1. Standards Certification Education & Training Publishing Conferences & Exhibits Peter L. Fuhr, Ph.D. Industrial Wireless Systems 17 OCT 06 Contact info: peter.fuhr@apprion.com

2. 2 Presenter Background Dr. Peter L. Fuhr, Chief Technology Officer, Apprion, Inc. 600+ publications/presentations Research sponsors: DoD, NSF, NASA, DHS, DOT/FHWA, –NIST, IBM, DuPont, Boeing, GEC Marconi, etc numerous companies Activities: Chair SP100 Interop, SP100 RFID/RTLS, WINA, etc. Recent Related Wireless/SCADA/DCS Presentations/Panels: Security Threats and Counter Measures in Process Industries with Wireless Sensor Networks, IFPAC, Washington, Feb 2006 Special Forum: Sensors & Wireless in Homeland Security - Implications for the Industrial Sector, ISA Expo, Houston, Oct 2004 Special Forum on Industrial Security: Is It Secure? Security Aspects of Hybrid Wireless and Wired Deployments in Industrial Settings, ISA Expo, Chicago, Oct 2005 Industrial Networking and Control Systems Security, ISA Auto West, Long Beach, May 2006 Next Gen Embedded Control Systems, an NSF/DHS/NSA workshop, Washington DC, March 2006 Industrial Wireless

3. 3 Industrial Facilities may have LOTS of Wireless This facility has: 802.15.4, 802.11, 802.16, RFID, 2.4 GHz video, walkie-talkies, etc … 4 sq. miles in size.

4. Standards Certification Education & Training Publishing Conferences & Exhibits Flavors of Wireless: WiFi + Cellular WiFi map, June 2005 Cellular Map, Feb 2006 Wireless devices circa 1930

5. 5 This is The Wireless Landscape - Lots of Choices

6. 6 Wireless - IEEE Numbers & Letters

7. 7 E(t) = A(t) cos[  t +  (t)] $ Just a few of the tech topics…

8. 8 Industrial Network Topology SP100 End User View Scalable Reliable Predictable Secure GW

9. 9 Industrial Network Topology SP100 End User View

10. 10 Demonstrated Integration & Coexistence with multiple Wireless Applications at the facility a real facility has a host of RF. does it all get along? “On the Process Side…”

11. Standards Certification Education & Training Publishing Conferences & Exhibits Plant Wide Network Architecture - Process Applications

12. 12 Federal View: DHS/INL Wireless Field Devices

13. 13 Industrial Network Topology Integration with the Infrastructure

14. Standards Certification Education & Training Publishing Conferences & Exhibits SP100 - The Standard for Industrial Wireless Plant Wide Network Architecture - Non- Process Applications

15. 15 Industrial Network Topology RFID in the Plant

16. 16 Industrial Network Topology The Plant’s Enterprise Network Infrastructure

17. 17 Industrial Network Topology Infrastructure Segments of the Plant’s Process Network

18. 18 Industrial Network Topology Enterprise and Process SP100 CI needs to define the firewall and data flow methods between the 2 Network segments

19. Standards Certification Education & Training Publishing Conferences & Exhibits Industrial Wireless - A few details such as frequency, etc

20. 20 Legal Frequencies The FCC assigned frequencies www.fcc.gov

21. 21 China, (Australia) ITU Europe Korea 825845870890915935 876921 824 849 869 894 806 IMT-2000 960 2025 1710 IMT-2000 Japan DL & UL is Switched! 810 915 860 885 830 960 Americas 824849869894 TDMA, GSM, MXM 1990 185019101930 PCS R-GSM 900 CDMA GSM 900 PDC? – or AMPS & IS-95? GSM 1800/IMT-2000 PDC 800 & others ** UL 1870 175017801840 Korean PCS 1880 171017851805 GSM 1800 1880 171017851805 870 925 cdmaOne ** * The re-auction of the C & F block licenses (1890-1910 & 1970-1990 MHz, 40MHz) started on 2000-12-12. A, B, C are 2 x 15MHz; D, E, F are 2 x 5MHz. ** In Japan, both PDC 800 & cdmaOne have UL at upper frequency band. 1920 PHS 915 1900 DECT 1980 1920 IMT-2000 2110 2200 21102170 UMTS FDD 2010 MSS 2200 MSS TDD MSS KDDI cdma2000 W-CDMA 1940 21102130 A D B E F C A D B E FC ** ** Combined DL/UL DL 843 832 898 887 833 845 888 900 1487-1491 1439-1443 “1.5G” 21102155/7017101755/70 3G/AWS/IMT-2000 IMT 1900 DECT 1980 1920 21102170 UMTS FDD 2010 TDD 1980 1920 21102170 UMTS FDD Wireless - Worldwide Cellular Frequencies

22. Standards Certification Education & Training Publishing Conferences & Exhibits Which Frequency is Best? Real World:

23. 23 RFID is in Industrial Facilities - It’s Frequencies 10 kHz100 kHz1 MHz 10 MHz 100 MHz 1 GHz 6.78 MHz 2.45 GHz 120,125,134 kHz 13.56 MHz 5.8 GHz 433 MHz 10 GHz 862-928 MHz 10 kHz 100 kHz 1 MHz 10 MHz 100 MHz 1000 MHz 300 GHz Low Freq. EAS Mid. Freq. EAS Cell Phone RFID:ItemManagement DataModem AM RadioToys GarageDoor CB FM RFID: Access Control Animal ID RFID: Toll Roads & Item Management MicrowaveEAS TV DataTerminal RFID: Smart Cards 2.45 GHz

24. 24 Low Data Rate Wireless Personal Area Networking. The 802.15.4 Frequency Bands BAND COVERAGE DATA RATE CHANNELS 2.4 GHz ISM Worldwide 250 kbps 16 915 MHz ISM Americas 40 kbps 10 868 MHz Europe 20 kbps 1 868MHz/ 915MHz PHY 2.4 GHz 868.3 MHz Channel 0 Channels 1-10 Channels 11-26 2.4835 GHz 928 MHz902 MHz 5 MHz 2 MHz 2.4 GHz PHY

25. 25 Modulation defines how the signal is manipulated to encode the data E(t) = A(t) cos[  t +  (t)] Its Just an Electromagnetic Field Amplitude Modulation (AM) info is in A(t) Frequency Modulation (FM) info is in  Phase Modulation (PM) info is in  (t)

26. 26 Direct-Sequence Spread-Spectrum Signals

27. 27 Review - We’ve just covered the Design of a Wireless Sensor Node Repeat after me: “Every bit transmitted brings me closer to death* *in a battery powered system

28. Standards Certification Education & Training Publishing Conferences & Exhibits Industrial Wireless - A few details this is not just old school RF IT is in the house (ok, the plant)

29. 29 Network Topologies – Most Common? Most Reliable Least Reliable Cheapest Oldest Wireless Friendly Lowest Latency Highest Latency

30. 30 Layered Communications (cont’d) Header, and additional other information, are added to the transmission packet.

31. 31 OSI Model

32. 32 More on the OSI Model

33. 33 All of this RF can lead to coexistence “issues” A Word on Congestion Management (what do you do when the Wireless Process Sensor Networks have Used up the available RF Spectrum?) hint: Currently vendors do Nothing. Can such congestion happen? RF Measurements taken at ISA Expo, Chicago, Oct 2005 900 MHz ISM 2400 MHz ISM (saturated) Noise floor Measurements by: Peter Fuhr, Apprion Hesh Kagan, Invensys Rob Conant, Dust Networks Wayne Manges, Oak Ridge National Lab Jose Gutierrez, Emerson Saturated Pssst: we’re conducting similar studies right here, right now

34. Standards Certification Education & Training Publishing Conferences & Exhibits Industrial Wireless - A few details quick compare of a few RF technologies

35. Data rate 10 kbits/sec 100 kbits/sec 1 Mbit/sec 10 Mbit/sec 100 Mbit/sec 0 GHz2 GHz1GHz3 GHz5 GHz4 GHz6 GHz 802.11a UWB ZigBee Bluetooth ZigBee 802.11b 802.11g 3G UWB

36. Range 1 m 10 m 100 m 1 km 10 km 0 GHz2 GHz1GHz3 GHz5 GHz4 GHz6 GHz 802.11a UWB ZigBee Bluetooth ZigBee 802.11b,g 3G UWB

37. Cost (projections) $.10 $1 $10 $100 $1000 0 GHz2 GHz1GHz3 GHz5 GHz4 GHz6 GHz 802.11a UWB ZigBee Bluetooth ZigBee 802.11b,g 3G

38. Infrastructure cost $.10 $1 $10 $100 $1000 0 GHz2 GHz1GHz3 GHz5 GHz4 GHz6 GHz 802.11a ZigBee Bluetooth 802.11b,g 3G UWB ZigBee

39. Industrial Wireless: A Network of Networks Coresident Wireless Systems

40. Standards Certification Education & Training Publishing Conferences & Exhibits Industrial Wireless Systems- * It’s much more than simply Wireless I/O * It’s much more than simply WiFi * It’s much more than simply wireless field transmitters. ** It IS an integrated wired+wireless community ** See the book, on shelves soon.

41. 41 Other Related Resources from ISA IC85C Overview of Wireless Technologies SP25 Wireless Sensor Networking For more information: www.isa.org/shopISA or (919) 549-8411