MBStar : A Real-time Communication Protocol for Wireless Body Area Networks

Transcription

1 MBStar : A Real-time Communication Protocol for Wireless Body Area Networks Xiuming Zhu, Song Han, Pei-Chi Huang, Aloysius K. Mok Univ. of Texas at Austin xmzhu, shan, peggy, mok@cs.utexas.edu Deji Chen Emerson Process Management deji.chen@emerson.com Abstract In this paper, we report on the design and implementation of MBStar, a higher-frequency, real-time, reliable, secure protocol for wireless body area networks(wban). As in most proposals for body sensor networks, MBStar adopts the star topology for communication, and is designed to support a message rate as high as 4 Hz, which to the best of our knowledge, is the highest among low-power wireless communication protocols implemented at the present time. The physical layer of MBStar utilizes DSSS compatible radio for which a higher-frequency, reliable, TDMA MAC layer is built. There is a simple application layer designed for security on top of it. MBStar utilizes public/private key encryption for provisioning devices and does not involve any human configuration before device join. Considering the resource limit of most embedded systems, the TDMA requirement of computing a shared global communication schedule presents a practical problem since it may not be feasible for all the devices to communicate in a long hyper-period while the communication schedule between devices is being created or modified as devices depart and rejoin. We solve this problem by keeping only the global hyper-period schedule on the gateway side, with each device being configured with a shorter, local period. Then, retransmission is employed to resolve any conflicts between the devices. Our strategy has the property that, given any fixed task set, the minimal average number of retransmissions is independent of any communication scheduling algorithm, and the EDF (Earliest Deadline First) is optimal for our communication architecture. Finally, we present experimental results that demonstrate that MBStar is an effective protocol for wireless body area networks. Keywords-Wireless body area networks; High frequency; Reliable and real-time communication; I. INTRODUCTION The application of wireless technology to health care has been recognized to be an important research topic []. Typically for such applications, sensors or actuators are attached to the human body and a powerful server that serves as the central data processor and the data sink. Together they form a wireless communication network, commonly called a Wireless Body Area Network (WBAN), as proposed in []. A key problem in WBAN is how to connect heterogeneous body sensors and assistive actuators securely, reliably and to meet real-time performance requirements. Typically, body sensors have to send out health data periodically and their transmission frequencies range from several Hz to several hundred Hz. There is also an increasing need for real-time control for assistive actuators. For wireless communication, there are several well-developed standards such as Wi-Fi, Bluetooth, ZigBee and WirelessHART. However, these standards fall short in some aspects to serve the needs of WBAN for medical applications. For example, both Wi-Fi and Bluetooth cannot provide timing guarantees on packet delivery. While beacon- Enabled ZigBee and WirelessHART can provide real-time communication, they are too slow for such applications. The maximum transmission frequency of WirelessHART is Hz and ZigBee is even slower. In this paper, we propose MBStar, a new protocol for WBAN. The main notable features of MBStar are listed as follows. Higher Frequency. MAC timeslot of MBStar is.5 milliseconds and the data rate can be as high as 4 Hz. Real-time. MBStar MAC layer adopts TDMA (Time Division Multiple Access) to ensure accurate timing control for packet delivery. Reliable. MBStar utilizes channel hopping and channel blacklist to minimize noise interference. It also supports acknowledged transmission and retransmission to provide link reliability. Secure. MBStar employs both public/private key mechanisms for provisioning devices before join and uses AES (Advanced Encryption Standard) for encrypting health data after join. Star Topology. Since body area networks cover a small area, the star topology is quite sufficient. In a MBStar network, we shall assume that a gateway is connected with access point(s) and a number of sensors/actuators are connected to the access point wirelessly. A major contribution of our paper is to provide a practical solution to implementation problems by appropriate design choices. In our application model, sensor processes send data periodically, and a sensor may depart and rejoin a network at any time. We use the offset-free scheduling model [] where the processes are executed periodically in accordance with a schedule whose length covers the hyper-period of the processes. Because of resource limits, it may not be feasible for a sensor node to keep a long global schedule covering the hyper-period. In our solution, a newly joined sensor process is configured with the parameters of local period T new and an offset O new. After configuration, the sensor sends data in the O new + k T new, k =,,... s. This strategy may incur collisions between the sensor data transmissions at the access point since the access point can send/receive on only one channel at a time. Physically, there is actually no In this paper, we assume that there is only one access point connected to the gateway; extension to the multiple access point case is possible

2 collision since senders transmit on different channels by using frequency hopping in our scheme, and collision is detected by the transmitter if there is no acknowledgement from the intended receiver. In case of collision, a sender retransmits the data until either it gets an ACK or data expiration. We shall define a MBStar offset-free scheduling problem in terms of the determination for each process an optimal pair of values for (T new,o new ); an optimal schedule must guarantee both the highest utilization ratio of the receiver s channel and the lowest average number of retransmissions. We tackle this problem in four steps. First, we prove the the optimality of the EDF scheduler in generating the global schedule for the MBStar offset-free scheduling problem when the period parameters have been fixed. Second, EDF utilization upper bound is used to choose the optimal value for T new. Third, optimal value for O new is determined by searching within a small range. Finally, EDF is used to generate the schedule. The remainder of the paper is structured as follows: Section II introduces background and the related work. Section III describes MBStar in Detail, followed by an prototype implementation in Section IV. Section V will present the experimental data and Section VI the conclusion. II. BACKGROUND AND RELATED WORK A. Wireless Body Area Network According to [] [], WBAN usually consists of at least one powerful data center server, a number of sensor nodes for sensing and actuator nodes for control actions. It can be easily confused with Wireless Sensor Actuator Networks (WSAN). Compare to WSAN, the specific requirements of WBAN which can be listed as follows: ) Reliability. Data sent by WBAN sensors are heath information for which high reliability is required. WBAN reliability should be certifiable. ) Latency. Health data, especially emergency data, cannot tolerate long response time. Real-time transmission with performance guarantee is required, especially in the case of control actions where low latency is often required for system stability. ) Security. privacy as well as freedom from tempering is important in WBAN. 4) Power consumption. Compared to WSAN, battery replacement in WBAN is easier and so there is less focus on power consumption. Table I lists some body sensor bandwidth requirements [] [4]. From the table, we can see the sizes of medical data packets are usually small while the bandwidth range can vary quite widely. B. Related Wireless Protocols As mentioned above, current commercial wireless protocols (Wi-Fi, Bluetooth, Zigbee and WirelessHART) cannot be applied to WBAN directly. Table II summarizes the features of these protocols. Except for voice packets, Bluetooth cannot guarantee real-time delivery. For WirelessHART, the data rate is at most Hz and the message header of WirelessHART is unnecessarily long for health data, which is not power efficient. TABLE I: Bandwidth and data size requirements on typical biomedical measurements Biomedical measurements Bandwidth Data size EMG - Hz 6 bits ECG -5 Hz bits Blood Pressure 5- Hz 6 bits Respiration 5 Hz 6 bits Heart Rate 5 Hz 4 bits Motion Pressure - Hz bits TABLE II: Features of present Wireless Communication Protocols Protocol Low power Realtime Delivery Channel Hopping High frequency (> Hz) WiFi No No No Possible Bluetooth Yes Yes Yes No Zigbee Yes Yes No Yes WirelessHART Yes Yes Yes No Besides above protocols, there are several related works such as BSN-MAC [5], H-MAC [6], Lamprinos [7], Omeni [8]. All these protocols try to improve energy efficiency. BSN-MAC uses an adaptive MAC protocol. It utilizes beacon-mode and it adjusts the interval of contentionfree and contention-based period based on sensors feedback. In this way, it gains better energy efficiency. H-MAC proposes an interesting way to synchronize the human body sensors by making use of the human heartbeat rhythm as an external clock, thus saving the energy of broadcasting time messages. Lamprinos [7] proposes a token-based mechanism to synchronize transmission between the data sink and sensors. Only the sensor that obtains the token is allowed to send data and it must release the token after finishing transmission. Through this lock-share method, it removes the collisions between slaves. Omeni [8] employs listen-before-transmit (LBT) to avoid collision with nearby senders and proposes a dynamic allocation for lower frequency, fluctuating traffic. Since the sensors are deployed only on the human body, the mesh topology is not necessary for such a small area and there is no need to use any routing mechanism. Till today, the star topology is the major established for all WBANs. III. MBSTAR IN DETAIL In this section, we describe the MBStar protocol in detail. MBStar adopts several important features from current wireless protocols, like channel hopping and channel blacklist to create a suitable solution for WBAN. A. MBStar Protocol Architecture and topology Fig. shows the architecture of MBStar protocol. The physical layer utilizes the radio for low power consumption, for which a higher frequency, reliable, TDMA MAC layer is built. The MAC layer adopts channel hopping and channel blacklist to minimize the effect of noise on any particular channel and retransmission is also used to attain high reliability. The MAC length is.5 milliseconds supports a higher bandwidth than current low-power wireless

3 TABLE IV: MBStar Timing Profiles Fig. : Architecture of MBStar Protocol TABLE III: Radio Timing Profiles Symbol Description Value (µs) TsTxWarmup Tx Warm-up 96 TsTxCooldown Tx Cool-down TsTxRx Turnaround between Tx and Rx 9 TsTxUnit Tx one byte TsTxPhyHeader Tx physical header (6 bytes) 9 Symbol Description Value (µs) TsTxOffset Tx preparation time TsTxMaxPacket Time to Tx the max packet (4 97 Bytes) TsRxAckDelay Time between finishing Tx and 5 waiting for the ACK TsRxAckWait Wait time for the start of ACK 44 TsRxOffset Rx preparation Time 5 TsRxWait Wait time for the start of message 44 TsTxAckDelay Time between the end of message and start of sending ACK TsTxAck Tx time for ACK 49 protocols. On top of all, there is a simple, secure application layer, and MBStar can support 8-bit AES (Advanced Encryption Standard) encryption/decryption. The application layer will sample health data from the sensors and then encrypt the data and pass it down to the MAC layer. The main reason why we do not put security in MAC layer is for efficiency. Usually, encryption/decryption involves high computational cost and the MAC may be too short to complete all the tasks. We shift security into the application layer because the timing requirement is not as harsh. The MBStar network has a star topology that connects a number of devices to an access point that is in turn connected to the gateway. The MBStar protocol stack is executed by all the nodes in a network. Nodes that are sensors/actuators collect data and transmit them via an access point to the central data server for processing and the actuator commands are sent downlink for control actions. B. MBStar MAC Layer The MAC layer is the key part of MBStar. In this section, we will describe the definition of MAC and the format of packet. ) MAC Time Slot Definition: Table III shows the timing profiles. The basic is.5 milliseconds. The physical layer header is 6 bytes. Hence, there is not much space in one packet to hold many bytes. In MBStar, the maximum DLPDU (or MAC Layer Protocol Data Unit) packet size is 4 bytes, which is quite enough for medical data and there is a smaller MAC ACK packet, which is 9 bytes. Fig. and Table IV show the timing definition for transmitting slot and receiving slot. A noteworthy value is TsRxWait and TsRxAckWait. Both are 44 µs, which is designed for receiving all the physical header bytes. If there is no physical header of a packet arriving after this period, the receiver should close its antenna for saving power. ) Time Synchronization: Since MBStar adopts a very timestringent slot size, the time synchronization requirement is more demanding than other low-power networks. Since two devices may drift in different directions, the receiver may open its antenna either too early or too late. In MBStar, the Fig. : MAC Slot Timing receiver should open the antenna 5 µs before the sender starts transmitting. Hence, the maximum permitted time difference is 5 µs. For devices with ppm clock accuracy, we have to synchronize them at least every 5/( * ) =.5 s. Since MBStar is a star topology, it is enough for the access point to send out a broadcast packet every.5 seconds. ) MAC Data Format: Table V shows the DLPDU data packet format. MBStar endeavors to find a good balance between reliability, security and packet size. For one packet, there is a 9-byte overhead. A packet begins with -byte tag in order to distinguish itself from other compatible protocol packets. The number snippet gives the least significant byte of the number which denotes the offset (measured in the number of s) from time zero, i.e., the time point at which the access point joins the network. The MIC is used for DLPDUs authentication and generated securely according to the present absolute slot number and destination address. Only two devices sharing the same key can authenticate it. Finally, there is a -byte CRC at the tail of the packet. 4) Channel Hopping and Channel Blacklist: MBStar adopts channel hopping and channel blacklist to minimize the effect of noise on any specific channel by using hopping from channel to channel. Each device is configured with a unique channel offset. The current channel for a device can be computed as follow. Channel = (Timeslot Snippet + Channel Offset) % Number of Channels Periodically, the access point updates the transmission failure number of each channel and broadcasts the present channel situation. In this way, each device in the network knows how to avoid using blacklisted channels before the next update.

4 Byte Number Byte - Byte Byte Byte 4 Byte 5-n Byte n+-n+ Byte n+-n+4 C. Application Layer TABLE V: DLPDU format Description MBStar Packet Tag Bit - is for packet specifier and bit 4-7 is network ID Bit - is destination address and bit 4-7 is source address Time slot number snippet (the least significant byte value) Payload (maximum 5 bytes) MIC (message integrity code) CRC The application layer is relatively simple. It is mainly responsible for encrypting sensor data and decrypting configuration commands from the access point. The maximum APDU payload is 4 bytes, which is enough for medical application. D. Security Basically, secure communication in wireless networks involves two steps: ) How to authenticate the new device during joining process? ) How to make sure the secure communication after join? With respect to the former, all current wireless protocols involve manual pre-configuration. Wi-Fi and Bluetooth ask for password input. ZigBee and WirelessHART require the user to store the unique device ID beforehand. A manual configuration interface (keyboard, screen, FSK port and so on) is needed for authentication. In MBStar, we utilize the Internet Key Exchange protocol (IKE) [9] to authenticate and provision a device over the air. IKE consists of two phases. In phase I, we use the Diffie-Hellman key exchange mechanism to establish a secure authenticated communication channel between peers. Based on the secure channel, the peers negotiate Security Associations (SAs) for further services. In MBStar, we adopt a Self- Certified ECC-based Diffie-Hellman(ECDH) key exchange protocol [] in phase I. In phase II, a certificate is generated in the gateway and will be configured into the new device. One major concern of using ECDH on embedded systems is the time overhead. ECDH is not a good option for timestringent applications. However, since there is usually no explicit time requirement for the join process, this is not a problem. The latter is much easier to handle. As soon as a device is authenticated, a fresh communication key will be immediately provisioned with the shared key generated by ECDH. Thereafter, communication will be protected by symmetric encryption/decryption algorithms, such as AES or DES. MBStar can support up to 8-bit encryption, which is deemed to be good enough at the current time. E. Join Sequence Based on the above description, the sequence of a device join is as follows: ) The gateway first configures the access point and then the access point starts to broadcast periodically. ) For a device, it synchronizes itself when it receives broadcast packets and then starts to send request for authentication based on Internet Key Exchange protocol (IKE). ) After finishing IKE phase II, a shared key is established between the gateway and the device. Then, the gateway configures a new key and the network ID into device. At this point, secure communication channel is established. 4) Next, the device will send out a bandwidth request and wait for the response from the gateway. If the request is authorized, the device will send out data periodically subject to the bandwidth agreement. 5) A device may drop out of the network for losing synchronization at any time. However, it can always start rejoin. IV. IMPLEMENTATION In this section, we will describe our implementation. We shall first introduce our hardware platform, and then our software architecture. Then, we shall discuss some algorithmic issues concerning link scheduling. A. Hardware Platform Our implementation is built on Freescale MCx series which have the following core features: 4 MHz -bit ARM 7 core based MCU 96K bytes RAM compatible radio Four independent 6-bit hardware timers Hardware acceleration for AES security Freescale provides both a simple physical layer library and a security library. These libraries enable us to operate the antenna directly and develop the security module easily in MBStar. B. Software Architecture Fig. shows the software architecture of our implementation. The main modules can be described as follows: Message Handling Module: Message Handling module is responsible for sending and receiving packets, usually one for receiving and another for sending. For a nontiming-critical interface (sensor to APP,e.g), there is a packet queue associated with it and the message handling module will use events to notify the corresponding layer after putting the packet in the queue. For timing-critical tasks, message handling will directly use interrupts to handle the message. There is no queue between the MAC layer and the physical layer. The transmitting buffer and receiving buffer are shared by both layers. This simple design removes the queuing delay and ensures the quick handling of messages. Timer Module : There are four 6-bit hardware timers on MCx and we use only one of them. For each timer, there is a free running register storing the current tick number and a comparison register for input. Whenever

5 the values of the two registers are the same, a timer interrupt event will occur. Timer interrupts have the highest priority and are used for processing only time critical and light-weight jobs. Computational intensive job, like encryption/decryption, may take too long and thus are not performed by the timer interrupt handler. Another function of the timer module is synchronization with the access point. In MBStar, the synchronization operation is carried out when a packet, mostly, advertisement, from the access point arrives. The arrival time of the first bit is recorded and is compared to the designed packet sending time as follows. time diff = arrival time -slot star time-tstxoffset As mentioned above, a device will redo the synchronization at least every.5 seconds to maintain synchronization. Scheduler : The scheduler module in the MAC layer is used to determine the type (transmitting, Receiving, or idle) of next according to configuration stored in MAC PIB. In our implementation, it is called at the end of each because a device has to get all the information to determine the type of next slot (retry, e.g). Security Module : The security module is put in the application layer because of its high time cost. This decision is acceptable in MBStar. Measurements show that it takes less than.5 milliseconds for encrypting/decrypting 4 bytes on MCx with built-in AES module. For secure provisioning, [] lists the time and memory cost on MCx: the total memory footprint of ECDH implementation is around KB and it takes less than seconds to complete all the authentication steps. Pre-computation is also employed in our implementation. For example, the encryption of sensor data can be done beforehand. Also, packet MIC generation can also be precomputed both for sender and receiver because MIC is not related to the content of a packet. MAC Time Slot State Machine : Fig. 4 shows the transition of MAC states for transmitting slot and receiving slot. The transition is driven either by timer interrupt or by message coming interrupt. As shown in the figure, all the operations are light-weighted to guarantee timing requirements. APDU processor : The functionality of APDU (Application Protocol Data Unit) processor is simple. It is used to parse configuration messages from the gateway and encapsulate sensor data into APDU which is then sent down to MAC layer. C. Link Scheduling This section introduces the link scheduling problem in MBStar. We first describe a typical scenario and define the associated MBStar offset-free scheduling problem. We then discuss our solution approach. ) MBStar Offset-free Scheduling Problem: For economy of space, we only consider uplink scheduling in this paper, Fig. : Software Architecture Fig. 4: MAC Time Slot State which means that the access point only receives data from sensors. Our discussion can be readily extended to the downlink case. The scenario can be described as follows: For the access point, it can only communicate with one device in each. For a wireless body sensor, it may have a desired data transmission rate (maximum rate) and also a tolerable rate (minimum rate). In other words, the bandwidth request is a range. (See Table I) The protocol is based on TDMA and channel hopping. So, devices are sending on different channels in the same. There is no physical collision but logical

6 devices Fig. 5: An Example for Schedule in Gateway transmission collision may occur at the target (access point). To ensure data reception, the sender will retransmit the same data packet if it does not receive the correct ACK. However, if a new sample arrives (sampling rate is the same as transmission rate), the sender will have to discard the old packet in order to send the latest data. Devices may join and leave at arbitrary times. The gateway tries to satisfy the maximum bandwidth requirement of a device. If it does not have enough bandwidth to meet the lowest data rate requirement, the device will not be permitted to join the network. To solve the problem, we adopt a simple way to configure the device. For each bandwidth request, the gateway will respond with two values: the designated beginning number and the permitted rate. If the permitted rate is not zero, the device can start sending the data at the designed number at the (fixed) permitted rate ad infinitum. Otherwise, the bandwidth is insufficient and the device is not permitted to send any data. The gateway has all the information required to generate a suitable schedule to guarantee every packet be received before expiration if there is no other interference. Note that the devices do not have knowledge of the global schedule that spans a hyper-period. Each device only keeps its own period. Fig. 5 shows an example of the schedule. The X-axis denotes number and Y-axis denotes sensor number. A stripped block denotes a transmission failure because of collision while a clear one means a success (same for later figures). In this figure, there are two sensors. Sensor is sending a packet every slots while sensor is sending every slots. Both begin at time. And at time, access point is scheduled to pick up the packet sent by sensor and send an ACK back. At time, access point is scheduled to talk to sensor since it knows sensor will retry. There are several reasons why we do not share the global schedule that spans the hyper-period. First, since the sampling rates of medical devices are not harmonics in general, the length of the hyper-period may be very long. We cannot in practice expect every device to have enough memory or computing capability to keep in step with the global scheduler. Also, the configuration packet size is likely to be not long enough and thus, the configuration loop will be very long even if a device has enough space. Second, since devices may join and leave arbitrarily, each join and departure will involve an update of the hyper-period schedule to the entire network, which is not very scalable. As we can see from Fig. 5, the first packet sent by sensor is of no use, which results in power waste. However, as stated in the related work section, recharging body medical devices is much easier than that in normal wireless sensor networks, and power consumption is not considered as the key issue here. We adopt the offset-free real-time scheduling model [] to tackle our problem. In offset-free systems, the offset of tasks is assigned by the scheduler. In MBStar, we aim to find both an optimal offset and period for a new device. Thus, the MBStar offset-free scheduling problem is defined as follows: Consider that n senders s,..., s n already joined the network, and there is a new sensor s new that needs to be accommodated. Each joined sensor s i is characterized by a pair (T i, O i ) with period T i N and offset O i. The release time of kth (k =,,...) packet of s i is O i + (k ) T i. And, sender s i keeps transmitting the packet until either it receives an ACK from the receiver or the next packet from the sensor is released. The kth packet must be received before O i + k T i th slot. The new sensor is characterized by a pair (mint new,maxt new ) with desired period to be mint new but no bigger than the tolerable period maxt new. The average global retransmission number retran number is defined as the number of retransmissions divided by the number of successful transmissions in the global hyper-period schedule, assuming packet loss is due to logical conflict only. The global utilization ratio U is the sum of /T i for all joined s i. The new task set is a set of pairs {(T, O ),..., (T n, O n )},which n N that contains the period and offset assignment to the new sensor task. The objective is to find a pair (T new, O new ) for the new sensor, where T new [mint new, maxt new ] and O new N, and to generate a schedule in the gateway for the new task set. A schedule is optimal if it meets the following constraints: ) It has the highest global utilization ratio. ) Subject to the highest utilization ratio that can be achieved for the task set, the schedule should attain the smallest average retransmission number. Next, we shall discuss our solution approach for this problem. First, the optimality of the EDF policy is proved given that the task period and offset parameters are fixed. Then, how to choose optimal values for (T new, O new ) will be proposed. ) Optimality of EDF: The optimality of the EDF (earliest deadline first) preemptive scheduling algorithm for tasks with arbitrary release times and deadlines has been proved by Dertouzos []. Liu and Layland [] and Spuri [4] proved that as long as the global utilization ratio is no bigger than, EDF can be applied successfully, even if the tasks are asynchronous. This also applies to the discrete time model where the granularity of time measurements is in terms of integral multiples of some basic time quantum [5]. In this model, time intervals are always measured between integral time points and given in integral time units (s). Since our protocol is based on TDMA, one transmission only takes exactly one regardless of the data size and both task periods and execution times are all measured in s.

7 Notice that here, any time interval cannot span window that starts in the middle of a and ends in the middle of another one. Let a be a scheduling time unit, then all task periods and execution times are integers. Furthermore, all execution times are of one time unit. Thus, it is not hard to see that EDF meets the first constraint. We shall prove EDF retains its optimality with the second constraint. Before proving this, two lemmas should be listed first. Lemma IV.: (Generalized Chinese Remainder Theorem) [6] Let T, T,..., T n be positive integers. Let P be the least common multiple of T, T,..., T n and let a, O,..., O n be any integers. There exists one integer t which satisfies the conditions provided that a t < a + P, t O i (mod T i ), i n () O i O j (mod(gcd(t i, T j ))), i < j n () and there is no such integer t when the later condition fails. Lemma IV. says that if equation () is satisfied, sensor s i, s j will always collide with each other periodically. In other words, there exists a minimum non-zero number of collisions between devices if equation () is satisfied. We now show Lemma IV.. Lemma IV.: If n devices collide at the same time, at least n (n )/ retransmissions will be generated. Proof: Suppose n devices collide at t, since the access point can only receive one packet at one, it needs at least n s to receive n packets. Then, at time slot t +, at least n devices will resend. Hence, at time slot t + i, i [, n ], at least n i retransmissions will come out. Hence, totally, (n ) = n (n )/ retries will be generated. Lemma IV.: For any given fixed task set, the smallest global average retransmission number is independent of the scheduling algorithm that does not idle tasks unnecessarily. Proof: Based on Lemma IV. and Lemma IV., we can get that the smallest average retransmission number is only related to periods and offsets. Thus, no scheduling algorithm can affect this value. For a scheduler, as long as it schedules a successful receiving when there is at least one device sending its packet, it will have the smallest value. To illustrate this result, let us take the following three tasks. Suppose the pair set is (5,O ),(,O ) and (4,O ), since,4,5 is pairwise co-prime between each other, equation () is satisfied for all offsets. Every 5 slots, period and 5 collide and at least one should retry. Every slots, period and 4 collide and at least one should retry. Also, every slots, period 4 and 5 collide and at least one should retry. Finally, every 6 slots, all three collide and at least three retrial packets will be sent. Theorem IV.: Given a fixed offset-free task set, EDF is optimal for generating the schedule for the MBStar offset-free scheduling problem. devices 5 5 (a) EDF Schedule devices 5 5 (b) RM Schedule Fig. 6: Example for same average retransmission number Proof: EDF satisfies the first requirement for optimality according to Dertouzos []. For the second requirement, we note that the receiver does not idle unnecessarily because one packet among all the packet in a logical collision is always picked up by the access point. So the EDF scheduler achieves the highest utilization and also does not cause any extra retransmission. Fig. 6 shows an example. The task set is {(5,),(4,),(,)}. The left schedule is generated by EDF while the one on the right is generated by the RM (Rate Monotonic) scheduler. From the figure, the average retransmission number of both schedules which is also the smallest value, is the same. As long as the collided slot is not idle, the retransmission ratio is the smallest. ) Solution for MBStar Offset-free Scheduling Problem: The above section shows that it is straightforward to choose the optimal value for T new as long as the global utilization ratio is smaller than. However, finding an optimal value for O new is more difficult and the choice of O new might greatly affect the average retransmission number. Fig. 7 shows an example. For case A the task set is {(,),(,),(6,5)} and for case B it is {(,),(,),(6,)}. Both schedules are generated by EDF and it is obvious that the average retransmission number of case A will be much lower than that of case B. devices devices (a) Case A (b) Case B Fig. 7: Example for Different Offset Assignments Unfortunately, we do not have an analytical expression to compute the optimal O new. For practical purpose, however, we

8 4 Retransmission ratio Optimal Assignment Random Assignment All Zero 5 5 number of tasks Fig. 8: Average Retransmission Numbers for Different Offset Assignment Policies can search through all the possibilities provided that the search range is small. In particular, note that the search range is no larger than T new, and paper [] further proves that there are at most gcd{t new,lcm{t,..., T n }} choices for O new and the range is [,gcd{t new,lcm{t,..., T n }}), where gcd and lcm denote the greatest common divisor and the least common multiple respectively. In practice, since the hyper-period length is already known, the time complexity of searching O new is O(T new ). We note that the searching space will be much larger if we had tried to solve the global scheduling problem that does not allow retransmission such that the offsets have to be found for every task to avoid any collision. Algorithm summarizes the solution. It should be noted that, in line, we only compare the average retransmission number in the time window [r+p, r + * P-]. This is because, according to paper [7], from time r+p the schedule in interval [r + P, r+*p-] will be repeated infinitely in the infinite horizon schedule. We have done a simulation to find out how much gain we can get from the optimal offset assignment. The results are shown in Fig. 8. In the simulation we generate several groups of sensors with periods randomly chosen between and 4. The group size is between and 5. For each group, we tried three types of offset assignment policies and measure the average retransmission number. The policies are: all zeros, random assignments and optimal values. Each test is repeated 5 times and the average is taken. In Fig. 8 the X-axis is the group size and the Y-axis is the average of the average retransmission number. From the figure, we can see that the optimal assignment is the best. Its average retransmission number is always below.5 and about half of that of the random assignment. Both are better than the zero assignment, whose average retransmission number can be as high as above.5. Bigger retransmission number leads to bigger power consumption. It should be emphasized that when there is a physical packet loss, a device will retry. For the access point, it can easily reschedule another pickup before packet expiration. Fig. 9 gives a illustration. The task set is {(5, ), (, )}. At slot 5 (the block with a cross), the packet is supposed to be received successfully by access point but lost because of interference. However, the access point soon finds out that it should receive Fig. 9: Example for reschedule a packet from device and knows it will retry. Hence, it will wait at slot 8 and get the packet before its expiration. Notice that, since the access point knows all the offsets and periods, it only needs to search a short range (at most the period of the faulty device) to produce such a schedule. However, if the schedule is pretty full, it may not be able to find an empty slot and the packet will be lost forever. Algorithm Solution for MBStar offset-free problem : // Input: Bandwidth request (mint new, maxt new ) : // Output: Pair (T new, O new ) and an optimal schedule S : // U Ratio is the present utilization ratio 4: // H Len is the present length of hyper-period 5: // V is the present scheduled tasks set 6: 7: //Step : Find optimal value for T new 8: if U Ratio + /maxt new then 9: Find the smallest value T in [mint new, maxt new ] which /T + U Ratio <. Then, T new = T : else : return FAILURE; // No enough bandwidth : end if : 4: //Step : Find Optimal value for O new 5: Offset Range=gcd(T new, H Len) 6: least Retran Ratio = Max P eriod(v (T new, O )) 7: optimal Offset = 8: for all Each O between [,Offset Range ] do 9: V = V (T new, O ) : r = Max Offset(V ) : // new hyper-period length : P = gcd(h Len, T new) : // Generate EDF schedule in [r + P, r + * P] 4: S = Get EDF Schedule(, r + P ) 5: retran Ratio = Get ReT ran Ratio(S, V ) 6: if least Retran Ratio > retran Ratio then 7: least Ratran Ratio = retran Ratio 8: optimal Offset = O 9: S = S : end if : end for V. EXPERIMENTS In this section, we present our experiment results based on the prototype implementation which is described in Section IV, and setup a star network with one access point and three devices as shown in Fig.. The access point is connected to

9 x 4 8HZ 5HZ HZ Weighted Average Loss Ratio Fig. : Experiment testbed: One Access Point and three devices are organized in a star network TABLE VI: Device configuration and experiment settings Dev ID Description Data Frequency Period Offset Join Sequence dev access NA 4 NA point dev sensor 8 Hz 5 dev sensor 5 Hz 8 dev 4 sensor Hz a computer through the serial port, and the baud rate is set to 4 bps. A serial port communication software is running on the computer to collect all the packets exchanged between the computer and the access port. The frequencies of the three devices are Hz, 8Hz and 5Hz, respectively. Their join sequence and offset assignments are summarized in Table VI and the communication schedule is shown in Fig.. Same as in Fig. 9, a stripped block is used to denote a transmission failure because of collision. Our experiments mainly focus on evaluating the loss ratio of our MBStar system in different test scenarios. The results are shown in normal office environment, noisy environment and its co-existence performance when other wireless networks in.4ghz frequency band are present, for instance, Bluetooth and Wi-Fi. A. Experiments in Normal Office Environment In this experiment, we put our testbed in a normal office environment. There are several Wi-Fi networks around but we disable the Wi-Fi interface on the laptop. Then, after the MBStar system keeps running in one hour, collects 599 packets in total and misses 6 packets. The averaged loss ratio devices Fig. : Communication schedule in the experiments Time (minute) Fig. : Packet Loss Ratio in Normal Office Environment TABLE VII: Loss ratio with noise maker w/o channel blacklist and reschedule w/ channel blacklist and reschedule total packets missed packets 8 loss ratio.59.4 is Fig. shows the change of the packet loss ratio for each device along with the time. It can be observed from the figure that all devices packet loss ratios are very small. B. In Noisy Environment MBStar tolerates noisy environment with channel hopping. In this experiment, we would like to test how channel blacklist and reschedule can further improve the system performance. First, we create a noise maker that continuously sends - byte packets with random value every.5 milliseconds. It occupies a specific channel for a minute, then moves on to another channel. This is repeated over all the channels. Then, we put the noise maker one meter apart from the access point and ran the experiment twice, one with both channel blacklist and reschedule for loss packet enabled and the other with both disabled. Each experiment is run at least 6 minutes so that each channel has been jammed at least once. As shown in Table VII, the result is that with channel blacklist and reschedule, the loss ratio is at least times lower. Note even with both disabled the loss ratio is still low. C. Coexistence with other Networks Now, we investigate the situation when there are other networks (BlueTooth and Wi-Fi) around document [8] has shown the simulated coexistence results for ZigBee, which shares the same physical layer with MBStar. From the simulation, it seems rather pessimistic while there are other networks around. For example, if there is 8.b (Wi-Fi) within one meter, the packet error ratio is close to. And if there is 8.5. (BlueTooth) within one meter, the packet error ratio is more than %. However, our results on test-bed are much better. ) Coexistence with BlueTooth: In this experiment, we use a BlueTooth earplug to make a long phone call. On remote site, it plays music continuously and on local site, a mobile phone is

10 TABLE VIII: Loss ratio with Bluetooth around Close to each other meter apart Result Result packet number miss number 98 5 loss ratio.55. TABLE IX: Loss ratio with Wi-Fi around static channel assignment w/ channel hopping and blacklist total packets missed packets loss ratio..7 sending data to a Bluetooth earplug. Hence, the mobile phone is the main noise maker. Table VIII shows the results under different cases. In the first setting, we put the mobile phone between devices and access point. And in the second setting, we put the mobile phone a little further (about meter away). For the former case, the loss ratio is.55 and the later, it is., which is about times better. Hence, distance adjustment should be recommended when the two meet each other. ) Coexistence with Wi-Fi: In this case, we open Wi-Fi antenna on the laptop and are using FTP to upload and download files from a remote server. Since Wi-Fi only works on one wide channel, channel hopping and blacklist in MBStar will play an important role in reliability. Hence, two experiments have been done. For one experiment, we statically assign devices with channels which overlap with Wi-Fi. For another, we enable channel hopping and channel blacklist. The results are shown in Table IX. It can be observed that, with channel hopping, the loss ratio is about seven times lower. From above experiments, there does exist a problem of coexistence between MBStar and other networks based on.4g Hz radio. However, compared to the simulated results in [8], the loss ratio is very low. VI. DISCUSSION AND CONCLUSION In this paper, the major of our contributions is to design and develop MBStar for WBAN, which is a real-time, highfrequency, reliable, secure protocol. MBStar uses star topology as most other wireless body area networks. The physical layer utilizes compatible radio for low power consumption. The MAC layer adopts TDMA for real-time packet delivery and a time stringent with only.5 milliseconds is designed. MAC layer employs channel hopping and blacklist to avoid noise from specific channel. Retransmission is utilized in MAC layer to provide reliability. On top of that, a simple, secure application layer is built. For security, MBStar uses IKE (Internet Key Exchange) protocol to provision a device on the air, which removes human involvement in pre-configuration and is more secure. After join, the less time-consuming symmetrical encryption is applied on medical data for privacy protection. Our prototype implementation endeavors to meet the stringent timing requirements. Simple design and proper precomputation techniques are applied. For link scheduling, we propose an easy and feasible method that only configures a local period and an offset to a device while keeping the global hyper-period in the gateway. Hence, collisions between devices may happen and retransmission is employed. We then point out that the least global average retransmission number is independent of any scheduling algorithm and EDF is still optimal under such case and used for choosing the local period. Also, we give out the range for searching the optimal offset. Experimental results on our implementation are very encouraging. In the normal office environment, error ratio is around 5. For noisy environment, the functionality of channel blacklist and reliability mitigates the packet loss ratio greatly. We also show co-existence results with Bluetooth and Wi-Fi and it is much better than simulated results of ZigBee. Hence, it is quite suitable for real application. Our future work consists of developing full-blown stack and merging our protocol into a real body medical application. REFERENCES [] L. Benoit, B. Braem, I. Moerman, C. Blondia, and P. Demeester, A survey on wireless body area networks, Wireless Networks, pp. 8,. [] K. Van Dam, S. Pitchers, and M. Barnard, Body area networks: Towards a wearable future, in Proceedings of WWRF kick off meeting,, March. [] J. Goossens, Scheduling of offset free systems, Real-Time Syst., vol. 4, pp. 9 58, March. [4] T. Penzel, B. Kemp, G. Klosch, A. Schlogl, J. Hasan, A. Varri, and I. Korhonen, Acquisition of biomedical signals databases, Engineering in Medicine and Biology Magazine, IEEE, vol., no., pp. 5,. [5] H. Li and J. Tan, An ultra-low-power medium access control protocol for body sensor network, in Engineering in Medicine and Biology Society, 5, pp [6], Heartbeat-driven medium-access control for body sensor networks, Trans. Info. Tech. Biomed., vol. 4, pp. 44 5, January. [7] I. Lamprinos, A. Prentza, E. Sakka, and D. Koutsouris, Energy-efficient mac protocol for patient personal area networks, in 7th Annual International Conference of the engineering in Medicine and Biology Society, 5, pp [8] O. A. Omeni, A. Burdett, and C. Toumazou, Energy efficient medium access protocol for wireless medical body area sensor networks, Biomedical Circuits and Systems, IEEE Transactions on, vol., no. 4, pp. 5 59, 8. [9] The internet key exchange(ike), [] B. Arazi, Certification Of DL/EC Keys, May 999. [] D. Chen, M. Nixon, T. Lin, S. Han, X. Zhu, and A. Mok, Over the air provisioning of industrial wireless devices using elliptic curve cryptography, submitted to IEEE International Conference on Computer Science and Automation Engineering (CSAE ). [] M. L. Dertouzos, Control robotics: The procedural control of physical processes. in IFIP Congress, 974, pp [] C. L. Liu and J. W. Layland, Scheduling algorithms for multiprogramming in a hard-real-time environment, J. ACM, vol., pp. 46 6, January 97. [4] M. Spuri and P. Reflecs, Analysis of deadline scheduled real-time systems, Tech. Rep., 996. [5] A. K. Mok., Fundamental design problems of distributed systesm for the hard-realtime environment, Ph.D. dissertation, MIT, 98. [6] D. E. Knuth, The art of computer programming, volume (rd ed.): seminumerical algorithms, 997. [7] J. Y.-T. Leung and M. L. Merrill, A note on preemptive scheduling of periodic, real-time tasks, Inf. Process. Lett., vol., no., pp. 5 8, 98. [8] IEEE standard , download/ pdf, 6.