An Innovative Distributed Instrument for WirelessHART Testing

Transcription

1 I2MTC International Instrumentation and Measurement Technology Conference Singapore, 5-7 May 2009 An Innovative Distributed Instrument for WirelessHART Testing P. Ferrari, A. Flammini, D. Marioli, S. Rinaldi, E. Sisinni Dept. of Electronics for Automation University of Brescia Via Branze, Brescia, Italy emiliano.sisinni@ing.unibs.it A. Taroni Carlo Cattaneo University Corso Matteotti, Castellanza (VA), Italy Abstract In the last few years solutions adopted in industrial communication have been deeply changed thanks to the adoption of technologies borrowed from completely different areas. In particular, the advent of hybrid wired/wireless networks promises to greatly improve efficiency and scalability. However, their success will depend on the availability of standard solutions, that ensure multivendor compatibility. Recently, the WirelessHART specifications have been released, making it the only available standard for wireless networking in the industrial field. In this paper, authors present an innovative distributed instrument that will make easier the debug and the development of WirelessHART devices and networks. Keywords- WirelessHART, realtime systems, wireless sensor network, low power system, synchronization I. INTRODUCTION The world of industrial communications shows increasing interest toward wireless fieldbuses, that is the use of wireless communications to interconnect devices at field levels: sensors; actuators; instruments; controllers; and so on. Besides some proprietary solutions, some standards are emerging, like WirelessHART or ISA100 [1]. The goal of both proposals is to establish a wireless communication standard for process automation applications. The more known ZigBee, on the contrary, seems unsuitable for this application field as it has not been specifically designed for reliable, real-time, cyclic communications. Although ZigBee, WirelessHART and ISA100 use the same Physical level of IEEE , they differ a lot concerning Medium Access Control (MAC) level, practically impeding the use of common devices and tools. Our work focuses on WirelessHART (WH), that is a mesh solution adopting frequency agility and power adaption to improve communication reliability. The WH specifications are available since september 2007, but instruments specifically designed for commissioning or diagnostics of WH systems are still lacking. HART consortium has proposed a sort of sniffer [2], also called Wi-Analys and still in the development stage, that is able to monitor simultaneously more frequency channels in order to support frequency agility and some companies proposes similar solutions for multistandard analysis, like Perytron-C [3]. If we suppose to install a mesh wireless network in a real industrial plant, the idea of a single-probe instrument shows some limits. In fact, only one-hop network can be analyzed, since the area coverage of the instrument itself is on the same order of the area coverage of a single device. In addition, a diagnostic instrument should be able to simultaneously analyze several parts of the plant, to better characterize and adjust the mesh behavior. The ability of a WH node to tune the transmitting power can be effectively used only if there is an instrument that is able to simultaneously measure the quality of communication in several points of the plant. In addition, as it will be clear in the following section, a distributed diagnostic instrument is necessary to help the Network Manager in designing the best graph routing. As we said, even if the physical layer is the same of IEEE , traditional distributed protocol analyzer, like the Q51 from Exegin [4] or the 2400-SNA from Daintree [5], cannot be used since they are not able to simultaneously hear all the available channels. This paper is structured as follows. In the Section II a brief resume of WH characteristics is reported. In Section III, the architecture of the new distributed instrument, that can be used for both diagnostic and commissioning of WH systems, is detailed. In Section IV, the probe implementation is discussed and in Section V some experimental results are reported. Finally, some concluding remarks are highlighted. II. THE WIRELESS HART STANDARD WirelessHART (WH) is an extension of the well-known and widespread wired HART protocol; it preserves backwards compatibility and offers new possibilities thanks to greater flexibility and scalability of wireless networking. As previously stated, it is mainly devoted to the process automation; for this reason WH supports applications that have a minimum cycle times on the order of seconds. It is a time-synchronised, ultra low-power, mesh wireless fieldbus. In order to maximize reliability, it uses frequency diversity, time diversity, and spatial diversity, beside allowing transmitting power adaption. The WH specifications follow the OSI layers, and contain a PHYsical, Data Link (that includes Medium Access Control) and NetWorK layers. The Transport and APPlication layer are the same for both wired and wireless HART. A WH network contains different kind of devices (logical and or physical): one and only one Security Manager, that distributes encryption keys to the Network Manager of each network; /09/$ IEEE

2 one and only one active Network Manager, whose aim is to form the network, schedule resources, configure routing paths etc at least one Gateway, whose aim is to interconnect field devices with the plant automation system; several field devices that are connected with the process, i.e. devices with sensors and actuators. There can be also devices that have no connections with the process but have only communication facilities; they are routers, handheld devices (used for commissioning and/or maintenance purposes) and adapter (used to connect legacy hardware with the wireless network). With regards to the physical layer, the working group has adopted the IEEE ; i.e., physical devices compliant with this standard can be used to implement WH nodes. This implies that modulation schemas are exactly the same but all other protocol layers are different; this means that there is no compatibility between these standards and interoperability has to be realized at the application layer. The main tasks of the MAC (Medium Access Control) protocol are: slot synchronization; identification of devices that need to access the medium; propagation of messages received from the upper layer; propagation of packets coming from neighbors. The MAC is based on an hybrid use of Time Division Multiple Access (TDMA) and Slow Frequency Hopping approaches. The time is organized into repetitive structures called Superframe, that is repeated continuously; each Superframe is made up of a fixed number of timeslots 10ms wide. For this reason, it is very important that all nodes participating to the network share the same sense of time; synchronization is achieved thanks to pair-wise exchange of time information within data messages and their acknowledges. In fact, begins of all transmitted data packets is well known, as imposed by the Network Manager. However, when the network is setup for the first time, it is not configured, i.e. it does not contain any information about how data must be transferred among nodes. This means that the Network Manger has not yet define Links within the Superframe. The opportunities for device to device communications is dictated by the existence of a Link between them; the Link includes a reference to neighbors that are permitted to communicate with the device (unicast and multicast transactions). Furthermore, the slot number within the Superframe, the direction of the communication (transmit/receive), link characteristics (e.g., shared/dedicated), and the initial communication channel are also specified. WH supports only 15 of the 16 channels of IEEE (the last one is avoided), and a black list can be created by the Network Manager to improve coexistence. The active channel index CH is easily computed since every node must track the absolute slot number ASN (i.e. the progressive number associated with slots started when the network is formed) and knows its channel offset CO (CH=(ASN+CO)moduleNAC, where NAC<16 is the number of the active channels). Finally, access to the medium is also regulated by a Clear Channel Assessment mechanism; this allows for shared links, where two or more nodes are allowed to talk within the same link. In addition, it also favors coexistence with other RF sources. With regards to routing of data packets, it is based on graph routing rather than on the (optional) address routing. Each pair of nodes is interconnected by a graph, i.e. a directed list of paths that connect them. Both upstream (toward the Gateway) and downstream graphs are used in WH. Only the Network Manager, that is responsible for correctly configuring each graph, knows the entire route; the graph information within a node only indicates the next hop destinations. III. ARCHITECTURE OF THE PROPOSED INSTRUMENT The proposed distributed instrument is based on the deployment of several probes interconnected by a wired Ethernet link. The aim of each probe is to sniff and collect traffic over the air compliant with the WH specifications in order to give significant information on the correct behavior of the wireless network under test. Each probe has a modular organization and can host a minimum of two transceivers compliant with the IEEE physical layer. In this way it is possible to simultaneously sniff both the active channel of the current timeslot and the active channel of the future time slot (information on the frequency map can be obtained from the Network Manager that must be always present or from the engineering software during the commissioning). However up to 15 transceiver can be managed, allowing for the simultaneous scanning of all the available bandwidth (the last channel of the physical layer is not used in the WH communication). The proposed instrument probe is not only able to log traffic, but can also acquire physical input signals with the same timestamping reference. This feature can be used to measure performance of the application layer; for instance, it is possible to measure the delay between an event (monitored on the input line) and its notification over the network. An arbitrary number of probes, e.g. each one covering a different area of the plant, can be deployed; all of them are interconnected by an Ethernet measurement network. Both logged data, timestamps and ancillary data (as incoming signal power ) are encapsulated within an UDP packet in order to be viewed and collected with traditional sniffing tool; the subsequent data analysis can be performed by means of user developed software. It must be remembered that sniffed data are made up of raw encrypted packets; this means that the host system running user developed software must also know encryption keys (from Network or Security Manger) and decrypt packets. An overview of the system is depicted in Fig. 1. Network Manager Monitor station A Measurement network Switch B Probe WH stations Figure 1. Architecture of the proposed instrument. C

3 Obviously, the bandwidth of each probe must be higher than the aggregate traffic coming from all the channels; however, this is not a real problem since the maximum theoretically available bandwidth of the network is about 4Mbps. In a more realistic situation where the maximum packet (133Byte) and its ACK (26Byte) are transmitted together with 60Byte of ancillary data per link, the overall bandwidth is lower than 3.5Mbps (15 channels, 2232 bit in 10 ms for each channel). According to these considerations, adopting a Gigabit Ethernet link as the measurement network and considering a reasonable available throughput of 200Mbps up to 50 probes can be interconnected together without losing their data. The Monitor Station has relaxed constrains, since its tasks are not time related. Monitor Station must store and elaborate all the incoming data; thus the only critical point is the system bandwidth, that is the ability to manage all the data without dropping frames. An additional task of this device is to configure the measurement network and to transfer probe parameters, such as probe ID, synchronization methods, etc. Moreover this station has to exchange information with the WH Network Manager, such as network configuration or encryption keys, that could be useful for the analysis of the collected data. It can be implemented using a traditional Personal Computer running dedicated sniffing tools. An additional question to point out is the time synchronization among probes; only in this way it is possible to compare timestamps coming from the whole measurement network. The proposed probe can be connected to a GPS receiver or to other 1-PPS (pulse per seconds) sources. Moreover any probe can act as the reference time source and distribute that reference to other probes. As also suggested in [6], two different methods can be implemented; the sync signal can be transmitted by wire or over the measurement network. In the first case, all the probes have a dedicated wire carrying a 1-PPS signal used for synchronization. In the second case, the time reference is distributed using network protocols (e.g. IEEE1588 PTP [7]) through the measurement network. The proposed instrument can be easily realized using commercial available transceiver compliant with the IEEE specs (no matter the vendor), managed by a supervisor FPGA; the monitoring station can be a PC running dedicated software. IV. PROBES IMPLEMENTATION The block diagram of a probe is illustrated in Fig. 2 while in Fig. 3 is shown the internal block diagram of the FPGA. The FPGA (Stratix-II from Altera) manages the radio frequency transceivers and the monitoring port M Port ; an additional AUXiliary Port is provided as input/output port for synchronization signals, e.g. GPS or 1-PPS. A buffer memory is used to temporary store sniffed data. It must be remembered that the physical interface toward a generic IEEE transceiver is not standardized; in other words, there is not the equivalent of the Media Independent Interface (MII) interface of Ethernet or Host Controller Interface (HCI) of Bluetooth. However, transceivers are usually accessed by means of synchronous serial interface (Serial Peripheral Interface SPI) flanked by very few control lines. They act as slaves on this link, receive the clock from the master and answer after a polling action. IEEE Network Port transc DMA Port 1 Port 2 Port N FPGA core Monitor link Port M AUX Sync I/O 1-pps I/O GPS Figure 2. Block diagram of the instrument probe. spi SPI Controller internal bus Port N transc spi SPI Controller Memory Controller external memory Sync I/O PTP Clock time EtheMAC PTP supp ethernet PHY Port M PTP Timer SSB aux I/O Figure 3. Detailed block diagram of the instrument probe. FPGA Even if a single SPI master implemented inside the FPGA would be sufficient to handle all devices within a probe, we prefer to realize a master for each one of them in order to improve performances (even if this choice affect resource utilization, it allows for a modular approach that improve performances). All the blocks are interconnected by means of an internal bus and are linked to a Supervising and Synchronization Block (SSB) that embodies a CPU soft core. During the design phase, several different options for the probe implementations were considered, including the adoption of an external microcontroller. At last, a single chip solution has been preferred for sake of simplicity and flexibility. In particular, it has been used the 32-bit NIOS2 IP core. The SSB exchanges configuration parameters with the monitor station through the measurement network (Port M). This very small amount of non time critical data does not affect measurement network bandwidth and performance. By means of configuration messages, probe properties (e.g. addresses, sync method, probe status ) and recording settings (e.g. logging filters, data decryption ) can be remotely written or read. However, the SSB not only manages the probe configuration, but also handles synchronization protocol. It implements the IEEE1588 PTP over the Ethernet link (Port M, handled by an hardcoded module within the FPGA). In order to

4 support an accurate clock synchronization over Ethernet a Ethernet MAC block with PTP support (EtheMAC PTP supp) has been implemented. This module provides several services useful to PTP stack, such as the hardware timestamping of incoming and outcoming PTP frame. In addition, if needed, the SSB handles the GPS or other wired synchronization signals, cited as Sync I/O in Fig. 3. Referring to the same picture, the PTP Clock provides the internal time reference, which is synchronized with all other probes and it is used by the PTP Timer to timestamp incoming packets. The PTP Timer can be considered as a sort of free running timer with an input capture feature used to latch signals arriving from the transceiver. The details of each block SPI Controller are shown in Fig.4. It is black box that fetches packets from the transceiver and stores them into a buffer together with their timestamps. This buffer implements a ping-pong structure so that no packets can be lost; when the upper portion is used to store a new packet the lower one can be read by the SSB and vice versa. Moreover, it can be optionally implemented a Direct Memory Access (DMA) peripheral in order to improve the throughput. The core of the block is a Finite State Machine (FSM). It implements a sequencer whose steps are stored in a Look Up Table (LUT), previously programmed by the microcontroller. In this way the RF transceiver initialization and programming can occur without the NIOS intervention, but these steps can be easily re-programmed in order to interface with a different device. Nios2 interface clk cntrl data irq SPI Controller tx data rx data Buffer status control FSM LUT baud rate div tx shift reg rx shift reg Figure 4. Block diagram of the SPI Controller block. SPI interface sclk In particular, the MC13192 from Freescale has been used as the radio frequency transceiver. When the so called receiving streaming mode is adopted, it presents the data to the SPI link on a word-by-word basis. When a new packet is detected, the first interrupt notification (IRQ, violet line in Fig. 5) is generated after the completion of the IEEE Length field. This signal is used by the SPI Controller to start the packet transfer towards the buffer. This signal could be also sampled by the PTP Timer to obtain the timestamp of the frame, but it is preferable to use the out_of_idle signal provided by the transceiver (green line in Fig. 5) in order to simplify the system architecture. In any case, as shown in Fig. 5, the use of this signal does not introduce any additional jitter, so the timestamp accuracy of the system is not affected; the acquisition has been done using an Agilent MSO6014A with persistence and triggered by a digital line signaling the transmission of a new frame ( Start of TX frame, yellow line in the same figure). miso mosi CE_n In this way, if we suppose to realize a sniffer with 15 radio modules, all channels can be simultaneously scanned and all incoming packets can be timestamped with the same reference time. IRQ out of idle Start of TX frame 4.4μs Figure 5. Jitter of SPI signals related to timestamp activities. It must be also remembered that all WH packets are encrypted. Since the sniffer passively scans the radio channels, the decryption can be easily performed off-line by the monitoring station. In addition, nowadays are available several transceiver with an on board encryption/decryption engine, like the MC1322X from Freescale [8]. V. RESULTS Prototypes, have been realized around the NIOS2 development kit by Altera, equipped with a EP2S60F672C3 Stratix II FPGA (60k LE). A purposely designed daughter cards extension hold the MC13192 transceivers, even if, as previously stated, this is not a real constrain and all commercial available devices can be easily adapted. Occupations of available resources is summarized in Table I. The complete system occupies less than 40% of all the available FPGA logic elements and about 10% of the FPGA RAM. Obviously, most of the available resources are used to implement the 15 SPI Controller, one for each channel used by WirelessHART. TABLE I. RESOURCES REQUIRED BY THE CURRENT PROBE IMPLEMENTATION. System block LE RAM (bit) Nios processor PTP Clock + timer + PLL EtheMAC+PTP DDR controller SPI Controllers (15) Total Occupation [%] 37% 9% As an example, in Fig. 6 it is shown the development board together with a 4-transceiver extension card.

5 Figure 6. The developed probe Some additional measurements have been performed in order to estimate the time needed to move incoming data from the transceiver toward the Ethernet port. In particular, since we use the streaming mode, data exchange occurs by two byte SPI transfers and the subsequent Ethernet buffer filling. A resuming picture is depicted in Fig. 7. It refers to a preliminary SPI transfer needed to clear the RX interrupt and a second one needed to read the first two data bytes of the incoming packet. These operations are executed in hardware by the SPI Controller and do not affect performances. On the contrary, the real constrain is the time elapsed during the data transfer toward the Ethernet buffer, that could be supervised by the SSB. As shown in the same figure, this transaction requires 700ns and all available channels can be scanned without losing any packets. IRQ notification 1st SPI transfer 2nd SPI transfer ETH buffer transfer: 700ns The frame transmitter (TX) consists of a XBee RF module from MaxStream, composed of a microcontroller HSC08 and a MC13192 transceiver. This device can be configured to generate a generic IEEE traffic. This choice has been dictated by the absence of any commercial available solution based on WH; there is not yet a device officially approved by the HCF consortium, Particularly, during characterization experiments the timer of the microcontroller has been configured to generate a IEEE frame (29 bytes) every 500ms. During the first experiment the MC13192 transceiver (RX A) has been evaluated while the other (RX B) is not present. In order to characterize this device, the receiving delay, i.e. the difference between Rx_out_1 signal -generated by the receiver when a new message is received-, and Tx_out signal -generated by the transmitter at the beginning of a transmission-, have been measured using a high stability counter (Agilent 53132A, option 010). In Fig.9. the distribution of the receiving delay signal has been reported (3000 measurement samples). The average receiving delay is 800 μs while the maximum jitter is about 2 μs. This offset is mainly due to software delay in the transmitting node. The distribution is almost uniform and the maximum deviation from the average value is 2.2μs. Frequency (%) Receiving Delay (μs) Figure 7. Detail of a single data transfer. A. Transceivers characterization During the development phase several tests have been carried out to characterize the transceiver used in the sniffer implementation (MC13192). The experimental setup used for transceiver characterization is shown in Fig.8. TX XBee Tx_out RX A RX B Rx_out_1 Rx_out_2 Figure 8. Experimental setup used to characterize the transceivers Figure 9. Distribution of the receiving delay of the MC13192 transceiver B. Timestamping assignment accuracy One of the most important and probably sensitive activity of a sniffer involves the assignment of the reference time to each captured frame. Only in this way we can relate in a consistent manner the events that occur on the network. For this reason the characterization of timestamp assignment accuracy provided by the probes is a key point of test phase. As shown in the previous section, the packet timestamp assignment occurs on the rising edge of a signal (out_of_idle) provided by the transceiver to identify the beginning of an incoming frame. So the timestamping assignment accuracy of the sniffer can never be better than the accuracy of this signal. For this reason it is important to characterize the behaviour of the transceiver when it receives a frame. The experimental setup consists of a traffic generator, implemented using the XBee RF module and two MC13192 transceivers listening to the same RF channel. The RF module generates a 29-byte frame each 500 ms. The difference between the out_of_idle signals generated by the two receivers when they receive the same frame has been measured. The distribution of this

6 difference is shown in Fig.10. (3000 measurement samples). As you can see from the figure, the maximum deviation between the two signals is about 4 μs. That means it is impossible to identify the occurrence of an events on a WH network with a resolution greater than 4 μs using this particular transceiver. The quantized behaviour is probably due to the fact that both transceiver are both synchronized on the preamble of the same incoming packet. Frequency (%) Timestamping accuracy (μs) Figure 10. Distribution of timestamping difference between the two transceiver. and not only a single hop trunk per time. Experimental results have shown its capability of packet timestamping with an accuracy on the order of μs (mainly dictated by the modulation schema and the adopted transceiver). As a concluding remark, it must be remembered that until now no WirelessHART device is commercial available. For this reason, it is not possible to show a real world traffic acquisition. REFERENCES [1] A. N. Kim, F. Hekland, S. Petersen, P. Doyle, When HART goes wireless: Understanding and implementing the WH standard, Proc. Of ETFA2008, Sept. 2008, pp [2] On line: [3] On line: [4] On line: [5] On line: [6] P. Ferrari, A. Flammini, D. Marioli, A. Taroni, "A distributed instrument for performance analysys of real-time Ethernet networks", IEEE Trans. Industrial Informatics, February, 2008, Vol. 4, N. 1, pp [7] J.C. Eidson, Measurement, Control, and Communication Using IEEE 1588, Birkhäuser, 2006, ISBN [8] On line: [9] On line: It is also important to verify that the timestamping logic implemented in the FPGA does not add any additional jitter on overall timestamping accuracy. For this reason the previous experimental setup has also been used to compare the timestamp associated by the sniffer logic to the same frame captured by different transceivers listening to the same RF channel. The summarizing results about the timestamping assignment accuracy have been reported in Tab.II. The first row of this table refers to results shown in the previous figure, while the second row is obtained evaluating the distribution of timestamping available on the measurement network. It is evident that the timestamp logic does not significantly affect the accuracy of the system, whose main limitation is the transceiver capability to detect the arrival of an incoming packet. TABLE II. TIMESTAMP ASSIGNEMENT ACCURACY Timestamping accuracy (μs) Measure Std. Ave. Max. Dev. Transceiver Layer Sniffer Logic Layer VI. CONCLUSION In this paper an innovative distributed instrument for WirelessHART has been proposed. It is able to scan simultaneously all the 15 radio frequency channels used by the standard and thus can collect all incoming packets, even those that do not respect the time slot deadline. For this reason, it is a very useful instrument for the debug of new devices and for the provisioning of a new network. In addition, more probes can be deployed on the field, allowing to hear all the mesh network