4.2.1 Define the resolution and dimension

We start from a basic matrix with 79 columns, each representing a Bluetooth chan-nel. Since there is limited amount of memory on the FPGA, more channels (morecolumns) means shorter duration of non-repeating transmission time (less rows).

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 115

Figure 5.7: The shift between transmission slots from independent piconets.

Hence, only 20 out of the 79 columns are kept in the complex matrix to observe theimpact on 1 Wi-Fi channel (20 MHz). Though, the basic matrix of 79 columns areused in the generation process on the host computer to keep the emulation realistic.

The determination of the timespan represented by a row involves several fac-tors. It is initially set to the basic transmission slot of 625 µs. However, thisimplicitly assumes that (i) all piconets’ transmission slots are aligned, and (ii) allpackets last for multiples of 625 µs. In reality, individual piconets are not syn-chronized, hence the transmission slots are shifted in time, as illustrated in Figure5.7. Furthermore, some packets only occupy a fraction of a transmission slot, e.g.,the frequently occurring POLL packet only lasts for 126 µs. Thus, the timespanrepresented by a row should be considerably smaller than 625 µs. Though, againdue to the memory constraint, reducing the timespan of each row would decreasethe overall non-repeating transmission period. As a compromise, we use a row torepresent only a fifth of the transmission slot (125 µs), which is approximately thelength of a POLL packet. This setting allows more precise emulation of packetlength, and the time shifts among the piconets. However, rather than continuousvariation, the time offsets are now quantized in 5 discrete levels. The influence ofthis difference is observed and analyzed in Section 5.5.

5.4.2.2 Basic emulation

Every emulated piconet is assigned with (i) a random sequence of channel indexes(within 1 to 79) to emulate the frequency hopping behavior, (ii) an arbitrary offset(out of the 5 slots) to model the time shifts among piconets, and (iii) a magnitudeto represent the difference in received signal strength, as explained in the nextsection. A data packet in the matrix is preceded by a POLL packet in the samecolumn. If an entry belongs to multiple packets, it takes the sum of the magnitudesof the collided signals.

5.4.2.3 Topology control

The magnitude of a piconet is calculated based on (i) the distance between thevictim network and the emulated piconet, and (ii) the path loss model of the mea-

116 CHAPTER 5

surement environment. In our case, the basic log-distance path loss model is ap-plied [36], though more accurate models based on either existing studies [37] ormeasurements on site, could be used to improve the emulation quality.

5.4.2.4 Traffic control

Bluetooth has various link and modulation types, which are closely related to thethroughput performance. For the case of Asynchronous Connection Link (ACL)[38], packets may last for 1, 3, or 5 transmission slots, and may contain variousamount of payload as a result of the Forward Error Correction (FEC) [39]. Mod-eling the exact packet generation process is bound to be highly complex, whichreduces the benefit of emulation.

Instead, we assume that all data packets have a middle-ranged payload size(320 bytes, transmitted over 3 slots) and a middle-ranged physical layer data rate1.By applying the above assumptions, the average amount of data packets sent by apiconet (Npacket) in a given time becomes proportional to the required throughput(TPreq), as depicted in Equation 5.1.

Npacket = round(TPreqPayload

), (5.1)

This means a data packet should occur roughly every 4 transmission slots to emu-late the throughput of 1 Mb/s, given that the upper layer protocol produces trafficin a uniform way. In case there is no data to send within 20 ms when lightertraffic load is being emulated, a pair of NULL and POLL packets is generated in-stead. More sophisticated traffic pattern can be realized by varying the distributionof packets across rows or reduce the level of simplification when designing thematrix, though at the cost of increased complexity.

5.4.3 Define the dimension of Padded matrix

The objective in this stage is to define the amount of repetitions in the frequencyand time domain, namely the values of M and N . Recall that the emulator’sfrequency resolution is 39 kHz, and time resolution is 25.6 µs. For a 1 MHzwide Bluetooth channel, M is calculated as round( 1000

39 ) = 26, meaning that anemulated Bluetooth signal consists of 26 subcarriers. Similarly, the time slot of125 µs is approximated by the transmission of N = round( 125

25.6 ) = 5 paddedrows.

1Bluetooth V3.0 has three types of modulation, GFSK, QPSK, and 8PSK

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 117

−1.5 −1 −0.5 0 0.5 1 1.50

0.2

0.4

0.6

0.8

1

Nominal frequency

Am

plitu

de

Figure 5.8: The ‘window coefficient’ derived from the RRC filter with a roll-off factor of0.4.

5.4.4 Select the window coefficients

Bluetooth 3.0 applies Root Raised Cosine (RRC) filter with a roll off factor of0.4 for pulse shaping [40]. The filter’s nominal frequency response is plotted inFigure 5.8, the points selected as the window coefficients are highlighted with redcircles. As there is no space between adjacent Bluetooth channels, it is impossibleto emulate what is beyond the channel width, hence the window coefficients areselected between [-1, 1].

5.5 Evaluation

This section presents measurements from two locations: a simple experiment in ananechoic chamber, and a large-scale experiment with variable amount of devicesand traffic loads in the generic w-iLab.t testbed [41]. The chosen locations arerepresentative in the sense that the anechoic chamber has (ideally) no reflectiveobjects, while the w-iLab.t testbed contains long metal tubes belonging to the ven-tilation system of a clean room situated beneath, as displayed in Figure 5.9. Thecontrast of measurement locations serves to verify the feasibility to emulate sig-nals in different environments by applying the appropriate path loss models, andthe experiments in w-iLab.t testbed aim to examine the emulation of impact fromvariable network scales and traffic loads.

5.5.1 Devices and configurations

The Delock [42] USB dongle (with an internal antenna) is used as the Bluetoothinterface. It is configured via the official Bluetooth protocol stack for linux [43].Each piconet has 1 slave and 1 master, representing the Bluetooth peripheral andthe host it is connected to respectively. A UDP stream is sent from the slave tothe master via the Bluetooth Encapsulated Ethernet Protocol (BNEP) [46] inter-

118 CHAPTER 5

Figure 5.9: The measurement environments: (i) the anechoic chamber (left) and (ii) thew-iLab.t testbed (right).

face. The Wi-Fi interface is configured via the Atheros ath9k driver [44], it hastwo omni-directional antennas: one is placed vertically, and the other one hori-zontally. The victim Wi-Fi link is IEEE 802.11g compliant, it consists of 1 accesspoint (AP) and 1 client. In all subsequent experiments, we configure the clientto push 30 Mb/s UDP traffic towards the AP, which exceeds the measured max-imum throughput of 28 Mb/s 2 when no interference is present. The purpose ofthis setting is twofold: (i) to observe the Wi-Fi’s reaction to Bluetooth interferencewhen it is most sensitive; (ii) to compare the consistency of the emulator with realinterference under the worst case scenario. The iPerf software [47] is used to pro-duce traffic in both Bluetooth and Wi-Fi network. The WARP platform has beendiscussed previously. The antennas of WARP are also omni-directional, verticallyplaced on the same height as the Bluetooth dongles and Wi-Fi antennas.

5.5.2 Experiment in the anechoic chamber

The measurement involves up to 3 pairs of Bluetooth piconets. The master andslave dongles of a piconet are placed 30 cm apart, as displayed in the left part ofFigure 5.9. The slaves of the 3 piconets are located 2.1 m, 2.65 m, and 1.95 m awayfrom the Wi-Fi AP, respectively. Within a piconet, 1 Mb/s UDP stream is pushedfrom the slave to the master. The throughput of Wi-Fi is recorded for 50 seconds,each time when a piconet is activated. Next, all Bluetooth piconets are deactivated,and a WARP SDR is place at the location of the most closeby piconet to the Wi-Filink (the 3rd piconet). The medium path loss to the Wi-Fi link from each piconetis computed based on the distance and the path loss coefficient, which is 2.0 foran anechoic chamber. The received signal strength relative to the 3rd piconet isdisplayed in Figure 5.10-a. As iPerf produces constant traffic load, there is noneed to consider more advanced traffic condition in this measurement. Accordingto Equation 5.1, a data packet is generated every 4 slots to emulate the Bluetooth

2This is the throughput on the application layer.

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 119

Table 5.2: The mean and standard deviation of Wi-Fi throughput under the impact of thereal and the emulated Bluetooth traffic in the anechoic chamber.

1 real 1 emu 2 real 2 emu 3 real 3 emu

mean 21.6 20.5 18.1 18.3 15.9 15.6

STD 0.60 0.68 0.74 0.50 0.58 0.55

Figure 5.10: (a) The relative received signal strength of the emulated piconets, thehorizontal axis indicates the appearance order of the piconets in real Bluetooth

measurements; (b) The boxplot of Wi-Fi throughput, impacted by X real and X emulatedpiconets (X = 1, 2, 3), with fixed traffic load of 1 Mb/s.

traffic load of 1 Mb/s, and the performance of Wi-Fi is recorded accordingly.

The boxplot of Wi-Fi thoughput interfered byX real and emulated piconets aredisplayed side by side in Figure 5.10-b, whereX = 1, 2, 3. The mean and StandardDeviation (STD) of the Wi-Fi throughput are displayed correspondingly in Table5.2. We observe that that up till 3 piconets, the emulated and real Bluetooth traffichave very comparable impact on the Wi-Fi throughput in the anechoic chamber.More detailed discussion is presented in the next section.

5.5.3 Experiment in w-iLab.t testbed

The measurement in w-iLab.t testbed extends the previous experiemnt in the fol-lowing aspects: (i) experiments have different topologies, and are conducted in adifferent environment, (ii) up to 20 (emulated) Bluetooth piconets are involved,(iii) traffic load variations of (emulated) piconets are included, and (iv) in additionto throughput, the jitter of the victim network is also measured.

120 CHAPTER 5

Figure 5.11: The experiment topology: (a) 20 Bluetooth piconets and 1 Wi-Fi link; (b) 1WARP SDR, 1 Wi-Fi link, and measurement locations of the portable Wi-Fi link.

5.5.3.1 Experiment setup

The overall testbed topology forms a grid as shown in Figure 5.11, where eachblue dot (referred to as a node) represents an embedded PC equipped with Wi-Fi,Zigbee and Bluetooth interfaces. The nodes involved are highlighted with logoscorresponding to their roles in the experiment. A USRP N210 [45] is used tocapture samples for spectrum visualization purposes. Additionally, to explore theimpact area of the centralized emulator, a pair of mobile nodes (with identicalhardware as the fixed nodes) are used to represent the victim Wi-Fi link at differentlocations, as indicated in Figure 5.11-b.

The real Bluetooth measurement involves up to 40 nodes to form 20 piconets,as indicated in Figure 5.11-a. The Bluetooth piconets are activated sequentially,the appearance order of the piconets are labeled with numbers. For a given quan-tify of piconets, the throughput of each piconet is varied from 64 kb/s to 1 Mb/s.The Wi-Fi link is placed at the center of the testbed, and its performance (charac-terized by throughput and jitter) is recorded for 50 seconds, for all combinationsof the Bluetooth traffic load and the amount of piconets, leading to in total 100measurements.

Next, the 20 distributed piconets are replaced by 1 WARP board, as indicatedin Figure 5.11-b. The path loss coefficient of the testbed is measured and found to

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 121

Freq (MHz)

Tim

e (m

s)

(a) Real Bluetooth

2400 2405 2410 2415 2420

0

5

10

15

20

25

30

35−80

−75

−70

−65

−60

−55

−50

−45

−40(b) Emulated Bluetooth

Freq (MHz)

Tim

e (m

s)

2400 2405 2410 2415 2420

0

5

10

15

20

25

30

35−80

−75

−70

−65

−60

−55

−50

−45

−40

5 slots

3 slots

overlap

POLL PKT POLL PKT

Figure 5.12: The spectrogram of (a) 10 real piconets, each produces 1 Mb/s traffic, versus(b) 10 emulated piconets, with the same traffic load. The unit of the color axis is dB.

be 1.76 (less than free space due to the presence of metal objects). The mediumpath loss to the victim network from each piconet is computed, and the signalstrength relative to the piconet that is most close to the victim network is used asthe magnitude of a piconet. Based on Equation 5.1, the traffic load of 1 Mb/s, 500kb/s, 250 kb/s, 128 kb/s and 64 kb/s are emulated by producing a data packet every4, 8, 16, 32, 64 transmission slots respectively. In total 100 matrices are generatedaccording to the piconets and the traffic load conditions. The throughput and jitterof the Wi-Fi link are measured under the impact of the emulated Bluetooth signal,for all the matrices.

5.5.3.2 Physical layer inspection

The spectrograms of 10 real piconets with 1 Mb/s traffic load, and 10 emulatedpiconets with the same traffic load, are displayed in Figure 5.12.

Note that the color axis’s unit is dB, as the USRP device is not calibrated. Thespectrogram shows that the emulated Bluetooth signals have the expected band-width, signal strength and the random frequency hopping behavior. In addition,the concurrence of multiple piconets (including the overlapping of packets) aresuccessfully emulated. Exemplary packets are highlighted by text in the graph. Anoticeable difference is that apart from the POLL packets, all emulated packetslast for the same amount of time, while the packet length in the real Bluetooth’sspectrogram varies. This is the consequence of the assumption that all data pack-ets have the same length. The impact of this difference is addressed in the next

122 CHAPTER 5

section.

5.5.3.3 Network layer inspection

Processing method The Wi-Fi’s throughput and jitter measurements are plottedwith respect to the amount of piconets for all the traffic conditions, as shown inFigure 5.13 and Figure 5.15. The common logarithm of the measurements exhibitsa linear relationship with the number of (emulated) piconets. Mathematical modelsbased on the following expression is used to characterize the measurements:

log10(y) = a+ bx, (5.2)

where y denotes either the throughput or jitter of the Wi-Fi link, x denotes thenumber of piconets, a and b are the constant coefficients, representing the inter-ception and the slope of the model, which are listed in Table 5.3 (for throughput)and Table 5.4 (for jitter). Mapping the meaning of the coefficients to the mea-surements, a reveals the amount of throughput or jitter of the Wi-Fi link when noBluetooth traffic is present, while b shows how fast the impact of Bluetooth in-creases with the number of piconets. For this reason, coefficient a remains almostconstant across different Bluetooth traffic loads, while b is clearly related to thetraffic loads.

The STD of Wi-Fi performance is calculated for each measurement, and theratio of the STD under the emulated and the corresponding real BT traffic (denotedas STDemu

STDreal) is displayed in Figure 5.14 (for throughput) and Figure 5.16 (for jitter).

Similar analysis is carried out to compare the Mean Square Error (MSE), with thedifference that the MSEemu is calculated against the mean of the measurementsobtained under the corresponding real Bluetooth traffic.

Throughput Figure 5.13-a shows that the throughput of Wi-Fi is negatively in-fluenced by the increase in both the number of Bluetooth devices and the traf-fic load. The heavier the traffic load of each Bluetooth piconet is, the faster thethroughput decreases with the increment of the piconets. Figure 5.13-b exhibitssimilar performance degradation under the corresponding emulated Bluetooth sig-nal.

Among the 100 measurements, the MSE ratio of 47 cases is below 0 dB, and 71cases fall within the interval [-3,3] dB. This proves that the average Wi-Fi through-put influenced by the real and emulated traffic conditions is comparable for morethan 70% of the cases. However, instances with extreme MSE ratios do exist,e.g. the MSE of 500 kb/s and 20 piconets is 8 dB stronger than its counterpartin the real Bluetooth experiment, as shown in Figure 5.14-a. The exceptionallyhigh MSE ratio indicates a deviation in the mean level. Recall that an emulatedpiconet has a shorter hopping sequence than a real piconet, which causes the com-bined signals to exhibit less randomness over time. The more piconets are being

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 123

0 5 10 15 200

5

10

15

20

25

30

Number of Bluetooth piconets

Wi−

Fi t

hrou

ghpu

t (M

b/s)

(a) Real Bluetooth

1M mdl1M dat500K mdl500K dat250K mdl250K dat128K mdl128K dat64K mdl64K dat

0 5 10 15 200

5

10

15

20

25

30

Number of Bluetooth piconetsW

i−F

i thr

ough

put (

Mb/

s)

(b) Emulated Bluetooth

1M mdl1M dat500K mdl500K dat250K mdl250K dat128K mdl128K dat64K mdl64K dat

Figure 5.13: Wi-Fi throughput performance under the impact of the real and the emulatedBluetooth traffic. The legend “dat” denotes the data points of individual throughput

measurements, while “mdl” refers to the derived mathematical model.

emulated, the more probability of replaying a matrix with biased impact on theWi-Fi network. As a result, fluctuations of the mean throughput and occasionalappearances of extremely high MSE ratios are observed in Figure 5.13-b and Fig-ure 5.14-a, respectively. The extremely small MSE ratios are linked to the varianceof the measurements, which is addressed in combination the STD.

In total, 67 measurements’ STD ratio is below 0 dB, meaning that the majorityof emulated traffic have smaller deviation than their counterparts obtained in thereal Bluetooth experiment. We believe, the assumption of constant packet sizeand the quantization of time shifts among piconets, are responsible for the overalldifference in the STD. Additionally, Figure 5.14-b shows that the small STD ratiois concentrated at the area with heavier traffic load and more piconets. This canbe explained in the same way as the deviation in mean level. Due to the differencein the length of hopping sequence, the growth in the amount of emulated piconetsand traffic load, enlarges the gap of signals’ diversity between the emulated and thereal Bluetooth traffic, as observed in the trend of the STD ratio. Though generallyspeaking, 78% of STD ratios is still within the [-3,3] dB interval, which indicatesthat the overall variation level is acceptable for this experiment.

Jitter Figure 5.15-a shows that the jitter of Wi-Fi network increases with boththe Bluetooth traffic load and the number of Bluetooth devices. The higher thetraffic load within each piconet is, the faster the jitter increases with the growth ofpiconets. Again, a similar trend is observed in Figure 5.15-b. The extreme MSEratios occurred for the traffic load of 500 kb/s can be explained in the same way as

124 CHAPTER 5

Table 5.3: The model of the Wi-Fi throughput under the impact of the real and theemulated Bluetooth traffic.

BT traffic (kb/s) 1000 500 250 128 64

a (real) 1.512 1.548 1.495 1.473 1.465

b (real) -0.066 -0.054 -0.026 -0.014 -0.007

a (emulated) 1.597 1.523 1.483 1.472 1.465

b (emulated) -0.062 -0.051 -0.026 -0.014 -0.007

Number of Bluetooth piconets

Blu

etoo

th tr

affic

load

(kb

/s)

(a) MSE ratio of throughput

5 10 15 20

1000

500

250

128

64

10lo

g 10(M

SE

emu/M

SE

real

) (d

B)

−8

−4

0

4

8

Number of Bluetooth piconets

Blu

etoo

th tr

affic

load

(kb

/s)

(b) STD ratio of throughput

5 10 15 20

1000

500

250

128

64

10lo

g 10(S

TD

emu/S

TD

real

) (d

B)

−4

−2

0

2

4

Figure 5.14: The subplot (a) shows the ratio between the MSE of the Wi-Fi throughputinfluenced by the real Bluetooth network, and the MSE of Wi-Fi throughput affected by thecorresponding emulated Bluetooth network. The subplot (b) shows the ratio of STD in a

similar approach.

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 125

0 5 10 15 200

5

10

15

20

25

Number of Bluetooth piconets

Wi−

Fi j

itter

(m

s)

(a) Real Bluetooth

1M mdl1M dat500K mdl500K dat250K mdl250K dat128K mdl128K dat64K mdl64K dat

0 5 10 15 200

5

10

15

20

25

Number of Bluetooth piconetsW

i−F

i jitt

er (

ms)

(b) Emulated Bluetooth

1M mdl1M dat500K mdl500K dat250K mdl250K dat128K mdl128K dat64K mdl64K dat

Figure 5.15: Wi-Fi jitter performance under the impact of the real and the emulatedBluetooth traffic. The legend “dat” denotes the data points of individual jitter

measurements, while “mdl” refers to the derived mathematical model.

Table 5.4: The model of the Wi-Fi jitter under the impact of the real and the emulatedBluetooth traffic.

BT traffic (kb/s) 1000 500 250 128 64

a (real) -0.577 -0.757 -0.901 -1.030 -1.176

b (real) 0.092 0.088 0.069 0.056 0.048

a (emulated) -0.526 -0.703 -0.866 -1.032 -1.111

b (emulated) 0.086 0.083 0.066 0.058 0.041

the throughput. Though up to 94% MSE ratios and 90% STD ratios fall into the [-3,3] dB interval. As such, we conclude that the Wi-Fi network’s jitter performanceis influenced in a comparable way by both the emulated and the real Bluetoothnetwork.

5.5.3.4 Impact range

In order to explore the impact range of the centralized emulator, a pair of mobilenodes (representing the victim Wi-Fi link) are moved away from the emulator inparallel with each other to the right side of the testbed. Measurement locationsare placed 2 m apart along the moving trajectory, as depicted in Figure 5.11-b.During a measurement, the nodes remain still just like the Wi-Fi link formed bythe fixed nodes. As the mobile devices are powered by batteries, measuring 100

126 CHAPTER 5

Number of Bluetooth piconets

Blu

etoo

th tr

affic

load

(kb

/s)

(a) MSE ratio of jitter

5 10 15 20

1000

500

250

128

64

10lo

g 10(M

SE

emu/M

SE

real

) (d

B)

−8

−4

0

4

8

Number of Bluetooth piconets

Blu

etoo

th tr

affic

load

(kb

/s)

(b) STD ratio of jitter

5 10 15 20

1000

500

250

128

64

10lo

g 10(S

TD

emu/S

TD

real

) (d

B)

−4

−2

0

2

4

Figure 5.16: The subplot (a) shows the ratio between the MSE of the Wi-Fi jitter influencedby the real Bluetooth network, and the MSE of Wi-Fi jitter affected by the correspondingemulated Bluetooth network. Subplot (b) shows the ratio of STD in a similar approach.

traffic scenarios at multiple locations is not feasible. Instead, the influence of asingle scenario (i.e., 10 emulated piconets with 250 kb/s) on the victim Wi-Fi linkis observed to analyze the influence of locations. The average throughput of thevictim Wi-Fi link is plotted in Figure 5.17, with respect to the distance (on thehorizontal axis above) and the Signal to Interference-plus-Noise Ratio (SINR) (onthe horizontal axis below). The SINR is computed based on the received signalstrength measured by the Wi-Fi interface, and the intensity of the emulated signal,obtained as the transmit power of WARP subtracted by the medium path loss at agiven distance.

The throughput curve forms a mirrored ‘L’ shape: it initially increases gentlywith minor fluctuations, once the SINR reaches 12 dB, the throughput rises rapidlywith the increment in distance. It is widely acknowledged that the performanceof a radio receiver is subject to the SINR and the applied Modulation and CodingScheme (MCS). We select a common MCS scheme (QPSK and 3/4 FEC), offeringthe data rate of 18 Mb/s (slightly above the throughput at the first location), toillustrate how drastically Packet Error Rate (PER) may be affected by a smallchange in SINR. According to [48], for the chosen MCS scheme, the Bit ErrorRate (BER) of a IEEE 802.11g receiver is around 10−5 when SINR is at 10 dB,and it drops below 10−6 when the SINR reaches 12 dB. PER can be expressed asfollows:

PER = 1− (1−BER)N , (5.3)

where N denotes the packet size in bits. The packet size in this experiment is de-termined by the Maximum Transfer Unit (MTU) of the Wi-Fi interface (i.e. 1500bytes), because it is considerably smaller than the buffer size of iPerf. SubstitutingN = 1500 into the equation above, we obtain that the PER of a IEEE 802.11g re-ceiver at SINR of 12 dB is below 11%, whereas the PER at SINR of 10 dB reaches69%. The drastic variation in PER explains the sudden change of the throughput

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 127

−3.5 1.8 4.8 7 8.7 10.1 11.3 12.313.216.5

17

17.5

18

18.5

19

19.5

20

20.5

SINR (dB)

Distance (m)W

i−F

i thr

ough

put (

Mb/

s)

2 4 6 8 10 12 14 16 18

Figure 5.17: Throughput of the portable Wi-Fi link under the impact of 10 emulatedpiconets with 250 kb/s traffic load at different locations, with respect to the distance to the

emulator (top axis) and the SINR (bottom axis).

performance at the distance of 14 m.The experiment of Wi-Fi link at multiple locations confirms that the central-

ized emulator has a limited impact range. Though it is also verified that the impactis stable within certain radius, which is around 12 m for our testbed. Note that the12 m radius is not generally applicable, as it is subject to the measurement envi-ronment. Naturally, an environment with lower path loss coefficient will have alarger impact range. The impact range can be estimated using the path loss model,in conjunction with the BER vs SINR performance of the SUT, as demonstratedin this experiment. In short, one need to be aware of the restriction on the impactrange when applying the emulator for field measurements.

5.6 Conclusions and future work

In this chapter, we propose a solution to analyze the impact of a to-be-deployedwireless network on an existing one. This solution is desired for large-scale net-work deployments in industrial environments, where discovering coexistence is-sues among wireless technologies prior to the deployment is of tremendous impor-tance. The key concept is to emulate the signals generated by the to-be-deployednetwork with a single radio device. The centralized solution is preferred for itssimplicity, despite the limited impact range. A network consisting of up to 20Bluetooth piconets is emulated by a single SDR, and the overall impact of the realand the emulated Bluetooth network on a Wi-Fi link is observed to be consistent.

128 CHAPTER 5

This concludes that the emulator can cause reliable local impact on the victimWi-Fi link.

The emulator relies on path loss models to adjust to different environments.The successful emulation of Bluetooth impact in two representative environmentsdemonstrates the effectiveness of this approach. When no regional impact is ob-served, we suggest to repeat measurements at multiple locations to enhance thereliability. The selection of measurement locations is also subject to the environ-ment. Intuitively, to reach a given confidence level of the impact prediction, therequired measurement density in space is higher for an indoor environment witha large amount of obstacles and scatters, than for an empty room. Eventually,the trade-off between measurement complexity and the prediction accuracy can beformulated as an optimization problem, which triggers a valuable research subjecton itself.

The current emulator design is capable of generating signals with configurablebandwidth, duration, and intensity, which offers the potential to emulate technolo-gies other than Bluetooth. Carrier sensing modules should be included to emulatetechnologies with random back-off behavior. A couple of issues, such as the influ-ence of antenna, emulation of mobile transmitters, and the impact of complicationsfrom upper layer protocols, are not addressed or fully examined in this work, due toa combination of practical constraints. Though we have confidence that the mech-anism of using a matrix to describe the spectrogram of the desired signals, offerssufficient flexibility to cope with these issues. For instance, when the antenna ra-diation pattern and position is known, its gain can be calculated and incorporatedinto the matrix generation process; the emulation of mobile nodes can be achievedby adjusting the magnitude of an emulated transmitter across multiple rows in thematrix. In this work, a traffic generator is used to produce constant traffic loadon the application layer. However, more sophisticated application scenarios maycause the traffic load to vary over time. These variations can also be reflected inthe matrix, by distributing the data packet accordingly, or even reduce the level ofsimplification (i.e. constant packet size), to make the emulation more realistic.

AcknowledgmentThe work is supported by FORWARD — a national research project in Belgium,and the involved companies and institutes. The portable test facility is funded bythe European Horizon 2020 Program under grant agreement n645274 (WiSHFULproject). We would also like to acknowledge the FWO-SBO SAMURAI projectfor additional support, and the electromagnetic research group for their generosityof sharing the anechoic chamber.

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 129

References

[1] J. Kjellsson, A. E. Vallestad, R. Steigmann, and D. Dzung. Integration ofa wireless I/O interface for PROFIBUS and PROFINET for factory automa-tion. Industrial Electronics, IEEE Transactions on, 56(10):4279–4287, 2009.

[2] T. Sauter, J. Jasperneite, and L. L. Bello. Towards New Hybrid Networks forIndustrial Automation. In ETFA, volume 9, pages 1141–1148, 2009.

[3] H.-J. Korber, H. Wattar, and G. Scholl. Modular wireless real-time sensor/ac-tuator network for factory automation applications. Industrial Informatics,IEEE Transactions on, 3(2):111–119, 2007.

[4] H. Hayashi, T. Hasegawa, and K. Demachi. Wireless technology for processautomation. In ICCAS-SICE, 2009, pages 4591–4594. IEEE, 2009.

[5] E. Tanghe, W. Joseph, L. Verloock, L. Martens, H. Capoen, K. V. Herwegen,and W. Vantomme. The industrial indoor channel: large-scale and tempo-ral fading at 900, 2400, and 5200 MHz. Wireless Communications, IEEETransactions on, 7(7):2740–2751, 2008.

[6] D. Plets, W. Joseph, K. Vanhecke, E. Tanghe, and L. Martens. Coverageprediction and optimization algorithms for indoor environments. EURASIPJournal on Wireless Communications and Networking, 2012(1):1–23, 2012.

[7] E. C.-C. Lo. An investigation of the impact of signal strength on Wi-Fi linkthroughput through propagation measurement. PhD thesis, Auckland Uni-versity of Technology, 2007.

[8] M. Jain, J. I. Choi, T. Kim, D. Bharadia, S. Seth, K. Srinivasan, P. Levis,S. Katti, and P. Sinha. Practical, real-time, full duplex wireless. In Proceed-ings of the 17th annual international conference on Mobile computing andnetworking, pages 301–312. ACM, 2011.

[9] J. Akerberg, F. Reichenbach, M. Gidlund, and M. Bjorkman. Measurementson an industrial wireless hart network supporting profisafe: A case study.In Emerging Technologies & Factory Automation (ETFA), 2011 IEEE 16thConference on, pages 1–8. IEEE, 2011.

[10] H. Arslan. Cognitive radio, software defined radio, and adaptive wirelesssystems, volume 10. Springer, 2007.

[11] D. Yang, Y. Xu, and M. Gidlund. Wireless coexistence between IEEE 802.11-and IEEE 802.15. 4-based networks: A survey. International Journal of Dis-tributed Sensor Networks, 2011, 2011.

130 CHAPTER 5

[12] N. Golmie, N. Chevrollier, and O. Rebala. Bluetooth and WLAN coexistence:challenges and solutions. Wireless Communications, IEEE, 10(6):22–29,2003.

[13] N. Golmie and O. Rebala. Techniques to Improve the Performance of TCPin a mixed Bluetooth and WLAN Environment. In Communications, 2003.ICC’03. IEEE International Conference on, volume 2, pages 1181–1185.IEEE, 2003.

[14] N. Golmie, N. Chevrollier, and I. ElBakkouri. Interference aware Blue-tooth packet scheduling. In Global Telecommunications Conference, 2001.GLOBECOM’01. IEEE, volume 5, pages 2857–2863. IEEE, 2001.

[15] C. F. Chiasserini and R. R. Rao. Coexistence mechanisms for interferencemitigation between IEEE 802.11 WLANs and Bluetooth. In INFOCOM 2002.Twenty-First Annual Joint Conference of the IEEE Computer and Communi-cations Societies. Proceedings. IEEE, volume 2, pages 590–598. IEEE, 2002.

[16] D. Plets, W. Joseph, K. Vanhecke, and L. Martens. Exposure optimization inindoor wireless networks by heuristic network planning. Progress In Electro-magnetics Research, 139:445–478, 2013.

[17] N. Liu, D. Plets, K. Vanhecke, L. Martens, and W. Joseph. Wireless in-door network planning for advanced exposure and installation cost mini-mization. EURASIP Journal on Wireless Communications and Networking,2015(1):1–14, 2015.

[18] P. Sebastiao, R. Tome, F. Velez, A. Grilo, F. Cercas, D. Robalo, A. Rodrigues,F. Varela, and C. Nunes. WLAN planning tool: A techno-economic perspec-tive. In Proceedings of COST 2100 TD (09) 935 meeting, pages 28–30,2009.

[19] J. Laiho, A. Wacker, and T. Novosad. Radio network planning and optimisa-tion for UMTS. John Wiley & Sons, 2006.

[20] S. Soliman and S. Reynolds. Wireless network planning tool, January 201998. US Patent 5,710,758. Available from: https://www.google.com/patents/US5710758.

[21] S. Uhlig, A. Luntovskyy, and D. Gutter. Cross-layered wireless networkplanning and modeling methods and tools. In Proceedings of the 2009 Inter-national Conference on Wireless Communications and Mobile Computing:Connecting the World Wirelessly, pages 1417–1421. ACM, 2009.

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 131

[22] Y. Wu, P. A. Chou, Q. Zhang, K. Jain, W. Zhu, and S.-Y. Kung. Networkplanning in wireless ad hoc networks: a cross-layer approach. SelectedAreas in Communications, IEEE Journal on, 23(1):136–150, 2005.

[23] B. Bloessl, M. Segata, C. Sommer, and F. Dressler. An IEEE 802.11 a/g/pOFDM Receiver for GNU Radio. In Proceedings of the second workshop onSoftware radio implementation forum, pages 9–16. ACM, 2013.

[24] P. Fuxjager, A. Costantini, D. Valerio, P. Castiglione, G. Zacheo, T. Zemen,and F. Ricciato. IEEE 802.11 p transmission using GNURadio. In 6th Karl-sruhe Workshop on Software Radios (WSR), pages 1–4, 2010.

[25] R. M. Koteng. Evaluation of SDR-implementation of IEEE 802.15. 4 Physi-cal Layer. 2006.

[26] M. A. Sarijari, A. Marwanto, N. Fisal, S. K. S. Yusof, R. Rashid, M. H. Satria,et al. Energy detection sensing based on GNU radio and USRP: An analysisstudy. In Communications (MICC), 2009 IEEE 9th Malaysia InternationalConference on, pages 338–342. IEEE, 2009.

[27] COBHAM. Infrastructure Test System TM500 HSPA Test Mo-bile Data Sheet. http://cobhamwireless.com/wp-content/uploads/TM500-HSPA-Test-Mobile-Data-Sheet.pdf, 2001. [Online; accessed21-June-2016].

[28] N. Anand, E. Aryafar, and E. W. Knightly. WARPlab: a flexible frameworkfor rapid physical layer design. In Proceedings of the 2010 ACM workshopon Wireless of the students, by the students, for the students, pages 53–56.ACM, 2010.

[29] Xilinx. Virtex-4 Family Overview. http://www.xilinx.com/support/documentation/data sheets/ds112.pdf, 2010. [Online; accessed 29-June-2015].

[30] C. May, E. Silha, R. Simpson, H. Warren, et al. The PowerPC Architecture:A specification for a new family of RISC processors. Morgan KaufmannPublishers Inc., 1994.

[31] M. Ownby and W. H. Mahmoud. A design methodology for implementingDSP with Xilinx System Generator for Matlab. In SOUTHEASTERN SYM-POSIUM ON SYSTEM THEORY, volume 35, pages 404–408, 2003.

[32] P. Phunchongharn, E. Hossain, and D. I. Kim. Resource allocation for device-to-device communications underlaying LTE-advanced networks. IEEE Wire-less Communications, 20(4):91–100, 2013.

132 CHAPTER 5

[33] C.-J. M. Liang, N. B. Priyantha, J. Liu, and A. Terzis. Surviving wi-fi inter-ference in low power zigbee networks. In Proceedings of the 8th ACM Con-ference on Embedded Networked Sensor Systems, pages 309–322. ACM,2010.

[34] S. Bluetooth. Core Specification v3. 0+ HS, 2009.

[35] J. Haartsen. Bluetooth-The universal radio interface for ad hoc, wirelessconnectivity. Ericsson review, 3(1):110–117, 1998.

[36] T. S. Rappaport et al. Wireless communications: principles and practice,volume 2. Prentice Hall PTR New Jersey, 1996.

[37] A. Bose and C. H. Foh. A practical path loss model for indoor WiFi posi-tioning enhancement. In Information, Communications & Signal Processing,2007 6th International Conference on, pages 1–5. IEEE, 2007.

[38] A. P. P. S. Bilan. Streaming audio over bluetooth ACL links. In Informa-tion Technology: Coding and Computing [Computers and Communications],2003. Proceedings. ITCC 2003. International Conference on, pages 287–291.IEEE, 2003.

[39] J. H. Schiller. Mobile communications. Pearson Education, 2003.

[40] G. Yashodha. Bluetooth Enhanced Data Rate (EDR): The Wireless Evolution.Wireless Communication, 1(3):148–156, 2009.

[41] S. Bouckaert, P. Becue, B. Vermeulen, B. Jooris, I. Moerman, and P. De-meester. Federating wired and wireless test facilities through Emulab andOMF: the iLab. t use case. In Testbeds and Research Infrastructure. Devel-opment of Networks and Communities, pages 305–320. Springer, 2012.

[42] Delock. Adapter USB Bluetooth V2.0 + EDR. http://www.delock.de/produkte/G 61693/merkmale.html?setLanguage=en, NA. [Online; accessed29-June-2015].

[43] M. Krasnyansky. BlueZ: Official linux bluetooth protocol stack, 2003.

[44] M. Vipin and S. Srikanth. Analysis of open source drivers for IEEE802.11 WLANs. In Wireless Communication and Sensor Computing, 2010.ICWCSC 2010. International Conference on, pages 1–5. IEEE, 2010.

[45] E. Research. USRP, Last accessed in March 2016. Available from: http://ettus.com/.

[46] S. Bluetooth. Bluetooth network encapsulation protocol (BNEP) specifica-tion. Revision 0.95 a, June, 2001.

ASSESSING THE COEXISTENCE OF HETEROGENEOUS WIRELESS TECHNOLOGIES 133

[47] A. Tirumala, F. Qin, J. Dugan, J. Ferguson, and K. Gibbs. Iperf: TheTCP/UDP bandwidth measurement tool. htt p://dast. nlanr. net/Projects,2005.

[48] J. Mikulka and S. Hanus. IEEE 802.11 g baseband physical layer sim-ulation. In Proceedings of the 5th WSEAS International Conference onAPPLIED ELECTROMAGNETICS, WIRELESS and OPTICAL COMMU-NICATIONS (ELECTROSCIENCE’07), rocnık, volume 1, pages 361–364,2007.

6Conclusion

“雖有嘉肴，弗食，不知其旨也；雖有至道，弗學，不知其善也。故學然後知不足，教然後知困。知不足，然後能自反也。”

–《禮記·學記》(500 - 221 BCE)

The above Chinese saying originates from the book “Records of Rites”, whichis believed to be written up to 500 years before the birth of Christ. It is literallytranslated as follows:

“However fine the viands be, if one does not eat, he will not know their taste;however flawless the philosophy may be, if one does not learn, he cannot knowits perfection. Therefore when one learns, he knows his deficiencies; when oneteaches, he knows his limitations. Only after one is aware of his deficiencies andlimitations, can he truly reflect upon himself.”

The goal of this PhD is to develop a set of enablers to make the radio commu-nications more efficient. Many lessons are learned while pursuing this PhD, bothtechnically and spiritually. It is thanks to these experiences that I could better un-derstand the strengths and weaknesses of the work conducted. While the primaryfocus of this chapter is to present a global view of this research, it is also the placeto reflect upon what could have been done better, and how the results could beapplied in the future. The remainder of this chapter is composed of the researchbackground, a brief summary of the main contributions in each chapter, and thepotential improvements in the future.

136 CHAPTER 6

6.1 Background

The expression “spectrum drought” is invented to describe the shortage of radiospectrum over the past decades. As the majorities of the applicable radio bandsare already allocated, it becomes increasingly difficult to find spectrum for newwireless services, e.g., the cellular phone technology was trapped in laboratoriesfor decades, largely due to the lack of suitable spectrum. However, recent studiesseem to suggest that the “spectrum drought” is not as severe as it appears to be.To a large extent, the crisis is caused by suboptimal spectrum allocation, ratherthan excessive usage. These studies draw our attention to the efficiency of theradio spectrum usage. In the meanwhile, comparing to the first radio transmissionin 1920, today’s radio technology is significantly maturer and more robust thanit used to be. The exclusive licensing system, that was once intended to protectthe fragile radio connections, ended up unnecessary, and even prohibits furtherimprovement in the spectrum usage.

Under these circumstances, Cognitive Radio (CR) is proposed to enable dy-namic spectrum access, including the scenario of opportunistic usage of licensedbands as secondary technologies, and the access to unlicensed spectrum by multi-ple technologies with equal privileges. In either scenario, the ability to correctlyexamine the radio environment is a vital requirement of CR, which is also the mainsubject of this research. In addition, we also focus on the planning and experi-mentation tools to optimize the design of wireless network for dynamic spectrumaccess.

6.2 Summary

Spectrum sensing primarily consists of sample collection and processing activities.We start from a survey on existing sensing solutions, and observe that the pro-cessing activity usually lags behind, which forces the sampling process to pauseperiodically, leaving signals undetected during these interruptions. As a remedy, anovel sensing engine is designed to enhance the processing speed so that samplingprocess can operate continuously. From the top level, the sample collection andprocessing activities are situated as two stages of a pipeline system, among whichthe processing stage acts as a spawner of additional threads to further speed up theprocess. Besides the capability of continuous spectrum sensing, the solution is im-plemented on a commercial Software-Defined Radio (SDR) platform, which hasa clear advantage in price over the high-end spectrum analyzers, and outperformsthe low-end sensing devices in terms of flexibilities. A vast range of parameterscan be adjusted to meet various experiment requirements, such as the measurementresolutions in frequency and time domain, the sensitivity level, and the output for-mat. Particularly, the use of Channel Occupation Ratio (COR) — the percentage

CONCLUSION 137

of a channel being occupied in a certain timespan — can precisely intercept thepresence of transient signals, and at the same time keep the size of the output datareasonably small. We have experimentally demonstrated two advantages of con-tinuous spectrum monitoring: the accurate assessment of channel occupancy, andthe capability of detecting transient signals such as Bluetooth.

Despite the optimized sensing solution, it is still insufficient to achieve accu-rate spectrum monitoring over a large space. Hence, the robustness of propaga-tion condition estimated by multiple, heterogeneous devices, at diverse locationsis thoroughly investigated. The experience of operating several different spectrummonitoring equipments, paves the way towards a systematic study of how mea-surements from heterogeneous sensing devices can be compared and combined.More specifically, a Common Data Format (CDF) (consisting of a data structureand a toolbox) is provided to configure sensing devices and store measurement re-sults in a uniform approach. Aggregation techniques are applied to raw spectra inboth frequency and time domain, to overcome diversified measurement resolutionsfor comparison purposes. However, the spectra after aggregation cannot be usedfor sensitivity analysis, since sensitivity and resolution are related. Additionally,we propose to replace the wireless medium with coaxial cables, and use high-endsignal generator as reference, to derive the power offsets of devices for calibra-tion purposes. This approach is experimentally validated to be highly reliable andrepeatable. The drawback is that the usage of coaxial cable excludes the antennagain from the calibration system. In the future, the influence of the antenna couldbe studied more in depth to improve the accuracy of the calibration process.

Given the previous efforts to improve spectrum assessment over a longer pe-riod of time and a larger area in space, we are still confined to a binary answerof whether a piece of spectrum is available or not. However, depending on thetechnology types, sharing the spectrum could be either beneficial or problematic.Hence, the capability to identify concurrent technologies is highly valuable in a CRnetwork. Though, due to more complex algorithms and technology-specific imple-mentations, its practical application is rather limited. The study of this dissertationshows that the strength of Radio Frequency (RF) signal is affected by both the in-terruptions in the time domain, and the variation of the amount of carriers in thefrequency domain. Due to the difference in modulation schemes and medium ac-cess control mechanisms, many RF signals of real-life technologies exhibit highlydistinctive features, which can be applied to identify the technology. To verify thefeasibility of this approach, the characteristics of Received Signal Strength Indica-tor (RSSI) from three representative technologies (i.e., Wi-Fi, LTE, and DVB-T)are studied in depth, and a basic algorithm is proposed to distinguish the selectedtechnologies. The performance is evaluated experimentally, showing more than90% accuracy in a three fold cross validation process.

Till this point, we have been looking at the interference detection and avoid-

138 CHAPTER 6

ance mechanisms in the context of dynamic spectrum access. These solutions areeffective to react to interference in real time, however, “proactive measures” musttake place when the network is planned to achieve reliable operations. At this mo-ment, the mainstream network design solutions only optimize wireless networksbased on a single technology, causing coexistence problems among heterogeneousnetworks to augment over time. Hence, prior to deploying a wireless network, itsimpact on the existing networks must be estimated. To this end, the last part of thisdissertation presents an emulator built upon a single SDR platform, which is ableto produce aggregate interference at a finite range of traffic levels from the to-be-deployed network on a victim network. Comparing to actually installing a wirelessnetwork consisting of distributed devices, the centralized emulator is more conve-nient to operate, however, it inevitably has a smaller impact range than the originalnetwork. This drawback can be remedied by extrapolating the local impact, orusing multiple emulators to enlarge the impact area if necessary. The emulator’sperformance is evaluated through large-scale experiments, where a network con-sisting of up to 20 Bluetooth piconets is emulated by a single SDR, and the impactof both the real and the emulated Bluetooth network on a Wi-Fi link is observed tobe highly consistent. This concludes that our goal of providing a reliable and sim-ple solution for assessing the coexistence problem among heterogeneous wirelessnetworks is achieved.

In short, to design a CR network with building blocks presented in this disser-tation, one should start from network planning and impact assessment using thesolution of Chapter 5, and then select among options in Chapter 2, 3, and 4 forreal-time radio environment monitoring, depending on whether more detection ac-curacy is preferred in time, space, or the exact technology type. These informationshould serve as input to intelligence blocks at higher layer, so that detailed actionscan be derived to enhance network performance.

6.3 Future directions

Among the work presented in this dissertation, we believe that the following as-pects contain potentials and may require further investigations.

Most of the solutions in this dissertation are implemented on SDR platforms,among which some rely heavily on the host computer, while others are able to per-form digital signal processing on board. We observe that the use of host-computeroriented SDR is more convenient for prototyping, but usually consumes an ex-tensive amount of processing power on the host machine, which prevents it frombeing ported on constrained devices. SDR platforms with a full-fledged embeddedsystem are generally more powerful, and capable of working independently. How-ever, the embedded system design usually requires longer development time. AsField Programmable Gate Array (FPGA) is a common building block in SDR plat-

CONCLUSION 139

forms, some functionalities that was realized on host computer could be shifted tohardware modules. Hence, porting a solution to an embedded SDR not only meansmigrating software to embedded processors, but also means the redistribution ofwork load between software and hardware. Ideally, computation intensive activi-ties should be realized with hardware modules, while the functionalities requiringflexibilities should be fulfilled by the processor on board. We believe using cus-tomized hardware modules to accelerate processing speed on an embeddedSDR will play an important role in future CR solutions.

We have demonstrated that CDF can effectively simplify heterogeneous sens-ing measurements. However, to use a device via CDF, it must be supported byspecific scripts. The IEEE 1900.6 standard is the first effort to unify spectrumsensing related parameters and data structures. We believe it is important to fur-ther increase the level of standardization in spectrum monitoring solutions, inorder to reduce the device-specific implementation efforts, and foster the exchangeof spectrum information in real time among diversified wireless devices.

Another contribution of this PhD is the RSSI-based feature detections for tech-nology recognition. The proposed algorithm involves several thresholds in the de-cision making process, the values of these thresholds directly impacts the perfor-mance. In this aspect, many advanced techniques in data sciences can be appliedto optimize the selection of the appropriate features and thresholds. Eventually,this parameter selection process should be automated through machine learningtechniques, making the algorithm able to accommodate new technologies in thedynamic radio environments. In general, we observe that CR related research in-volves a large amount of data, making data science and machine learning tech-niques the logical choices of the next steps of the CR technology.

Finally, we have shown that the emulation of Bluetooth signals with an SDRplatform can be used to analyze the its impact on other coexisting wireless net-works. In the future, the application of RF signal emulation could be exploredmore deeply, expanded to other over the air physical layers, and presentedas a test and evaluation method for several generalized wireless networkingproblems, not just coexistence.

ARobust distributed sensing with

heterogeneous devices

In Chapter 3, we discuss the methodologies of spectrum measurements using het-erogeneous devices based on several real-life experiments. In this appendix, weelaborate one of the experiments in details, so that readers have more backgroundinformation to understand Chapter 3.

? ? ?

P. Van Wesemael, W. Liu, M. Chwalisz, J. Tallon, D. Finn, Z.Padrah, S. Pollin, S. Bouckaert, I. Moerman, and D. Willkomm

Published in the proceedings of Future Network & Mobile Summit 2012

Abstract In the ISM band multiple wireless technologies compete for a limitedamount of spectrum, leading to interference and performance degradation. Reli-able information on the spectrum occupation enables more optimal usage and canimprove co-existence in the ISM band. In this paper, we study the robustness ofthe information obtained about the propagation environment when sensing withmultiple, heterogeneous devices, at multiple diverse locations. More specifically,we look into the impact on the path loss estimation depending on the type, numberand the location of the sensing devices. The analysis in this paper is done basedon indoor measurements in the ISM band. Based on the presented measurements

142 APPENDIX A

and analysis we conclude that analysis based on only one device type or in specificlocations can lead to suboptimal or even incorrect estimation results.

A.1 IntroductionThe reliable detection of the presence of different wireless technologies is one thekey enabling functionalities to improve the co-existence in the ISM band. Spec-trum sensing is one of the most popular technologies to obtain this information.In this paper the robustness of information obtained about the propagation envi-ronment using multiple, heterogeneous devices for spectrum sensing in multiplelocations is studied. We used 6 different hardware platforms to capture the re-ceived power level while transmitting a controlled, constant 20 MHz wide OFDMsignal modelled according to a repeated Wi-Fi packet transmission on Wi-Fi chan-nel 8. We use least squares regression to estimate the path loss environment andevaluate our results for the different hardware platforms guided by three questions:

• What is the influence of the number of measurement points used on theaccuracy of the spectrum view?

• Should measurements in different locations be given a different weight whenusing them as input for building a path-loss model for the considered envi-ronment?

• How heterogeneous is the conclusion drawn with different hardware solu-tions and can different heterogeneous measurements be combined to createa more reliable view of the spectrum?

Our study is different from previous work since it compares a large number of dif-ferent sensing platforms. Although there has been a lot of work experimentally in-vestigating the accuracy of sensing solutions, none of these studies experimentallycompare the results of different sensing solutions or the impact of selecting spe-cific distributed indoor locations to build a view on the spectrum environment. Thiswork is a continuation of our previous work presented in [1], where the scope waslimited to single-location sensing and no combination of multiple sensing mea-surements was investigated.

In [2] measurement data obtained in various outdoor locations is comparedwith various known path loss models, to verify how accurately each of those mod-els predicts the propagation environment. Similarly, in [3] they study how feasibleit is to use a database that is computed off-line to predict the propagation envi-ronment. To that extent, a precomputed database is compared with measurementresults obtained using dedicated measurement equipment. In contrast, the goal ofthis study is not to compare various path loss models (in fact, we use a very simpleone), but to compare different types of sensing hardware and to determine how

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 143

grouping the different spectrum sensors based on their location impacts the spec-trum observation quality. Also, it is studied how much measurements on differentlocations and from different devices are needed to get to a reliable interpretationof the environment.

The remainder of this paper is organized as follows: Section A.2 introduces themetrics and hardware that are used, the calibration step and the processing. SectionA.3 describes the measurement setup and measured results. In Section A.4, A.5and A.6, the impact of the type, number and location of the devices is investigated.Finally, section A.7 concludes this paper and gives some recommendations forrobust distributed sensing with heterogeneous devices.

A.2 MethodologyOne of the main concerns of sensing based opportunistic spectrum access is therobustness of the sensing information against environmental influences (such asshadowing and fading) and the robustness for spatial extrapolation (use infor-mation gathered in one location to estimate the spectral environment in anotherlocation). In this paper we investigate the above concerns based on large-scaledistributed spectrum sensing experiments. What is important in the setup of theexperiment, is first to determine the metrics of interest that will be used to interpretthe sensing data, the technical details of the different sensing solutions used, howto (pre-) calibrate the different sensing solutions and finally how to (post-) processthe different data sets in order to be able to fairly compare their results. Theseaspects are discussed below.

A.2.1 Metrics

We use our measurement data to estimate the path loss exponent α and offset β ofthe well known path loss model:

PL(d)[dB] = 20× α× log10(d) + β

where d is distance between Tx and Rx in meter and PL is the path loss in dB.From the measurements we have path loss estimates for known distances so weare looking for α and β that provide the best match to this dataset. We test aleast squares regression and robust fit algorithm to determine α and β coefficients.The least squares regression will attribute an equal weight to each set of inputsand the outcome will be α and β which will result in the minimum mean squarederror over the complete set of inputs. Since least squares can be biased and drawntowards outliers we additionally fit the model using robust regression. The robustregression will iteratively attribute weights in such a way to reduce the impact ofoutliers.

144 APPENDIX A

We use the mean squared error (MSE) of the measurement points as a met-ric to judge the performance of a specific solution. There are two scenarios weuse for reference: the homogeneous device reference and the heterogeneous de-vice reference. In the homogeneous reference scenario, we compute the MSE tothe regression based on the measurements of only one device (devRef). For theheterogeneous reference we compute the MSE to the regression based on the mea-surements of all devices (allRef). The heterogeneous reference is thus treated as aground truth.

The general approach for all evaluations is that we use regression to estimatethe path loss exponent α and the offset β using only a subset of the measurementpoints. This comes down to estimating the global path loss model with a set oflocal measurements. To assess the goodness of fit of this estimation, we compare itto the two references (devRef and allRef) described above. The difference betweenthe estimated path loss model and the references is measured by the MSE. TheMSE is directly related to the quality of the estimated path loss model, whicheventually can serve as an indication of how suitable the corresponding estimationis in terms of distributed sensing.

A.2.2 Hardware used

A range of six heterogeneous devices were used in the experiment, from low-costcommercial-off-the-shelf devices, to more sophisticated custom implementations.The following is a list of the devices used:

• Metageek Wi-Spy 2.4x with Kismet Spec-tools for Linux OS [4]

• Crossbow/Memsic TelosB [5] [6] with CC2420 transceiver [7] and TinyOSapplication [8]

• Fluke Airmagnet Spectrum XT [9]

• Ettus Research USRP 2.0 [10] with XCVR 2450 daughterboard and Iris [11]

• VESNA sensor node [12]

• Imec sensing engine [13] [14]

Rohde & Schwarz lab equipment (SMIQ06 & AMIQ02 [15]) is used to gener-ate the test signals.

A.2.3 Calibration

To calibrate the devices, each device was connected to a signal generator via a ca-ble and power splitters. We transmitted the test signal also used in the experimentsat different power levels and used these measurements to compute the offset on

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 145

measurement levels reported by the different devices. Apart from this “automatic”calibration we also did a manual calibration based on the real measurements (e.g.to account for the antenna effects). We detected a constant offset for the Airmagnetand one of the Telos devices, which were manually adjusted. Furthermore one ofthe measurement points of the WiSpy sensor was obviously a false measurementand, thus, removed.

A.2.4 Processing

Although each device has its own proprietary output format a conversion step wasdone ensuring all results are stored using a common data format [16] [17] that wascreated as part of the CREW project and is based on the IEEE 1900.6 standard [17].The common data format contains the relevant parameters of the sensing device,time and location information and measurement results. This enables the usage ofcommon scripts for data processing and reduces the risk of introducing errors.

Since not all devices did an equal amount of measurements we compute theaverage received signal strength for all available device and location combinations.By using the average we attribute an equal weight to each device, whereas whenwe would use all available results without averaging the device with the largestamount of measurements would contribute more to overall result.

A.3 Measurements

A.3.1 Measurement Setup

The experimental setup is shown in Figure A.1, where 23 measurement locationsand one transmit location were chosen within an indoor cafeteria on the premisesof imec, Leuven, Belgium. The transmitter was set up to transmit a constant 20MHz wide OFDM signal modeled according to a repeated Wi-Fi packet transmis-sion on Wi-Fi channel 8 (2.447 GHz), with a power of 3 dBm. Each platform thenperformed spectrum measurements, a minimum of thirty seconds in length, at eachlocation. Background ISM traffic devices were switched off throughout the dura-tion of the experiment. Measurements were performed in an asynchronous manner,however due to the constant nature of the transmit signal and the statistical natureof the readings we assume the results to be the same as if all measurements hadbeen synchronized. The set up includes a mixture of both Line-Of-Sight (LOS)and None Line-Of-Sight (NLOS).

A.3.2 Measurement Results

As discussed in section A.2.1 we test both a least squares and robust fit to estimatethe path loss exponent α and offset beta based on the results from the measure-

146 APPENDIX A

Figure A.1: Experimental set-up and location group

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 147

101

50

55

60

65

70

75

80

85

90

Distance (m)

Pat

h Lo

ss (

dB)

MeasurementLSRobust

11 2 14 8 7 16 6 12 4 19 20 22

1 15 10 3 13 17 9 18 5 21 23Location nr

Figure A.2: least squares and robust fit

ments described in section A.3. This results in an α of 2.32 and 2.29 and β of 46.4and 46.8 for the least squares and robust fit respectively. The value of the path lossexponent α is close to 2 for both methods, indicating that path loss behaviour closeto free space propagation. Figure A.2 shows the result of both fitting algorithmsand the input points. We find that the impact of the type of regression, for thesemeasurement results is very limited and hence we choose to select least squaresfitted curve as the allRef, for the remainder of this paper.

A.4 Heterogeneity of the devices

To compare different devices we start by computing a least squares fit solely basedon the measurements from one device (devRef). These results are shown in FigureA.3. As can be seen in the figure most devices display very similar behaviour,with the exception of the USRP. As the calibration, discussed in section A.2.3,was done by connecting a cable directly to Rx and hence without the antenna, onepossible reason for this deviant behaviour is different antenna properties. Furtherinvestigation is needed to fully clarify this observation.

We show the MSE between the estimated path loss curve and the average mea-surement result for all locations in Table A.1 (first column). Additionally we also

148 APPENDIX A

101

50

55

60

65

70

75

80

85

90

Distance (m)

Pat

h Lo

ss (

dB)

airmagnetusrpimecTelosWiSpyVESNAallRef

11 2 14 8 7 16 6 12 4 19 20 22

1 15 10 3 13 17 9 18 5 21 23Location nr

Figure A.3: Least squares regression for individual devices

provide the MSE compared to the average measurements for all devices at all lo-cations (allRef) in Table A.1 (second column). This provides us with a metric toevaluate how close the estimation from one single device (on all locations) ap-proximates our allRef. The results in Table A.1 confirm what was already visiblein Figure A.3: the path loss estimation based solely on the USRP will lead to asignificant error. The second observation is that the imec and VESNA devicesproduce the most consistent results, illustrated by low MSE compared to devREF.

A.5 Number of devices

In this section we investigate how many sensing devices are needed in an area tohave a good estimation about the wireless environment in this area. To answerthis question we estimate the path loss model with the least squares error approachfor each device based on a selected number of locations and calculate the MSEcompared to devRef and allRef. In order to eliminate the influence of one specificlocation we have performed the analysis of all possible combinations for everynumber of selected locations and took mean over the MSE.

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 149

Table A.1: Mean Squared Error per device.

Device nameMSE

Compared to devRef Compared to allRef

Airmagnet 31.8376 20.7657

USRP 33.9482 28.8005

imec 14.8554 21.5957

Telos 28.5254 20.1824

WiSpy 25.9246 23.2951

VESNA 15.6993 20.4692

A.5.1 Homogeneous device analysis

The resulting MSE for each number of locations is shown in Figure A.4. As ex-pected, when 23 locations are used for fitting, the error is always 0 as this is whatwe defined as devRef. This analysis provides insights on the consistency of theindividual device results, using of 3 or 4 locations form imec sensing engine orVESNA gives similar results as using 6 locations of USRP, Airmagnet or WiSpy.We can also see that there are not many differences if we take 9 devices or more.

A.5.2 Heterogeneous device analysis

To compare different devices amongst each other, we conduct a similar analysis,only this time we calculate the MSE compared to the path loss estimation basedon all devices, allRef instead of using devRef. In Figure A.5 we see that imecsensing engine and VESNA node are able in this case to predict a path loss modelclose to allRef and the results are comparable to the previous analysis. For alldevices we see a steep curve that flattens out fast when the number of devicesincreases, from this we can learn that, for this set up, using more than 9 deviceswill not help you to obtain a significantly better estimate of the path loss model.It is also very clear on Figure A.5 that the USRP (and WiSpy to a lesser extent),even when using measurements from all locations, will not get close to allRef,which is consistent with the results from Section A.4. As a conclusion we can saythat the MSE compared to both devRef and allRef reduces rapidly with increasingnumber of locations and that there is limit above which adding extra locations willnot reduce the measurement error anymore.

150 APPENDIX A

2 4 6 8 10 12 14 16 18 20 220

10

20

30

40

50

60

70

80

90

100

Number of points taken for fitting

MS

E o

ver

grou

nd tr

uth

airmagnetusrpimecTelosWiSpyVESNA

Figure A.4: Homogeneous device reference

2 4 6 8 10 12 14 16 18 20 220

10

20

30

40

50

60

70

80

90

100

110

Number of points taken for fitting

MS

E o

ver

grou

nd tr

uth

airmagnetusrpimecTelosWiSpyVESNA

Figure A.5: Heterogeneous device reference

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 151

A.6 Heterogeneity of locationsIn this part we combine locations in different manners in order to discover thecommon characteristics and minimize the influence caused by the randomness ofindividual locations. We refer to a specific combination of locations as a locationgroup. We used 2 ways to perform the division into location groups, illustrated inFigure A.1:

• Clear line-of-sight to Tx (LOS group: all locations in the TOP section +locations 15 and 16) or none line-of-sight to Tx (NLOS group: all locationsin the DOWN section except locations 15 and 16)

• Based on the mesh topology of the locations we group points on horizon-tal (H1-H5) and vertical (V1-V4) lines. We will further refer to this ‘linelocation’

In each of the following 2 parts, the performance of every location group is pre-sented, followed by comparison and explanation.

A.6.1 LOS vs NLOS

The resulting path loss curves estimated based on LOS and NLOS locations areshown in Figure A.6 and the estimated path loss exponent and path loss offset arelisted in Table A.2. We can see from Table A.2 that compared to LOS model,NLOS has a smaller slope but higher offset. The high offset in NLOS estimationis typically caused by the shadow effect. For the same reason, around shadow, theincrement of path loss caused by distance can be compensated by the decreasingamount of shadowing, hence the path loss exponent appears to be smaller thanonly LOS estimation.

A.6.2 Line location group

The estimation results for different line location groups are shown in Figure A.7and Table A.2. There are 3 groups (i.e., H4, H5 and V1) with a path loss exponentsignificantly different from the other ones, and our reference calculated in SectionA.4. For H4 and H5 the reason is to be found in the simple path loss estimationmodel that is used. The H4 and H5 groups contain both LOS and NLOS loca-tions, which in combination with the simple path loss model, leads to unrealisticestimations of the path loss exponent. The highest path loss exponent estimationcomes from group V1, which might be caused by the fact that several locationsare amongst the closest to the transmitter (i.e. the received power level is overesti-mated due to saturation at those locations), but further investigation is required tovalidate this. In summary, shadowing effects can be very disturbing, the selectionof locations should avoid the border of the shadow.

152 APPENDIX A

101

50

55

60

65

70

75

80

85

90

Distance (m)

Pat

h Lo

ss (

dB)

LOSNLOSALLMeasurement

11 2 14 8 7 16 6 12 4 19 20 22

1 15 10 3 13 17 9 18 5 21 23Location nr

Figure A.6: LOS vs NLOS pathloss estimation

Table A.2: Location heterogeneity overview.

PL exponent PL offset MSE

LOS versus NLOS

LOS 2.229 46.25 1.14

NLOS 1.259 59.57 10.84

Line Location Group

H1 2.458 43.35 2.91

H2 2.509 42.82 2.92

H3 1.731 53.56 1.33

H4 3.751 34.52 14.06

H5 -5.643 132.84 290.50

V1 3.82 32.71 10.59

V2 2.316 47.54 1.25

V3 2.639 43.71 0.65

V4 2.062 48.47 0.506

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 153

101

50

55

60

65

70

75

80

85

90

Distance (m)

Pat

h Lo

ss (

dB)

AllH 1H 2H 3H 4H 5V 1V 2V 3V 4Measurement

11 2 14 8 7 16612 4 19 20 22

1 15 10 313 17918 5 21 23Location nr

Figure A.7: Line groups pathloss estimation

154 APPENDIX A

A.7 ConclusionsIn this paper we present results from path loss measurements in the ISM band in anindoor environment with heterogeneous devices. Most devices give similar overallresults in terms of estimation of path loss exponent and offset estimation. How-ever not all devices display the same consistency for all locations. This behaviouris confirmed in Section A.5 where we see that the amount of devices needed toobtain a reliable estimate depends on the device type. Futhermore, some devicesdo not even achieve an estimation close to the overall reference when all availablemeasurement points for that device are used. Finally we see that, when the devicelocations are not selected carefully, the path loss and offset estimation can be veryfar from the overall result. In summary, we conclude that analysis based on onlyone device type or in specific locations could lead to misleading conclusions.

AcknowledgmentThe research leading to these results has received funding from the EuropeanUnion’s Seventh Framework Programme (FP7/2007-2013) under grant agreement258301 (CREW Project).

ROBUST DISTRIBUTED SENSING WITH HETEROGENEOUS DEVICES 155

References

[1] D. Finn, J. C. Tallon, L. A. DaSilva, P. Van Wesemael, S. Pollin, W. Liu,S. Bouckaert, J. Vanhie-Van Gerwen, N. Michailow, J. Hauer, et al. Ex-perimental assessment of tradeoffs among spectrumsensing platforms. InProceedings of the 6th ACM international workshop on Wireless networktestbeds, experimental evaluation and characterization, pages 67–74. ACM,2011.

[2] C. Phillips, D. Sicker, and D. Grunwald. Bounding the error of path lossmodels. In New Frontiers in Dynamic Spectrum Access Networks (DyS-PAN), 2011 IEEE Symposium on, pages 71–82. IEEE, 2011.

[3] R. Murty, R. Chandra, T. Moscibroda, and P. Bahl. Senseless: A database-driven white spaces network. Mobile Computing, IEEE Transactions on,11(2):189–203, 2012.

[4] How Wi-Spy Works. Available from: http://blogs.metageek.net/blog/2011/01/how-wi-spy-works/.

[5] TelosB. Available from: www.memsic.com.

[6] J. Polastre, R. Szewczyk, and D. Culler. Telos: enabling ultra-low powerwireless research. In Information Processing in Sensor Networks, 2005.IPSN 2005. Fourth International Symposium on, pages 364–369. IEEE,2005.

[7] T. Instruments. CC2420: 2.4 GHz IEEE 802.15. 4/ZigBee-ready RFTransceiver. Available at http://www. ti. com/lit/gpn/cc2420, 53, 2006.

[8] P. Levis, D. Gay, V. Handziski, J.-H. Hauer, B. Greenstein, M. Turon, J. Hui,K. Klues, C. Sharp, R. Szewczyk, et al. T2: A second generation OS for em-bedded sensor networks. Telecommunication Networks Group, TechnischeUniversitat Berlin, Tech. Rep. TKN-05-007, 2005.

[9] Datasheet: Airmagnet Spectrum XT. Available from: http://enterprise.netscout.com/content/datasheet-airmagnet-spectrum-xt.

[10] Ettus Research. Available from: http://www.ettus.com/.

[11] P. Sutton, J. Lotze, H. Lahlou, S. A. Fahmy, K. Nolan, B. Ozgul, T. W. Ron-deau, J. Noguera, and L. E. Doyle. Iris: an architecture for cognitive ra-dio networking testbeds. Communications Magazine, IEEE, 48(9):114–122,2010.

156 APPENDIX A

[12] Versatile Sensor Node (VSN) platform - design of hardware and software.Available from: http://videolectures.net/wsn2010 mihelin vsn/.

[13] M. Ingels, V. Giannini, J. Borremans, G. Mandal, B. Debaillie, P. Van Wese-mael, T. Sano, T. Yamamoto, D. Hauspie, J. Van Driessche, et al. A 5mm 240nm LP CMOS 0.1-to-3ghz multistandard transceiver. In Solid-State Cir-cuits Conference Digest of Technical Papers (ISSCC), 2010 IEEE Interna-tional, pages 458–459. IEEE, 2010.

[14] S. Pollin, E. Lopez, A. Antoun, P. Van Wesemael, L. Hollevoet, A. Bourdoux,A. Dejonghe, and L. Van der Perre. Digital and analog solution for low-power multi-band sensing. In New Frontiers in Dynamic Spectrum, 2010IEEE Symposium on, pages 1–2. IEEE, 2010.

[15] Rhode & Schwarz. Available from: https://www.rohde-schwarz.com/home48230.html.

[16] CREW Common Data Format. Available from: http://www.crew-project.eu/content/common-data-format.

[17] IEEE 1900.6 Working Group on Spectrum Sensing Interfaces and DataStructures for Dynamic Spectrum Access and other Advanced Radio Com-munication Systems. Available from: http://grouper.ieee.org/groups/dyspan/6/index.htm.

BFPGA-based wireless link emulator for

wireless sensor network

In Chapter 5, the emulation of Radio Frequency (RF) signals from a wireless net-work is used to assess its potential impact on other networks. In this appendix, weuse emulation to obtain well-controlled wireless medium, so that the experimentson higher network layers are free from unpredictable interference in the physi-cal medium. To this end, a wireless link emulator for a Zigbee sensor network isdesigned, and its usage is elaborated with a reference experiment.

? ? ?

W. Liu, L. Bienstman, B. Jooris, O. Yaron, and I. Moerman

Published in the proceedings of International Conference on Testbeds andResearch Infrastructures for the Development of Networks & Communities(Tridentcom) 2012

Abstract Wireless sensor testbeds lack the flexibility for topology control and theaccuracy for interference generation. Once the testbed is set up, the topologybecomes fixed. Due to the nature of the wireless environment, experimenters oftensuffer from unpredictable background interference, while at the same time, find ithard to get accurate and repeatable interference sources.

The wireless link emulator addresses these issues by replacing the uncontrol-lable wireless link by a well-controlled and programmable hardwired medium. A

158 APPENDIX B

radio interface is then made to behave according to the link configuration, thus of-fering flexibility for both topology and interference control. This paper describesthe implementation of the wireless link emulator based on a number of low-costXilinx FPGA’s. The system is verified experimentally and compared to existingemulation systems.

B.1 Introduction

Over the years, more and more researchers have realized that simulation resultsalone are not sufficient to guarantee the proper function of wireless network appli-cations in a real-life environment. Hence many universities and research groupshave set up their own testbeds [1] [2]. Such a testbed often consists of a largenumber of actual sensor nodes which can be programmed remotely. It is a com-mon practice to install the sensor nodes at fixed locations. Therefore once thetestbed is set up, the topology of the network is fixed. In addition, many testbedsare deployed within the office environment, the experiments often suffer from un-predictable interference, such as Wi-Fi, Bluetooth or even microwave oven.

Network simulators are generally flexible and predictable, however, they ig-nore many aspects of the real hardware platforms. A testbed offers real hardwarebehavior but lacks flexibility and controllability. Is there a way to combine theadvantages of both systems? The answer is yes: use emulation instead of simula-tion and at the lower level, emulate only the wireless ether behavior, not the sensornode itself. This is the solution integrated into w-iLab.t — the wireless sensornetwork testbed of Gent University [3].

(a) The original TelosB node (b) The modified TelosB node

Figure B.1: The orignal TelosB node versus the modified node

The w-iLab.t testbed is deployed in an office building of 12x80 m and is spreadout of three floors. It consists of more than 200 sensor nodes. The sensor node isbased upon the TelosB mote [4]. The TelosB mote is an ultra low power wirelessmodule for use in sensor networks. It mainly consists of integrated sensors, amicrocontroller and a radio module (Figure B.1a). The radio module is basedon the Chipcon CC2420 radio chip [5]. The CC2420 is a true single-chip 2.4GHz IEEE802.15.4 compliant RF transceiver designed for low-power and low-

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 159

voltage wireless applications. On the TelosB mote, the CC2420 is controlled byTI MSP430 microcontroller.

We extend the w-iLab.t testbed with a group of special nodes. These nodesare also TelosB compatible, however, they communicate via an emulated networkinstead of the wireless ether (Figure B.2a, Figure B.2b). In another word, weintroduce a group of nodes with their “private ether” into the testbed. An interfaceis offered to control the “private ether”. For the experimenters of the testbed, thosespecial nodes can be programmed in an identical way as the original nodes.

(a) The wireless network (b) The emulated wireless network

Figure B.2: The real wireless network versus the emulated wireless network

To implement the wireless link emulator three steps are needed : first, separatethe radio from the rest of the hardware on the sensor node. Second, a radio inter-face is made to maintain the radio functionality. Finally, a hardwire programmablelink to other nodes is implemented to replace the ether (Figure B.1b). In reality thisis realized by replacing the radio and its antenna with an interface that connectsthe MSP430 processor to this private ether. All the ether behavior is emulated withlow cost FPGA .

The remaining part of the paper is organized as follows: Section B.2 discussesthe system implementation in detail. Section B.3 describes the principles of phys-ical layer emulation. Section B.4 presents the experimental validation of our sys-tem. Section B.5 compares our emulator with other emulation systems and SectionB.6 concludes this paper.

B.2 System implementation

B.2.1 Requirements for a wireless network emulator

The emulator of w-iLab.t takes a different approach compared to most existingemulation systems. The idea is to remove the wireless ether completely, and re-place it by a well-controlled programmable medium. The requirements for suchan emulator are :

160 APPENDIX B

• The software running on the modified sensor node should behave exactlythe same as if it was executed on the original TelosB mote.

• The electrical characteristics of the radio (CC2420) should be maintained,including the Serial Peripheral Interface (SPI) commnication to the localprocessor and the interface signals (CCA, SFD, FIFO, FIFOP, Vref, RST).

• The transmitting and receiving functionality of the radio should be main-tained.

• Similar latency as the radio physical layer is mandatory for the emulator.

• Programmable topology.

• Programmable interference.

Among all the requirements, the latency is most challenging. Electromagneticwaves travel at the speed of light in the air. By nature, the wireless environmentis a broadcast medium with extremely low latency. According to the datasheet ofCC2420 [5], there is approximately 2 us latency between the transmitter and thereceiver due to the bandwidth limitations on both sides. The emulator only needsto behave as well as the radio, hence the actual latency requirement is 2 us. Thedetailed calculation related to latency is written in Section B.2.5.

B.2.2 A new proposal : the wired emulator to test a wirelessnetwork

In order to achieve reliable low level interconnection, wires are used as the physi-cal medium for the emulator. The “private ether” is now a wired network in whichall nodes are connected together by wires. The question is, what is the most suit-able physical topology for the emulator to meet all the requirements? One optionis to use a full meshed topology, where every node can communicate to every othernode, Figure B.3a . A Master node is required to control the communication pa-rameters of the mesh while the effective data is directly transmitted between theslaves. The definition of the Master node (to manage the ring) and the Slave node(the real transceiver) is used all over in this paper.

It is obvious that such a topology offers the largest bandwidth, but at the sametime it also has the largest amount of connections. For a network of N nodes,a total N × (N − 1)/2 connections are required. This could be a considerablenumber for a complex emulator.

Another option is to connect all the nodes in a common bus topology (FigureB.3b). All nodes can still communicate to each other, but a complex arbitrator onthe bus is required. This could be a serious limitation to the system bandwidth.From a electrical point of view, the more nodes present on the bus, the higher

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 161

(a) Full mesh topology (b) Bus topology

Figure B.3: The full mesh topology versus the bus topology

the parasitic capacitance (every node adds some capacitance), and accordingly thelower the switching speed of the bus will be.

The star topology (Figure B.4a) is a point-to-point network that does not sufferfrom the accumulation of parasitic capacitance. However, the master node needsto have enough processing power to handle all the incoming and outgoing data tomeet the low latency requirement.

(a) Star topology (b) Ring topology

Figure B.4: The star topology versus the ring topology

The ring topology of Figure B.4b has some appealing features. It is a point-to-point network, so every link can run at high speed. Although it does not offer directlink between every single node (Slave), the available high speed and an appropri-ate protocol can compensate for it. The ring topology has an inherent pipelinedbehavior, which further increases the total network bandwidth. The pipelined ar-chitecture allows for simultaneous data transfer between every two neighboringnodes. For example, at the same time instant, while Slave 2 is communicatingwith Slave 3, Slave 3 can also communicate with Slave 4. This offers a huge ad-vantage over the bus topology. Therefore, we decide to take the ring topology asthe physical topology of the emulator.

162 APPENDIX B

B.2.3 The low level protocol

A flow of packets are circulating unidirectionally through the ring. At any momentevery single node is receiving a frame from its left neighbor and at the same timeis transmitting a frame to its right neighbor. The packet flow is formed by frames(Figure B.5 ). Each frame is allocated to one node (Master, Slave). A node is onlyallowed to write data into its own frame. When receiving a frame from anothernode, the content of the frame is retransmitted; when receiving a frame from thenode itself, either new data or a dummy empty frame is transmitted. Hence agiven frame can circulate only once on the ring. Thanks to the frame structure andinherent pipelining, the ring effectively behaves as multi-access medium withoutcollision, which is exactly what we wanted for the physical connection on theemulator.

Figure B.5: Frame sequence

A frame is a 32 bit value and can have several formats. Figure B.6a showsthe normal data frame. A normal data frame is used to transfer data from oneslave to the other slaves. The bit D0=1 indicates the normal data frame. The bitsD1-D7 contain the source address, which serves as the identifier of the frame onthe ring. The D8-D15 bits contain the parameter Channel ID, indicating at which“frequency” the node is transmitting, compatible to the Zigbee channel index. Thebits D16-D23 are the transmit power (TX Power) in dBm unit. And the Lower4 bits of D24-D31 contains the 4-bit actual data, comparable to the 4-bit symbolformed on the real radio, the extra 4 bits are reserved for future extension. Theparameters Channel ID and Tx Power cover all the physical property of a symbol.According to the 802.15.4 standard, a symbol stays on the ether for 16 us. Toemulate the symbol period, the data frame is only transmitted via the ring every

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 163

16 us, however, the actual duration for a frame to circle around the ring is muchshorter. This is covered in Section B.2.5.

(a) Normal data frame (b) Configuration or status frame

Figure B.6: Normal data frame versus configuration or status frame

Besides connections to the ring, the Master node also has connections to a webserver and a Local Area Network (LAN) connection to the w-iLab.t database. Viathe web server the user can configure the “virtual ether”. Parameters for a specificnode, such as the noise floor, or path loss, can be programmed via the Master. Thisis realized by generating a master configuration frame on the ring (Figure B.6b).This frame circulates through the ring and the addressed slave will copy the datainternally. Broadcasting configuration, i.e. addressing several slave nodes withone frame, is possible. Besides configuration, if requested, a slave node can sendstatus reports to the Master. The Master fetches the report and writes it into the w-iLab.t database. The status reports usually contain information related to GeneralPurpose Input and Output (GPIO) activities on the radio interface, or commandsreceived from the local processor. Therefore it is a powerful tool for monitoringthe radio activity and software debugging.

Broadcasting is straightforward. A transmitting node will write its frame witha given Channel ID on the ring. Any other node with the same channel ID shouldread out this frame.

B.2.4 The physical implementation

A connection between two nodes is made by a standard UTP cable (4 twisted pairs)Figure B.7. Low Voltage Differential Signaling (LVDS) is the IO standard on thering. This ensures good signal integrity at high transmission speed. Among the 4twisted pairs, one pair is used as clock signal, two pairs are used for data, the lastpair is used for synchronization. The Sync signal travels along with the Masterframe. It can be considered as the Master frame flag. This Sync signal is essentialfor the synchronization of the whole ring structure. A node that is receiving a framewhile the sync is active is for sure receiving the Master frame. The two data linesallow to double the transmit speed. Hence to transmit 32 data bits only 16 clockpulses are needed. Three extra clock pulses are needed for internal processing.This results in a total of 19 clock pulses to transmit a 32 bit frame. The timingdiagram of the ring is shown in Figure B.8. Every frame on the ring corresponds

164 APPENDIX B

Figure B.7: The 4 pair UTP cable connection between nodes

Figure B.8: Detailed timing diagram of the data on the ring

to a time slot of 19 clock pulses.As mentioned earlier, all the logic needed to implement the ring structure and

to emulate the radio module is implemented on the FPGA. Every node (master,slave) has one FPGA board. More specifically, the slave node is built on the XilinxSpartan-3A-400 FPGA [6], while the master is built on the Xilinx Spartan3E-500FPGA [7]. The FPGA chip has a large amount of logic gates available to buildall types of dedicated logic, on top of that a powerful 32 bit “soft” microprocessor(microBlaze [8]) is also available as an IP (intellectual property) core. To imple-ment the low level ring protocol, a dedicated ring transmitter is built with VHSICHardware Description Language (VHDL).

The radio interface is a combination of software and customized hardware onthe FPGA, with the software part running on the “soft” processor — microBlaze,mainly responsible for connecting the ring transceiver and the radio interface. Inaddition, the software also performs processing needed for physical layer emula-tion, to be explained in Section B.3. The core of the hardware part of the radiointerface is a dedicated finite state machine, which takes care of the SPI communi-cation towards the MSP processor, generating necessary interrupt towards softwareand partially controls the GPIO signals on the radio interface. The block diagramof a slave is shown in Figure B.9.

Special care is taken to maintain the quality of the clock signal. The XilinxSpartan-3A FPGA has on-board high-speed LVDS transceivers to drive the ring.

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 165

Figure B.9: Block diagram of the slave node

The clock recovery is executed by the Phase Locked Loop (PLL) inside the FPGA.The Master node is generating the clock while each slave node is reconstructingthe clock on its output with minimal phase delay with respect to the input. Thisrecovered clock is used in the ring transceiver logic. Thanks to this structure, theclock quality is maintained through the entire ring. This enables the ring clock torun at very high speed.

B.2.5 Timing considerations

The clock speed of the ring is 100 MHz. A complete 32-bit frame requires 19clock pulses. We currently only implement a ring with 6 slave nodes and 1 master.When a frame passes a node, it is first received completely and then transmitted.Hence the duration for a frame to reach all the other nodes on the ring equals:

T1 = 6× 19× 10ns = 1.14µs (B.1)

The duration for one frame to completely circulate through the ring is :

T2 = (6 + 1)× 19× 10ns = 1.33µs (B.2)

Be aware that not one but seven frames do travel around the ring during the 1.33µs. Hence a node can get access to the ring every 1.33 µs. The latency on the ringis defined as the time between transmitting a frame by a given node and receivingthat frame by another node. The best case is when a node is transmitting to its leftneighbor, the worst case is when a node is transmitting to its right neighbor. Theequation (B.1) shows that our worst case latency is 1.14 µs, smaller than the 2 µslatency of CC2420 chip. Hence this design meets the initial requirement.

166 APPENDIX B

B.3 Physical layer emulation

In wireless systems, bit errors occur during the decoding of received symbols.When the received signal is much stronger than the local noise floor, the receivedsymbol is almost always correctly decoded, hence hardly any bit error can appear.On the other hand, if the received signal is not strong enough to decode, frequentbit errors will appear. In between the two extremes, there is a “gray zone” wherethe bit error rate varies. We now focus on this zone. It is known that for eachmodulation technique, there is a given relationship between the Bit Error Rate(BER) and Signal-to-Noise Ratio (SNR). The 802.15.4 standard features the OffsetQuardrature Phase Shift Keying (OQPSK) and Direct Sequence Spread Spectrum(DSSS) modulation. The theoretical BER curve for 802.15.4 is shown in FigureB.10 [9]. Once the SNR is known, we can generate the bit error accordingly.

To enable the calculation of SNR, several parameters need to be considered:

• The transmit power

• The path loss between the transmitter and receiver

• The local noise floor and interference level at the receiver

The transmit power accompanies with each symbol as explained in Section B.2.4.Each slave has a path-loss table, which contains the path loss to all the other nodes.The local noise floor is also a parameter configured by the Master. All the parame-ters are stored in dB scale. For each incoming symbol, the SNR can be calculatedas follows:

SNR = TxPower − PathLoss−NoiseF loor (B.3)

If there are multiple senders active at the same time on the same channel, re-ceivers can only recognize the symbol from one sender, the symbols of the othersenders are treated as interference. To emulate the interference from other nodes,the strongest interference is used instead of the noise floor in the calculation ofSNR. In this case the SNR is actually the same as Signal to Interference-plus-Noise Ratio (SINR), for simplicity, we use the term SNR throughout this paper.

B.3.1 Quantized SNR and its link to bit error rate

Once the SNR value is obtained, theoretically we could calculate the correspond-ing BER, however, practically this would give too much processing load on theembedded FPGA system. Hence we quantize the BER vs SNR curve and storethe most interesting part into a local look-up table. As explained above, the “grayzone” of SNR is closely related to the bit error. So the first step is to quantize this“gray zone”. This is illustrated in Figure B.10. The SNR value can be expressed

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 167

by the formula below:

SNR = SNRoffset + SNRstep × n (B.4)

SNRoffset and SNRstep are two important parameters. SNRoffset representsthe lowest SNR value at which data can still be received, albeit with errors. Belowthis value packets are completely corrupted. SNRstep is the quantization step.Thus SNR becomes a function of n. The maximum value of n represents a thresh-old set by the user. When the SNR value is above the selected threshold, the datais processed without introducing bit error. The value n is also used as the index tolook for the proper BER in the look-up table. In the remainder of the paper, thevalue n is referred to as the SNRindex.

B.3.2 Bit error generation

The bit error is generated in software. BER value by nature is a fraction number,however, calculation based on floating point and fraction number is slow and ex-pensive. Therefore we express BER as 1/X , the X is the nearest integer of theBER value’s reciprocal. Only X is stored in the look up table. For instance, whenBER is 0.1%, the value 1000 will be stored in the look-up table. The softwarecounts the total number of received bits, and will toggle one bit every X bits. Thetoggle location is generated randomly. When X bits are received, the bit count iscleared to zero, and a new cycle starts with a new random toggle location gener-ated. Such a cycle is called a bit-error cycle.

This solution is simple to implement, but has one major drawback, whentransmitting a fixed number of packets with a fixed packet size, the Packet ErrorRate (PER) becomes a constant. To avoid this situation, another parameter is intro-duced — run-length of the bit error. This parameter defines the maximum numberof bit errors that can appear in a roll. Thus in the beginning of one bit-error cycle,the random toggle location and the run-length of bit error are generated. Whenthe bit count reaches the toggle location, it will continue to toggle the receivedbits until the number of toggled bits reaches the run-length. When more than onebits are toggled in a bit-error cycle, there will be none toggled in the followingcycles. Hence eventually bit error rate stays the same. The run length parametereffectively characterizes the burst behavior of the bit error.

The random generator used here is based on a 32-bit hardware Cyclic Redun-dancy Check (CRC) shift register. So it is actually a pseudo random generator. Weadmit this can cause certain level of distortion. However, during experiments (seeSection B.4), we are able to obtain emulation results that are compatible with realmeasurements, the distortion introduced here is considered to be insignificant.

168 APPENDIX B

−10 −5 0 5 1010

−12

10−10

10−8

10−6

10−4

10−2

100

SNR (dB)

BE

RGrey Area

SNR step

SNR offset

Figure B.10: Quantized BER

B.3.3 Topology Control and Interference Generation

Until now the link between BER and SNR is established. In summary, the topol-ogy control is directly achieved by specifying path loss between each node. Thepath loss will affect several parameters, namely, Received Signal Strength Indi-cator (RSSI) and SNR, and eventually affect the BER of the received packet. Byconfiguring the path-loss table in each node inside the “virtual ether”, an arbitrarylogical topology can be formed, with no impact from the physical ring topology.When the path-loss table is configured in real time, the logical topology becomesdynamic. This allows us to emulate a network with mobile nodes.

As for interference generation, there are two options. One option is to directlygenerate interference configuration from the Master. This is realized by configur-ing the local noise floor parameter in all the Slave nodes. The noise configurationcan be based on a simple pattern, as illustrated by experiment in Section B.4.2.Another possibility is to record the interference in a certain environment and re-play it by the Master afterwards. The quality of this approach depends on the timeresolution of the recorded interference.

The second option is done by estimating the BER curve. Sometimes interfer-ence does not have a simple pattern. Recording interference with high resolution

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 169

−10 0 10 20 30 4010

−8

10−7

10−6

10−5

10−4

10−3

10−2

SNR (dB)

BER

Indoor Approximation

Indoor Measurement

Outdoor Approximation

Outdoor Measurement

Figure B.11: Approximated BER curve

170 APPENDIX B

consumes a large amount of memory. Hence direct interference generation is notalways a good option. If we can obtain the BER vs SNR curve under a certainenvironment, an appropriate amount of bit errors can be generated. The amount ofgenerated bit errors should be equivalent to what is caused by the interference inthe given environment. Therefore the desired amount of interference is obtained.

The measurement of BER is usually not that straightforward. It can be done inmany ways. Here for simplicity, we assume every bit inside a packet is indepen-dent, for a packet of N bits, the BER and PER have the following relationship:

1− PER = (1−BER)N (B.5)

Therefore BER can be derived from PER when the packet size is known. Themeasurement of PER is usually simple. When combine the PER measurementwith a simple energy recording, the BER vs SNR curve can be derived. This isfurther explained with experiment, Section B.4.1.

B.4 Experiments

B.4.1 Emulation of indoor and outdoor environment by BERestimation

In this experiment we aim to emulate different environments by the proper estima-tion of BER curve. We used the experiment result in [9] as input, where a set ofPER measurements are performed in function of the distance between the trans-mitter and the receiver. The measurement is performed both indoor and outdoor.In addition to PER, RSSI is also recorded. The indoor experiment is performedmultiple times. Each time a different packet size is used. We only selected themeasurement with packet size of 127 bytes for the indoor emulation. The PERin the outdoor environment is measured only with a packet size of 20 bytes. Fordetails of the experiment, readers are referred to [9]. We derived the path loss fromthe measured RSSI, the result is shown in Figure B.12. These derived path loss isused as the direct input for the link configuration.

The next step is to estimate the BER curve. We first calculate the measuredBER based on the PER measurement (Figure B.13, Figure B.14) and EquationB.5. We measured the indoor noise floor in our office with Airmagnet [10], whichis around -88 dBm. For the outdoor environment, -100 dBm is the selected averagenoise level based on calculations [11]. Given the transmit power (0 dBm), pathloss, and local noise floor, SNR can be calculated according to Equation B.3. Theselead us to the measured BER curve, shown in Figure B.11. Based on the theoreticalrelationship of SNR and BER, the approximation of measured BER curves arederived (Figure B.11). These estimated BER curves are stored in the look-up table

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 171

2 5 8 101214 20 25 3032 40 50 60 7050

55

60

65

70

75

80

85

90

95

distance[m]

Pat

hlos

s [d

Bm

]

Indoor PathlossOutdoor Pathloss

Figure B.12: Path loss vs distance

for our emulation. The results of the emulated PER for both indoor and outdoorenvironments are plotted in Figure B.13 and Figure B.14 respectively.

0 5 10 15 20 25 30 350

0.005

0.01

0.015

0.02

0.025

0.03

0.035

distance[m]

PE

R

Measured PEREmulated PER

Figure B.13: PER indoor

In general, the emulated PER approaches the measured PER very well for bothindoor and outdoor scenarios. There are some deviations at certain locations, theseare most likely caused by inaccurate RSSI or simply fluctuations of measurements.

Hence, we prove that by estimating the BER curve properly, we are able toemulate different environments. The PER increases with the distance, which alsoprove that our methodology for topology control works as expected.

172 APPENDIX B

10 20 30 40 50 60 700

0.01

0.02

0.03

0.04

0.05

0.06

0.07

0.08

0.09

0.1

distance[m]

PE

R

Measured PEREmulated PER

Figure B.14: PER outdoor

B.4.2 Emulation of microwave oven interference by direct con-figuration

In this experiment, we generate the interference configuration directly from theMaster. We aim to compare our emulation result with JamLab [12]. JamLab fo-cuses on interference emulation based on existing testbed facilities, such as TelosBnodes. According to [12], the interference of microwave oven has a simple on-offpattern with 20 ms period time and 50 % duty cycle. We decide to use this simplepattern to emulate the interference of microwave oven. The experiment scenario isidentical as in JamLab. One node sends 400 packets to another node at 1 pkt/sec.The transmitter and receiver are placed about 3 meters apart with no obstacles inbetween. According to the widely-used path loss model [13], path loss at distanced from the transmitter equals:

PL(d) = PL(d0) + 10λ logd

d0(B.6)

The path loss at 2 meter is known to be 46 dB [12]. The path loss coefficient λfor indoor environment is typically 2.5. When substitute these values into equa-tion (6), we get 50 dBm as the path loss at 3 meter. Thus the topology can beconfigured.

The only difference between our emulator and JamLab is how the interferenceis generated. JamLab used another TelosB node to generate the interference. Inour system, Master transmits a configuration frame every 10 ms via the broadcastconfiguration channel, thus the interference is turned “on” or “off” every 10 ms.

We only emulated for NULL MAC with packet size of 100 bytes. The em-ulated Packet Reception Rate (PRR) from our emulator is 44.1%, from JamLab

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 173

is 43.6%. We can see, that both emulation results are compatible to each other.However, in JamLab, the location of the interferer has to be carefully chosen, thetransmit power also needs to be adjusted in order to obtain the right level of inter-ference. If interference is required in a large area, the coverage becomes an issue.When multiple interference sources are present, JamLab needs a careful planningto avoid cross talk between different interference areas. Compared to JamLab, weonly need to configure the Master. Every node gets the exact amount of interfer-ence as configured, which is much more accurate and flexible.

B.4.3 Testing at MAC layer

There is always a concern that the physical topology of the ring will influencethe network behavior on the higher level. In this experiment we further prove thereliability of the emulator by performing a throughput test at MAC layer.

1 2 3 4 510

20

30

40

100

number of senders

Th

rou

gh

pu

t (k

bit

/sec

on

d)

Measured throughputEmulated throughput

Figure B.15: Throughput vs Senders

We emulate the throughput experiment presented in [14]. The original experi-ment is performed on a set of TelosB motes. The receiver is situated in the centerwhile a set of 1 to 10 senders are placed 1 meter away from the receiver. To em-ulate the same topology, we configured the receiver to have identical path loss toall the senders. The path loss value is calculated based on Equation B.6. Thesenders sent packets to the receiver as fast as permitted by the MAC layer. Thereceiver counted the number of packets received successfully over the duration of60 seconds. We only performed the test for XMAC [15] with 1 to 5 senders. Thesoftware is downloaded from [16], identical as used in [14]. The result is shownin Figure B.15. In general, the throughput increases with the number of senders.The emulated throughput curve fits well with the measurements.

174 APPENDIX B

0 1 2 3 4 5−1

−0.8

−0.6

−0.4

−0.2

0

0.2

0.4

0.6

0.8

Number of nodes in between sender and receiver

Th

rou

gh

pu

t d

evia

tio

n (

%)

Figure B.16: Deviation vs physical topology

We also take an extra step to exclude the influence of the physical topology.In case of only one sender and one receiver, we change the sender and receiver’sphysical location, from being neighbors on the ring till 5 hops apart. The deviationof the throughput in percentage is plotted in Figure B.16. The deviations do notshow a trend related to the physical topology, and the value itself is also very small,less than 1% of the total throughput. Hence we conclude the impact of the physicalring topology on the performance of higher level protocol is negligible.

B.5 Related work

Many efforts have been made to overcome the limitations associated with wire-less testbeds. For example, the solution presented in [12] focuses on generatinginterference with existing off-the-shelf hardware in a testbed. The transmit powerand the location of the interferer have to be carefully set up in order to obtain de-sired interference coverage and low cross-talk between interference sources. Oursolution, on the other hand, does not require such kind of physical deployment.Both topology and interference are controlled by software parameters, and can berealized in real time.

The work presented in [17] is comparable to our work in the sense that theyalso use FPGA to replace the wireless medium. However, there are three major dif-ferences: first at hardware level, they actually intercept the analog RF signal at theantenna port, while in our system, the data is never modulated into RF signal; sec-ondly, in their work the FPGA is used to perform Digital Signal Processing (DSP)based on a certain channel model, while in our system it is used to implement the

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 175

radio interface and ring transceiver; finally, our system relies on the relationshipbetween SNR and BER to achieve topology and interference control, while theyrely on the physical layer channel model and DSP. From a user perspective, thetopology and interference control is realized by tuning DSP parameters of the se-lected channel model, e.g, large-scale attenuation or fine grain fading. While forour system it is achieved by specifying parameters such as path loss and noise leveldirectly. The work presented in [17] is more suitable to emulate certain physicallayer phenomena, while our system focuses more on general network performance.Also we believe our system is more user-friendly for researchers without DSP andphysical layer background.

B.6 Conclusion and future workWe implemented a wireless link emulator upon low-cost Xilinx FPGA boards.This emulator differs from previous work by its unique hardware aspects, includ-ing the customized radio interface and the ring transceiver. The high speed hard-ware design is the key enabler for the concept of physical layer emulation.

We introduced the methodology used by our system to emulate various envi-ronments, and demonstrated experimental results that are compatible with real-lifemeasurements.

Nevertheless, many interesting directions remain for further research. For ex-ample, the real-time topology control can be used to emulate a network with mo-bile nodes, and the real-time interference control creates the possibility to replayinterference from recordings.

Our solution is a low cost yet very powerful and flexible test facility, that can beextended to other radio chips and wireless technologies. The scale of the emulatednetwork can be further increased by using the newest FPGA family (Spartan6)yielding higher speeds clock on the ring. In the future, we aim to enhance the ringclock speed by a factor of eight, resulting in 48 nodes in the emulated network.

AcknowledgmentThe research leading to these results has received funding from the EuropeanUnion’s Seventh Framework Programme FP7 under grant agreements number 258301(CREW project) and number 287581 (OpenLab project).

The authors would also like to thank Piet Cordmans, Yang Yang, Stefan Schip-per, Libo Li and Peter Ruckebusch for their contribution to this work.

176 APPENDIX B

References[1] G. Werner-Allen, P. Swieskowski, and M. Welsh. Motelab: A wireless sen-

sor network testbed. In Proceedings of the 4th international symposium onInformation processing in sensor networks, page 68. IEEE Press, 2005.

[2] V. Handziski, A. Kopke, A. Willig, and A. Wolisz. TWIST: a scalable andreconfigurable testbed for wireless indoor experiments with sensor networks.In Proceedings of the 2nd international workshop on Multi-hop ad hoc net-works: from theory to reality, pages 63–70. ACM, 2006.

[3] L. Tytgat, B. Jooris, P. De Mil, B. Latre, I. Moerman, and P. Demeester.Demo abstract: WiLab, a real-life wireless sensor testbed with environmentemulation. In 6th European conference on Wireless Sensor Networks (EWSN2009), 2009.

[4] T. Sky. Ultra low power IEEE 802.15. 4 compliant wireless sensor module.Moteiv Corporation, 2006.

[5] T. Instruments. CC2420: 2.4 GHz IEEE 802.15. 4/ZigBee-ready RFTransceiver. Available at Available at http://www. ti. com/lit/gpn/cc2420,53, 2006.

[6] Spartan-3A Evaluation Kit, User Guide. Available from: www.xilinx.com/support/documentation/boards and kits/ug330.pdf.

[7] Xilinx UG331 Spartan-3 Generation FPGA User Guide. Available from:www.xilinx.com/support/documentation/user guides/ug331.pdf.

[8] MicroBlaze Processor Reference Guide. Available from: http://www.xilinx.com/support/documentation/sw manuals/mb ref guide.pdf.

[9] M. Petrova, J. Riihijarvi, P. Mahonen, and S. Labella. Performance study ofIEEE 802.15. 4 using measurements and simulations. In Wireless commu-nications and networking conference, 2006. WCNC 2006. IEEE, volume 1,pages 487–492. IEEE, 2006.

[10] Datasheet: Airmagnet Spectrum XT. Available from: http://enterprise.netscout.com/content/datasheet-airmagnet-spectrum-xt.

[11] S. Haykin. Communication systems. John Wiley & Sons, 2008.

[12] C. A. Boano, T. Voigt, C. Noda, K. Romer, and M. Zuniga. Jamlab: Aug-menting sensornet testbeds with realistic and controlled interference gen-eration. In Information Processing in Sensor Networks (IPSN), 2011 10thInternational Conference on, pages 175–186. IEEE, 2011.

FPGA-BASED WIRELESS LINK EMULATOR FOR WIRELESS SENSOR NETWORK 177

[13] M. Zuniga and B. Krishnamachari. Analyzing the transitional region in lowpower wireless links. In Sensor and Ad Hoc Communications and Networks,2004. IEEE SECON 2004. 2004 First Annual IEEE Communications SocietyConference on, pages 517–526. IEEE, 2004.

[14] K. Klues, G. Hackmann, O. Chipara, and C. Lu. A component-based archi-tecture for power-efficient media access control in wireless sensor networks.In Proceedings of the 5th international conference on Embedded networkedsensor systems, pages 59–72. ACM, 2007.

[15] M. Buettner, G. V. Yee, E. Anderson, and R. Han. X-MAC: a short preambleMAC protocol for duty-cycled wireless sensor networks. In Proceedings ofthe 4th international conference on Embedded networked sensor systems,pages 307–320. ACM, 2006.

[16] TinyOS Git repository. Available from: https://github.com/tinyos/tinyos-main.

[17] K. Borries, X. Wang, G. Judd, P. Steenkiste, and D. Stancil. Experiencewith a wireless network testbed based on signal propagation emulation. InWireless Conference (EW), 2010 European, pages 833–840. IEEE, 2010.