IoT

operational technology (OT): physical device controller
challenges:
- software update
- processing power
lossy networks (LLN)

Things

characteristics
- power: battery, plugged
- mobility: mobile, static
- reporting frequency
- data richness
- communication distance
- object density per cell
micro-electro-mechanical system (MEMS): scale of mm and less
smart object features
- processing unit
- sensors and/or actuators
- communication unit
- power source
wireless sensor network (WSN)
- limited processing power
- limited memory
- lossy communication
- limited BW
- limited power source
- communication pattern: event-driven, periodic

Sensor

characteristics
- energy input: active, passive
- part of environment: invasive and non-invasive
- whether contact is required for measurement: contact, no-contact
- measurement scale: absolute, relative
- area of application
- measured physical phenomenon
  - position
    - absolute: absolute position sensor
    - relative: displacement sensor
  - occupancy: generate signal even if person is stationary
  - motion: generate signal if person moves
  - velocity: linear, angular
  - accelaration
  - force
  - pressure: liquids and gases (force per unit area)
  - flow
    - mass flow: fluid volume
    - flow velocity: fluid rate in a period of time
  - acoustic
  - humidity
  - light
  - radiation
  - temperature
  - chemical
  - biosensors

Actuator

characteristics
- type of motion
- power output
- binary or continuous
- area of application
- energy type
  - mechanical
  - electrical
  - electromechanical
  - electromagnetic
  - hydraulic
  - pneumatic
  - smart material: ion exchange fluid, bimetallic, piezoelectric
  - micro- and nanoactuators

Fog computing

compute is close to sensors instead of being in cloud
features
- location awareness
- low latency
- geo distribution
- 3-4k nodes per gateway
- wireless communication between fog and endpoint
used for real-time

Mist computing

edge computing: comoute is performed on endpoints themselves

Regulations

regulated values
- frequency
  - sub-GHz industrial, scientific and medical (ISM)
    - 169 MHz
    - 433 MHz
    - 870-876 MHz
      - EMEAR
    - 779-787 MHz
      - LoRaWAN 1.0, IEEE 802.15.4g
      - China
    - 863-870 (868) MHz
      - IEEE 802.15.4(g), 802.11ah, LoRaWAN
      - EMEAR
    - 902-928 (915) MHz
      - North America, Brazil, Japan, Australia
- effective isotropic radiated power (EIRP): Tx power
- duty cycle (dwell time): percentage of time, when device is active in transmission
- channel bandwidth
- channel hopping

Architectures

core IoT functional stack
- applications and analytics
- communications network
  1. access network sublayer: LoRa, 802.11ah, ZigBee
  2. gateways and backhaul network sublayer
  3. network transport sublayer: IP, UDP
  4. IoT network sublayer: CoAP, MQTT
- sensors and actuators
IoT data management and compute stack
- cloud
- fog
- edge

oneM2M

layers
1. applications
2. services: communication protocols, network technologies
3. network: sensor communication

IoT World Forum (IoTWF)

layers
1. physical devices & controllers
2. connectivity
  - communication between layer 1 devices
  - reliable delivery
  - switching & routing
  - protocol translation
  - network-level security
3. edge computing
  - data aggregation and reduction
  - data reformat
  - filtering
4. data accumulation
  - convert event-based data to query-based data
  - data storage
5. data abstraction
  - format normalization
  - semantics verification from different sources
  - virtualizes data access
6. application
  - data interpretation
7. collaboration & processes
  - business processes

Purdue model for Control Hierarchy

levels
- level 0: process (things level)
- level 1: basic control (controllers)
- level 2: area control (HMI)
- level 3: site manufacturing operations and control (SCADA)
- level 4: site business planning and logistics network
- level 5: enterprise network

Industrial internet reference architecture (IIRA)

Industrial internet consortium (IIC)
described industrial internet systems (IIS)

Access protocols

routing
- mesh-under: L2 routing, usually proprietary
- mesh-over: L3 routing, usually RPL

IEEE 802.15.4

OSI L1 (PHY) + L2 (MAC)
- frequence sharing
- frame scheduling
- network beacons
- PAN (dis)association
- reliable link communication
frame types
- data
- beacon
- acknowledgement
- MAC command
frequency: 2.4 GHz, unlicensed sub-GHz
EUI-64 MAC addresses must be supported
- 16-bit addresses can also be assigned: local to PAN, might limit ULP choice
topology: unique PAN ID, same for all nodes in PAN
1. star
2. P2P
3. mesh
roles
- coordinator: central point, master
  - usually full-function device (FFD)
  - FFD can communicate directly to other FFD and devices (clustered star topology)
  - network beaconing
- sensor: master
  - usually reduced-function device (RFD): implements subset of the protocol
  - RFD cannot communicate directly to other sensor, only to coordinator
classes of constrained nodes (RFC 7228)
- class 0:
  - < 10 KB RAM
  - < 100 KB storage
  - battery-powered
  - cannot implement full IP stack
  - example: push button
  - suited for LPWA
- class 1:
  - ≈ 10 KB RAM
  - ≈ 100 KB storage
  - cannot implement full IP stack
  - can implement optimized stack (e.g., CoAP) ≡ do not require gateway
  - example: envoronmental sensors
- class 2:
  - > 50 KB RAM
  - > 250 KB storage
  - can implement IP stack
  - example: smart power meter
MTU = 127 bytes
AES-128 + HMAC
CSMA/CA ⇒ unbound latency and unreliability
no frequency hopping technique ⇒ susceptible to interference and multipath fading
transmission options
1. 2.4 GHz, 16 channels, 250 kbps
2. 915 MHz, 10 channels, 40 kbps
3. 868 MHz, 1 channel, 20 kbps
DSSS modulation
- offset QPSK: phase shift
- BPSK: phase shift
- amplitude shift keying (ASK) + parallel sequence spread spectrum (PSSS)
802.15.4g
- MTU = 2047 bytes
- focus on outdoor mesh for field area networks (FAN)
  - powered nodes
- modulation
  - multi-rate and multi-regional frequency shift keying (MR-FSK)
    - constant envelope of transmit signal
    - good Tx power efficiency
    - up to 200 kbps
  - multi-rate and multi-regional orthogonal frequency division multiplexing (MR-OFDM)
    - high data rate
    - complex for low-power and low-cost devices
    - up to 800 kbps
  - multi-rate and multi-regional offset quadrature phase shift keying (MR-O-QPSK)
802.15.4e
- time-slotted channel hopping (TSCH)
  - frequency hopping
  - timeslot: for single packet + ack transmission
  - timeslots are repeated for guaranteed access
  - time division multiple access (TDMA)
- information elements (IE)
  - header IE: standard
  - payload IE: private
  - TLV format
- enhanced beacons (EB): IE in beacon frames, limited to IE from EBR
- enhanced beacon requests (EBR): IE specify requested info
- enhanced acknowledgement: frame counter for acknowledged frame

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                |    Preamble   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Preamble                   |      SOF      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Frame length  |         Frame control         | Sequence num  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Dst PAN ID   |      Destination address (variable length)    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Src PAN ID   |        Source address (variable length)       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/             Auxiliary Security header (0-14 bytes)            /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                      Information elements                     /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                             Payload                           /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|              CRC              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Preamble: 4 bytes, synchronization
Frame length:

802.15.4: bytes, after frame length
802.15.4g: 2-byte field, bytes, after frame length

Frame control:

0xe000: frame type
0x1000: security enabled
- 1 ≡ Auxiliary Security header is included
0x0800: frame pending
0x0400: ACK request
0x0200: PAN ID compression
0x01c0: reserved
0x0030: destination addressing mode
0x000c: frame version
0x0003: source addressing mode

CRC:

802.15.4: 2 bytes
802.15.4g: 4 bytes

ZigBee

own stack on top of IEEE 802.15.4
- network layer
  - routing (AODV)
  - neighbour discovery
  - forming appropriate topology: mesh, tree, star
- security layer
industrial
low power, datarate, latency
2.4 GHz
10-100 m
20-250 Kbps
cluster
- sets of commands and message type
- building blocks of application profile: ensure interoperability
  - building automation
  - home automation
  - healthcare
  - smart emergy
object functions
- device role
- device discovery
- network join
- security
ad-hoc on-demand distance vector (AODV)
- mesh network
- message is sent as soon as route is needed: bcast for route
- bursts of routing traffic
- metric – hop count

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+
|      Application profile    |  | ZigBee or vendor specific
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+
|      Application support    |  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  | ZigBee platform stack
|  Network and Security layer |  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+
|          MAC layer          |  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  | IEEE 802.15.4
|          PHY layer          |  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+

ZigBee IP

6LoWPAN + RPL
defines only top of stack: application profiles
- smart energy profile 2.0
6LoWPAN adaptation layer
- mesh addressing header not included
- required: fragmentation, header compression
- describes IP packaging into L1 and L2 (e.g., into Ethernet)
6LoWPAN Neighbour discovery in lieu of IPv6 NDP

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             ZigBee IP           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       UDP       |       TCP     | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IPv6, ICMPv6, 6LoWPAN-ND  | RPL | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     6LoWPAN adaptation layer    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             MAC layer           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             PHY layer           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

6LoWPAN

IPv6 over IEEE 802.15.4
header compression

ISA100.11a

6LoWPAN + UDP
predictable latency
DSSS
TDMA
2.4 GHz

WirelessHART

mesh
- time-synchronized
- self-organizing
- self-healing
DSSS
TDMA
2.4 GHz
predictable latency

Thread

6LoWPAN
mesh network

DASH7

industrial communications
usually for RFID
AES
1.5 km
frequencies: 433 MHz, 868 MHz, 915 MHz
166 kbps
MTU = 256 bytes

Narrowband power line communications (NB-PLC)

IEEE 1901.2a
over power lines, AC and DC
up to 500 kbps
frequency: 5-500 kHz
- CENELEC: Europe
  - Comité Européen de Normalisation Élecrotechnique
  - bands
    - A: 35.937-90.625 kHz
    - B: 98.430-121.875 kHz
    - C: 125.000-140.000 kHz
    - D: 140.000-148.500 kHz
- ARIB: Japan
  - Association of Radio Industries and Businesses
  - bands
    - 1: 37.500-117.180 kHz
    - 2: 154.687-403.125 kHz
- FCC: US
  - Federal Communications Commission
  - bands
    - FCC-Low: 37.500-117.180 kHz
    - FCC-Above-CENELEC: 154.687-487.500 kHz
OFDM
supports frame fragmentation
- encryption before fragmentation (Segment Control not included)
- decryption after reassembly
- HMAC only in last fragment
modulation
- robust modulation (ROBO)
  - transmit redundant info over multiple carriers: 4 (Super-ROBO: 8)
  - QPSK modulation
- DBPSK
- DQPSK
- D8PSK
- 16QAM
topology: mesh
security
- AES-128 + HMAC
- 802.15.9 Key management protocol

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                |  Rsvd |T|C|P|L| Sgmt count|   Segment length  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                         802.15.4 frame                        /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

T: tone map request (TMR)
C: contention control (CC), 0 ≡ allowed, 1 ≡ contention-free access
P: channel access priority (CAP), 0 ≡ normal, 1 ≡ high
L: last segment flag (LSF)
Segment length: bytes

G3-PLC

ITU G.9903
incompatible with 802.15.4g/e, IPv6

PRIME

ITU G.9904
ATM-like: L7 protocol runs over L2 ≡ no L3 protocol

Wi-Fi HaLow

IEEE 802.11ah
bands
- 868.0-868.6 MHz: EMEAR
- 902.0-928.0 MHz: NA, APJ
- 314.0-316.0 MHz: China
- 430.0-434.0 MHz: China
- 470.0-510.0 MHz: China
- 779.0-787.0 MHz: China
OFDM
channels: 1/10 width of IEEE 802.11ac + 1MHz for low BW Tx
100 kbps at 1 km
1.5 km (multipoint), 10 km (P2P)
MAC layer
- 8192 devices per AP
- shortened MAC header
- null data packet (NDP) support: info in PHY header
- grouping and sectorization: antenna array + beamforming
- restricted access window (RAW)
- target wake time (TWT)
topology: mesh, star
- 2 hops are assumed
- client acts as relay, not AP
- transmit rate reduces with extra hops from AP ≡ transmission speed hierarchy ⇒ congestion avoidance

Digital enhanced cordless telecommunications (DECT)

operates in licensed spectrum (1.9 GHz) with no royalties applied

DECT Ultra low energy (DECT ULE)

DECT spectrum ⇒ does not require service provider
IoT communication

LoRaWAN

long ranged WAN
Semtech chipsets
chirp spread spectrum (CSS) modulation
- resistant to Doppler effect
- frequency changes in time within timelot: up-chirp and down-chirp
bands
- 433 MHz
- 779-787 MHz
- 863-870 MHz
- 902-928 MHz
  - 915-928 MHz: Australia
  - 920-923 MHz: South Korea
  - 920-928 MHz: Japan
device classes
- A: default
  - battery-powered nodes
  - bidir communication: 2×Rx after 1×Tx
- B: experimental
  - additional receive windows
  - gateways sync using beacons
- C
  - powered nodes
  - continuously listen: receive windows always open when not transmitting
MTU: depends on frequency band and data rate (19-250 bytes)
unicast only
- uplink messages can be relayed by multiple LoRaWAN gateways
- downlink messages relayed by single LoRaWAN gateway
addresses
- device EUI-64 (DevEUI)
- application EUI-64 (AppEUI)
- device address (DevAddr): network ID (NwkID, 7 bit) + netword address (NwkAddr)
AES-128
join mechanism:
- activation by personalization (ABP): static, preconfigured on node
- over-the-air activation (OTAA): dynamic, register + exchange keys
roaming
geolocation
adaptive data rate
topology: star

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                |  MAC header   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                            Payload                            /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Message integrity code                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Sigfox

bands:
- 433 MHz
- 868 MHz
- 902-928 MHz
ultra-narrowband modulation
up to 600 bps
MTU: 12 bytes
star topology

Ingenu Inramp

band: 2.4 GHz
DSSS
star, tree topologies
up to 6 kbps
MTU: up to 10 KB
roaming

Bluetooth

radio classes
- class 1: range up to 1m
- class 2: range up to 10m
- class 3: range up to 100m

Bluetooth low energy (BLE)

2.4 GHz
50-150 m
1 Mbps

Bluetooth Smart

FHSS
AES

Near Field Communication (NFC)

Radio Frequency ID (RFID)

does not need power source

Wireless Networks for Industrial Automation – Process Automation (WIA-PA)

Master Slave/Token Passing (MS/TP)

Z-Wave

BUM
master + slave

WiMAX

IEEE 802.16
up to 50 km
up to 70 Mbps
2.5 GHz
10 MHz channel
fixed WiMAX (802.16d): backhaul implementation
licensed (high BW) and unlicensed (low BW) bands

Cellular

licensed bands

LTE Cat 0

UE category
1 Mbps
power saving mode (PSM): ≈ powered-off mode
- device remains registered in network while idle
- idle time negotiated
- after waking, device sends tracking area update (TAU): let network know its current area
half-duplex mode

LTE-M

lower receiver BW: 1.4 MHz instead of 20 MHz
lower data rate: 200 kbps
half-duplex mode
enhanced discontinuous reception (eDRX): node can sleep minutes between paging cycles

Narrowband IoT (NB-IoT)

OFDMA downlink: up to 30 kbps
OFDMA, FDD uplink: up to 60 kbps
modes:
- standalone: GSM carrier (900 MHz, 1800 MHz)
- in-band: part of LTE band
- guard band: between LTE/WCDMA bands
200 kHz wide channel
half-duplex
164 dB link budget
topology: star

Dedicated short-range communication (DSRC)

5.9 GHz, 75 MHz wide
10 MHz channels
half-duplex
6-27 Mbps
300-1000 m range
onboard unit (OBU)
roadside unit (RSU)
channels
- 172:
  - vehicle-to-vehicle safety
  - broadcast core state information at 100 ms interval
  - each vehicle can build neighbour’s trajectory and avoid collision (e.g., emergency brake)
- 174
- 176
- 178:
  - RSUs announce to OBUs supported applications and their channels at 100ms interval
  - OBU authC RSU signature
- 180
- 182
- 184:
  - emergency services warn vehicles about their approach
  - emergency services enable green light in advance

Wireless Access in Vehicular Environments (WAVE)

IEEE 802.11p
half-duplex
allows communication without prior association

Network transport sublayer

IPv6

models
- adaptation: gateway/proxy translates between protocols
- adoption: full IP stack on endpoint

IPv6 over low-power wireless personal area networks (6LoWPAN)

IEEE 802.15.4
headers
- sequence
  1. mesh addressing
    - single IP subnet
    - mesh-under routing
  2. fragmentation
  3. IPv6 header compression
    - stateless
    - UDP-only
- headers are stacked on top of each other
IPv6 only, no IPv4 support

Mesh addressing header

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                                +-+-+-+-+-+-+-+-+
                                                |1|0|V|F|  TTL  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                       Originator address                      /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                          Final address                        /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

V: originator address format

0: EUI-64 address
1: 16-bit address

F: final address format

0: EUI-64 address
1: 16-bit address

TTL: 0xF ≡ 8-bit Deep Hops Left follows immediately

Fragmentation header

                     1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|1|1|F|0|0|    Datagram size    |         Datagram tag          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Datagram offset|
+-+-+-+-+-+-+-+-+

F: 0 ≡ first fragment, 1 ≡ not first fragment
Size: entire IP packet before fragmentation
Tag: ID for the fragments
Offset: included in all fragments, except the 1st

6Lo

evolution of 6LoWPAN: include extra L1+L2 technologies
- BLE
- NFC
- Wi-Fi HaLow
- DECT ULE
- WIA-PA
- MS/TP
SNMP MIB
generic header compression (6LoWPAN-GHC)

6TiSCH

IPv6 over TSCH of 802.15.4e
6top: layer between 6LoWPAN and TSCH
schedule management
1. static scheduling
  - packet can be expected in any timeslot ≡ energy wasted on listening
2. neighbour-to-neighbour
  - based on observed number of node-to-node transmissions
  - timeslots can be added and deleted
3. remote monitoring and scheduling management
  - timeslots are allocated by management entity (can be several hops away)
  - CoAP
4. hop-by-hop scheduling
  - path reservation
  - no protocol defined yet
forwarding models
- track forwarding (TF)
  - receive timeslots are bundled with transmit timeslots
  - forwarding regardless of L3 protocol
- fragment forwarding (FF)
  - first fragment is routed-over
  - subsequent fragments follow 1st fragment next-hop
- IPv6 forwarding (6F)
  - hop-by-hop reassembly ≡ latency and CPU utilization increase
  - QoS, RED

IPv6 Routing Protocol for Low Power and Lossy Networks (RPL)

RFC 6550
constrained node mode
- storing: all nodes have full routing table of RPL domain
- non-storing:
  - only border routers have full routing table
  - other nodes have list of parents ≡ default routes (up to 3)
builds destination-oriented directed acyclic graph (DODAG)
- root = destination ≡ border router
- DAG information object (DIO):
  - determine parent and their best path to DODAG
  - builds uplink routes
- destination advertisement object (DAO)
  - announces parent set towards DODAG root
  - informs parents about node presence and reachability to descendants
  - builds downlink routes
- only single path, no ECMP
objective function (OF): calculate metric and node rank
- rank: distance to DODAG root
  - can be increased by receiving DIO with larger version
  - can be decreased when lower-cost route appears
- metrics and constraints
  - expected transmission count (ETX): transmissions to deliver packet
  - hop count
  - latency
  - link quality level
  - link colour
  - node state: high CPU, low memory are avoided
  - node attribute: aggregators are preferred
  - node energy: avoid low powered nodes for transit
  - throughput
  - RSSI
RPL option in IPv6 Hop-by-Hop header: data plane loop detection
source routing header (SRH): forwarding in mesh

Mapping of address and port using translation (MAP-T)

RFC 7599
NAT44 + NAT64
- NAT44 is required to allow sharing public IPv4 address
  - CE is assigned translated port range
  - border router determines CE based on IPv4 + port range (A+P algorithm)
- NAT64 enables IPv6 support
- IPv4-only nodes over IPv6-only IoT network (e.g., LoRaWAN)
less overhead compared to tunnelling

Ethernet Ring Protection Switching (ERPS)

Resilient Ethernet Protocol (REP)

Cisco proprietary
avoids L2 loops in Ethernet
50 ms convergence on fiber
master node: controls the ring
- control VLAN for REP messages
- segment ID identifies REP ring
alternate port: blocked port in ring
- should be defined explicitly to make selection deterministic
loss of signal (LOS) detection:
- when failure is detected, switch sends notification to all REP switches ≡ notify alternate port
- when notification is received – flush CAM

ITU-T G.8032

ring topology
max nodes: 250 (16 recommended)
50 ms convergence

Media Redundancy Protocol (MRP)

IEC 62439-2
roles
- media redundancy manager (MRM)
  - sends control packets over one port to receive them on other ring port
  - if test packets are received, MRM keeps one of its ports blocked
- media redundancy clients (MRC)
up to 50 nodes
30-500 ms convergence

Parallel Redundancy Protocol (PRP)

IEC 62439-3-4
sends redundant Ethernet copies over parallel VLAN segments
- PRP switch drops redundant copy
- intermediate switches do not have to support PRP
supports any topology
endpoints can be PRP-capable or attach to PRP switch

High-availability Seamless Redundancy (HSR)

IEC 62439-3-5
ring-only topology
endpoint is single-attached
HSR switch sends duplicate copies over the same VLAN in opposite directions
intermediate switches must support HSR

Device level ring (DLR)

50 nodes max
3 ms convergence

IoT network sublayer

MQTT

message queue telemetry transport
publisher-subscriber, many-to-many
TCP (1883), TLS (8883), WebSocket
message types
- connect
- disconnect
- publish
topic name
- #: whole subtree
- +: one topic level
- $: exclude from wildcard (# or +) match
QoS
- levels
  - 0: best-effort, unacknowledged, at most once
  - 1: acknowledged, prone to duplication, at least once
  - 2: acknowledged, strictly single copy, exactly once
- QoS level is set per session to broker, might differ between published-broker and subscriber-broker

   0     1     2     3     4     5     6     7
+-----+-----+-----+-----+-----+-----+-----+-----+
|     Message type      | DUP |    QoS    |RETAI|
+-----+-----+-----+-----+-----+-----+-----+-----+
|                Remaining length               |
+-----+-----+-----+-----+-----+-----+-----+-----+
\                                               \
/                Variable header                /
\                                               \
+-----+-----+-----+-----+-----+-----+-----+-----+
\                                               \
/                    Payload                    /
\                                               \
+-----+-----+-----+-----+-----+-----+-----+-----+

Message type

1: CONNECT
2: CONNACK
3: PUBLISH
4: PUBACK
5: PUBREC, publish received
6: PUBREL, publish release
7: PUBCOMP, publish complete
8: SUBSCRIBE
9: SUBACK
10: UNSUBSCRIBE
11: UNSUBACK
12: PINREQ
13: PINGRESP
14: DISCONNECT

DUP: 1 ≡ packet re-delivery
QoS: level
RETAIN:

1 ≡ store message, replace existing one
allow new subscribers get last known value without waiting for next update

Remaining length: bytes left after this field

CoAP

constrained application protocol
wireless
UDP (5683), DTLS (5684)
subset of HTTP, request/response, one-to-one
observation: streaming of state changes (no need for receiver to query)
security modes
- NoSec: mandatory support
- PreSharedKey
- RawPublicKey: mandatory support
- Certificate
implements own fragmentation (does not use IPv4 fragmentation)
DF bit always set
congestion control
- default timeout
- retransmission with exponential back-off
- duplicate message detection through message ID
/.well-known/core – CoAP servers resource listing
caching

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Ver| T |  TKL  |      Code     |          Message ID           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                             Token                             /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\                                                               \
/                            Options                            /
\                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      0xFF     |           Payload (variable length)           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

T: type

00: confirmable
01: non-confirmable
10: acknowledgement
11: reset

TKL: token length, bytes (0-8; 9-15 are reserved)
Code: 3 bit class + 5 bit detail

0: request
- 0: empty message
- 1: GET
- 2: POST
- 3: PUT
- 4: DELETE
2: success response
- 1: created
- 2: deleted
- 3: valid
- 4: changed
- 5: content
4: client error response
- 0: bad request
- 1: unauthorized
- 2: bad option
- 3: forbidden
- 4: not found
- 5: method not allowed
- 6: not acceptable
- 12: precondition failed
- 13: request entity too large
- 15: unsupported content-format
5: server error response
- 0: internal erver error
- 1: not implemented
- 2: bad gateway
- 3: service unavailable
- 4: gateway timeout
- 5: proxying not supported

Message ID: duplication detection, match ACK and RST to CON and NONCONN
Token: correlate request and response
Options: TLV
Payload: if empty, 0xFF not included

DDS

data distribution service
realtime

AMQP

advanced message queuing protocol

XMPP

extensible message and presence protocol
XML
TCP

Application layer

Supervisory Control and Data Acquisition (SCADA)

serial bus: RS-232, RS-485, DB9

Modbus

up to 247 nodes on link
115Kbps
modes
- ASCII
- RTU (remote terminal unit)
Modbus TCP:
- IPv4 only
- TCP 502

DNP3

distributed network protocol 3
water, electric stations
ICCP (inter-control center communications protocol): inter-master stations communication
master/outstations (≡ slave)
IEEE 1815: DNP3/IP
- IPv4 only
- TCP 20000
- dual endpoint: both listens and opens connections
- IP/serial redirector: server software, mapping serial COM to IP port (raw socket connection)
- protocol translation: instead of raw sockets, fog computing on IoT gateways

IEC

60870-5-104

IPv4 only
TCP/UDP 2404

Manufacturing Message Specification (MMS)

IEC 61850-8.1
client-server
over IP
power measurement, tripping and interlocking circuits
clear-text authC
end-to-end latency < 10 ms
jitter < 500 µs

Generic Object Oriented Substation Event (GOOSE)

IEC 61850-8.1
publisher-subscriber
mcast over Ethernet
no authC
end-to-end latency < 10 ms
jitter < 500 µs

Sampled Values (SV)

IEC 61850-9-2
publisher-subscriber
mcast over Ethernet
voltage and current samples
no authC
end-to-end latency < 10 ms
jitter < 500 µs

DLMS User Association

TCP/UDP 4059

PROFINET

process field net
Ethertype = 0x8892
motion and precision control
modes
- not realtime (NRT): 100ms UDP
- real time (RT): 1-10ms Ethernet
- isochronous real time (IRT): 1ms, special HW
uses MRP