From Smart Dust to Reliable Networks Kris Pister

From Smart Dust to Reliable Networks Kris Pister Prof. EECS, UC Berkeley Founder & CTO, Dust Networks

Outline • Conclusion • Background – The Science Project • Market – The Hype • Technology – Challenges – Status • Applications • Open Research Problems

Conclusion • The market is real – Industrial Automation, Building Automation – $100 M? in 2006, $500 M by 2010 • Net impact of academic research on this market to date: zero to slightly negative • Open problems in “ADA*” – – Metrics/optimal reliability and power consumption Time synchronization Deeply duty cycled 802. 11 end-points Certification, binding, commissioning *ADA = Academically Dull Applications

Grand Challenge A B C Reliably, at low power

Smart Dust Goal c. 1997

Smart Dust, 2002 SENSORS ADC PHOTO 8 -bits 1 V 1 -2 V FSM RECEIVER 375 kbps 16 mm 3 total circumscribed volume TRANSMITTER 175 bps ~4. 8 mm 3 total displaced volume 1 V 1 V SOLAR POWER 3 -8 V 2 V OPTICAL IN OPTICAL OUT

UCB “COTS Dust” Macro Motes Services David Culler, UCB Networking Tiny. OS We. C 99 James Mc. Lurkin MS Rene 00 Small microcontroller - 10 kbps EEPROM storage (32 KB) Simple sensors Mica 02 Demonstrate scale - 8 kb code, 512 B data Simple, low-power radio Dot 01 Designed for experimentation -sensor boards -power boards NEST open exp. platform 128 KB code, 4 KB data 50 KB radio 512 KB Flash comm accelerators

University Demos – Results of 100 man-years of research Motes dropped from UAV, detect vehicles, log and report direction Intel Developers Forum, live demo 800 motes, 8 level dynamic network, and velocity Seismic testing demo: real-time data acquisition, $200 vs. $5, 000 per node vs. 50 temperature sensors for HVAC deployed in 3 hours. $100 vs. $800 per node.

Sensor Networks Take Off! Industry Analysts Take Off! $8. 1 B market for Wireless Sensor Networks in 2007 Source: In. Stat/MDR 11/2003 (Wireless); Wireless Data Research Group 2003; In. Stat/MDR 7/2004 (Handsets)

Wireless Sensor Networking Decision Systems Monitoring Systems Control Systems Enterprise Applications • Significant reduction in the cost of installing sensor networks • Enables new class of services Analog Sensors and Actuators Digital Sensors and Actuators Physical World Serial Devices • Increases sensor deployment

WDRG, 2003 $748, 000 in ‘ 03

Cost of Sensor Networks Mesh Networking Computing Power Installation, Connection and Commissioning $ Sensors Time

Low Data Rate WPAN Applications (Zigbee) security HVAC AMR lighting control access control asset mgt process control environmental energy mgt BUILDING AUTOMATION CONSUMER ELECTRONICS PC & PERIPHERALS INDUSTRIAL CONTROL patient monitoring fitness monitoring TV VCR DVD/CD remote PERSONAL HEALTH CARE RESIDENTIAL/ LIGHT COMMERCIAL CONTROL mouse keyboard joystick security HVAC lighting control access control lawn & garden irrigation

Mesh Systems

Dust Networks • Founded July 2002 – Angels, In-Q-Tel, ~$1. 5 M – 28 employees in Jan 04 • Series A Feb 2004 – Foundation – IVP • Series B Feb 2005 – Crescendo – Cargill

Network Architecture • Goals – – High reliability Low power consumption No customer development of embedded software Customer visibility into all aspects of network operation/status/health – Minimal/zero customer RF/networking expertise necessary • Challenges – 1 W emitters in regulated but unlicensed RF bands – Extreme computation and communication resource constraints • MIPS, RAM, bps

What do OEMs and SIs want? • • ^ and scientists and engineers and startups and grad students and…. Reliability Low installation and ownership costs – No wires; >5 year battery life – No network configuration – No network management • Typically “trivial” data flow – Regular data collection • 1 sample/minute… 1 sample/day? – Event detection • Threshold and alarm

Reliability • Hardware – Temperature, humidity, shock – Aging – MTBF = 5 centuries • Software – Linux yes (manager/gateway) – Tiny. OS no (motes) • Networking – RF interference – RF variability

IEEE 802. 15. 4 & Wi. Fi Operating Frequency Bands 868 MHz / 915 MHz PHY 2. 4 GHz Gutierrez Channel 0 Channels 1 -10 868. 3 MHz 902 MHz Channels 11 -26 2 MHz 928 MHz 5 MHz 2. 4835 GHz

900 MHz cordless phone -50 d. Bm Solid mote signal -20 d. Bm

Spatial effect of multipath

Frequency dependent fading and interference From: Werb et al. , “Improved Quality of Service in IEEE 802. 15. 4 Networks”, Intl. Wkshp. On Wireless and Industrial Automation, San Francisco, March 7, 2005.

Beware of static measurements and RF pathloss simulations • Site surveys need to be done over at least 24 hours • Simulation tool results need much more speckle Pictures from www. wirelessvalley. com

Radio Reliability in a Crowded Spectrum • UWB? – Unclear potential for duty cycling • DSSS doesn’t cut it – Helpful, but only about 10 d. B • +20 d. Bm doesn’t cut it – Helpful, but expensive in batteries – 802. 11 & cordless phones • Must frequency hop – Time synchronization required… …but you probably needed that anyway. – Lots of channels, lots of bandwidth, better scaling, …

Network Types Star Powered mesh infrastructure X Full Mesh Star-connected sensors No infrastructure X Why not use 802. 11? Mesh-connected sensors

Zigbee 1. 0 • Single channel networks are built into standard. This will be fatal for reliability. • Tree-based routing recommended by standard will likely not be adopted, especially given the single-channel radio. • No definition of duty cycling routers – Assumes powered routers, battery powered leaf nodes – No explicit prevention of router duty cycling – Zigbee 2. 0?

Power-optimal communication • Assume all motes share a network-wide synchronized sense of time, accurate to ~1 ms • For an optimally efficient network, mote A will only be awake when mote B needs to talk A A wakes up and listens B B transmits B receives ACK A transmits ACK Expected packet start time Worst case A/B clock skew

Packet transmission and acknowledgement Mote Current Radio TX startup Packet TX Radio TX/RX turnaround ACK RX Energy cost: 295 u. C

Fundamental platform-specific energy requirements • Packet energy & packet rate determine power – (QTX + QRX )/ Tlisten – E. g. (300 u. C + 200 u. C) /10 s = 50 u. A

Idle listen (no packet exchanged) Mote Current Radio RX startup ACK RX Energy cost: 70 u. C

Scheduled Communication Slots • Mote A can listen more often than mote B transmits • Since both are time synchronized, a different radio frequency can be used at each wakeup • Time sync information transmitted in both directions with every packet A B TX, A ACK B Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

Latency reduction • Energy cost of latency reduction is easy to calculate: – Qlisten / Tlisten – E. g. 70 u. C/10 s = 7 u. A • Low-cost “virtual on” capability • Latency vs. power tradeoff can vary by mote, time of day, recent traffic, etc. A B Tlisten B TX, A ACK

Latency reduction • Global time synchronization allows sequential ordering of links in a “superframe” • Measured average latency over many hops is Tframe/2 G T 2, ch y A T 1, ch x B Superframe

Time and Frequency Time A Freq One Slot C B 902. 5 MHz B A 903 MHz B A … B C 927. 5 MHz One Cycle of the Black Frame • Graphs & Links are abstract, with no explicit time or frequency information. • Frames and slots are more concrete • Time synchronization is required • Latency, power, characteristic data rate are all related to frame length • Relative bandwidth is determined by multiplicity of links

Time and Frequency Channel Time B A C B B A B A Cycle N+1 • Every link rotates through all RF channels over a sequence of NCH cycles • 32 slots/sec * 16 ch = 512 cells/sec • Sequence is pseudo-random C B Cycle N+2 B A A B C

50 channels, 900 MHz 900 MHz 930 MHz

16 channels, 2. 4 GHz 2. 485 GHz

Configure, don’t compile Smart. Mesh Console TM IP Network XML Smart. Mesh Manager Mote ~100 ft Reliability: 99. 99%+ Power consumption: < 100 u. A average

50 motes, 7 hops 3 floors, 150, 000 sf >100, 000 packets/day

Communication Abstraction • Packets flow along independent digraphs • Digraphs/frames have independent periods • Energy of atomic operations is known, (and can be predicted for future hardware) IP Network XML – Packet TX, packet RX, idle listen, sample, … Smart. Mesh Manager • Capacity, latency, noise sensitivity, power consumption models match measured data • Build connectivity & applications via xml interface A C Network Services B Configurable Data Filter/Control Analog I/O Digital I/O Serial Port E H G F

Available data • Connectivity – Min/mean/max RSSI • Path-by-path info: – TX: attempts, successes – RX: idle, success, bad CRC • Latency (generation to final arrival) • Data maintained – Every 15 min for last 24 hours – Every day for last week – Lifetime • Available in linux log files or via XML IP Network XML Smart. Mesh Manager

Micro Network Interface Card m. NIC • No mote software development • Variety of configurable data processing modules • Integrators develop applications, not mesh networking protocols • For compute-intensive applications, use an external processor/OS of your choice. Network Services Configurable Data Filter/Control Analog Digital Serial I/O Port

Energy Monitoring Pilot • Honeywell Service: monitor, analyze and reduce power consumption • Problem: >> $100/sensor wiring cost • Solution: – Entire network installed in 3 hours (vs. 3 -4 days) – 9 min/sensor – Software developed in 2 weeks (XML interface) – 12 months, 99. 99%

Chicago Public Health – Dust, Tridium, Teng Temperature and power monitoring

Tridium Niagra. AX

Micro Network Interface Card m. NIC • No mote software development • Variety of configurable data processing modules • Integrators develop applications, not mesh networking protocols • For compute-intensive applications, use an external processor/OS of your choice. Network Services Configurable Data Filter/Control Analog Digital Serial I/O Port Sensor u. P

Perimeter Security Passive IR and Camera 1. 5 in MEMS and GPS 2. 5 in

SAIC Field Demonstration with the USBP • Two hundred 2 nd generation sensor nodes – Geophone, passive IR, magnetometer, camera, radiation sensors • Packaged for long lifetime, easy deployment, and effective concealment • Deployed on the U. S. – Mexico border for onsite assessment and persistent unattended surveillance Demonstration in Naco, Arizona Improved electronic surveillance needed to supplement the limited physical security offered by fences

Perimeter Security - MARFORPAC Objectives: Develop and demonstrate an ultra-low-power, low-cost, reliable wireless sensor network for widespread and persistent surveillance of borders and perimeters in support of OEF and OIF Key Participants: MARFORPAC, MCWL, MCAS, SAIC, and Dust Networks Deploy and demonstrate at the Chocolate Mountains Aerial Gunnery Range (CMGAR) at the Marine Corps Air Station (MCAS) near Yuma, Arizona • Addresses a need to detect intruders, smugglers and scrappers at the CMAGR • Provides a proving ground and relevant data collections for production and deployment in OEF and OIF

Applications Public Safety Parking Management Conditioned Maintenance Resource Metering Traffic Monitoring Public Information

Basic Enforcement Operation 1 Sensor nodes are deployed along streets 2 Sensor nodes detect the arrival, 3 presence and departure of vehicles. Information is collected via the low power mesh, and relayed back to a central database over 4 cellular data networks. The central database maintains an up-to-the-minute map of parking events and violations 5 for the entire city. PCOs are dispatched in 6 efficient routes to ticket violations. Detailed historical and statistical information on parking is used to improve policy and operations over time.

Mote on a Chip? (circa 2001) • Goals: – Standard CMOS – Low power – Minimal external components antenna Temp ~$1 u. P SRAM Amp ADC Radio ~2 mm^2 ASIC battery inductor crystal

UCB Hardware Results ~2003 • 2 chips fabbed in 0. 25 um CMOS – “Mote on a chip” worked, missing radio RX – 900 MHz transceiver worked • Records set for low power CMOS – ADC • 8 bits, 100 k. S/s • 2 u. A@1 V – Microprocessor • 8 bits, 1 MIP • 10 u. A@1 V – 900 MHz radio • 100 kbps, “bits in, bits out” • 20 m indoors • 0. 4 m. A @ 3 V

X Radio Performance em 250 25 X cc 2400 X IRX (m. A) 20 cc 2420 15 X Xemics cc 1000 10 X X X cc 1000 5 Cook 2005 Molnar (0. 4 m. A) X Otis (0. 4 m. A) X 100 k X 200 k 300 k Bit rate (bps)

Die area, power, 2005 2009 • ADC – 10 -12 bits, zero area, zero power • Digital – – 32 bit u. P 1 mm 2 0. 25 mm 2 Crypto - ~ u. P Dedicated datapath? 0. 25 m. W/MHz 50 u. W/MHz • Memory – ROM & Flash 128 k. B/mm 2 0. 5 MB/mm 2 – RAM 16 k. B/mm 2 64 k. B/mm 2 – ~m. W/MHz ~ u. W/MHz • RF – 2 mm 2 1 mm 2 – 10 s of m. W 100 s of u. W • Leakage – 10 s u. A @ 85 C? <1 u. A @ 85 C (circuit solutions; processes get worse)

Mote on a Chip, 2009 • Goals: – Standard CMOS – Low power – Minimal external components antenna u. P Security Temp Location Amp ADC Radio Time SRAM ~2 mm^2 ASIC battery inductor crystal

Open Problems, Hardware • None. ü Sensors ü ADC ü u. P ü Radio ü RF Ranging ü Integration

Security Goals • Encryption – Make sure that no one can see the data • Integrity – Make sure that no one can fake the data, fake control packets, screw up the network with replay of old packets, screw up the network with random packets – Make sure that random bit errors don’t screw up the network • Certification – Networks only accept trusted motes – Motes only join trusted networks • Binding – Motes only join the right network

Use cases • • One supplier/integrator One supplier, separate integrator Multiple suppliers, one integrator Multiple suppliers, multiple integrators, multiple neighboring customers Building 2 • HVAC network • Security Network • Fire network • Tenant networks Building 1 • HVAC network • Security Network • Fire network • Tenant networks ? ? New mote ?

From manufacture to 3 AM join Mote N Manufacturing Protocol version# PC Mote ID Joining Key Signed(ID, JK) Store/ sleep Mote P 1 Mote P 2 Manager Data/advert packet Join request Signed(ID, JK) Manager verifies signature Operator accepts new mote Configure? Path key encrypted with JK Mote N key encrypted with JK Activate child Path key encrypted with P 1 key Path key encrypted with JK Mote N key encrypted with JK config. ACK Encrypted with Path Key Add link N->P 2 Path key encrypted with P 2 key Add link N->P 2 Path key encrypted with N key

Open Problems, Software • Definitions, metrics, and optimization of reliability and power consumption for Academically Dull Applications (low rate data collection and control) – Simple models are fine (until proven otherwise) • Interference, multi-path, radio power, etc. • Start w/ reliability >99. 9%, duty cycle <10% and improve • • Time synchronization Powered Infrastructure w/ 802. 11 Certification, Binding, Commisioning Reducing barriers to access – Interfacing to PDAs, cell phones, web