Internet of Things Handbook 2020

Developing connected medical devices for the IoT Page 14

Is predictive maintenance the ‘killer app’ of Industrial IoT? Page 26

APRIL 2020

INTERNET OF THINGS HANDBOOK

200228_AutoDelta1_DW_US.indd 1

2/17/20 3:05 PM

™

dESIgN

SOLuTIONS

… with Interconnect Components & Hardware

Battery Clips, Contacts & Holders

Fuse Clips & Holders

Terminals and Test Points

Spacers & Standoffs

Plugs & Jacks

Multi-Purpose Hardware

It’s what’s on the InsIde that counts ® E L E C T R O N I C S

C O R P.

View our Dynamic Catalog M70 at www.keyelco.com (516) 328-7500

(800) 221-5510

Request a copy of our Product Design Guide M70

EE-DW-IoT_THiNK Corp_4-20.indd 1

3/6/20 12:10 PM

INTERNET OF THINGS HANDBOOK

No, IoT RF radiation won’t cause a pandemic I once had a lengthy exchange with a guy who claimed RF from WiFi was making him sick. After numerous emails back and forth in which I tried to correct his misconceptions about WiFi signals, I gently suggested that he go find an RF screen room and sit in it to see if the experience made him feel any differently. I never heard from him again.

Clinicians would probably say my email pen-pal was suffering from electrohypersensitivity (EHS) syndrome.

EHS is claimed to appear in people exposed to levels of electromagnetic radiation far below those high enough to raise the temperature of or induce electrical effects in living tissue. The problem is no high-grade (double or single-blind, randomized, and with a control group) clinical studies have been able to find evidence that EHS syndrome is real. Most clinicians have come to the same conclusion about EHS as Eric van Rongen of the Health Council of the Netherlands. Van Rongen surveyed the results of numerous EHS studies done with GSM signals. He says the evidence shows that exposure to a GSM-type signal may result in minor effects on brain activity, but such changes have never been found to relate to any adverse health effects. Van Rongen further concludes there are clear indications that psychological factors such as the conscious expectation of an effect may play an important role in people claiming to suffer from EHS. Many of the studies van Rongen reviewed took place in the early 2000’s when cell phones were becoming ubiquitous.

Though you can still find doomsayers warning about low-level cell phone signals, most concerns these days are voiced about WiFi and, increasingly, 5G frequencies. And with the widespread media coverage of IoT and 5G technology, it’s likely that the anxiety level about RF fields will grow.

Although no one has been able to find ill effects from low-level RF fields, that hasn’t been the case for effects caused by news stories about RF. Consider the findings of Anne-Kathrin Bräscher and her colleagues at the Johannes Gutenberg University in Germany.

They showed one group of test subjects a TV report on adverse health effects of EMF, the other group a neutral report. They then asked participants whether or not they could sense WiFi signals. The participants didn’t know that half of them were in an RF screen room and weren’t receiving RF energy of any kind. The group that had seen the EMF health effects propaganda were more likely to report some kind of sensation from the sham WiFi exposure, especially among participants who were super sensitive to touch or prone to vague gastrointestinal disorders. Bräscher also notes that participants of the WiFi group reported more anxiety about WiFi exposure than the control group and tended to perceive themselves as being more sensitive to RF fields after the experiment than before.

Bräscher and her colleagues concluded that sensational media reports can make even healthy people hypersensitive to minor symptoms they might otherwise just blow off. People who tend to perceive bodily symptoms as intense, disturbing, and noxious seem most vulnerable to having catastrophizing thoughts after exposure to sensational media reports about EM radiation.

In that regard, perhaps there is something good to come out of our current pandemic: It has temporarily redirected the attention of those with minor symptoms away from WiFi and toward the flu as being a likely culprit. But over the long term, there are ample reasons for researchers to stop proposing increasingly implausible links between EHS syndrome and RF.

LELAND TESCHLER | EXECUTIVE EDITOR 2

DESIGN WORLD — EE NETWORK

4 • 2020

eeworldonline.com

|

designworldonline.com

1.800.463.9275

newark.com

Discover Over a Million

Engineering Products from Suppliers You Know and Trust 900+ new products each week

Custom services such as kitting, panel meters, enclosures, and many more!

Market-leading online community of over 600,000 engineers

DESIGN WORLD FOLLOW THE WHOLE TE AM ON T WIT TER @ DE S IGNWORLD

EDITORIAL

PRINT PRODUCTION

MARKETING

EVENTS

VP, Editorial Director Paul J. Heney pheney@wtwhmedia.com @wtwh_paulheney

VP, Creative Services Mark Rook mrook@wtwhmedia.com @wtwh_graphics

VP, Digital Marketing Virginia Goulding vgoulding@wtwhmedia.com @wtwh_virginia

Events Manager Jen Osborne jkolasky@wtwhmedia.com @wtwh_Jen

Senior Contributing Editor Leslie Langnau llangnau@wtwhmedia.com @dw_3Dprinting

Art Director Matthew Claney mclaney@wtwhmedia.com @wtwh_designer

Digital Marketing Specialist Sean Kwiatkowski skwiatkowski@wtwhmedia.com

Event Marketing Specialist Olivia Zemanek ozemanek@wtwhmedia.com

Executive Editor Leland Teschler lteschler@wtwhmedia.com @dw_LeeTeschler

Graphic Designer Allison Washko awashko@wtwhmedia.com @wtwh_allison

Webinar Coordinator Halle Kirsh hkirsh@wtwhmedia.com

PRODUCTION SERVICES

Executive Editor Lisa Eitel leitel@wtwhmedia.com @dw_LisaEitel

Graphic Designer Mariel Evans mevans@wtwhmedia.com @wtwh_mariel

Senior Editor Miles Budimir mbudimir@wtwhmedia.com @dw_Motion

Director, Audience Development Bruce Sprague bsprague@wtwhmedia.com

VIDEOGRAPHY SERVICES

Senior Editor Mary Gannon mgannon@wtwhmedia.com @dw_MaryGannon

Video Manager Bradley Voyten bvoyten@wtwhmedia.com @bv10wtwh

Associate Editor Mike Santora msantora@wtwhmedia.com @dw_MikeSantora

Videographer Derek Little dlittle@wtwhmedia.com @wtwh_derek

FINANCE Controller Brian Korsberg bkorsberg@wtwhmedia.com

Customer Service Manager Stephanie Hulett shulett@wtwhmedia.com

Webinar Coordinator Kim Dorsey kdorsey@wtwhmedia.com

ONLINE DEVELOPMENT & PRODUCTION Web Development Manager B. David Miyares dmiyares@wtwhmedia.com @wtwh_WebDave Senior Digital Media Manager Patrick Curran pcurran@wtwhmedia.com @wtwhseopatrick Front End Developer Melissa Annand mannand@wtwhmedia.com Software Engineer David Bozentka dbozentka@wtwhmedia.com

Customer Service Representative Tracy Powers tpowers@wtwhmedia.com Customer Service Representative JoAnn Martin jmartin@wtwhmedia.com

Digital Production Manager Reggie Hall rhall@wtwhmedia.com Digital Production Specialist Elise Ondak eondak@wtwhmedia.com Digital Production/ Marketing Designer Samantha King sking@wtwhmedia.com

Accounts Receivable Specialist Jamila Milton jmilton@wtwhmedia.com

WTWH Media, LLC 1111 Superior Ave., Suite 2600 Cleveland, OH 44114 Ph: 888.543.2447 FAX: 888.543.2447

DESIGN WORLD does not pass judgment on subjects of controversy nor enter into dispute with or between any individuals or organizations. DESIGN WORLD is also an independent forum for the expression of opinions relevant to industry issues. Letters to the editor and by-lined articles express the views of the author and not necessarily of the publisher or the publication. Every effort is made to provide accurate information; however, publisher assumes no responsibility for accuracy of submitted advertising and editorial information. Non-commissioned articles and news releases cannot be acknowledged.

Unsolicited materials cannot be returned nor will this organization assume responsibility for their care.

DESIGN WORLD does not endorse any products, programs or services of advertisers or editorial contributors. Copyright© 2020 by WTWH Media, LLC. No part of this publication may be reproduced in any form or by any means, electronic or mechanical, or by recording, or by any information storage or retrieval system, without written permission from the publisher.

Subscription Rates: Free and controlled circulation to qualified subscribers. Non-qualified persons may subscribe at the following rates: U.S. and possessions: 1 year: $125; 2 years: $200; 3 years: $275; Canadian and foreign, 1 year: $195; only US funds are accepted. Single copies $15 each. Subscriptions are prepaid, and check or money orders only.

Subscriber Services: To order a subscription or change your address, please email: designworld@omeda.com, or visit our web site at www.designworldonline.com POSTMASTER: Send address changes to: Design World, 1111 Superior Ave., Suite 2600, Cleveland, OH 44114

4

DESIGN WORLD — EE NETWORK

4 • 2020

eeworldonline.com | designworldonline.com

THREE REAL-WORLD APPLICATIONS FOR PNEUMATICS AND IIoT Pneumatics designers have more access to the Industrial Internet of Things (IIoT) technology, from position sensors on cylinders to system flow sensors and smart edge gateways. However, the rich data these tools produce also presents a challenge: How to put this technology to work that makes the most of opportunities.

COMPARING MAGNETIC CORES FOR POWER INDUCTORS

Super-small radio SoCs are being paired with innovative battery technologies to bring inexpensive medical electronics online.

16

THE JOURNEY TOWARDS AUTONOMOUS MANUFACTURING As data are increasingly aggregated across manufacturing lines, the reality of autonomous lines is likely to be reached in the next five years. Here’s a look at what a typical journey towards autonomous manufacturing looks like and best practices for how manufacturers can begin to achieve this.

20

HOW TO TEST USB4 DESIGNS Designers must look at and characterize the entire Type-C ecosystem when testing USB4 designs.

26

IS PREDICTIVE MAINTENANCE THE ‘KILLER APP’ OF INDUSTRIAL IoT? Once headlined as the ‘killer app’ for IIoT, predictive maintenance has taken a while to find its feet, but progress has in fact been sure and steady, with some standout examples of successful niches.

30

BREAKING BLE Despite built-in safe-guards, Bluetooth Low Energy IoT devices are vulnerable to hacks when they communicate over the air. Here are the basics of the problem.

34

SELECTING THE RIGHT BLUETOOTH LOW ENERGY SoC

38

OF

Tricks of the trade for optimizing the energy consumption of BLE chips affect memory size, clock speed, operating modes, and other factors determined during the initial design.

HOW TO USE MQTT TO OVERCOME OBSTACLES TO IIoT INTEGRATION End users struggle with specific pain points around digital transformation in the traditional technology stack. While traditional communication technologies will continue to be in demand, pairing MQTT with existing offerings can give users a way to evolve.

43

ARCHITECTURES THAT HELP IMPLEMENT THE INDUSTRIAL INTERNET OF THINGS Among the models available to implement the Internet of Things, two standards bodies, the Industrial Internet Consortium and oneM2M, offer complementary architectural approaches.

Here’s a look at each, and how they work together.

eeworldonline.com | designworldonline.com

HANDB OOK

DEVELOPING CONNECTED MEDICAL DEVICES

TH I NGS

14

•

It is helpful to know how the material properties and geometries of magnetic cores affect the ability of inductors to store energy or filter current.

4 • 2020

I NTER NET

10

CONTENTS

6

2020

NO, IoT RF RADIATION WON’T CAUSE A PANDEMIC

APR IL

2

5

INTERNET OF THINGS HANDBOOK

Maintenance technicians can analyze appropriate data from IIoT sensors and use that information to predict that a shock absorber at the end of an actuator is deteriorating by sensing a millisecond’s increase in its stroke speed.

Three real-world applications for pneumatics and IIoT Enrico De Carolis, Vice President of Global Technology • Fluid Control and Pneumatics at Emerson Pneumatics designers have more access to the Industrial Internet of Things (IIoT) technology, from position sensors on cylinders to system flow sensors and smart edge gateways.

However, the rich data these tools produce also presents a challenge: How to put this technology to work that makes the most of opportunities.

6

DESIGN WORLD — EE NETWORK

Industrial hydraulics and manufacturers using pneumatics have access to more IIoT technology than ever before, from position sensors on cylinders to system flow sensors and smart edge gateways that operate independently from the machine controller with globally accepted communication protocols.

However, the rich data these tools produce also presents a challenge for machine builders and OEMs: How do we put the Industrial Internet of Things (IIoT) to work in a way that makes the most of opportunities in a digitized, highly connected world?

4 • 2020

Let’s explore real-world applications that leverage IIoT-enabled pneumatics to solve fundamental challenges faced on an ongoing basis:

Improving safety to protect people and equipment Pneumatics have long provided efficient and cost-effective motion and actuation with reliable technology and a proven record of equipment safety. Now, IIoT technology, along with related European trends like Industry 4.0, creates new opportunities for pneumatics to further improve safety. Additional functional insights also allow users to monitor a machine’s safety characteristics to better protect people and equipment from harm. eeworldonline.com | designworldonline.com

APPLICATIONS: IoT AND PNEUMATICS

Consider a machine using a safety light curtain to disable a pneumatics valve system when an operator is loading or unloading a part to be processed into the machine. Historically, safety applications have relied on statistical calculations to define a safety component’s mission time replacement cycle. Mission time defines the number of cycles when a safety component requires replacement regardless of whether it is functioning or not, in order to keep the calculated statistical safety function valid. While the valve may seem to be okay according to its rated mission time, there are other measurable factors that may not be considered (for example, changes in valve response time). A response time that changes from 30 to 70 milliseconds could create a serious safety hazard by allowing an operator to move further into the machine’s dangerous motion area before a safety response event is triggered.

A system using new IIoT technology would proactively capture, analyze and report the decline in the valve’s response time, as well as the corresponding alert response time before the safety function is compromised. This type of actionable safety information creates a safer workplace.

Improving predictive and preventative maintenance Dealing with wear and tear is a daily challenge in any manufacturing setting.

Predictive and preventative maintenance programs are critical to effectively manage machine life cycles and maximize overall equipment effectiveness (OEE).

For example, maintenance technicians can analyze appropriate data from IIoT sensors. They can then use that information to predict that a shock absorber at the end of an actuator is deteriorating by sensing a millisecond’s increase in its stroke speed.

This can trigger predictive maintenance protocols to replace the worn shock eeworldonline.com | designworldonline.com

absorber. As a result, there are shorter or fewer machine stoppages and a reduction in unplanned downtime, or complete or unrecognized failures.

In addition, IIoT-enabled pneumatics can monitor functionality at a valve’s location.

A valve’s state of wear can be hard to zdetermine from the outside of a machine. If additional internal sensors are not an option, an IIoT gateway can evaluate valve life by tracking the valve’s cycle counts. The user can then enable a cycle counter algorithm to determine how much of the valve’s life cycle has been used and to predict how many operating days and hours it has left. This allows machine operators or end-users to plan downtime.

Data-driven insights for predictive maintenance can also help to improve the scheduling of preventive tasks for pneumatics components. The data can be analyzed and used as information to guide plant management teams as they predict and address issues before they cause injury, damage, failure or production losses.

The integration of data-driven predictive maintenance with preventive maintenance also allows just-in-time part replacements, decreasing the need to purchase and warehouse a full inventory of system-critical “just-in-case” parts. When pneumatics work together with IIoT, it creates a system that facilitates early detection and prediction of potential issues. Maintenance technicians can place orders to ensure parts are delivered when they are needed. In the future, this, too, could become an automatic step where the IIoT system itself autonomously sends the order to parts suppliers.

Improving machine efficiency The real-world value of a certain technology ultimately equates to how well that technology boosts the bottom line and creates a return on investment. IIoT offers significant opportunities to improve 4 • 2020

An intelligent, IIoT-based closed-loop system, including sensors on IIoT-enabled pneumatics components, allows for more flexibility in machine operation positioning.

A smart pneumatics monitor (SPM) is a “gateway” that aggregates, organizes and analyzes pneumatics performance data and can deliver it through separate pathways to plant management systems, cloud environments and/or simple HMIs.

DESIGN WORLD — EE NETWORK

7

INTERNET OF THINGS HANDBOOK

Organizing data with a Smart Pneumatics Monitor As pneumatics technology becomes more intelligent, additional data points are being generated across the production systems where they are installed. Examples include information such as diagnostics, usage statistic and lifetime data. In addition, if all the pneumatics components (along with other intelligent machine drives, devices and subsystems) are generating megabytes of performance data, there’s a potential to overwhelm the machine control network and complicate automation process and control performance.

A smart pneumatics monitor (SPM) is a “gateway” that aggregates, organizes and analyzes pneumatics performance data and can deliver it through separate pathways to plant management systems, cloud environments and/or simple HMIs. This gateway can be independent of the process control architecture, using OPC UA, MQTT, FTP or email pathways to deliver alerts for both system-level and device-level performance data.

pneumatics operations in several ways, including:

Regulating upstream/downstream flow Combining the traditional strengths of a pneumatics system with IIoT-based technology can maximize process control and monitoring, particularly for upstream/downstream flow.

The result is enhanced OEE and lower total cost of ownership (TCO).

Consider a plant using a system that allows only fully open or fully closed positions on pneumatically actuated gates on a hopper or silo that dispenses bulk material for packaging. Uneven product flow and traffic jams can inundate or starve downstream processing stations. The inability to vary the dispensing gates’ position based on downstream demand creates inefficiencies and bottlenecks throughout the plant. The results range from damages to the bulk material to overtime costs for personnel to make up production quotas.

A retrofit solution, without disturbing the existing controller or its program, can address

the issue at a fraction of the cost required for new controller equipment or work process modifications. An intelligent, IIoT-based, closed-loop system, with appropriate sensors on IIoT-enabled pneumatics components, allows each gate’s position to vary from 0 to 100% of the opening — not just the two positions of opened or closed. The flexibility results in much better flow control for bulk material, without the need to change the controller program.

By adding additional components, such as an extremely precise pneumatic positioning system for control and IIoT gateway to analyze functionality, the system enables more efficient control of the bulk material, preventing starvation of the packaging system downstream as well as optimizing OEE. In addition, data from the IIoT system can be leveraged for additional system improvements. It could, for example, measure valve life so the operator understands whether a valve is performing to specification and, if necessary, change the component during scheduled maintenance while alleviating any unplanned downtime.

The integration of data-driven predictive maintenance with preventive maintenance also allows for just-in-time part replacements, decreasing the need to purchase and warehouse a full inventory of system-critical “just-in-case” parts.

8

DESIGN WORLD — EE NETWORK

4 • 2020

eeworldonline.com

|

designworldonline.com

APPLICATIONS: IoT AND PNEUMATICS

Boosting energy efficiency MES/ERP level Process planning, surveillance, maintenance

Cloud services Data mining, long-term trends, third-party access

Field level Real-time process control

Smart energy usage is a key consideration for machine manufacturers and end-users alike. Data generated by IIoT-connected sensors can be converted into actionable information, allowing manufacturers to more fully understand and better manage energy usage.

For example, smart sensors can monitor pressure losses within the system and an IIoT gateway can analyze this data and send alerts when leakage becomes the predominant contributor to energy consumption. Users could then identify excessive leaks caused by a worn seal, for example, and mitigate them before they become a major concern. This functionality can also be achieved without changing the machine controller’s program or process.

Additionally, smart technology can minimize air consumption, not only to save money but also to reduce wear on components. For instance, by monitoring and analyzing compressed air pressure with respect to cycle time, the end-user can reduce the preset system pressure at the point of use to the work side of a cylinder, and determine the optimal operating point where the cycle time can be maintained with the least energy consumption.

This also decreases component wear by optimizing generated forces and reducing vibrations.

Enabling manufacturing flexibility Cylinder position

From product customization to packaging variations, manufacturers increasingly require the flexibility to change equipment without sacrificing quality.

Connected components can be engineered to easily and seamlessly supply different pressures for different tooling positions and sequences. A directional control valve system, for example, can support simple, on-the-fly changes and tooling positions for quick product variations and changeovers.

SPM

Air consumption

Build a path forward Pressure

Fieldbus

Valve actuation and diagnosis

IP network

IO connection

Combining the traditional strengths of a pneumatics system with IIoT-based technology can maximize process control and monitoring, particularly for upstream/downstream flow.

eeworldonline.com | designworldonline.com

Data is only as useful as its ability to provide insights, guide decisions and help justify investment.

And while OEMs and end-users understand the potential to capture, aggregate and use sensor data, it’s time to turn that potential into reality.

From creating a safer workplace to predicting failure before it happens and building flexible production lines, IIoT-enabled technology can generate real-world results in pneumatics operations.

Emerson | emerson.com

4 • 2020

DESIGN WORLD — EE NETWORK

9

INTERNET OF THINGS HANDBOOK

Comparing magnetic cores for power inductors It is helpful to know how the material properties and geometries of magnetic cores affect the ability of inductors to store energy or filter current.

There can be a lot of mystique attached to the specs of magnetic cores used in power inductors, due partly to the fact that magnetic materials may not be well characterized for handling high levels of magnetic flux. Thus a few basic concepts may come in handy when working with these components.

There are three general types of materials used for inductor magnetic cores: powder cores comprised of various iron alloys, ferrites, and wound cores comprised of thin magnetic steel strips. Of these, the most common go-to materials are ferrites for transformers, ironpowder for inductors.

One reason is the behavior of these materials in the presence of ripple currents.

Ferrites have a power loss comparable to that of iron powder but can handle higher ripple currents. Because transformers typically have a high ripple current but zero average current, ferrite cores work well.

In contrast, most inductors handle a small amount or ripple current but a large average current. Iron-powder cores typically maintain their magnetic qualities in the presence of high dc currents, though the ripple current must be relatively small to avoid overheating. Thus iron-powders are usually the first choice for inductor cores.

The geometry often used for power inductors and transformers is the toroid because its shape maximally constrains the magnetic field while providing a large area for windings. Both powder cores and ferrites are commonly obtained shaped as toroids, but also tape-wound (also called strip-wound or cut wound) cores can be used as toroidal transformers. The strips can be as thin as 0.000125 in and may be

10

DESIGN WORLD — EE NETWORK

Leland Teschler • Executive Editor

comprised of silicon steel, nickel-iron, cobaltiron, and amorphous metal alloys.

Tape-wound devices can be useful up to 10 to 20 kHz depending their material. The maximum usable frequency is usually lower than for ferrites because their resistivity is lower, resulting in high eddy currents and higher core losses. The thinner the tape material, the higher the usable frequency.

A benefit of tape-wound cores is that they saturate at higher levels than ferrite cores so they can be physically smaller at high power levels. On the other hand, ferrites have lower core losses and cost less per unit weight. Also, nickel-iron alloys can be brittle, so tape-wound core toroids wound with this material can be sensitive to shock and vibration. Tapes of silicon-steel alloy don’t have this problem.

MIND THE GAP The magnetic cores used in power inductors frequently have an air gap within their structure. The gap is used to boost the flux level at which the core saturates under load.

Specifically, the air gap reduces and controls the effective permeability of the magnetic structure. Permeability, μ, is a measure of how much magnetization a material receives in an applied magnetic field. Recall μ can be

expressed as the flux density, B, divided by the magnetic field, H. Thus the lower the value of μ, the greater the value of H (or current) that the core supports when B is below the maximum value of flux density (Bsat) inherent to the magnetic material. Commercially useful magnetic materials have a Bsat that ranges from about 0.3 to 1.8 T. The gaps in power inductors can be either discrete or distributed. Powder cores are distributed gap materials. Microscopically, magnetic alloy powder grains are separated from one another by binder insulation or by a high-temperature insulation that coats each grain. Distributing the gap throughout the powder core structure eliminates the disadvantages of a discrete gap structure, which include sharp saturation, fringing loss, and EMI. Additionally, distributed gap materials control eddy current losses to permit use of higher Bsat alloys at relatively high frequencies though they have a comparatively low bulk resistivity.

Ferrite cores are where you typically find discrete gaps. A ferrite core with a gap becomes a hybrid ferrite-air material. Its magnetic qualities move toward those of iron powder in that the field inductance drops and the saturation current rises.

Ferrite’s main advantage for inductor

A comparison of core materials made by Magnetics Inc. MPP

High flux

Kool Mμ

XFlux

75 series

Kool Mμ MAX

14-300

14-160

14-125

26-60

26-60

26-60

Saturation (BSAT)

0.7 T

1.5 T

1.0 T

1.6 T

1.5 T

1.0 T

Max temp (°C)

200

200

200

200

200

200

Lowest

Moderate

Low

High

Low

Very low

Toroid, E, Block

Toroid

Toroid

Permeability

AC core loss Core shapes

Toroid

Toroid

Toroid, E, U, Block

DC bias

Better

Best

Good

Best

Better

Better

Alloy composition

FeNiMo

FeNi

FeSiAl

FeSi

FeSiAl

FeSiAl

4 • 2020

eeworldonline.com

|

designworldonline.com

CHOOSING MAGNETIC CORES A typical magnetization curve for a soft magnet with key parameters labeled: Ms, or the saturation magnetization; Mr, the magnetization remaining after an external field is removed; Hc, the value of the magnetic field necessary to remove magnetization after the magnetic material has saturated; and Χi, the initial magnetic susceptibility.

Magnetization curve for a generic soft magnet

cores is low loss at high frequencies because it has a high resistivity compared with metal alloys. Ferrites are at the low end of the available range for Bsat, and they shift down in Bsat significantly as temperature rises. The presence of a discrete gap gives the inductor a sharp saturation point, forcing designers to keep the inductor well away from this area of operation.

Additionally, discrete gaps create magnetically intense localizations of the B field while simultaneously “leaking” the field to produce circuit noise and EMI. Inductors with discrete gaps also are vulnerable to eddy current losses in their coils from fringing.

Amorphous and nanocrystalline tape-wound cut cores may also use discrete gaps. They have less ac loss than powder cores but often cost more.

Magnetic cores with various geometries have been devised for specific purposes, though toroids are generally the least expensive and have less thermal resistance than other shapes. For example, E-shaped cores are usually applied in transformers with a bobbintype coil over their center piece. Placing the coil on the center member helps ensure it is enclosed in a magnetic field for efficiency considerations. To get a high permeability over the range of operating frequencies, the core is designed gap free (if there’s no dc current to worry about). Also available are C and U-shaped cores, again used for transformers, where windings may be put on one or both legs.

Additionally there is the EP core, basically, a magnetic structure containing a post for a bobbin-wound coil and additional magnetic material which fully encloses the coil. These cores are generally employed for broadband transformers working up to a few megahertz. The two pieces of EP core material that enclose the bobbin are usually held together with a clamp so there’s no gap between the two magnetic pieces. However, for specialized cases as when there is a dc current or high-level ac excitation, some EP cores will incorporate a small air gap to linearize the transformer behavior.

COMMON CORE MATERIAL PROPERTIES Ferrites for magnetic purposes are generally made of sintered manganese and zinc (MnZn) or nickel and zinc (NiZn) for use in higher frequencies. Magnetic materials containing high percentages of nickel or cobalt cost more than those containing mainly iron. But there are a variety of compositions comprised of numerous materials and geometries. And of course, material cost affects large cores more significantly than small ones.

MPP (Molypermalloy powder) cores are distributed-air-gap toroidal cores made from a nickel-iron- molybdenum alloy powder.

MPP exhibits the lowest core loss of the powder-core materials, but its processing costs and 80% nickel content makes it cost more. MPP toroids are typically available with outside diameters ranging from 3.5 to 125 mm.

High-flux cores are distributed-air-gap toroidal cores made from a nickel-iron alloy powder. These cores contain 50% nickel and have processing costs comparable to that of MPP. Their lower nickel 4 • 2020

DESIGN WORLD — EE NETWORK

11

Ms

Mr Hc

Hc

i

Mr

Ms

Optically Clear Silicone Adhesive Addition Cured MasterSil 157

Outstanding optical clarity Refractive index, 75°F: 1.43 Wide temperature range -175°F to +500°F Superior flexibility Elongation, 75°F: 110-140%

154 Hobart St., Hackensack, NJ 07601 • USA +1.201.343.8983 • main@masterbond.com

www.masterbond.com

INTERNET OF THINGS HANDBOOK Soft saturation effects

FERRITE

The gapped ferrite must be kept a safe distance away from the sudden rolloff.

Small shifts in the rolloff curve, or in the operating point, could have a distastrous effect. This curve shifts to the left with increasing temperature.

A graph from Magnetics Inc. showing how powder materials saturate gradually and still maintain a useful, predictable inductance even at high current loads. A gapped ferrite will maintain an inductance closer to the unbiased value until saturation, at which point inductance suddenly drops.

POWDER CORE INDUCTANCE

The powder core is safely designed to operate part way down the curve. The curve does not shift appreciably with increasing temperature.

CURRENT

FERRITE CURRENT

content typically makes them 5-25% less costly than MPP. High flux cores have a higher core loss than MPP and Kool Mμ. But they have a higher Bsat which leads to a low inductance shift under high dc bias or high ac peak current. Like MPP cores, high-flux cores are generally toroidshaped only.

Core manufacturers may mix proprietary combinations of materials to produce cores with special qualities. Examples include Kool Mμ (or, sendust) cores. These are distributed air gap cores employing iron, aluminum, and silicon alloy powder. Kool Mμ material has dc bias performance resembling that of MPP. But the absence of nickel in the formulation helps keep the cost down. The main trade-off is that Kool Mμ has ac losses exceeding those of MPP. It is designed for use when iron powder is too lossy, typically because the frequency is moderate or high.

Another proprietary formulation is the Xflux distributed gap cores made from a silicon-iron alloy powder. The XFlux material exhibits slightly better dc bias performance than High Flux cores and much better than than that of MPP or Kool Mμ. Again, the absence of nickel in the formulation helps keep down costs. But XFlux has higher ac losses than High Flux. It targets applications where iron powder is too lossy or lacking dc bias or where nickel alloys are too expensive or lack dc bias.

Iron-powder cores have higher core losses than MPP or Kool Mμ but generally

12

DESIGN WORLD — EE NETWORK

POWDER CORE CURRENT

when a magnetic material is magnetized. The effect is called magnetostriction. The resulting mechanical motion can produce an audible hum if it takes place in the audio range. Magnetic materials that include Permalloy 80, KoolMμ and MPP powder cores have low magnetostrictive properties and frequently get specified when audible noise is a possibility.

CORE SIZE There are two dimensions that primarily impact the size of a magnetic core: the core window (winding) area and the core cross¬ sectional area. The product of these two is generally called the area product, or WaAc and relates to how much power the core can handle. The larger the WaAc, the higher the power capacity.

The area product can drop as operating frequencies rise, thus reducing the necessary core size. Core suppliers often publish figures for the area products of their products.

Curie temperature is the temperature at which a material loses all of its magnetic properties and thus become electrically useless.

Many cores incorporate an insulated coating which melt well below the Curie temperature.

Similarly, exposure to the Curie temperature permanently alters the qualities of tape-wound cores. Tape-wound cores and powder cores generally have Curie temperatures exceeding 450°C, but their materials can oxidize well below this temperature. Ferrites, however, have low Curie temperatures (120 to 300°C) and temperatures somewhat above these levels won’t alter the structure of the ceramic material.

In general, the core magnetic properties return when the temperature drops below the Curie temperature as long as the material hasn’t oxidized or been held at high temperature for extended periods.

cost less. Iron powder tends to find use when the frequency is quite low or when the ac ripple current is minimal (resulting in fairly low ac losses). Most iron-powder cores contain an organic binder that can eventually break down in high temperatures, so thermal aging qualities (available from published curves) are a consideration. Iron-powder cores come in a variety of shapes including toroids, E-cores, pot cores, U-cores, and rods.

Gapped ferrite cores are marketed as an alternative to powder cores. Powder materials saturate gradually even when the current load rises significantly. A gapped ferrite will maintain an inductance closer to the unbiased value until saturation, where inductance suddenly drops. Another point to note is that the flux capacity of any power ferrite drops significantly as temperatures rises while the flux capacity of powder cores remains essentially constant over temperature.

The operating point of powder cores doesn’t shift much with temperature or material tolerances. And these cores have a natural swinging inductance – high L References at low load, controlled L at high load.

Magnetics Inc., www.mag-inc.com/ Finally, powder cores not susceptible Ferroxcube Inc. (Div. of Yaego), www.ferroxcube.com/ to fringing losses and gap EMI effects, Micrometals Inc., www.micrometals.com/ and that they have higher inherent Bsat Amidon Inc., www.amidoncorp.com/ levels than ferrites.

Fair-Rite Products Inc., www.fair-rite.com/ Finally, there is a small change TDK U.S.A., www.tdk.com/ferrites.php/ in dimension (generally on the order of a few parts per million) 4 • 2020

eeworldonline.com

|

designworldonline.com

IIoT devices run longer on Tadiran batteries.

PROVEN

40 YEAR OPERATING

LIFE

Remote wireless devices connected to the Industrial Internet of Things (IIoT) run on Tadiran bobbin-type LiSOCl2 batteries.

Our batteries offer a winning combination: a patented hybrid layer capacitor (HLC) that delivers the high pulses required for two-way wireless communications; the widest temperature range of all; and the lowest self-discharge rate (0.7% per year), enabling our cells to last up to 4 times longer than the competition.

ANNUAL SELF-DISCHARGE TADIRAN

COMPETITORS

0.7%

Up to 3%

Looking to have your remote wireless device complete a 40-year marathon? Then team up with Tadiran batteries that last a lifetime.

* Tadiran LiSOCL2 batteries feature the lowest annual self-discharge rate of any competitive battery, less than 1% per year, enabling these batteries to operate over 40 years depending on device operating usage. However, this is not an expressed or implied warranty, as each application differs in terms of annual energy consumption and/or operating environment.

Tadiran Batteries 2001 Marcus Ave. Suite 125E Lake Success, NY 11042 1-800-537-1368 516-621-4980 www.tadiranbat.com

*

INTERNET OF THINGS HANDBOOK

Developing connected medical devices for the IoT Adrie Van Meijeren, Low Power Connectivity • Dialog Semiconductor

Super-small radio SoCs are being paired with innovative battery technologies to bring inexpensive medical electronics online.

The Internet of Things (IoT) has disrupted many industries in short order. However, when it comes to adopting the IoT, the medical and pharmaceutical space has largely been held back.

It’s not entirely surprising. The high level of regulation in the medical field and the (literal) life-or- death stakes of introducing new technologies for patient care understandable lengthen development cycles for new medical devices. But engineering roadblocks around power, size and cost have been the biggest factors in making widespread development and adoption prohibitive for disposable connected medical devices.

There is a path forward, though, for developers who want to devise IoT-based medical designs that meet the necessary size, power and cost requirements.

One of the major roadblocks to developing disposable connected medical devices is cost. It can be a prohibitively expensive venture to create designs in a small form factor that integrate a system-on-chip (SoC) and the necessary external components for, say, measuring blood pressure or glucose levels or inhaling medicine. That cost is driven up by the need for components like two crystals rather than a single low-power version; four-layer PCBs rather than cheaper and simpler two-layer boards; and costly batteries. As long as the bill of materials (BOM) remains high and the product isn’t miniaturized, mass market adoption of connected medical devices will slow to a crawl.

In addition to BOM cost, medical designers often must contend with power consumption problems. Medical disposable products must last a long time. Shelf lives of 18 months up to several years are not unusual, followed with a relatively short active life measured in weeks to months. During its time on the shelf, battery capacity can drop from both self-discharge and leakage current to the application itself. Once active life starts, the battery may not have enough capacity available to support it. Clearly, both patients and doctors need IoT medical devices to be dependable – both to treat the patient and also to provide the data necessary to ensure dosages and tests happen correctly.

14

DESIGN WORLD — EE NETWORK

4 • 2020

Finally, there’s the disposability issue. The nature of disposable medical devices is that they will only be used for anywhere between 14 days and two months. Given that short lifetime and their cost, insurance companies are naturally reluctant to support them.

The answer to all these challenges lies in the battery and specifically, in implementing disposable silver-oxide or printed batteries. Recently both high-energy thin film lithium batteries and printed rechargeable zinc batteries have become commercially available. But there are questions about whether or not these technologies are ready for mass deployment.

The fabrication of batteries via 3D printing has several advantages over conventional battery fabrication technologies. For one thing, battery components may be printed directly on the PCB holding the rest of the electronics. Thus there is the possibility of eliminating assembly and packaging steps that discrete batteries require. Additionally, the printing process can also conceivably fabricate complex battery architectures that may be impractical via other means. Printing methods can adjust the shape and thickness of the electrodes and print solid-state electrolyte that is stable and safe.

Printed zinc batteries look promising. One such device from Impact Energy uses a High Conductivity Polymer Electrolyte (HCPE) that is stable, rechargeable, and does not need a sealed container.

Because the chemistry is based on zinc rather than lithium, it avoids the safety issues associated with many lithium technologies In additoin, lithium titanate (LTO) and lithium iron phosphate (LFP) are commonly used anode and cathode materials in 3D-printed batteries, but carbon nanomaterials are promising for use as electrodes as well. Carbon nanotubes and carbon nanofibers are widely used in printing inks because of their high mechanical strength, high chemical stability, large specific surface area, and excellent electrical and thermal properties.

It also looks as though printed battery electrolytes will help reduce fabrication costs as well. The electrolyte serves as catalyst by promoting the movement of ions from the cathode to the anode on charge and in reverse on discharge. Electrolyte material plays a key role in electrochemical performance, cycle life, and safety of the battery. eeworldonline.com

|

designworldonline.com

MEDICAL IoT

One example of a platform used for devising connected medical devices is Dialog Semiconductor’s Smartbond Bluetooth low energy 5.1 system-on-a-chip DA14531, visible on the daughterboard plugged into the dev kit motherboard.

The DA14531 is a small, low-power SoC for beacon and tracker devices and is designed to work with any type of (disposable) battery, 3-V coin cell or 1.5-V alkaline button cells, 1.4-V zinc-air cells or even printed batteries. The DA14531 supports dc-dc peak current control, allowing operation with low capacity (e.g. <20 mAh) batteries with high internal resistance. The SoC supports 2.5-dBm output power and a 96.5-dBm link budget. Sleep current can be as low as 700 nA while using a hibernation mode with external wake up trigger. The DA14531finds use in (disposable) smart labels, beacons or trackers.

There are still numerous challenges before printed batteries can be widely commercialized. One problem is that currently there are only a few printable active materials that can be used as inks. Additionally, much work remains to be done in characterizing how battery inks behave when patterned over top other inks. And though there has been a lot of work done on the materials for the electrodes and electrolytes, current collectors will likely need a similar amount of optimization.

Once the technology is ready, healthcare applications will likely benefit greatly from super-thin 3D-printed batteries. Skin patches using printed batteries are already commercial. Smart skin patches use laminar batteries, often partially printed, combined with printed electrode patterns to deliver drugs, cosmetics, and other chemicals through the skin. Medical diagnostic devices will likely benefit as well.

Wireless sensor/network applications will also benefit. Here, the trend is to combine energy harvesting with thin batteries to keep the package size down. Similarly, new small batteries will be a boon to battery-assisted passive RFID although coin-cells are the main power sources now. Smart card apps are another application wherein several thin-film battery technologies have been optimized for lamination into cards, though the prices are probably too high for disposable uses.

High peak currents can reduce battery capacity and lifespan. High in-rush currents can arise in dc-dc converters which tend to incorporate a high amount of capacitance on the power input to avoid voltage drops eeworldonline.com | designworldonline.com

on the supply rails. When power is applied initially, the charging of these capacitors can result in an in-rush current that can exceed the nominal load current. If left unaddressed, this high current can cause the voltage rails to fall out of regulation, perhaps making the system unstable or putting it in an unpredictable state. There are various ways of limiting in-rush current. For example, some BLE devices incorporate built-in current limiters .

All in all, the review cycles for medical devices are justifiably long, and it can be several years before they can hit the mainstream. But these devices have game-changing potential for patient care, and it all starts with finally cracking these longstanding design challenges.

References Dialog Semiconductor, www.dialog-semiconductor.com

4 • 2020

DESIGN WORLD — EE NETWORK

15

INTERNET OF THINGS HANDBOOK

The Journey towards autonomous manufacturing Dr. Michael Grant, CTO, DataProphet

As data are increasingly aggregated across manufacturing lines, the reality of autonomous lines is likely to be reached in the next five years. Here’s a look at what a typical journey towards autonomous manufacturing looks like and best practices for how manufacturers can begin to achieve this.

Within the industrial world, leaders are defining their journey to autonomous manufacturing. Manufacturers are focusing on digitization strategies that will help to drive efficiency across their plants.

When reflecting on the concepts of Industry 4.0, we need to consider where production systems have come from and the changes that have been made over time to improve throughput and efficiency.

Production improvement starts with robotic process automation (RPA), where you take a repetitive process and apply some form of mechanization to improve the throughput rate. The interesting thing here is that it doesn’t improve the processes quality, but does make it less variable—simply because the process

When reflecting on the concepts of Industry 4.0, consider where production systems came from and the changes made to improve throughput and efficiency.

Production improvement starts with robotic process automation (RPA) that make processes less variable because the process is more repeatable.

16

DESIGN WORLD — EE NETWORK

4 • 2020

eeworldonline.com

|

designworldonline.com

PAGE TITLE WILL GO HERE

The future of industry 4.0 is more flexible. We´re at a point where artificial intelligence (AI) systems are able to correct at the highest rate possible, which is ahead of real-time, to produce the best quality at the lowest cost, without the need for a human expert.

is more repeatable. For example, if your current process produces 1,000 defects, RPA will make 10 times as many defects, but also produce 10 times as many good parts. This is great for throughput but not very effective for improving quality.

Once manufacturers started shifting paradigms to become more data-led in their production systems (by using historians, PLCs, etc.), it enabled them to draw on that data to inform the expert analysis of the process.

This results in improved control limits and a reduction in the variance and in the number of quality defects. It does however make the operators´ job more difficult, as they need to manually maintain the process within these finite control bounds.

The next level of improvement is to make these adaptive changes as quickly as possible, with an understanding of the system from start to finish, to improve production. This final step brings us closer to the goal of autonomous manufacturing.

Production systems need to be flexible to tolerate the variance in upstream processes, without compromising on the quality of the final output.

The future of industry 4.0 is definitely more flexible. We´re at a point where artificial intelligence (AI) systems are able to correct at the highest rate possible, which is ahead of real-time, to produce the best quality at the lowest cost, without the need for a human expert.

eeworldonline.com | designworldonline.com

T H E STAT E O F A U T O N O M O U S M A N U FA C T U R I N G T O D AY The journey to autonomous manufacturing is complicated. It’s not as trivial as simply turning on a solution. In the final step described previously, the AI solution needs to offer guidance, making corrective suggestions to the production team to improve quality.

This helps to reduce the manufacturing risk because the quality result is assured despite a large variance in input material. Total system efficiency is improved because less scrap means greater production capacity, as well as the production of better-quality parts.

Most plants today draw data from their production systems and send it to their engineering or production teams. Operators are left to follow their own inquisitiveness as they look through the data to devise an optimization or system improvement. There isn´t a holistic view or use of data from the start to the end of a process to achieve an overall system improvement.

These data led investigations are also limited by the complexity of the manufacturing system. These systems-ofprocesses are often too complex to express in the terms of classical engineering descriptions of their processes. An engineering model that would be able to handle material from the start of the process through to the finished goods is too complex to express analytically or interrogate with traditional methods. In addition, the traceability of the component

4 • 2020

through a complex process is difficult to achieve. Unless the system achieves a rigorous sampling and tracking of the component flow, people alone are not able to join the data from step A through to step Z. The solution to this complexity is a system that allows manufacturers to express the relationship between the start of a process and the end of the process, without having to enforce the rigorous traceability that would typically be required. This system requires looking at the process with a slightly different view. It´s important to understand the quality result from each step in the process to make a final quality improvement at the end of the process.

E X I ST I N G SY ST E M S C A N B E U S E D The paradigm of autonomous manufacturing is specifically designed to work with existing processes. The only change is that the manufacturing system becomes more data-led, by using production data and quality data to make the prescribed process changes that result in improved quality. The journey to autonomous manufacturing is, in fact, predicated on having an existing production system - although it can also work in greenfield spaces. Autonomous manufacturing only requires enough data to describe the process in order to make a substantial impact on the system.

DESIGN WORLD — EE NETWORK

17

INTERNET OF THINGS HANDBOOK

Most plants draw data from production systems and send it to engineering or production teams. Operators are left to follow their own inquisitiveness as they look through the data to devise an optimization or system improvement. There isn´t a holistic view or use of data from the start to the end of a process to achieve an overall system improvement.

T H E S H I F T F R O M R E A C T I V E T O P R E S C R I P T I V E A I In reactive manufacturing, a quality failure is discovered at the end of the line and the production team will make a set of reactive changes to the system to correct for the immediately observed error. This approach has two core features: the first is that the defect has already occurred and the second is that the factory keeps producing poor quality goods until the root cause has been solved. A prescriptive system is different, as it involves making a small change now to avoid future quality failures. A small set of corrective actions are made in anticipation of a quality cost that is never realized. These prescriptions can help to reduce the cost of non-quality. In the reactive case, by contrast, one waits for the quality failure and all the associated costs to occur before correcting the failures in the system.

B E ST P R A C T I C E S F O R A U T O N O M O U S M A N U FA C T U R I N G The two most important things manufacturers can do to prepare production systems to achieve the goal of autonomous manufacturing are:

18

DESIGN WORLD — EE NETWORK

4 • 2020

•

Identify and save production data. As soon as a plant can start saving production data, it opens the opportunity to use that data to optimize the future. That´s the single most important thing manufacturers can do now if they haven´t yet started.

•

Improve the quality system. To improve quality, it´s important to ensure that the details of the defect are recorded (type, location, and description), and not just the fact that a defect has occurred. This will allow AI to automatically diagnose the root cause of the problem and to provide continuous directions to the machine or to the operator—so as to improve quality.

References DataProphet, https://dataprophet.com/

eeworldonline.com

|

designworldonline.com

EE Classroom is a syndicated content resource for electronic engineers looking for need-to-know information about various electronic components and systems. Curated by EE World’s editorial team, this digital content hub includes valuable technology background and insights, key trends affecting your designs of today and tomorrow, and frequently asked questions relating to a wide range of important electronic engineering topics.

Topics include: • • • • •

Power electronics Embedded computing Test & measurement Sensors Connectivity

To view free educational content, go to www.eeworldonline.com/learning-center

INTERNET OF THINGS HANDBOOK

How to test USB4 designs Designers must look at and characterize the entire Type-C ecosystem when testing USB4 designs.

Jit Lim • Keysight Technologies

The USB Type-C connector has received significant adoption with ubiquitous standards like USB, DP, and Thunderbolt. The next-generation variant of USB is USB4.

USB4 will transmit and receive on all four lanes of the Type-C connector in parallel, with bonded rates of 40 Gbps in each

Test points for USB4 compliance testing Test point Description

Comments

TP1

Transmitter IC output

Not used for electrical testing.

TP2

Transmitter port connector output

Measured at the plug side of the connector.

direction for an 80-Gbps link.

As these signals get sent through even longer passive cables, specialized transmitter and receiver techniques are necessary to preserve signal integrity. They involve new equalization requirements, signaling technologies, and measurement methodologies. Here, equalization at the transmitter and/or receiver serves to mitigate the effect of intersymbol interference and hence, to minimize the bit error rate (BER). In equalization, the signal passes through a filter having its frequency response equal to the inverse of the channel frequency response. A high gain is applied at higher frequency to counter the signal attenuation at the high frequencies. In simple words, equalization is an adaptive filter with coefficients determined at runtime depending upon the physical channel. It takes ultra-lownoise test instruments to properly characterize these highspeed signals.

The USB4 standard was announced in Q1 of 2019 and the specification published in August 2019. Typically, there is often a more lengthy time-lag between the standards TP1 announcement and the specification release. But there

The test points and their and definitions as spelled out for USB4 compliance testing.

20

DESIGN WORLD — EE NETWORK

+ -

TP3

Receiver port connector output

Measured at the receptacle side of the connector. All the measurements at this point shall be done while applying reference equalization function.

TP3

Receiver port connector input

Measured at the plug size of the connector.

TP4

Receiver IC input

Not used for electrical testing.

Source: USB Implementers Forum

TP2

TP3’

TP3

TP4

+ -

TXp TXn

IC Package

4 • 2020

IC Package

eeworldonline.com

|

designworldonline.com

TESTING USB4 USB4 Host

Host I/F Adapter

DP Source

Typical USB4 implementation requirements as spelled out on the USB Implementers Forum.

Enhanced SuperSpeed Host

DP IN Adapter

TMU USB 2.0 Host

PCle Controller

Host Router PCle DN Adapter PCle DN Adapter

USB3 DN Adapter

USB4 Port

USB4 Port

USB3 DN Adapter

USB Type-C Connector(s)

Downstream Facing Port

USB 2.0 USB4/Enhanced SS Bus Composite Cable

Upstream Facing Port

Insertion loss budget for USB4

Insertion loss budget for USB 3.2

Speed

Total budget (dB) Host (dB) Cable (dB) Device (dB)

Data Rate

Host

Connector

Cable

Connector Device

Gen2 (10G)

23

5.5

12

5.5

5G

10dB

Std A

7.5dB

Std B

2.5dB

Gen3 (10G)

22.5

7.5

7.5

7.5

5G

10dB

Std A

3.5dB

Micro B

6.5dB

5G

6.5dB

C

7dB

C

6.5dB

5G

10dB

Std A

3.5dB

C

6.5dB

5G

6.5dB

C

4dB

Std B

2.5dB

5G

6.5dB

C

4dB

Micro B

6.5dB

10G

8.5dB

Std A

6dB

Std B

8.5dB

10G

8.5dB

Std A

6dB

Micro B

8.5dB

10G

8.5dB

Std A

6dB

C

8.5dB

10G

8.5dB

C

6dB

Std B

8.5dB

10G

8.5dB

C

6dB

Micro B

8.5dB

10G

8.5dB

C

6dB

C

8.5dB

Insertion Loss Budget for USB 3.2 and USB4.

Source: USB Implementers Forum

was only a short period between the USB4 announcement and spec release because USB4 is based on the Thunderbolt 3 protocol.

Earlier generations of USB like USB3.2 could be implemented on the Std A or B connectors, but USB4 must be implemented using the Type-C connector. The USB4 physical data rate is 20 Gbps on one lane with a requirement to run in x2 mode for a 40-Gbps bonded effective bit rate. There are numerous high-speed standards that run much faster. The challenge with USB4 is that the link must work with a lowcost cable that is running as a 20bGbps x4 pipe or 80 Gbps.

THE USB4 ARCHITECTURE What adds complexity is that a USB4 product must also implement the lower-rate USB4 at 10 Gbps, USB 3.2 at 10 Gbps and 5 Gbps, USB eeworldonline.com | designworldonline.com

4 • 2020

DESIGN WORLD — EE NETWORK

21

Reference Receiver CTLE attenuates low-frequency signal components, amplifies components around the Nyquist frequency, and filters out higher frequencies. CTLE gain can be adjusted to optimize the ratio of low frequency attenuation to high frequency amplification. Visible here are some of the CTLE filtering options.

INTERNET OF THINGS HANDBOOK Differential return loss gives a measure of the undesired interaction and reflection between the USB cable and the host or receiving device.

Differential return loss test limits

Reference receiver CTLE

-3

0

-4

-5

0dB 1dB 2dB 3dB 4dB

-5

5dB

-10 Mag [dB]

Mag [dB]

6dB

-6

-7

7dB 8dB

-15

9dB

-20

-8 -25 -9 0

2

4

6 Freq. [Hz]

8

10

7

12

10

10

8

9

10 Freq. [Hz]

10

10

10

11

Symbol

Description

Min

Max

Units

Comments

UI

Minimum unit interval

99.97

100.03

ps

The minimum UI value corresponds to the link baseline speed of 10.0 Gbps with an uncertanity range of -300 ppm to 300 ppm. See note 4.

AC_CM

TX AC common mode voltage

--

100

mV pp

TJ

Total jitter

--

0.38

UI pp

See note 2 and note 3.

UJ

Sum of uncorrelated DJ and RJ components (all jitter components except for DDJ)

--

0.31

UI pp

See note 2.

DDJ

Data-dependent jitter

--

0.15

UI pp

See note 5.

UDJ

Deterministic jitter that is uncorrelated to the transmitted data

--

0.17

UI pp

UDJ_LF

Low frequency uncorrelated deterministic jitter

--

0.04

UI pp

DCD

Even-odd jitter associated with duty-cycle-distortion

--

0.03

UI pp

YI

TX eye inner height (one-sided voltage opening of the differential signal)

140

--

mV

Measured for 1E6 UI. See note 1, note 2, and figure 3-15.

Y2

TX outer height (one-sided voltage opening of the differential signal)

--

650

mV

Measured for 1E6 UI. See note 1, note 2. and figure 3-15.

See note 5.

Short channel transmitter specifications. Here a short channel represents a device that plugs directly into the host connector (such as a memory stick) with a host controller that is as close as possible to the host port connector.

22

DESIGN WORLD â&#x20AC;&#x201D; EE NETWORK

4 â&#x20AC;˘ 2020

eeworldonline.com

|

designworldonline.com

TESTING USB4 Transmitter Equalization Pre-Shoot and De-Emphasis

2.0, and potentially also DisplayPort and PCIe. It might be natural to assume that if the link runs correctly at 20 Gbps, then for sure it Informative filter coefficients would run at 10 Gbps and the slower rates. So why bother testing Present Pre-shoot De-emphasis the lower rates if testing at 20 Gbps passed? number (dB) (dB) C-1 C0 C1 The reason is each of these speed rates takes place under a 0 0 0 0 1 0 different set of conditions and experience a different channel loss.

So, though a bit rate may be slower, the cable used will be much 1 0 -1.9 0 0.90 -0.10 longer and lossier. There are numerous instances where a link will 2 0 -3.6 0 0.83 -0.17 test fine at 20 Gbps and yet fail at 10 Gbps when tested with a 3 0 -5.0 0 0.78 -0.22 longer cable model.

An understanding of the entire link’s loss budget is critical 4 0 -8.4 0 0.69 -.31 to designing, testing, and implementing a low-BER system.

5 0.9 0 -0.05 0.95 0 Comparing USB4 IL to the USB 3.2 IL spec, the loss budget for the 6 1.1 -1.9 -0.05 0.86 -0.09 link partners has shrunk from 8.5 dB to 5.5 dB at the 10-G rate.

So the USB3.2 link implementations may not work with the much 7 1.4 -3.8 -0.05 0.79 -0.16 tighter USB4 IL budget.

8 1.7 -5.8 -0.05 0.73 -0.22 The good news is the cable loss increases from 6 to 12 dB at 9 2.1 -8.0 -0.05 0.68 -0.27 10 Gbps. The negative to this relaxed cable loss is that although USB4 10 G runs at the same rate as USB3.2 10 G, it must work with 10 1.7 0 -0.09 0.91 0 a 12-dB cable and not a 6-dB cable. Thus it’s important to have a 11 2.2 -2.2 -0.09 0.82 -0.09 thorough understanding of the insertion loss budget.

12 2.5 -3.6 -0.09 0.77 -0.14 The next step is understanding where and how the compliance test points are defined. There are no specific rules for naming 13 3.4 -6.7 -0.09 0.69 -0.22 test-points, so TP0, TP1, TP3’, TP3EQ will mean different things in 14 3.8 -3.8 -0.13 0.74 -0.13 different specifications.

For USB4 Tx testing, TP2 is the near-end or short channel test 15 1.7 -1.7 -0.05 0.55 -0.05 point at the Type-C connector. TP3 is the far-end or long channel use case test point - note the definition of TP3 includes the receiver equalization.

For Rx testing, TP3’ would be the short channel test point. TP2 would be the long channel use case. It’s important to know the test points precisely to accurately set up the tests and perform the compliance measurements.

There are significant channel losses Long Channel Transmitter Specifications with the passive cable use case, so both Tx and Rx equalization are required in Symbol Description Min Max Units Comments the implementation and when testing.

TJ Total jitter -0.60 UI pp See note 2, note 3.

When performing Tx testing, it is critical to find the optimal continuous time linear Sum of uncorrelated DJ and RJ equalization (CTLE) and decision feedback UJ components (all jitter components -0.31 UI pp See note 2. equalization (DFE) setting that provides except for DDJ) the largest eye opening. CTLE is a linear Deterministic jitter that is filter applied at the receiver that attenuates UDJ -O.17 UI pp uncorrelated to the transmitted data low-frequency signal components, amplifies Measured for 1E6 components around the Nyquist frequency, UI. See Note 2, and filters out higher frequencies. DFE is X1 TX eye horizontal deviation -0.23 UI a filter that feeds back a sum of detected Note 4, and figure symbols to the symbol decoder for the 3-15.

Y1

TX eye inner height (one-sided voltage opening of the differential signal

49

Y2

TX eye outer height (one-sided voltage opening of the differential signal

--

eeworldonline.com | designworldonline.com

650

mV

Measured for 1E6 UI. See Note 1, Note 2, and figure 3-15.

mV

Measured for 1E6 UI. See Note 1, Note 2, and figure 3-15.

4 • 2020

Long channel refers to the situation where the USB device connects to the controller through a 3-m-long cable.

DESIGN WORLD — EE NETWORK

23

INTERNET OF THINGS HANDBOOK

Protocol Decode of USB4 Signaling. In parallel, it's necessary to view, trigger, and decode the high-speed 10G and 20G lanes.

purpose of reducing intersymbol interference. Because there is little signal margin, the Rx equalization used during the Tx compliance testing must accurately reflect the specification and should also reflect how the silicon Rx is implemented.

The Tx specification has the common test parameters like voltage, eye diagram, SSC, and rise/fall times. There are also the familiar jitter parameters like UI, TJ, and DDJ. However, there are also requirements for UJ or uncorrelated jitter. In the traditional jitter decomposition model, TJ was split into RJ and DJ. In this case, TJ is split into correlated jitter (DDJ) and uncorrelated jitter. UJ can further be decomposed into RJ and UDJ. One reason for this finer distinction is a large cross-talk element when 20-Gbps lines run on four differential pairs in parallel over tiny structures and cables. If the jitter decomposition is not implemented precisely per the spec, incorrect jitter analysis results.

A new requirement that did not exist in the USB 3.2 compliance test specification is the return loss test. If the impedances don’t match, the signal from the Tx silicon will never make it to the Type-C connector; nor will the Rx signal going into the Type-C connector make it to the Rx silicon. This test should always take place before Tx or Rx testing. If it fails, there is no point proceeding with the Tx and Rx testing.

TRANSMITTER EQUALIZATION

There has always been the need to characterize the transmitter equalization (Tx Eq). However, in the USB 3.2 spec, there was just one Pre-shoot at 2.2 dB and 1 de-emphasis at -3.1 dB. (As a quick review, pre-shoot and de-emphasis refer to boosts to the signal just before and just after a signal polarity inversion respectively.) For USB4, there are now 16 presets with different combinations of preshoot and de-emphasis.

In addition to testing each of the 16 presets, USB4 requires optimization of the Tx Eq for the optimal eye opening. It is common to over-look the optimization of the Tx Eq or set it incorrectly in the Tx silicon. At 20 Gbps, it is common to fail signal integrity because there are only one or two Tx Eq settings that will work for each specific loss channel implementation.

The various Tx tests discussed so far were at TP2 where the use case is a cable with an embedded retimer, redriver, or an optical cable. But USB4 has the notion of a 0.8-m lossy, passive cable. This is a much more demanding use case. The measurements are Test matrix for the Type-C ecosystem essentially like TP2, but must allow for the 0.8-m-cable loss Design simulation, protocol decode, USB-PD, RF, channel characterization, SBU, thunderbolt, DP model. This is probably the most difficult test to pass for Tx testing Transmitter Test Interconnect Test Receiver Test at 20 Gbps.

Active Cable Test Return Loss Test Active Cable Test Like the Tx test cases, Rx Automated testing also has the short-channel Automated standards test SW standards test use-case and long-channel test software software cases. Case one is the shortM8000 Integrated protocol E5080B ENA with S96011A channel test case where the J-BERT <200FS RMS enhanced TDR software PG stressed cocktail is applied UXR Infiniium directly to the Type-C connector.

Scope HW Case two is the significantly more <1mV RMS <25fs RMS complex use and test case where Test fixture the BERT-stressed cocktail now Tx test fixture must go through the 0.8-m 20-G Fixture or 2-m 10-G use case. Improper Cable/connector set-up of the calibration channel test fixture Tx or calibration of the stress DUT Tx Rx cocktail will cause either underCable stressing or over-stressing the Rx.

24

DESIGN WORLD — EE NETWORK

4 • 2020

eeworldonline.com

|

designworldonline.com

TESTING USB4

Case 1:

Neighbor TX

PJ

RJ

SSC

TP3’ Device under test

Plug Fixture

TX FIR

Pattern Generator

ACCM Noise Software Channel

Short channel and long channel receiver test cases. The short channel case represents a device that plugs directly into the host connector (such as a memory stick) with a host controller that is as close as possible to the host port connector. .The long channel represents the situation where the USB device connects to the controller through a 3-m-long cable.

Case 2: TP3

Receptacle Fixture

Device under test

PJ

Calibration Path

Receptacle Fixture

Cable

PCB Fixture

TX FIR

RJ

SSC

Pattern generator

ACCM Noise Software Channel

During product turn-on, it is critical to view, trigger, and decode on the SBTx and SBRx low-speed lines for negotiation and debug. In parallel, it would be necessary to view, trigger, and decode the high-speed 10-G and 20-G lanes also. Not having the ability to view all the low-speed and high-speed lanes in parallel curbs the ability to debug the power-on sequence.

In a nutshell, one must view testing of a USB4 design not as an independent entity but in conjunction with the other technologies that must also be implemented simultaneously. Hence one must also consider design simulation, protocol, USB power delivery, channel characterization, side-band testing, Thunderbolt, and DisplayPort. Important as well are the specific instrumentation, software, and fixtures for testing the entire Type-C ecosystem.

eeworldonline.com | designworldonline.com

References Keysight Technologies, USB4, https://about.keysight.com/ en/newsroom/pr/2019/12dec-nr19156.shtml

4 • 2020

DESIGN WORLD — EE NETWORK

25

INTERNET OF THINGS HANDBOOK

Is predictive maintenance the ‘killer app’ of Industrial IoT? Once headlined as the ‘killer app’ for IIoT, predictive maintenance has taken a while to find its feet, but progress has in fact been sure and steady, with some standout examples of successful niches.

In 2016 predictive maintenance was touted as one of the key applications for IIoT. Even in 2018, analysts such as Gartner made strong predictions of future success.

Gartner predicts that by 2022, spend on IoT-enabled predictive maintenance would increase to $12.9 billion, up from $3.4 billion in 2018, with improved operational efficiencies through predictive asset maintenance leading to substantial savings of up to 40%.

However, the market has not exploded quite yet. Indeed, a new survey of more than 600 high-tech executives from Bain found that industrial customers were less bullish about predictive maintenance in 2018 than they had been in 2016. This was mainly due, according to the analyst firm, to challenges in effectively gaining insight from IIoT data once gleaned, and at the other end of the equation, difficulties in implementing systems in the first place.

According to Bain, another key barrier could be summarized as: “Device makers and other vendors of industrial and operational technology need to dramatically improve their software capabilities—not a historical strength for most of them.” In spite of this, the analyst firm still predicted rapid growth for IIoT, with the market doubling in size to more than $200 billion by 2021.

26

DESIGN WORLD — EE NETWORK

4 • 2020

eeworldonline.com

|

designworldonline.com

PREVENTIVE MAINTENANCE

PREVENTIVE VS PREDICTIVE One of the biggest challenges to predictive maintenance adoption has been the fact that many industry sectors are still working their way through the implementation of preventive maintenance systems. Arguably the forerunner of predictive, preventive maintenance systems can range from quite simplistic, such as a ‘traffic light’ health system for individual machines or plant elements, to far more complex networks of sensors feeding data back to centralized dashboards.

However, it generally relies on manufacturer lifetime predictions, human operators or direct sensor data to highlight potential problems, rather than use complex algorithms to predict maintenance schedules.

This means that the benefits of preventive maintenance are becoming well-entrenched, but the staged adoption has left many industrial players waiting for the machine learning and AI market to mature further, easing adoption pains, and lowering costs.

FOOD FOR THOUGHT The current situation has created a range of opportunities, such as in the food industry.

One example is the Mitsubishi Electric Smart Condition Monitoring (SCM) system that slots neatly into the niche between “traffic light” preventive systems and full-fat predictive IIoT. The system monitors the condition of individual assets but layers these to provide a holistic picture of overall plant health.

Local preventive systems still provide visual ‘health check’ indicators, but real-time data are transferred over Ethernet to a PLC for indepth monitoring and cloud-based analysis.

A teach function ‘learns’ the normal operating state of the machine, then vital information such as bearing defect detection, imbalance, misalignment, temperature measurement, lack of lubricant, cavitation detection, phase failure recognition and resonance frequency detection can be viewed in a cloud dashboard.

IMPROVING TRANSPORT EFFICIENCY There are certainly clear indications that predictive maintenance is still front of mind in many sectors, such as the transport industry.

One example is trackside maintenance, a significant operating cost for rail firms that also requires qualified personnel to operate around the clock in potentially dangerous

DESIGN WORLD — EE NETWORK

PROVEN SHOCK, VIBRATION & NOISE REDUCING SOLUTIONS

MATE

RIAL

PROTECT AGAINST

DROP SHOCK DAMAGE 800.838.3906

sorbothane.com

SORBOTHANE® MADE IN THE U.S.A.

27 Sorbothane_DesignWorldAd_C-9.indd 1

2/3/20 9:24 AM

INTERNET OF THINGS HANDBOOK

conditions. However, by deploying IIoT sensors and analytics technologies rail operators can move from wasteful inspection cycles (where perfectly serviceable equipment is checked and rechecked irrespective of condition) towards preventive, conditions-based and predictive maintenance.

For example, Nokia created a rail asset lifecycle optimization application that brings all three elements together, not only modelling maintenance schedules for each asset based on learned operating parameters and incorporating external data such as weather conditions, but also building in crucial risk-related data around the consequences of a component failure.

Overall, while predictive maintenance may have taken some time to mature, there are signs that the market is beginning to open up, especially in niche use cases. More generalized ‘plug-and-play’ systems targeting wider industry sectors are also beginning to emerge, highlighting that R&D investment is beginning to translate into real-world demand. It seems that predictions of demise have in this business case at least, been exaggerated.

KEEPING TRACK OF RENEWABLES

Avnet Abacus | www.avnet.com

Predictive maintenance technology originally designed for the mining industry has found an application in the renewables industry, in an interesting pivot. An Australian startup, Ping Services, developed an acoustic sensor that was intended for mining and drilling applications, able to monitor the acoustic signature of a drill bit over its lifetime, and then harness machine learning to predict fault development ahead of time. While reducing astronomically expensive drilling stoppages is clearly an area of considerable interest, the company embarked on pilot programs with Australian and US-based wind farms to monitor turbines with similar goals in mind.

The solar-powered, satellite-connected sensors actively listen to the turbine blades’ acoustic signature to detect the development of pitting or cracks caused by lightning strikes or hail. As such issues begin to develop, they can be monitored and targeted for

28

DESIGN WORLD — EE NETWORK

4 • 2020

maintenance remotely, rather than requiring highly-trained teams to tour windfarms and conduct routine testing.

PREDICTIVE COMES OF AGE

Author Bio: Martin Keenan is the Technical Director at Avnet Abacus, which assists and informs design engineers in the latest technological advances. With the IoT and Industry 4.0 changing manufacturing, Avnet Abacus helps designers find the best technological fit for their industrial applications, and accelerates the process all the way from idea to market.

eeworldonline.com | designworldonline.com

DesignFast is a tool for engineers to search across a list of aggregated components from trusted distributors. Engineers can make full-text searches across millions of components available in the DesignFast database and drill down to find a specific piece for their needs.

Searchable datapoints include manufacturer and distributor part numbers, manufacturers and distributors, datasheets, real-time pricing, and more.

DesignFast makes part searches more efficient by either matching part numbers explicitly or partially matching part families.

We know that designing components has its challenges. At DesignFast, our goal is to help create a better design process for engineers and other professionals involved in sourcing products and make component selection simple.

designfast.com

INTERNET OF THINGS HANDBOOK

Breaking BLE Despite built-in safe-guards, Bluetooth Low Energy IoT devices are vulnerable to hacks when they communicate over the air. Here are the basics of the problem.

Leland Teschler, Executive Editor

If you eyeball internet-of-things items ranging from smart ac plugs to motion sensors you typically find connectivity via the Bluetooth Low Energy (BLE) standard.

A lot of IoT devices use BLE because the protocol is well suited for transferring small amounts of data while consuming little power. But though BLE incorporates several security measures, vulnerabilities in the protocol have emerged over time.

For example, BLE communications can be hacked via man-in-the-middle (MITM) attacks where an attacker secretly alters messages between parties who think they are communicating with each other. BLE credentials can also be sniffed using a sniffing device that examines data sent on the advertising channels used to let BLE devices find each other. In BLE spoofing, an attacker mimics the MAC address of a BLE device as a means of impersonation.

Denial-of-service attacks are also possible because peripheral BLE IoT devices are usually designed to connect with only one master at a time. Bombarding the BLE device with connection requests in response to advertising packets can prevent legitimate users from connecting. In addition, unauthorized co-located apps can also hijack the connection between legitimate mobile apps and BLE devices.

30

DESIGN WORLD — EE NETWORK

4 • 2020

Many vulnerabilities pertain to the process of pairing devices, verifying and authenticating the identity of BLE nodes wishing to connect up. Part of the problem is that there are several ways of pairing devices, and not all of them have a high level of security. Ditto for BLE traffic encryption.

Data encryption is used to prevent MITM eavesdropping attacks on BLE links by making data unintelligible to all but the BLE master and slave devices forming the link.

Earlier versions of BLE had communication modes that didn’t incorporate a public key exchange for encryption/decryption, probably because more computing power (and a faster battery drain) was involved in running encryption/decryption algorithms.

Recent versions of the BLE standard incorporate modes where users must enter credentials to connect with IoT devices.

Unfortunately, researchers have found that many BLE IoT devices don’t implement applevel authentication properly.

In particular, numerous BLE IoT devices use “Just Works” for pairing (no invocation of app-device bonding at all), which allows any nearby attackers to arbitrarily connect and possibly do something devious.

To understand the problem with Just Works pairing, consider that there are four different pairing methods, but they all take place in three phases. In phase one, the two devices let each other know what pairing method is going to be used and what the BLE devices can do and expect. In phase two, a Short Term Key (STK) gets generated eeworldonline.com

|

designworldonline.com

BLE SECURITY

Pairing in bluetooth Initiator

Responder Established LL connection (Optional) Security_Request Pairing_Request

Phase 1

Pairing_Response

Pairing over SMP:

Phase 2

Legacy pairing or Secure Connections Establishment or encrypted connection with key generated in phase 2 Key Distribution Key Distribution

Phase 3

Key Distribution

by having the devices agree on a Temporary Key (TK) mixed with some random numbers to yield the STK. The STK itself is never transmitted between devices. In phase three, the key from phase two is used to distribute other keys needed for communications.

What may be the most secure of the four pairing methods is called OutOfBand, OOB, so called because it involves authentication outside the BLE communication channel. The Apple Watch is a good example.

For pairing, a swirling pattern of dots displays on the watch face. The user points the camera of the iPhone to be paired at the watch face to link the two.

Another strong pairing method is called Passkey Entry. Here a sixdigit value displays on one device and is entered manually into the other.

The two other pairing methods have more problematic security.

With Numeric Comparison pairing, devices to be paired both display the same six-digit value. Pairing generally involves just hitting “OK” on both devices. The main purpose of Numeric Comparison is to identify devices to be paired rather than thwart bad actors. MITM attacks are possible.

The last pairing method, called Just Works, is said to be the most widely used. It was intended for devices that lack a display. As in Numeric Comparison, a six-digit value gets passed, but the six digits are all zeros. Thus any nearby BLE device sending out a Just Works connection request can pair up with those nearby that use the same pairing scheme.

The Just Works method has come into wide use because it consumes less power than the other pairing methods. BLE schemes that employ Just Works pairing may build-in other security measures that are less power intensive, typically at the app level. For instance, the app can ask users to enter credentials and deliver them (through encryption) to the IoT devices to authenticate the connection.

Nevertheless, security researchers say vulnerabilities during pairing constitute a severe security risk. For example, researchers at The Ohio State University recently developed an automated app analysis tool and used it to identify 1,757 vulnerable free BLE apps in Google Play store. eeworldonline.com | designworldonline.com

The pairing protocol in BLE. Problems arise when the key exchanged between the app and the BLE device is zero or hard-coded into the app, where it can be discerned by disassembly.

They also performed a field test in which 7.4% of 5,822 BLE devices were vulnerable to unauthorized access.

FINGERPRINTING The Ohio State researchers also said their field test uncovered 5,509 BLE devices that were “finger printable” by attackers. The fingerprinting involves the universally unique identifier (UUID) from the advertisement packets broadcast by the BLE devices. UUIDs are typically 128-bit hexadecimal strings. The point of broadcasting UUIDs is so a BLE peripheral can advertise what services it provides, such as measuring a heart rate.

Thus some of the information in the UUID-- i.e. that defining the predefined services-- is universal. Nearby mobile apps must know what the UUID means to discover the device sending it out. Also, UUID packets are not encrypted-- all other kinds of BLE packets are.

Ohio State researchers say this use of UUIDs is a design flaw. UUIDs can be obtained from not only the BLE traffic but also from the IoT companion mobile apps. Attackers can use UUID information to fingerprint a BLE device this way: Attackers bent on mischief would first scan all mobile apps in an app store, such as Google Play, to find all possible UUIDs, allowing them to fingerprint all BLE devices statically. It is likely that multiple apps use the same scheme-specific BLE chip or UUID configuration, preventing any nearby attackers from precisely knowing which device the victim is using. To further narrow things down, attackers can inspect the next layer UUIDs (because BLE devices often organize UUIDs in a hierarchical structure) and use the structure of the UUIDs to fingerprint a victim BLE device. With the fingerprinted UUID information, they can sniff all advertising packets nearby (e.g., a metropolitan area such as New York City) to locate these devices. If mobile apps also tell them Just Works or weak pairing is in use, attackers can directly exploit these BLE devices.

In tests, the researchers discovered 168,093 UUIDs, 13,566 of which were unique, when they analyzed free BLE apps in Google Play. They also point out that there are special receivers available that can be used 4 • 2020

DESIGN WORLD — EE NETWORK

31

INTERNET OF THINGS HANDBOOK Bluetooth protocol stack Application layer

Application / profiles

The protocol stack for Bluetooth. Security problems arise when security measures are implemented at the app level but in ways that can be discerned by examining the app code.

Other LLC Audio

to sniff BLE signals up to 1 km away, though BLE signals typically travel only up to 100 m.

To prove their point, the OSU researchers built their own BLE sniffing device using not much more than a Raspberry Pi and a BLE antenna.

This DIY sniffer identified 431 vulnerable devices, including 369 units where the researchers could eavesdrop on conversations, within an area of just 1.28 square-miles.

Work by the OSU researchers shows what steps attackers must take when trying to decipher UUIDs. Sometimes UUIDs are directly hardcoded in the app. In this case, they may be extracted simply by looking for regular strings of characters (grepping) in the decompiled app code.

UUIDs associated with an IoT device also typically have a hierarchical structure. A service UUID can have “children” UUIDs derived from its characteristics. Such a UUID hierarchy could provide information useful for determining which IoT app maps to a particular BLE device.

One complicating factor is that no structural rules define relationships between parent and children UUIDs, so some educated guessing may be involved.

OSU researchers also explain the general approach attackers would likely take in figuring out whether an app itself is insecure. The only way a nearby attacker can sniff vulnerable IoT devices paired via Just Works is to figure out whether the app involved uses flawed or insecure authentication. To implement proper authentication, the app must use cryptography to prevent a relay attack either by encrypting the authentication token with nounces (arbitrary numbers used only once to ensure communications can’t be reused) or by using an additional layer of encryption of the traffic atop BLE link-layer encryption. Thus to check

32

DESIGN WORLD — EE NETWORK

RF comm

Service discovery

Telephony

Logical link adaptation protocol

Control

Data link layer

Link manager Baseband

Physical layer

Physical radio

the app for security, the approach is to look at the disassembled app code for any use of cryptography. If there’s no cryptography, the conclusion is the channel is not secure, and both passive/active sniffing and unauthorized access can be successful.

Even in apps employing cryptography, flawed authentication can rear its ugly head. One such flaw is the hardcoding of all credentials in the app, potentially discernible by disassembling the code. However, OSU researchers say it can be challenging to identify authentication flaws because there is no specific code pattern for implementing app authentication. Thus there’s no documented APIs to identify for extraction of the hardcoded credentials.

It turns out that flawed authentication involving hardcoded credentials can be identified systematically. The key insight is that to securely authenticate a mobile app to a BLE device, the app must provide a credential that comes from the external input, such as letting the user enter a password. OSU researchers say this opens up the possibility of using a data flow analysis algorithm to identify such apps. This approach, if used for nefarious purposes, implies an extremely determined attacker: The technique would likely involve creating data-flow equations for each node of the app’s control flow graph and solving them by repeatedly calculating the output from the input locally at each node.

In particular, researchers say data sent out to BLE peripheral must go through low-level APIs, allowing use of program slicing-basically looking at a subset of program statements that affect a variable of interest--to trace back to the source of the data. If none of the data sources 4 • 2020

Middleware layer

are external inputs (e.g., received from the BLE network or user inputs), then the app has used hardcoded commands including possible passwords to interact with the BLE devices Researchers also note that further intelligence may be gained by knowing where the UUIDs are used (i.e., the execution context). There are seven documented APIs defined by the Android BLE framework that carry the UUIDs as parameters, to generate the instances for accessing the related service, characteristic and descriptor in the paired BLE devices. While an app could have multiple UUIDs, their usage may have dependencies that can be exploited.

COUNTERMEASURES To head off vulnerabilities, researchers say the app should encrypt the data sent with no hard-coding of any factors involved in the encryption. Developers should also hide the authentication credentials in the cloud or let users enter them in the app.

The root vulnerability that enables UUID fingerprinting is that BLE devices must broadcast advertised packets to inform nearby apps. The UUID can be sniffed either from the advertisement packets or by browsing for services after the connection has happened.

In addition, UUIDs are fixed values and do not change over time.

The fingerprinting attack relies on mobile app analysis to reveal the UUIDs and their hierarchies, So anything that discourages this sort of analysis can be helpful.

Researchers also say that although protection methods in the app-level are seemingly plausible, they can’t fundamentally prevent the UUIDs from being reverse eeworldonline.com

|

designworldonline.com

0

L

BLE SECURITY Top 10 most vulnerable BLE devices in the OSU field test UUID

# Device

00001910-0000-1000-8000-00805f9b34fb 00001814-0000-1000-8000-00805f9b34fb 00001804-0000-1000-8000-00805f9b34fb 0000fef1-0000-1000-8000-00805f9b34fb 0000f000-0000-1000-8000-00805f9b34fb 00001820-0000-1000-8000-00805f9b34fb bc2f4cc6-aaef-4351-9034-d66268e328f0 0000ffd0-0000-1000-8000-00805f9b34fb 000018f0-0000-1000-8000-00805f9b34fb 0000ec00-0000-1000-8000-00805f9b34fb

7 6 6 5 5 4 4 4 4 4

Device description Digital thermometer Car dongle Key finder Smart lamp Key finder Smart toy Smart VFD Air condition sensor Smart toy Accessibility device

engineered from mobile apps. Obfuscation and encryption can only make it more difficult for attackers to retrieve UUIDs because the app will work with plain-text UUID somewhere along the line. Storing UUIDs outside the mobile app can prevent the UUIDs from being statically reverse engineered, but attackers can still obtain the plaintext UUIDs at run-time.

Researchers additionally advocate the piecing out of UUIDs as they get transmitted in the BLE RF channel. In this way, attackers can only see segments of UUIDs instead of continuous signals, The downside is that this approach probably entails use of additional hardware.

Another fundamental countermeasure would be to construct one-time dynamic UUIDs. The OSU researchers claim this scheme only requires an update of both the app and device firmware. Because multiple users can access one BLE device, they suggest using the cloud help synchronize the UUIDs among users. Then once an app has successfully connected with an IoT device for the first time, it negotiates a dynamic UUID for future communication. To prove this scheme actually works, the OSU team says they implemented a prototype using a real BLE chip in a software development board which provides

OSU researchers surveyed a 1.28-sq-mile area and discovered a number of BLE devices vulnerable to attack through compromised UUIDs. Here is their top ten list.

programming interfaces to configure UUIDs for advertisement packets, services, characteristics, and descriptors.

Clearly it would take a determined hacker willing to spend time parsing through disassembled app code to exploit some of the vulnerabilities the OSU researchers uncovered. That’s probably beyond the capabilities of casual mischief makers, but not out of the question for state-sponsored hackers and criminals.

References Automatic Fingerprinting of Vulnerable BLE IoT Devices with Static UUIDs from Mobile Apps, https://dl.acm.org/doi/10.1145/3319535.3354240 Bluetooth SIG Inc., https://www.bluetooth.com/ specifications/protocol-specifications/

0402CT Series

Low-profile Ceramic Chip Inductors • Maximum height of 0.45 mm ... 30% lower than competition • 23 inductance values available ... from 1.2 to 56 nH • Excellent Q Factors ... up to 84 at 2.4 GHz • Very high SRF ... as high as 27.5 GHz

Full Specs & Free Samples @ coilcraft.com

INTERNET OF THINGS HANDBOOK

Selecting the right Bluetooth Low Energy SoC Tricks of the trade for optimizing the energy consumption of BLE chips affect memory size, clock speed, operating modes, and other factors determined during the initial design.

Emmanuel Sambuis Silicon Lab

It can be challenging to optimize Bluetooth Low Energy (BLE) applications for minimal energy consumption. An understanding of BLE and the underlying system-on-chip (SoC) architecture is critical for realizing extended battery life. Particularly important are insights into the BLE modes of operation (such as Advertising and Sleep).

There are different ways to minimize the power consumption of the entire system by providing the right inputs to the stack and taking advantage of hardware features of BLE SoCs.

34

DESIGN WORLD — EE NETWORK

4 • 2020

Within Bluetooth, BLE has secured a significant number of sockets. One of the most critical reasons for selecting BLE in a wireless design is its ubiquity thanks to its large deployment in smartphones and its ability to extend the battery life-time. Long battery life is extremely valuable as most IoT end nodes are battery operated.

Though it may sound obvious, the selection of a BLE device starts with the evaluation of its documentation. While the initial data-mining process seems trivial, the comparison of semiconductor device datasheets can quickly turn into a complicated task.

Consider, for example, the active current in the wireless SoC’s receive or transmit modes. Many BLE SoCs report a current consumption of a few milliamps. For instance, eeworldonline.com | designworldonline.com

SELECTING BLE SoCS EFR32BF22 current consumption in active mode using dc-dc converter 5 1 MHz 16 MHz 26 MHz 38 MHz

Supply current (mA)

4

3

2

1

0 -40

-20

0

20

40

60

80

100

120

Temperature (Degrees C)

EFR32BF22 current consumption in sleep mode using dc-dc converter 5 1 MHz 16 MHz 26 MHz 38 MHz

Supply current (mA)

4

3

2

1

0 -40

-20

0

20

40

60

80

100

120

Temperature (Degrees C)

The leakage current of a BLE SoC at 25°C differs significantly from that at 85°C or higher as demonstrated in these supply current graphs for the EFR32BG22 BLE SoC. Also evident in the graphs is that supply current can depend a great deal on the SoC clock frequency. Here the top graph is for the EM0 active mode while the lower graph is for the EM1 sleep mode. Both graphs depict chip current when the internal dc-dc converter is employed with a 3-V supply.

eeworldonline.com | designworldonline.com

the EFR32BG22 SoC from Silicon Labs has a radio-receive current of 2.6 mA and a transmit current of 3.5 mA at 0 dBm. Note these numbers only relate to the SoC RF transceiver. At the SoC level, these currents are slightly higher, 3.6 mA and 4.1 mA respectively. Relying only on the radio numbers for the SoC current drain is a common mistake. The front-page of the device documentation often must be validated with a thorough analysis of the data-sheet.

Another example is the CPU power consumption reported in microampsper-megahertz. This number can become a decisive selection criterion in the case of intensive compute applications. It is typically reported in the best-case scenario, which is often the maximum frequency of the CPU. In other words, the value shown in the data-sheet could prove to be vastly inaccurate when the SoC CPU works at a different frequency than that specified in the manufacturer’s documentation.

A third example is the deep-sleep current, critical for battery-operated end products. This number typically ranges between hundreds of nanoamps to a few microamps. It is essential to ensure the deep- sleep current numbers are associated with the size of the RAM retained and include the realtime-clock (RTC) current consumption.

The RTC is used to maintain the timing necessary for proper BLE operation. In the case of the EFR32BG22 SoC, the front page of the data-sheet mentions a deep-sleep current of 1.05 µA in EM3 mode with 8 kB of RAM retained and the RTC running from the ULFRCO (ultra-low-frequency RC oscillator) onchip module. The current consumption section of the data-sheet provides additional information.

Thus the lack of standardization for power numbers in datasheets can produce erroneous comparisons that could ultimately lead to selecting the wrong device.

UNDERSTANDING APPLICATION REQUIREMENTS It is important to consider the application requirements when assessing BLE SoCs. Most suppliers try 4 • 2020

to represent their numbers responsibly, but it is impossible to treat all use cases for a device that might serve in dozens of different applications. This is where knowledge of the end application becomes critical.

Active and sleep currents are key specifications when selecting a BLE SoC. These current numbers must be inserted into a model that closely matches the application environment to produce a fair estimate of the average power consumption. Such models typically include the ON/OFF duty-cycle, knowing that a low duty cycle will favor an SoC with the lowest deep-sleep current. A high duty cycle will favor an SoC with the lowest active current.

Another parameter could be the ambient temperature of the end product, understanding that the leakage current of a BLE SoC at 25°C is significantly different from the leakage at 85°C or higher. The leakage current at a high temperature can be a key selection criterion in industrial applications such as sub-metering, which need a guaranteed battery life at high temperatures.

Another important element of the application relates to the type of battery technology used (in the context of battery-operated end products).

The battery powers the on-chip dc-dc converter integrated in the latest BLE SoCs. Using the dc-dc converter will significantly reduce the active current consumption of the entire SoC. Some sophisticated SoCs may integrate separate dc-dc converters for the radio and for the CPU. This practice provides an optimized solution, but the trend is clearly to have only one converter to minimize the cost of the SoC. Finally, it is also important to understand how on-chip or off-chip memories are used. A common requirement for BLE end nodes is to perform over-the-air (OTA) updates of software. Depending on the size of the image to be transferred, an external flash device can be economical. But its added power consumption and potential for security problems can, however, prove to be quite higher than that when using on-chip flash.

DESIGN WORLD — EE NETWORK

35

INTERNET OF THINGS HANDBOOK IoTMark-BLE active profile Application wakeup interval O/S

12C

LPF

BLE Server DUT

BLE notify

12C

CRC

Queue

PhyLink

LPF

BLE notify

CRC

Queue

Tx

Rx

Tx

Rx

Rx

Tx

BLE connection interval

Rx

PhyLink BLE Client Radio Manager

Tx

Queue

O/S

BLE write

Queue

Verify

BLE write

Verify

Application wakeup interval

A detailed analysis of the OTA updates will help determine the most appropriate memory bill-of-material.

In recent years, BLE SoCs have significantly reduced their total active current consumption while maintaining a low deep-sleep current. The reason is the migration of silicon technology from larger geometries (0.18 µm, 90 nm and 65 nm) to much more optimized technology nodes (55 nm and 40 nm). Use of 40-nm geometry combined with the integration of an on-chip dc-dc converter has tremendously reduced the overall current consumption of the EFR32BG22 SoC. For example, the Arm Cortex-M33 CPU requires 54 µA/MHz when running Coremark from the on-chip flash when the on-chip dc-dc converter is disabled. The same operation only requires 37 µA/MHz when the same dc-dc converter is activated.

In deep-sleep mode, the RAM retention is critical, both because it can represent a significant portion of the power budget and because RAM retention will allow a faster boot when the BLE SoC must return to active mode. From a design perspective, the use of low-leakage SRAM blocks has enabled silicon designers to

36

DESIGN WORLD — EE NETWORK

keep the deep-sleep current The IoTMark-BLE benchmark profile developed in the range of 1µA. An by the Embedded Microprocessor Benchmark additional key consideration Consortium can help assess power consumption. when selecting a BLE SoC is It spells out a communications path between an the size of each SRAM block emulated sensor, the edge node processor and an that can vary. The ability to emulated gateway. The benchmark measures the select the size of the RAM to energy required to power the edge node platform be retained will help minimize and to run the tests fed by the benchmark. power consumption in deepsleep mode. The EFR32BG22 SoC integrates independently the configuration of the dc-dc converter. The selectable SRAM blocks for a total of 32 kB stack comes via a software development of on-chip RAM. kit (SDK), which is fully integrated with Finally, the combination of clock gating an integrated development environment and power gating techniques allow the (IDE). The IDE includes a network analyzer BLE SoC to completely shut down certain that captures data directly from the SoC portions of the device depending on its radio. An advanced energy monitor also mode of operation. The activation of these correlates power consumption to code features is automatic, and their details are location. A visual GATT configurator is almost invisible to application developers. included to enable implementation of standard Bluetooth SIG profiles or custom SOFTWARE ENABLEMENT services. These tools allow development of Minimizing power consumption in BLE BLE applications that are fully integrated with applications requires highly optimized the hardware design, allowing developers scheduling of radio activity, maximizing the to focus on higher level design choices that time spent in the lowest possible energy affect power consumption. Also integrated mode while maintaining the precise timing into the SDK is secure bootloader support the protocol requires. To accurately control for firmware updates, both OTA and through transmitted power, the BLE stack integrates a serial interface.

4 • 2020

eeworldonline.com

|

designworldonline.com

SELECTING BLE SoCS EFR32BG22 typical application without dc-dc converter VDD Main supply

VREGVDD

AVDD

VREGSW

IOVDD

HFXTAL_I

VREGVSS

HFXTAL_O

DVDD

LFXTAL_1 LFXTAL_O

DECOUPLE RFVDD

CDECOUPLE

VDD

38.4 MHz

32.768 kHz (optional)

VDD

PAVDD

EFR32BG22 typical application using dc-dc converter

Main supply

CIN

VREGVDD VDCDC

The EFR32BG22 is an example of an BLE SoC that incorporates an on-chip dc-dc converter. Using the dc-dc converter will significantly reduce the active current consumption of the entire SoC. Some sophisticated SoCs may integrate separate dc-dc converters for the radio and for the CPU. This practice provides an optimized solution, but the trend is clearly to have only one converter to minimize the cost of the SoC.

AVDD

IOVDD

LDCDC VREGSW CDCDC

HFXTAL_I

VREGVSS

HFXTAL_O LFXTAL_1

DVDD

LFXTAL_O

38.4 MHz

32.768 kHz (optional)

DECOUPLE CDECOUPLE

RFVDD

The combination of sophisticated hardware and powerful software enables application developers to perform their own benchmarking on multiple devices.

This is the recommended approach that should be taken before selecting a BLE SoC. While initially more time consuming, this approach proves to be extremely valuable and helps reveal hidden challenges resulting from either missing hardware features or non-optimal software capabilities.

The development of a standardized benchmarking strategy can also help developers compare devices from multiple suppliers. The IoTMark-BLE benchmark profile developed by the Embedded Microprocessor Benchmark Consortium (EEMBC) provides a useful tool for assessing power consumption. The IoTMark-BLE benchmark profile models a real-world IoT edge node consisting of an I2C sensor and a BLE radio through sleep, advertise and connected-mode operations.

While this IoTMark-BLE benchmark might not suit all use cases, it can serve as a foundation for developing appropriate scenarios for any given application.

In a nutshell, side-by-side comparisons of vendor datasheets can lead to costly misunderstandings and misrepresentations. The analysis of BLE SoCs must take place at a system level as illustrated when comparing on-board and external dc-dc converter blocks within an SoC. Third-party benchmarks can often help determine what the comparative analysis should look like.

References The EFR32BG22 datasheet: https://www.silabs.com/wireless/ gecko-series-2/efr32bg22

PAVDD

The IoTMark-BLE benchmark: https://www.eembc.org/iotmark/ Mark Orchard-Webb, Silicon Labs, contributed the software enablement paragraph in this article.

eeworldonline.com | designworldonline.com

4 • 2020

DESIGN WORLD — EE NETWORK

37

INTERNET OF THINGS HANDBOOK

How to use MQTT to overcome obstacles to IIoT integration End users struggle with specific pain points around digital transformation in the traditional technology stack. While traditional communication technologies will continue to be in demand, pairing MQTT with existing offerings can give users a way to evolve.

Your customers are working to create a digital transformation in their companies. They want more data. They want more insight. More than just supporting their processes, they now need equipment that delivers useful information and easily integrates as part of a cohesive data network

, rn

f Technical Mar ket tor o c e i ng Dir

Josh Ea stb

u

extending from plant floor to executive office.

38

DESIGN WORLD — EE NETWORK

However, there are many obstacles to creating the level of integration required to fulfill that vision. Moving a single I/O signal from the field to the cloud requires a technology stack that includes many layers and involves many players. Each layer adds complexity, which affects the overall security and scalability of the system, not to mention added labor and cost (Figure 1).

Fortunately, new technologies are coming to the fore that bypass the traditional technology stack. There are several key technologies for machine integration called MQTT, a lightweight, publish-subscribe communications protocol for the internet of things (IoT). Including MQTT as an interface option multiplies the reach of machine data, providing new options to end users and even making direct-to-cloud integration a possibility.

4 • 2020

U N D E R STA N D I N G TH E PR O B LE M Design engineers have multiple options for providing an equipment data interface.

Many manufacturers, particularly of smallscale or off-the-shelf equipment, may use printed circuit board (PCB) designs including a serial or Ethernet I/O interface.

A programmable logic controller (PLC) or industrial I/O gateway included in the electrical panel of larger or semicustom equipment is another option that gives some flexibility. In the case of custom-engineered equipment, the end user might require the designer to use a specific fieldbus standard for sensors and transmitters that is compatible with their plant control network.

In all these cases, however, the end user faces a similar set of challenges with unlocking the full value of equipment data.

First, communication protocols themselves impose some limitations.

Proprietary protocols, obviously, inhibit interoperability, even if the manufacturer supplies a client application for communication with their device. To enable true integration, the manufacturer needs to offer a custom communications driver that can be incorporated into other applications.

However, even common industrial protocols, like Modbus/TCP or Ethernet/IP, have limited compatibility with IT systems— eeworldonline.com

|

designworldonline.com

IoT TECHNICAL TIPS PC workstation or server

Controller

Wire sensor to temperature input

Write code to get data Write code to log data

Sensor

Write code Configure sending to firewall database

Store data in the cloud or on-premises

Log data

Install, and configure input module

where data is in highest demand—and require further software and hardware support for integration. The most common approach requires the use of an open platform communications (OPC) server with drivers for each type of protocol in use on the plant network. No problem, right?

An unfortunate by-product of this model is that the more the network grows, the more congested it becomes. Poll-response communication protocols, like the ones mentioned, on control and corporate networks send frequent requests for information to maintain a sense of the state of the system and to act on the latest data.

Additionally, business applications accessing field data through an OPC network may be competing with industrial SCADA (supervisory control and data acquisition) or historian applications on the control network for

Figure 1: Providing even basic equipment information to central business applications involves a complex hierarchy of software and hardware systems.

bandwidth, with each making its own connection to field devices and requesting the same data over and over again.

All these one-to-one connections also create security issues, for which traditional industrial protocols and equipment, like PLCs, lack native support (Figure 2). Additional equipment and networking, like VLANs and firewalls, are required to provide security after the fact.

Unfortunately, with many different protocols in use, network protections become peppered with exceptions or become so restrictive that largescale integration is impeded.

Speaking of large-scale integration, these communications systems, of course, do not maintain themselves. Every controller, every gateway, every server and firewall, needs to be installed, configured, and updated

It’s not a web page, it’s an industry information site So much happens between issues of R&D World that even another issue would not be enough to keep up. That’s why it makes sense to visit rdworldonline.com and stay on Twitter, Facebook and Linkedin.

It’s updated regularly with relevant technical information and other significant news to the design engineering community.

rdworldonline.com eeworldonline.com

|

designworldonline.com

4 • 2020

DESIGN WORLD — EE NETWORK

39

INTERNET OF THINGS HANDBOOK

over time, rarely by the same person. Not only does that mean more personnel handling operating system updates and security policy configuration, it also means more cost in software licensing and upgrades.

With the influx of data required for highly connected, intelligent plant environments, plant engineers are looking for more scalable solutions; and OEMs who are looking to the future need to consider a different set of integration offerings for their equipment.

ENTER MQTT MQTT, formerly MQ Telemetry Transport, was developed in the 1990s under IBM’s Smarter Planet initiative to provide bandwidthefficient I/O communications for distributed

40

DESIGN WORLD — EE NETWORK

SCADA projects in the oil Figure 2: The typical industrial device contributes to & gas industry. Beginning the complicated web of unsecured, point-to-point in the early 2010s, MQTT connections that make up industrial networks. grew in popularity to emerge in recent years as the top IoT-specific protocol. Since applications and IIoT. Rather than establishing then, it has been enhanced for mission-critical multiple one-to-one connections between industrial applications through an additional master applications and slave devices, and specification, called Sparkplug B (SpB). then polling those devices repeatedly for What makes MQTT different? Efficiency. information, MQTT establishes a shared server, Cirrus Link Solutions, the company that known as a broker, as the endpoint for all field developed the SpB spec, reports an 80-95% devices and applications (Figure 3). Devices reduction in bandwidth consumption by users publish data to the broker, but they do so who move to an MQTT infrastructure. only when a change occurs in a given process MQTT achieves this efficiency using variable—a feature called report by exception. a radically different communication model Network applications can connect to the same from other protocols used for industrial MQTT broker, subscribe to updates from any 4 • 2020

eeworldonline.com

|

designworldonline.com

IoT TECHNICAL TIPS

device, and the broker will deliver them as they occur. If a device goes offline, the broker also delivers that notification to any subscribers.

This publish-subscribe communication model allows for reliable, many-to-many communication with reduced network traffic overall, making MQTT the kind of scalable infrastructure that plant engineers are looking for.

MQTT is also inherently more secure than traditional protocols. With the MQTT broker as the single node in charge of routing all traffic, data access rights for the entire network can be managed in one location. And because MQTT connections are established by the device client, not the MQTT server, there is no need to create firewall exceptions for inbound MQTT traffic, even from outside the company network. With eeworldonline.com

|

designworldonline.com

the addition of SSL/TLS encryption, MQTT traffic can be safely routed over public networks, and in fact, is the standard for all the major cloud IoT platforms, like Amazon Web Services, IBM Cloud, and Microsoft Azure.

But it is the OEM who unlocks the full potential of MQTT for end users, because direct support for MQTT in field devices and equipment produces the simplest integration experience.

GET ON THE BANDWAGON Fortunately for manufacturers, MQTT was designed for use with resource-constrained devices, and as such, has a simple specification with a small in-memory footprint. Open source reference implementations of MQTT and 4 • 2020

Figure 3: MQTT creates a secure, highly scalable, many-to-many architecture for industrial applications and IIoT. Sparkplug B are available in many programming languages through the Eclipse Paho and Tahu projects, and can be incorporated into PCB firmware without royalties.

For manufacturers that use a dedicated gateway as a customer data interface, there are also MQTT-enabled controllers and I/O gateway options available (Figure 4). This approach can be used to combine communication functions with real-time control or visualization in one device, but it also has the advantage of tailoring data processing DESIGN WORLD — EE NETWORK

41

INTERNET OF THINGS HANDBOOK

Figure 4: As MQTT grows in popularity, more industrial devices are appearing with embedded MQTT publishing options (Pictured: Opto 22’s groov EPIC controller and groov RIO I/O gateway)

and publishing to end user requirements with greater ease. Where a firmware-based approach might require downtime to flash update memory, industrial controllers often support online editing.

Regardless of which approach you opt for, don’t overlook Sparkplug B compliance. Many MQTT device implementations fall short of this critical mark. SpB guarantees that a device uses a standard data format and encoding, improving interoperability, and that it publishes critical state information, improving reliability for mission-critical settings.

W H AT ’S I N I T F O R M E ?

There are also direct benefits to OEMs who provide MQTT support. Just like your end users, you might be interested in extracting useful information from your installed equipment base but likely face a similar set of complications.

Typically, monitoring remote equipment requires creating exceptions in local firewalls to permit outside connections through to the equipment. This can raise security concerns with end user IT groups. However, because MQTT connections are always deviceoriginating, it’s possible to establish secure connections to the outside that are transparent to your customers’ IT policies.

MQTT-enabled equipment can be pre-configured to establish a connection to a remote MQTT broker that you control, allowing you to securely monitor equipment usage for billing, regulatory, or troubleshooting purposes. This monitoring can be performed without requiring modifications to your customers’ local security measures and can be done in parallel to their own data collection. If you opt for a metered cellular connection, instead of piggybacking on your customer’s network, you can reduce your own transmission costs thanks to MQTT’s low bandwidth requirements.

Other scenarios are possible as well, like using a shared MQTT broker connection to exchange data between multiple pieces of

42

DESIGN WORLD — EE NETWORK

equipment or provide equipment with live data from external web services. In one case, for example, wind farm operators can use the spot price of electricity to automatically adjust the output level of individual turbines.

LEAD THE CHARGE End users struggle with specific pain points around the scope of digital transformation and the obstacles inherent in the traditional technology stack. Traditional communication technologies will continue to be in demand for some time, of course, but by pairing MQTT with your existing offerings, you give your customers a way to evolve. As the industry continues to shift in response to the demand for more data, tools like MQTT give designers the opportunity to position themselves at the front of that transformation.

Author Bio: Josh Eastburn, Director of Technical Marketing After 12 years as an automation engineer working in the semiconductor, petrochemical, food and beverage, and life sciences industries, Josh Eastburn works with the engineers at Opto 22 to understand the needs of tomorrow’s customers. He is a contributing writer at blog.opto22.com.

References Opto 22, www.opto22.com All figures courtesy of Opto 22

4 • 2020

eeworldonline.com

|

designworldonline.com

IoT AND MANUFACTURING

Architectures that help implement the Industrial Internet of Things Among the models available to implement the Internet of Things, two standards bodies, the Industrial Internet Consortium and oneM2M, offer complementary architectural approaches.

Here’s a look at each, and how they work together.

STAFF REPORT

CO M M O N P O IN TS

Successfully implementing an Internet of Things solution requires expertise in a number of areas. Not all companies have such expertise so collaboration with members of an IoT ecosystem is often necessary. Two organizations, the oneM2M and the Industrial Internet Consortium (IIC), are collaborating to “drive global scale in standards development and avoid standards balkanization,” notes a recent paper from the IIC. The IIC has been working to help accelerate the adoption of the Industrial Internet of Things (IIoT). In 2018, the IIC joined with the OpenFog Consortium (OFC) to advance edge computing in IoT applications.

The IIC offers the IIRA standard as an architecture framework template and methodology for users to identify architectural concerns, concepts, and patterns. The IIRA standard consists of several perspectives, many of which work well with the oneM2M standard:

eeworldonline.com | designworldonline.com

• The business viewpoint is not commonly found in IIoT architectures, including oneM2M. IIoT designers who leverage the oneM2M common service layer may benefit from the analysis of business concerns as described in this viewpoint.

4 • 2020

DESIGN WORLD — EE NETWORK

43

INTERNET OF THINGS HANDBOOK

• The IIRA functional viewpoint describes domain and crosscutting functions for IIoT systems end-to-end. oneM2M defines functions common across industrial verticals.

It uses service abstraction within middle layer services to hide device layer complexity and bridge applications to devices.

• A number of synergies between IIRA and oneM2M show up in the implementation viewpoint. Users can follow the IIRA architecture patterns and use oneM2M common services to support those patterns.

• Functional components not covered by the common service layer can be part of the application layer components in oneM2M and developed for a specific IIoT system. oneM2M common services can be shared by different industrial verticals, enabling interoperability across these verticals.

From a system-usage analysis perspective, the IIRA usage viewpoint provides a way to analyze how the system is to be used to achieve its objectives.

O NEM2M oneM2M is a global standard defining a common service layer with a set of services required by IoT systems regardless of industry. These services help application developers focus on building, deploying and commercializing their IoT applications.

The oneM2M organization has 200 active members. One of its goals was to develop a common service layer with the IoT. This layer sits between applications, networks, and aids functions that are needed across different industry segments.

This common service layer functions as a layer between an application’s business logic and the communications network. It helps connect end-point devices and sensors. It also makes it easier for users of oneM2M specifications to integrate, design and manage stack technologies of multiple IoT applications within a company or in different industry verticals.

44

DESIGN WORLD — EE NETWORK

This service layer consists of a three-layer architecture that consists of applications, a common services layer (middleware), and networks. The interfaces between these layers have a standard format to enable a secure means for connecting data producers and data consumers. In particular, Machine-toMachine (M2M) and IoT applications will likely need a common service layer such as this.

This layer’s functions include device management, registration and security.

According to the IIC paper, the layer “horizontally joins the middle layers of several separate, heterogenous, vertical IoT solutions, to share common capabilities and ensure reusability and economies of scale.”

A key aspect of this horizontal architecture is enabling cross-silo interoperability. Thus, individual IoT solutions can share data and resources through common service layer functions. One result is that developers can easily share data between applications and reduce dependence on single-vendor products.

Both the oneM2M and IIC architectures use similar technologies. They connect to various communication systems such as the web and RESTful services, Data Distribution Service (DDS), OPC UA) and computational technologies, such as cloud computing, big data and machine learning. Thus, some of the specifications’ elements map to each other. But there are differences in focus and approach. Here’s a closer look.

4 • 2020

IIC’S IIR A The IIRA helps users rapidly install interoperable IIoT systems. It identifies and highlights important architectural concerns, concepts and patterns applicable within and across industrial sectors that might interfere with interoperability.

The IIRA suits system implementers, where it functions as a starting point to shorten system development. It makes use of reusable, commercially available, or opensource system building blocks. Many industrial sectors can take advantage of IIRA, including manufacturing, transportation, energy, agriculture, healthcare and others. IIRA helps reduce the cost of design and operations by giving users a common language.

This standard addresses communication architecture concerns with vocabulary, structures, patterns and a methodology. It adapts architectural concepts, constructs and approaches from the ISO/IEC/IEEE 420102011 Systems and Software Engineering— Architecture Description standard. A goal is to clarify how such a framework can help create the reference architecture, and then help create IIoT architectures.

According to the paper, architectural concerns are identified and classified into four viewpoints per the ISO/IEC/IEEE 420102011 Systems and Software Engineering— Architecture Description.

eeworldonline.com

|

designworldonline.com

IoT AND MANUFACTURING

These viewpoints are:

O NEM2M A R CHITE CTUR E

reuse for a second or third IoT application. The same logic applies to other service enablers necessary for the deployment and management of IoT applications. oneM2M addresses this by using a horizontal model based on a common services layer. This layer includes communications management, device management and security functions. It makes devices and their data discoverable and accessible to more than a single parent application. One benefit of this approach is that it doesn’t lock users with one vendor.

The common services layer is standard on oneM2M and includes specifications for end-device and gateway entities. Users can deploy native oneM2M systems, which comprise oneM2M compliant end-devices communicating with one or more oneM2M platforms.

Users can also choose systems that include a mix of oneM2M and proprietary devices. Such an approach may involve interworking proxy gateways to manage non-oneM2M devices communicating with a oneM2M platform.

Functionally, oneM2M defines fourteen common service functions (CSFs). These relate to network connectivity, device security, transport protocols, content serialization, IoT device services and management and IoT semantic ontologies.

Developers can use each service to focus on application-specific functions, such as turning a switch on or off. Abstraction techniques can be used to mask the underlying technology specific details, and allow the use of different communications stacks and protocols such as HTTP, CoAP and MQTT. For example, a switch might use a fixed or Wi-Fi network, a CoAP or HTTP transport. It might use a JSON or XML serialization technique, an Open Connectivity Foundation (OCF) or thread service, or an ontology based on Smart Appliances REFerence (SAREF) or W3C’s Thing Description. oneM2M offers security-related APIs to simplify security for devices and applications to secure IoT devices and prevent and mitigate attacks. This standard is constantly evolving to address new IoT requirements.

A common method of implementing IoT in applications is to use silos in a vertical solution stack. However, this method does not always scale well or handle resource reuse well.

In an IoT application, if a device management function is implemented for a narrowly defined use, this could easily prevent its

The IIRA organizes an IIoT system into functional domains and crosscutting functions. The functional domains focus on major system functions that support generic IIoT usages and IIoT system

• The business viewpoint identifies stakeholders and their business vision, value and objectives of an IIoT system. Business decision-makers, plant managers and IT managers can use this perspective to better understand and drive IIoT system development for business goals.

• The usage viewpoint describes how the IIoT system will deliver the intended business objectives.

• The functional viewpoint focuses on the functional components and structure to support the intended uses. It defines the domains most important to consider in an IIoT system and clarifies the relationship between them along with cross-cutting functions that must be available across many of the system components.

• The implementation viewpoint determines the technologies needed to implement functional components, their communication schemes and their lifecycle procedures.

The IIRA defines system characteristics as system properties and behaviors. It bases its definitions on an IIoT system’s constituent subsystems, their interactions, and the environment in which they operate.

For example, one system characteristic might be trustworthiness, which can include safety, security, privacy, reliability and resilience.

Other system characteristics examine how the IIRA functional domains work with other systems ranging from edge to cloud as IIoT architectures evolve.

Even though IIC and oneM2M take different approaches in dealing with IoT and IIoT challenges, they share a common objective of ensuring interoperability and reusability. The common goal is to reduce the complexity and costs of designing, developing, and deploying IoT systems.

eeworldonline.com | designworldonline.com

IIR A AN D O N E M 2 M — W O R K IN G TO G E TH E R

4 • 2020

DESIGN WORLD — EE NETWORK

45

capabilities. The crosscutting functions should be made available across many of the system functional components. oneM2M centers on the crosscutting design approach. It supports a software framework for linking IoT applications to value-added services relating to network connectivity, device security, transport protocols, content serialization, IoT device services and management and IoT semantic ontologies. With these services, application developers can focus on application-specific functions without worrying about the underlying technologies.

The oneM2M common service layer functions are: • Functions in the business, information and application domains, along with crosscutting functions, industrial analytics, and intelligent and resilient control. These are also available in the IIRA standard.

• The security functions considered in the IIRA System Characteristics corresponds to the security function in the oneM2M service layer.

• Functions in the operations domain and in the distributed data management in the crosscutting functions in the IIRA map to functions in the oneM2M common services layer. These are registration, discovery, device management in oneM2M common services layer.

46

DESIGN WORLD — EE NETWORK

• Functions belong to the IIRA distributed data management map to the oneM2M data management and repository.

• In the IIRA map, functions in the connectivity in the crosscutting function in both the common services layer and the devices (layer) correspond across the network spans in the oneM2M horizontal architecture. The IIRA connectivity functions directly map to semantics, communication management, network service exposure and transaction management.

• Functions in the control domain and the physical systems in the IIRA map to those belonging to things in the one M2M horizontal layer.

Other functions in the oneM2M services layer not mentioned may not be described directly in the IIRA or they belong to its lower layer functions.

A common IIRA architecture pattern often consists of elements arranged in three tiers—edge, platform and enterprise.

The edge tier includes an edge gateway communicating with three devices through a proximity network. Data and control pathways use a service network to link the platform and enterprise tiers.

An Application Entity (AE) is available for each connected sensor and data source.

AEs use a standard application service logic 4 • 2020

in individual devices, gateways and sensors to deliver a standard interface to manage and interact with applications.

In a distributed architecture, oneM2M’s common services layer resides in Common Services Entities (CSEs). CSEs control when communications occur, taking into account any time sensitivity for the data. Developers can embed CSE function in a gateway to place common services closer to the edge of an IoT installation. A complex IoT installation can involve several gateway CSEs interoperating with a cloud-based CSE. Finally, an AE is needed for the domain application in the enterprise tier. The AE will interact with edge devices and sensors.

AEs and CSEs offer a standard way for devices and sensors to function in a network-agnostic manner. They hide the complexity and heterogeneity of network usage from applications, which helps simplify implementation for application developers.

IN T E R W O RK I N G According to IIC, the introduction of machine-to-machine solutions into industrial IoT applications is progressing in three phases. Rather than a typical master/ slave architecture, users link multiple proximal networks through cloud-based data aggregation and supervisory control systems. As the IoT market matures, applications will use distributed architectures. As large-scale deployments eeworldonline.com

|

designworldonline.com

IoT AND MANUFACTURING

emerge, architectures will need new and standard enablers that interlink multiple sub-systems to peers and to central cloud systems.

Fundamental to successful implementations is the selection of a core connectivity standard to bridge applications and devices in an IIoT system. The IICF identifies potential standards for core connectivity with detailed assessment templates to evaluate connectivity technologies.

These templates will help developers choose a IIoT compatible core standard that fits the application.

A core connectivity standard requires standard mappings (i.e. bridges) to other core connectivity standards as referred in the IICF. Core gateways are the means used to implement these standard mappings. This approach limits the number of core connectivity standards, reducing complexity.

The gateway functions may be simple bridges converting data and protocols between connectivity core standards, or they may include more complex edge computing functions. Edge processors can perform analytics, data reduction, artificial intelligence, machine learning, security processing, storage and other functions. They convert between core connectivity standards and process the data that passes through the gateway functions.

The IICF recommends that system architects select a framework-layer standard for core connectivity. A framework-layer standard (e.g. DDS, OPC-UA, Web and RESTful Services) provides the ability to exchange data.

It standardizes the format of the communicated data and provides more data handling and communication management capabilities over lower-level transportlayer standards (e.g. MQTT, CoAP, HTTP). The IICF provides detailed assessments of several frameworkand transport-layer standards to help system architects choose the best connectivity technology for their needs.

The IICF addresses syntactic interoperability, but not the data or information model standards needed to address what the data means, or its context; for example, is a data reading about temperature or pressure? The IIC is working on information model guidance for future publication. oneM2M, however, addresses the need for standard information models and bridging or translating between different framework layer standards.

The goal of the standardization roadmap for oneM2M is to provide a protocol abstraction layer on top eeworldonline.com | designworldonline.com

of multiple connectivity technologies. It will complement and interwork various proximal industrial communication technologies (e.g. DDS, OPC-UA, WirelessHART, IWLAN) to the internet. This permits the use of established standards from the fixed-network, mobile-network and internet sectors (left-hand side of illustration) to be applied in support of applications from the industrial sector, smart homes and eHealth, for example. It maximizes the re-use of established industry standards.

In light of their respective organizational goals, the IIC and oneM2M will continue to foster the development of IoT and IIoT markets. Following the joining of forces between the IIC and OFC, the IIC will expand its effort to clarify distributed computing at and near the cyberphysical boundary of IIoT systems and continue to provide an ecosystem for the advancement of the IIoT.

The source for this information was a paper from the Industrial Internet Consortium and oneM2M.

4 • 2020

DESIGN WORLD — EE NETWORK

47

AD INDEX INTERNET OF THINGS HANDBOOK | APRIL 2020

Allied Electronics ........................................................BC

Master Bond ................................................................ 11

Beckhoff......................................................................IBC

Newark, An Avnet Company ......................................... 3

Coilcraft ....................................................................... 33

Sorbothane .................................................................. 27

Digi-Key ...........................................................Cover, IFC

Tadiran ......................................................................... 13

Keystone Electronics Corp. ........................................... 1

SALES

LEADERSHIP TEAM

Jami Brownlee jbrownlee@wtwhmedia.com 224.760.1055

Mike Francesconi mfrancesconi@wtwhmedia.com 630.488.9029

Mike Caruso mcaruso@wtwhmedia.com 469.855.7344

Neel Gleason ngleason@wtwhmedia.com 312.882.9867 @wtwh_ngleason

Bill Crowley bcrowley@wtwhmedia.com 610.420.2433

Jim Powers jpowers@wtwhmedia.com 312.925.7793

Jim Dempsey

@jpowers_media

jdempsey@wtwhmedia.com 216.387.1916 Michael Ference mference@wtwhmedia.com 408.769.1188

Courtney Nagle cseel@wtwhmedia.com 440.523.1685

Publisher Mike Emich memich@wtwhmedia.com 508.446.1823 @wtwh_memich Managing Director Scott McCafferty smccafferty@wtwhmedia.com 310.279.3844 @SMMcCafferty EVP Marshall Matheson mmatheson@wtwhmedia.com 805.895.3609 @mmatheson

2011 - 2019

2014 Winner

2014 - 2016

48

2013 - 2017

DESIGN WORLD — EE NETWORK

4 • 2020

W

OR

LD

@mrference

@DESIGN eeworldonline.com

|

designworldonline.com

Over 32,000 360º images online now Front-to-back and side-to-side – get to know your products before clicking “add to cart.”

Allied’s interactive, 360º images give you an extreme close-up of product features and functions for confidence that what you buy is exactly what will arrive at your doorstep.

It’s all in the details.

1.800.433.5700

© Allied Electronics, Inc. DBA Allied Electronics & Automation, 2020

APR20 Allied-360 Ad-9x10.875 (AW).indd 1

Explore 360º at

alliedelec.com/spin360

3/18/20 11:00 AM