IEEE802.11 Sensor Networking
P. Ferrari, A. Flammini, D. Marioli, A. Taroni
Paolo Ferrari
Dept. of Electronics for Automation and INFM, University of Brescia, Via Branze 38, 25123
Brescia Italy, Tel: +39 030 3715627, Fax: +39 030 380014, email: pferrari@ing.unibs.it
Alessandra Flammini
Dept. of Electronics for Automation and INFM, University of Brescia, Via Branze 38, 25123
Brescia Italy, Tel: +39 030 3715627, Fax: +39 030 380014, email: flammini@ing.unibs.it
Daniele Marioli
Dept. of Electronics for Automation and INFM, University of Brescia, Via Branze 38, 25123
Brescia Italy, Tel: +39 030 3715430, Fax: +39 030 380014, email: marioli@ing.unibs.it
Andrea Taroni
Dept. of Electronics for Automation and INFM, University of Brescia, Via Branze 38, 25123
Brescia Italy, Tel: +39 030 3715440, Fax: +39 030 380014, email: taroni@ing.unibs.it
Keywords: Smart sensor, IEEE802.11, Wireless Ethernet, IP, Sensor Network
1. Introduction
In a modern industrial plant there are thousands of transducers and a significant part of the
total cost is due to cables. Moreover, a wired system requires a continuous maintenance and
offers a reduced scalability; in effect, adding new segment or modifying an existing one could
be very costly, since structural works should be necessary.
Consumer market is evolving toward pervasive wireless applications and this trend will result
in a general cost reduction for all wireless communication devices and chipsets. Industrial
market still resist on cabling position, even if wireless promises are very attractive; for
instance, better mechanical reliability in hostile environments (with vibrations or corrosive
agents) and high network scalability, even in successive steps, can be achieved. In fact, today
many vendors propose standard-based and proprietary wireless products ready to be used in
industry, but generally no care is taken of time-critical applications.
Solutions that use proprietary hardware and protocols can offer superior performance and
lower power consumption than Standard-based solution, since they can be finely trimmered
on client requirements. In reality, a wireless network is frequently installed into an already
present network structure, so extra attention should be paid about compatibility. In a factory
there is a network stratification where each layer operates at a different level, from a single
automation cell up to the administration. If a smart transducer is able to talk with high level
protocols, bottleneck can be avoided since no (or less) gateways are needed. Furthermore,
Internet and Web offers the higher degree of standardization and a wireless transducer
supporting Internet protocols can be greatly advantaged.
Wireless networks based on international Standards seem to be a good option because,
although they can not reach a full optimization, they are widely known and supported. Among
Wireless standards, Bluetooth (BT) [1] and Wireless Ethernet (IEEE802.11) [2] are the most
diffused ones: Bluetooth is a short range (<10-100 m), low data-rate (<700 kbit/s)
communication standard, while IEEE802.11 is designed to replace Ethernet wired network
since it has a higher data-rate (i.e. 54 Mbit/s using part g specification) and a longer range
(100 m or more with an external antenna). In addition, IEEE1451 group is currently working
on part 5 to produce a standard on wireless sensor and these two Standards are favorite
candidates to be adopted at low layer.
Porting of Internet protocols over Bluetooth is more complicated than over IEEE802.11 that is
a part of the famous IEEE802 family. In addiction, IEEE802.11 is the natural solution for
Ethernet based-environment; in fact, IEEE802.11 components [3] are commonly employed to
extend industrial Ethernet links, as depicted in Fig. 1.
Our objective is to show the feasibility of a wireless sensor network for industrial application
that has a low cost and that can be easily integrated with an existing infrastructure. For all
these reasons the IEEE802.11 standard has been chosen as physical layer and a 8-bit
microcontroller has been used to manage the wireless interface.
2. Preliminaries
IEEE802.11, also known as Wireless Ethernet or WiFi, was born in 1996. It defines the MAC
(Medium Access Control) and the Physical layer (PHY) of a wireless connection between
fixed and mobile stations. Wireless Ethernet architecture is essentially a cellular type
network: the active stations can access a backbone network (Distribution System), by means
of base stations (Access Point), and exchange data; otherwise, if no base station is present,
active stations can communicate directly each other, provided that their ranges overlap. The
last topology is called “ad hoc” network.
PHY layers included in the IEEE802.11 are: Frequency Hopping spread-spectrum radio in the
ISM (Industrial Scientific Medical) free band; Direct Sequence Spread-Spectrum (DSSS) in
the ISM; Infrared (not commercially sustained).
MAC layer uses an access protocol of the CSMA/CA (Carrier-Sense Multiple
Access/Collision Avoidance) family relying on a random backoff and on control frames
(Request To Send/Clear To Send packets). A data encryption algorithm, called WEP
(Wireless Equivalent Privacy), is also provided to guarantee both wireless station
authentication and privacy protection.
There are three implementations of the IEEE802.11: the older realization was the 802.11b that
operates at 2.4GHz with a maximum data rate of 11Mbit/s; 802.11a was introduced to
increase data rate up to 54 Mbit/s but it works at 5GHz, a frequency that is not free in Europe;
last and more promising is the 802.11g, compatible with part 802.11b (2.4GHz) and featuring
the same transfer rate of 802.11a. This improvement has been obtained by the use of a
combination of DSSS and Ortogonal Frequency Division Multiplexing (OFDM) technique.
3. Proposed Approach
The proposed approach is shown in Fig. 2a, where several IEEE802.11 wireless transducers
belong to the same “ad hoc” network together with other WiFi devices. There is no difference
between a PC or a wireless transducer and, generally, information can be exchanged peer-topeer without any rule. The proposed architecture has a master-slave topology, because in
industrial applications such organization offers a reliable solution that keeps network traffic
low and produces repeatable results.
Anyway, this solution is open to any data architecture; as an example, each network entity can
be a master or a slave and, since everyone is visible within the same cell, master rights could
be passed each other.
Moreover, the proposed architecture can be linked with an already present wired Ethernet
segment by means of an Access Point (AP) as illustrated in Fig. 2b. The AP enables wireless
network traffic to be transmitted over the a preexisting fixed network, overcoming range
limitation and allowing merging of different wireless sub-networks.
The conceptual block diagram of the proposed wireless transducer is shown in Fig. 2. There
are three main parts: transducer interface and signal processing blocks are common to any
smart sensor, while IEEE802.11 MAC (Media Access Control) and RF section are specific of
a WiFi equipped transducers. Nowadays, in a smart sensor, signal processing is always
performed by a microcontroller and, in order to keep costs low, it should also furnish an
adequate support to communication algorithms. In fact, network protocols require more
computational power than traditional point-to-point ones.
In view of the fact that transducer interface and signal processing depend on specific
realization and application of a wireless device, they are not treated here. In the following,
only problems related with networking are considered, while transducer is substituted with
generic I/O lines (analog or digital).
The proposed system relies on a protocol stack (i.e. a set of protocols) based on IEEE802.11,
but it is also ready to connect with internet.
Wireless Ethernet protocol is directly derived from standard IEEE802.3 with insertion of a
LLC (IEEE802.2 Logical Link Control) and SNAP (IEEE802.3 SubNetwork Access
Protocol) fields. Differences with more common “Ethernet II”, which hasn’t LLC and SNAP,
can be here ignored since they are transparent to any upper protocol.
Internet Protocol (IP) is fundamental in every application that could be interconnected with a
global network, so it has been implemented as a basis, then a transport layer protocol should
be put over it. The internet stack offers two protocols, UDP (User datagram Protocol) and
TCP (Transfer Control Protocol); the first is the simplest, in fact it accommodates few
information allowing link data multiplexing (virtual “ports” over the same network link); the
second is a powerful connection-oriented protocol that guarantees a reliable transport
providing retransmission of lost data packets. Obviously, TCP software is more complex and,
even though solutions optimized for microcontroller were proposed in [4,5], UDP has been
used in this work. In addition, ARP (Address Resolution Protocol) and ICMP (Internet
Control Message Protocol) must be implemented to assure proper operation.
Last, a suitable proprietary protocol has been designed over UDP, how it is reported in Fig. 4a
with the well-known Ethernet frame. Protocol operation is typical of a master-slave
architecture; the master interrogate each slave waiting for a response. Messages from master
to slave (Fig. 3b) have the following fields:
 Destination: indication of which slave is the destination of the message. This field seem
to be redundant since MAC and IP addresses already specify a unique physical device;
actually, it is useful in case of multiple sensors that share the same network card (i.e.
multiplexing)
 Command & length: type of message (read/write, Data or Config). It also contains
length (4-bit) of the following data-field.
 Data: data for WRITE operations
 Master_Timer: value of the master timer when the message was compiled.
Response messages from slave to master (Fig. 4c) are composed of:
 Source: indication of which slave is the source of the message. Considerations reported in
the above Destination field are still valid.
 Command Ack & length: Acknowledge of the received command and length (4-bit) of
the following data-field.
 Data: data from READ operations
 Slave_Timer: value of the slave timer when the message was compiled
 Link_Quality: value of the RSSI (Received Signal Strength Indicator, range 27-154)
given by the slave card.
Once again, during this preliminary test phase simplicity has been preferred to safety; no
control or error correction/prevention facilities have been introduced.
It should be remarked that this protocol provides a certain degree of flexibility; for example,
slaves could generate messages to the master without being asked for. This extension, not
tested yet, can be carried out modifying the meaning of Command Ack field; for instance, if
asynchronous message are needed (e.g. alarms), a bit of this field can be reserved to signal an
unsolicited transmission.
A general scansion cycle of the proposed wireless system is reported in Fig. 5. The scansion
total length can be obtained as Ts = Ti · N where N is the number of slave in the sub-network
system and Ti is the interrogation time required to transfer and process slave data. In order to
reduce the interrogation time Ti, the master sends a request to slave n, decodes the slave (n-1)
reply then receives slave n reply; parallelly on the other side, during this time the slave n can
decode and create its response packet which will be processed next slot.
To demonstrate a really working 802.11 sensor network, a prototype has been build as shown
in Fig. 6. Each WiFi transducer has an analog input channel (0-3.3V), 8 digital inputs and 8
digital outputs.
The core of the system is a low-cost 8-bit microcontroller PIC18LF452 from Microchip with
32 kbytes of flash-type program memory and 1536 bytes of RAM; other integrated
peripherals used in the prototype are the 10bit AD converter and two 16-bit timers. As
IEEE802.11b MAC and PHY device an Orinoco Silver PCMCIA card from Lucent has been
adopted. This kind of solution is very effective since wireless PCMCIA cards can be found
cheaply in every computer shop, while single components of a 802.11 chipset must be
purchased in lots of thousands. Moreover, if well-industrialized and standard-compliant RF
devices are employed, layout design of the prototype is greatly simplified.
Orinoco card must be inserted into a standard 68-pin socket and the PCMCIA bus interface
has been implemented with a Cypress CY37128 CPLD (Complex Programmable Logic
Device); it hosts a state machine that helps the microcontroller to access sequentially the
registers required to drive the 16-bit wide PCMCIA bus. Both microcontroller and CPLD
operate at the main clock frequency of 20MHz.
The power supply section serves transducers, logic circuits and 802.11 module. It can accept
input from a fixed source or from a mobile source like a battery or a solar cell. It should be
said that all devices used can support 3.3V operation but the prototype works at 5V because
of Orinoco Silver Card constrains (PCMCIA “standard mode”).
4. Results
The prototype, shown in Fig. 5 and powered with 5 V, absorbs about 350mA of which
180mA are due to the WiFi card alone.
The software has been written in C; IP/UDP stack has been arranged to fit the poor memory
resources of the μC, while the Orinoco Silver Card driver has been derived from a free library
(Lucent HCF-light). The total occupation is 15 kbytes of code space and 1 kbytes of RAM.
Experimental setup includes two wireless transducers and one PC connected together with a
“ad hoc” network topology (see Fig. 2a). This configuration has been preferred since it should
be a favorable situation to achieve the best performance. Experiments are divided into two
groups: in the first one, only two prototypes have been used, one set as the master and the
other working as a slave; in the second set both prototypes are slaves and dialog with the PC,
where a LabVIEW virtual instrument acts as the master. Panel of the proposed test interface is
shown in Fig. 7.
With the first setup a point-to-point connection between master and slave has been employed
to measure the true rate of Ethernet packet generation (maximum throughput). Given that
software of master and slave is over our total control with no Operative System overhead, an
accurate estimation of delays can be done. 100 consecutive request messages have been
generated by the master and received by the slave, that was programmed not to respond: a
mean time of 2.6 ms is required by the prototype to build and send a packet. These time
intervals have been measured in hardware (with a Logic Analyzer HP1692A connected to the
microcontroller) and also verified with a network sniffer, like Ethereal, installed on the PC.
Next, the proposed system architecture has been stressed with all its functionalities activated.
The PC run the LabVIEW interface that accesses the sensor with mode and protocols
previously described, while the Logic Analyzer measures time delays probing microcontroller
pins. For each transducer, analog input is connected to a waveform generator HP33120
(sinewave @ 10 Hz, 4Vpp), digital inputs are associated to a dip-switch bank and digital
outputs are attached to some LEDs.
In this conditions, the mean time over 30 measures of the following operations has been
computed:
 ICMP Echo Request (as known as PING) takes 5.7ms
 The time that takes the master to retrieve information from a slave with a single request
(no cycle and no overlay) is Td = 11.5 ms
 Ti, defined above, is 9.3 ms (cycling and processing overlay activated)
Finally, some experiments about the operative range covered by the prototype have been also
carried out. This kind of measurement strongly depends on environmental conditions: if a
level of RSSI equal to 80 is considered as a safe working limit, a 60 m indoor range can be
obtained with no obstructions. Presence of metal obstacles or reinforced walls reduce this
range down to a half.
5. Conclusions
In conclusion, a complete solution to connect a IEEE802.11 based sensor with a wireless
network has been presented. WiFi is gaining market popularity and prices of interface cards,
chipset and other related components are falling. At the same time vendors of industrial
components are moving toward wireless solution to replace old wired control devices.
The proposed wireless system architecture can be integrated in an existing Ethernet
infrastructure by means of commercial AP, since most diffused protocols are supported (IP
and UDP). To show feasibility, some sensor prototypes have been realized using standard
PCMCIA cards interfaced with low cost electronics. Preliminary experimental results
demonstrate the system is compatible with soft real-time application in industry (Ts<10ms).
Anyway, power consumption is rather high and the short autonomy of a battery power supply
still remains the main disadvantage of the proposed IEEE802.11 sensor system.
6. Reference
[1] Bluetooth SIG, “Specification of the Bluetooth System 1.1”, 2001, <www.bluetooth.com>
[2] Institute of Electrical and Electronics Engineers, “IEEE Standard for Information
technology, Telecommunications and information exchange between systems, Local and
metropolitan area networks. Part 11: Wireless LAN Medium Access Control (MAC) and
Physical Layer (PHY) Specifications”, 1999
[3] Siemens Corp., RLM (Radio Link Module), CP1515 (Wireless Ethernet card), MOBIC
(Mobile Industrial Communicator), <http://www.ad.siemens.de/imc/index_76.htm>
[4] FLAMMINI, A., FERRARI, P., SISINNI, E., MARIOLI, D., TARONI, A., ‘Sensor
Interfaces: from field-bus to Ethernet and Internet ‘, Sensor & Actuators, part A, vol 101/1-2,
September 2002, pp. 194-202
[5] P. Ferrari, A. Flammini, D. Marioli, A.Taroni, “A Low-cost Internet-enable Smart
Sensor”, Proc. on IEEE Sensors 2002, 12-14 June 2002, Orlando, USA.
Wired Ethernet
Access Point
SCADA
PLC
PLC
AP
AP
Wired Ethernet
Figure 1. Wireless Ethernet used as a bridge between two Ethernet segments.
Ethernet infrastructure
802.11
Transducer
Access Point
b
802.11
AP
a
Transducer
802.11
Transducer
802.11
802.11
Transducer
Transducer
802.11
802.11
Transducer
Transducer
Figure 2. Proposed architecture: a) a wireless transducer network with an “ad hoc” topology;
b) more general wireless transducer network with an Access Point and a wired Ethernet
backbone.
Figure 3. Block diagram of the proposed wireless transducer(S is for sensor, A is for
actuator).
a)
16
20
8
4-22 (0-pad to 16)
4
ETH 802.3
IP header
UDP header
Proposed Protocol
ETH chksum
(+LLC+SNAP)
b)
c)
1
1
0-16
2
Destination
Command+len
Data (write)
Master_Timer
1
1
0-16
2
1
1
Source
Com. Ack+len
Data (read)
Slave_Timer
Reserved
Link_quality
Figure 4. The proposed protocol messages (3b master and 3c slave) and their position inside
the Wireless Ethernet packet (3a).
Ts
Ti
Master
S0
Slave 0
D2
R0
S1
D0
R1
S2
D1
R2
D+S
Slave 1
D+S
Slave 2
D+S
slot n-1
slot n
slot n+1
Figure 5. Operations performed by master and slaves during a cycle of the proposed protocol
(in case of 3 slaves). Decode phase for slave n-1 is performed during interrogation of slave n.
(R=receive, S=send, D=decode)
Power
supply
DA
μC
DS
AS
PIC18LF452
8-bit bus
PCMCIA
interface
logic
CY37128
802.11b card
Orinoco
PCMCIA bus
Figure 6. Block diagram of the proposed prototype. (DA=digital actuators, DS=digital
sensors, AS=analog sensor)
Figure 7. LabView virtual instrument that implements, on a PC, the master functionality and
the user interface of the proposed wireless network.