EMPOWERINGINTERNETOFTHINGSWITHTHEEMERGINGWIRELESS
INFRASTRUCTURESANDTECHNOLOGIES
By
DeliangYang
ADISSERTATION
Submittedto
MichiganStateUniversity
inpartialful˝llmentoftherequirements
forthedegreeof
ElectricalEngineeringDoctorofPhilosophy
2021
ABSTRACT
EMPOWERINGINTERNETOFTHINGSWITHTHEEMERGINGWIRELESS
INFRASTRUCTURESANDTECHNOLOGIES
By
DeliangYang
Wirelesstechnologieshavebeenevolvedrapidly,whoseinfrastructuresarebuiltandde-
liveredspeedily.Theemergingwirelesstechnologieso˙ernewsolutionsfordatacommu-
nication,monitoring,sensing,andedgecomputing,etc.Thefastgrowthofwirelessnet-
worksgeneratesnotonlyopportunitiesfornewapplications,butalsoissuesinhighenergy
consumption,unexpectedlatency,andpotentialprivacybreach.Inthisdissertation,we
proposetwonovelcyber-physicalsystemstodemonstratethepossibilityofempowering
newIoTservicesandapplicationsbyleveragingtheemergingwirelesscharginginfras-
tructuresandbenchmarkingtheenergyperformanceofendnodesinlow-powerwireless
networks,respectively.
First,wepresentQID,the˝rstsystemthatidenti˝esaQi-compliantdeviceduring
wirelesscharginginreal-timeusingwirelesscharging˝ngerprints.QIDemploysa2-
dimensionalmotionunittoemulateavarietyofmulti-coildesignsofQi,whichallowsfor
˝ne-graineddevice˝ngerprinting.Withthenovelmobilecoildesignandasetofnovel
˝ngerprintsfromoscillatorandcontrollerpatterns,QIDachieveshighdevicerecognition
accuracybyusingensembledMachineLearningalgorithms.Withtheprevalenceofpublic
wirelesschargingstations,ourresultsalsohaveimportantimplicationsformobileuser
privacy.
Second,wedevelopanovelbenchmarkingecosystem,called
NB-Scope
,tostudythe
energyperformanceoftheNarrowbandInternetofThings(NB-IoT)network.NB-Scope
adoptsahierarchicaldesign,resolvingtheheterogeneityinnetworkoperators,nodemod-
ulevendors,andlocationpro˝les,toallowforthefusionof˝ne-graineddiagnostictraces
andcurrentmeasurement.Wethenconductalarge-scale˝eldmeasurementstudycon-
sistingof30nodesdeployedatover1,200locationsin3regionsforthreemonths.Our
in-depthanalysisofthecollected49GBtracesshowedthatNB-IoTnodesyieldsigni˝-
cantlyimbalancedenergyconsumptioninthewild,uptoaratioof75:1,whichmaylead
toshortbatterylifetimeandfrequentnetworkpartition.Byextensivedataanalysis,we
identifyseveralkeyfactors,includingdiversenetworkcoveragelevels,long-tailpower
pro˝le,andexcessivecontrolmessagerepetitions,thatleadtohighvarianceintheenergy
performance.
Copyrightby
DELIANGYANG
2021
Thisdissertationisdedicatedtomyfamilyandfriends.
v
ACKNOWLEDGEMENTS
Therewouldbenopossibilityformeto˝nishtheworkpresentedinthisthesiswithoutthe
guidancefrommydissertationguidancecommittee,thehelpfrommycolleagues,aswell
asthesupportfrommyfamilymembers.Iowemysinceregratitudetoallthesepeople
whomakethisthesispossible.
Firstandforemost,Iwouldliketoexpressmydeepestgratitudetomyadvisor,Dr.
GuoliangXing,forhisguidanceandgeneroussupportthroughoutmyentiredoctoral
study.Heguidedmetobuildupmyresearchvisionandcapability.Hehasalwaysbeen
myrolemodelinconductinghigh-standardresearch.Iwouldnotbeanindependentand
enthusiasticresearcherwithouthisguidance.Thisrewardingexperiencewillbene˝tmy
entirelife.
Besidesmyadvisor,Iwouldliketothanktherestofmyguidancecommitteemembers:
Dr.RichardEnbody,Dr.JianRen,andDr.MiZhang,fortheirstrongencouragement,
criticalcomments,andhelpfulsuggestions.Inparticular,Dr.Renprovidedmeimportant
suggestionsonmyearly-stageprojects.Ialsodiscussedmanyimportantresearchtopics
withDr.Enbodyinthemiddleofmyprogram.Dr.Zhanggavemeimportantfeedback
onmyresearchprojectsandsuggestionsonmycareerpaths.
SpecialthankstoDr.XiaoboTan,whoprovidedmemuchhelpandsuggestionsduring
theshorttransitionperiodbetweenmyresearchprojects.
Isincerelythankmyfellowlab-matesintheeLANSlab:Dr.RuoguZhou,Dr.Dennis
Philips,Dr.MohammadMoazzami,Dr.JinzhuChen,Dr.YuWang,Dr.TianHao,Dr.
ChenQiu,Dr.JunHuang,Dr.ChongguangBi,andLinlinTu.Particularly,Iwouldlike
tothankDr.Zhouforhistremendoussupportatmyearlystageofresearch.Icannotex-
presshowmuchIhavelearnedfromhim.Tome,heisasincerefriend,anenthusiastic
collaborator,andaninspiringmentor.IalsothankDr.Huang,forhisprofessionalcom-
mentsthatsteeredmeintherightpaperdirection.Healsoinspiredmewithawiderange
vi
ofpossibledirectionsduringtheexplorationstageofmyresearchprojects.Iwouldnot
forgetthetimethatIspentwithRuoguandChongguangbothinsideandoutsidethelab,
whichwasawonderfulmemoryduringmyPh.D.study.
Toallmyfriends,thankyouallsomuchforalwaysstandingbymeanddelightingmy
journey.IwishIcouldnameyouall.Iwishyouthebestofluckwhereveryouare.
Particularly,Iwouldliketosincerelythankmyparents,whoseunconditionallove,sac-
ri˝ce,andencouragementaccompanymesincethebeginningofmylife.
Specialthankstomysoul-mate,MengyingSun.Westandtogether,exploretheworld
together.Wecelebratethegoodtimes,encourageeachotherinthebadtimes,andblueprint
thefuture.Ifoundanothermeaningoflifethroughthepast˝veyearswespenttogether.
Finally,Ithankmytwolittlecats,HuitaandTaijifortheircompanionallalongwithmy
study.
vii
TABLEOFCONTENTS
LISTOFTABLES
.......................................
xi
LISTOFFIGURES
.......................................
xii
CHAPTER1INTRODUCTION
..............................
1
1.1DeviceRecognitionUsingNewWirelessInfrastructures............1
1.2PerformanceEvaluationofNewLPWANTechnology.............2
1.3Contribution.....................................4
1.4ThesisOrganization.................................5
CHAPTER2RELATEDWORK
..............................
6
2.1DeviceFingerprinting,Localization,andWirelessChargingInfrastructure.6
2.2WirelessInfrastructureBenchmarkandDiagnostics..............9
CHAPTER3IDENTIFYINGMOBILEDEVICESVIAWIRELESSCHARGING
FINGERPRINTS
...............................
11
3.1Background.....................................11
3.2DesignChallengesandSystemOverview....................14
3.2.1DesignChallenges.............................14
3.2.2SystemOverview..............................15
3.3FeatureSelectionandAcquisition.........................19
3.3.1SelectingHardwareFingerprints.....................19
3.3.2TemporalFeatureAcquisition.......................22
3.4QIDMotionControl.................................23
3.4.1MotionPlatformDesign..........................23
3.4.2QIDSensorMotionControl........................24
3.4.2.1Contactareaboundarydetection................24
3.4.2.2PRxsymmetricaxisalignment.................25
3.4.2.3Fingerprintingtrajectoryplanning...............26
3.5FeatureExtractionandDeviceClassi˝cation...................27
3.5.1FeatureExtraction..............................27
3.5.1.1CEPintervalfeatures.......................28
3.5.1.2CEPvaluefeatures........................29
3.5.2Classi˝cation................................31
3.6Implementation...................................33
3.7Evaluation......................................35
3.7.1EvaluationSettings.............................35
3.7.2MeasurementDelay............................36
3.7.3Classi˝cationAccuracy...........................38
3.7.4ImpactofFeatureSelection........................40
3.7.5RecognitionAccuracyBreakdown....................42
viii
3.8ConclusionandDiscussion.............................43
CHAPTER4UNDERSTANDINGPOWERCONSUMPTIONOFNB-IOTINTHE
WILD:TOOLANDLARGE-SCALEMEASUREMENT
........
46
4.1ChapterIntroduction................................46
4.2NB-IoTPrimer....................................48
4.2.1FeaturesofNB-IoTTechnology......................48
4.2.2FramesandChannels............................49
4.2.3RandomAccessProcedure.........................50
4.2.4EnergyManagement............................53
4.3NB-ScopeDesign..................................54
4.3.1SystemOverview..............................54
4.3.2NB-ScopeHardwareDesign........................56
4.3.3NB-ScopeSoftwareDesign.........................58
4.4NB-IoTMeasurementStudy............................61
4.4.1FieldMeasurementMethodology.....................62
4.4.2MeasurementResultAnalysis.......................64
4.4.2.1Powerconsumptionw.r.tlocationpro˝les...........65
4.4.2.2Powerconsumptionw.r.tnetworkoperators.........66
4.4.2.3ComparisonofNB-IoTmodules................68
4.4.2.4Temporalvariationofpowerconsumption..........70
4.4.2.5Powerconsumptionv.s.distancetoeNodeB.........71
4.4.2.6Measurementsummary.....................72
4.4.3TheImpactofECL.............................72
4.4.4EnergyConsumptionBreakdown.....................76
4.4.5ImpactoftheInactivityPeriod......................80
4.4.6RepetitionofRandomAccessMSGs...................81
4.4.7UEBatteryLifeEstimation.........................83
4.5Conclusion......................................84
CHAPTER5NB-IOTNETWORKENERGYOPTIMIZATIONANDBEYOND
...
86
5.1Introduction.....................................86
5.2Methodology.....................................87
5.2.1InactivityTimerOptimizationEvaluation................89
5.2.2MSG3RepetitionCountOptimizationEvaluation...........90
5.3NewDirectionsinEnergyOptimization.....................91
5.3.1Per-UEInactivityTimer..........................92
5.3.2ECLAdaptationofUE...........................92
5.3.3Fine-grainedECLs.............................93
5.3.4CollaborativeEnergySaving........................93
5.4BeyondNB-Scope..................................93
5.4.1In-deviceSignalingDecoding.......................94
5.4.2TowardstheCoexistenceofNB-IoTandLoRa..............94
5.5Conclusion......................................95
ix
CHAPTER6CONCLUSION
...............................
97
BIBLIOGRAPHY
.......................................
99
x
LISTOFTABLES
Table3.1:PRxtimingconstraintsduringtheQipowertransferphase.........12
Table3.2:Thelistoffeaturesextractedfromacompletescan..............31
Table3.3:ThemeasurementdelayintheQIDsystem..................37
Table4.1:ListofmodulesthatNB-Scopesupports....................56
Table4.2:eNodeBCon˝gurationsofdi˙erentNetworkOperators.MSG1repeti-
tionandECLthresholdarenotavailableinthedebuglogsofNB-IoT
modulesdeployedintheUS...........................67
Table4.3:Powerconsumptionbreakdown(meanandstandarddeviation)byra-
dioaccessproceduresintheULcycleunderdi˙erentECLs.Unit:mJ...79
Table5.1:ListofeNodeBdefaultcon˝guration......................89
Table5.2:Meanenergyconsumptionofthe
MSG3
periodfordi˙erentECL2
MSG3
repetitions.....................................91
xi
LISTOFFIGURES
Figure3.1:Operatingpointscollectedinanexperimentbymanuallychanging
themobiledeviceplacement..........................12
Figure3.2:AnattachableQi-compatiblepowerreceiverforSamsungGalaxyS3...12
Figure3.3:Examplesofthemulti-coildesignsinQi...................13
Figure3.4:TheCEPtimeintervalvs.samplingtimein3independentfeature
acquisitionexperiments:(1)stationaryPRx;(2)PRxpositionchanged
duringcharging;(3)QIDisenabled......................15
Figure3.5:TheCEPvaluevs.samplingtimein3independentfeatureacquisi-
tionexperiments:(1)stationaryPRx;(2)PRxpositionchangedduring
charging;(3)QIDisenabled..........................16
Figure3.6:ThesystemarchitectureofQID.ItconsistsofQIDsensorandQID
server.QIDsensorisresponsibleforcontrollingthemotionofthe
chargercoil,capturingthesignalfromthewirelesscharger,aswellas
sendingthetimestampedpacketstoQIDserver.QIDserverextracts
thefeaturesfromthepacketsequenceandclassi˝esthedevice......17
Figure3.7:FingerprintingaPRxcoilwithamovementunit...............19
Figure3.8:Thescaledandzero-meanedCEPtimeintervaldistributionof42eval-
uateddevices.The˝rstlettersofthedevicesrepresentthebrandsof
thereceivers,whilethefollowingdigitrepresentsthespeci˝clabel
initsbrand.TheerrorbarshowsthestandarddeviationoftheCEP
timeinterval.Thecorrespondingactualtimeintervalspansarange
of(238,270)ms.................................20
Figure3.9:Heterogeneouspowerreceivercoils.Thesizeandshapeofthecoils
resultindi˙erentcontactrangemeanandstandarddeviation.......21
Figure3.10:TemporalFeatureAcquisition.Eachpacketisdecodedandtimes-
tampedbythemicrocontroller(MCU).....................22
Figure3.11:Mechanicaldesign-thechargerpadiscontrolledbytwosteppermo-
torlinearslides,movingina2-Dsurface...................23
Figure3.12:TrajectorydesignoftheQIDsensor......................24
xii
Figure3.13:GaussiankerneldensityestimationofCEPtimeintervals.Theletters
indicatethedevicebrands.Thenumberindicateseachuniquedevice
ofitsbrand.The0inthehorizontalaxiscorrespondsto240msinreal
timescale.....................................28
Figure3.14:ComparisonoftheCEPvaluefrequencyfor4di˙erencedivices.G0
toG7correspondtothesevenPRxcontrollerfeaturefrequencyrange
inTable3.2....................................30
Figure3.15:Classi˝cationprocesswithabaggingclassi˝ersinQIDserver.......32
Figure3.16:AprototypeoftheQIDsensor.........................34
Figure3.17:Pointcloudillustration..............................36
Figure3.18:Thecross-validationscoreanddevicebranddetectionaccuracyofdif-
ferentclassi˝ers..................................38
Figure3.19:Theimpactoffeatureselectionontheclassi˝cationaccuracy.G1:clas-
si˝cationwithouttheCEPtimeintervalfeatures;G2:allfeaturesare
included,buttheyaremeasuredwithoutthemotionplatform;G3:
classi˝cationperformanceusingtheCEPtimeintervalfeaturesonly;
G4:allfeaturesareincluded..........................38
Figure3.20:Confusionmatrixofthe52evaluateddevices................39
Figure3.21:Numberofpacketperscanfeaturedistributionof42devices(10sam-
plesperdevice)..................................41
Figure3.22:ThefrequencyofCEPvalueequaling0distributionof42devices(10
samplesperdevice)...............................41
Figure3.23:Devicerecognitionaccuracychangeswiththenumberofdevices....43
Figure4.1:NB-IoTframestructure.............................50
Figure4.2:NB-IoTsubframestructureineitherStandaloneorGuardbanddeploy
mode.Every10subframesmakearadioframe................51
Figure4.3:SignalingsbetweenUEandeNodeBbasestationduringaULpacket
transmission...................................52
Figure4.4:SystemarchitectureofNB-Scope........................55
Figure4.5:NB-IoTUEmoduleshieldboards.......................57
xiii
Figure4.6:STM32-basedmainboardforNB-IoT˝eldtest................58
Figure4.7:NB-Scopesoftwarearchitecture(˝eldtestmode).Thedebuglogcol-
lectionpipelineissimilartothecurrentsensingpipeline,thusisnot
showninthe˝gure................................59
Figure4.8:Messagedecodingexample.Therawdebuglogdatais˝rstsegmented
intodi˙erent˝eldsbythebytelength,andthenistranslatedtohuman-
readabletextsaccordingtothemessagede˝nitiondatabase........60
Figure4.9:Actualnodedeploymentofdi˙erentlocationpro˝les............63
Figure4.10:Meanactiveenergyperpacketdistributionbylocationpro˝lesand
networkoperators.Theupperandlowererrorbarareatmost1.5xin-
terquartilerangeawayfromthe75thand25thpercentilerespectively.
OP:outdoorparking,SL:smartlock,WM:watermeter,SD:smoke
detection,IP:indoorparking..........................66
Figure4.11:Averagepowerconsumptionperpackettransmissionforindoorap-
plicationsinabuilding.Notethatsomeco-locatedpointsmaybeon
di˙erent˛oors..................................67
Figure4.12:Performanceofdi˙erentmodelsinsmokesensinglocationpro˝le.
M1-M3aredeployedintheUS,whileM4-M6inChina...........69
Figure4.13:Distributionofthepacketenergyina12.5-hourperiod...........70
Figure4.14:Packetenergyw.r.tthedistancebetweentheUEandtheeNodeB.....71
Figure4.15:ECLratiow.r.tlocationpro˝lesandnetworkoperators...........73
Figure4.16:ECLselectionv.s.RSRPandSNRmeasurement...............74
Figure4.17:RSRPandSNRdistributionw.r.t˝vetypesoflocationpro˝les.......74
Figure4.18:Thetypicalpowerconsumptionpro˝lesunderdi˙erentECLs.The
leftcolumnshowstheULpacketTxcurrentpro˝leforeachECL.The
rightcolumnshowsUE'spowerpro˝leinacompletepacketTxcycle..77
Figure4.19:Averagedenergyconsumptionbreakdownbyradioaccessprocedures
andECLs.Thewedgesarearrangedclockwiseaccordingtotheleg-
end.TheexplodedwedgesrequireULtransmission.............80
Figure4.20:Thedistributionof
MSG3
repetitionsv.s.datatransferblockrepetitions..82
xiv
Figure4.21:Batterylifeestimationunderdi˙erentconditions.refers
toonlytheNB-IoTmoduleenergy;oincludestheenergycon-
sumptionofboththemoduleandothercomponentsontheboard;
means
InactivityTimer
.........................83
Figure5.1:TheSDReNodeBimplementation,withAmarisoftLTE100andUSRP
N210........................................88
Figure5.2:RoundtriptimeCDFintheevaluationexperiment.............90
Figure5.3:Prob.ofpacketswith
MSG3
re-transmissionw.r.tECL2
MSG3
repetition..90
Figure5.4:NB-ScopeV2hardwaredesign.........................95
xv
CHAPTER1
INTRODUCTION
Thewirelesstechnologieshavebeenevolvedspeedily,whoseinfrastructureisbuiltand
deliveredrapidly.Thefastgrowthofwirelessnetworksgeneratesnotonlyopportunities
fornewapplications,butalsoissuesinhighenergyconsumption,unexpectedlatency,and
potentialprivacybreach.Ourresearchshedsthelightupontwooftheemergingwireless
technologies,namelywirelesschargingandNarrowbandInternet-of-things,empowering
IoTservicesandapplications.
1.1DeviceRecognitionUsingNewWirelessInfrastructures
Recentyearshavewitnessedtheincreasingpenetrationofwirelesschargingbasestations
inpublicareaslikeo˚cebuildings,restaurants,andairports,etc.[19].Thereisalsoa
trendtoembedwirelesschargingbasestationsinfurniturelikedesksandtables[14,66].
Itisestimatedthatnearly500millionwirelesschargingdeviceswereshippedduringthe
year2017,ful˝llingonly20%ofthepotentialworldmarket[58].Thisemergingwire-
lesscharginginfrastructurehaspresentednewopportunitiesforpreciseuserlocalization,
wherethebasestationlearnsthelocationandidenti˝cationofthemobiledevicebeing
charged.ManyRF-orultrasonic-basedapproacheshavebeenproposedforindoorlo-
calization[40,45,67,73,77,82,85,86].Designedforprovidingthecontinuouslocationof
amovinguser,theyoftenincursigni˝cantoverhead,e.g.,duetotheneedforlarge-scale
wardrivingforcollecting˝ne-grainedsignal˝ngerprints.Inthiswork,weexploitwireless
chargingforaspeci˝capplicationscenario,wheretheuserstaysrightnexttothewireless
chargerforacertainamountoftime,waitingforthephonetobecharged.Therefore,the
wirelesschargerlocalizesamobilephonebysimplyreferringtothealready-knownlo-
cationoftheregisteredcharger.Moreimportantly,thisprocessdoesnotchangenatural
users'behavior,whichallowsforeasieradoptionoftheproposedsystem.
1
Leveragingpervasivewirelesschargingstationstoprovidehighlocalizationaccuracy,
highreliabilityatlowdeploymentcostenablesawiderangeofapplications.Forinstance,
aco˙eeshopmayrecognizeitscustomerswhentheychargetheirphonesontheco˙ee
tableandprovidecustomizedservicesorlocation-basedadvertisements.Foranotherex-
ample,whenuserschargetheirphonesonthetableinstrumentedwithwirelesscharging
duringameetingorlecture,theprecisesittingpositionsoftheuserscanbedetermined,
whichenablesinterestinginteractionssuchassharingdocumentsinanad-hocgroup,
sendinginstantmessages,exploringnearbypeople[49],orestablishingad-hocvotingor
commentinggroupsfortheattendeestoexpresstheiropinions.Inadditiontomobile
devicelocalization,thepopularityofwirelesscharginginfrastructurealsoprovidesthe
opportunityforuserauthentication.Forapaidwirelesschargingservice,thecharger
canidentifythephoneandprocessthepaymentautomatically.Luetal.[56]proposeda
wirelesschargingnetworksystem,wheremultiplewirelesschargerscommunicatewith
theserveroradjacentwirelesschargerstoprovidepay-per-usechargingservice.Reliable
chargingdeviceidenti˝cationisthebasicbuildingblockforsuchapplications.
Toleveragethewirelesscharginginfrastructureforuserlocalizationandidenti˝cation
services,akeychallengeistoreliablyidentifythewirelesschargingunitofmobiledevices.
Unfortunately,unlikenetworkinterfacessuchasWi-FiandBluetooththathaveuniqueand
˝xedhardwareaddresses,thewirelesschargingunitofcommercialo˙-the-shelf(COTS)
mobiledevicestypicallydoesnothavea˝xedhardwareID.Forinstance,accordingtothe
Qistandard[83],theidentityofapowerreceiverisde˝nedbyaBasicDeviceID,whichcan
beasoftware-generatedrandomsequencethatmaychangeeachtimethepowerreceiver
isbooted.
1.2PerformanceEvaluationofNewLPWANTechnology
Inthelastdecade,wehavewitnessedtherapiddevelopmentandwideadoptionofa
varietyoflowpowerwideareanetworks(LPWAN)technologies,suchasSigfox[48],
2
LoRa[54],andNarrowbandInternet-of-Things(NB-IoT).WhileLoRaandSigfoxhaveat-
tractedmuchattentionintheresearchcommunityduetotheirutilizationoftheIndustrial,
Scienti˝c,andMedical(ISM)bands,NB-IoTtechnologyreceivedinadequateresearchfo-
cus.
NB-IoTwasdevelopedbythe3rdGenerationPartnershipProject(3GPP)in2016.NB-
IoTenvisionsananytime,anythingconnectivityparadigm[46]forawidespectrumoflow
datarate,largevolume,andlonglifetimeIoTapplications,includingsmartgrid[53,65],
smartstreetlamp[15],parkingmanagement[72],airqualitysensing[26,80],andintelli-
genceagriculture[37].Currently,NB-IoThasbeenlaunchedgloballywith93commercial
networks[35],whilethereare140operatorsin69countriesinvestinginNB-IoTnetwork
deployment[34].AccordingtoEricsson[29],thenumberofglobalIoTshipmentswill
growfromonebillionin2018to4.1billionby2024.
Unfortunately,todate,thekeyaspectsofNB-IoTnetworks,suchasradioaccessperfor-
manceandpowerconsumption,havenotbeenwellunderstood,especiallytodevelopers
andacademicresearchers.Thisisduetothreekeychallenges.First,NB-IoTisaclosed
cellularnetworkdeployedbyoperatorsonthelicensedspectrum,wherethebasestations
cannotbeaccessedforpublicmeasurements.Themessage-levelinteractionsbetweenthe
nodeandbasestationarelargelyinaccessibletothedevelopersandresearchers.Second,
NB-IoTmeasurementisfundamentallydi˙erentfrom3/4Gcellularnetworkmeasure-
ment,wherethelattercouldbeconductedthroughmobileapplications[50,52]installed
onmassivemobiledevices.Incontrast,anIoTapplicationmayconsistofnumerousnodes
embeddedintheenvironmentoveralargegeographicregion,whichpresentsahighbar-
rierforunderstandingtheperformanceofNB-IoTinthewild.Inparticular,NB-IoTnet-
worksdi˙ersigni˝cantlyduetovariationsofoperatorcon˝gurations,modulesfromdif-
ferentvendors,andlocationpro˝les.Finally,therelacke˙ectivetoolsthatcanexposethe
low-leveldiagnostictracesfromNB-IoTnodes,supportlarge-scalemeasurementstudies,
andcapturethehighlevelofheterogeneityofnetworkoperators,NB-IoTmodules,and
3
locationpro˝les.
1.3Contribution
Inthisthesis,weproposetwonovelcyber-physicalsystemstodemonstratethepossibility
ofenablingnewapplicationsbyleveragingtheemergingwirelesscharginginfrastruc-
tures,andbenchmarkthenetworkperformanceofendnodesinanemergingLPWAN,
respectively.
First,wepresentthedesign,implementation,andevaluationofQIDthe˝rstprac-
ticalsystemthatreliablyidenti˝esQi-compliantmobiledevicesbasedonthehardware
˝ngerprints.Speci˝cally,QIDaugmentsstandard-compliantwirelesschargingbasesta-
tiontoextractfeaturesfromtheoscillator,coil,andcontrollerofaQi-compliantpower
receiver,whilerequiringnoretro˝ttingormodi˝cationtoexistingQi-compatiblemobile
devices.QIDemploysa2-DmotioncontrollertoemulatethecoilarrayintheQireference
design(describedinSection3.1)andregulatetheinductivecouplingbetweenthepower
transmittingandreceivingcoils,whichallowsfor˝ne-grained˝ngerprintingofthepower
receiverwhileoptimizingthee˚ciencyofpowertransfer.Experimentalresultsbasedon
52Qi-compatibledevicesshowthatQIDachievesanoverallidenti˝cationaccuracyofup
to89.7%,withanaverageof85.3%.Ourresultsalsohaveimportantimplicationsforuser
privacy.Withtheincreasingprevalenceofwirelesschargingstationsinpublicareas,how
topreventtheleakageoftheuser'slocationopensupnewresearchquestions.
Second,wedevelopNB-Scopethe˝rsthardwareNB-IoTdiagnostictoolthatsupports
˝ne-grainedfusionofpowerconsumptionandprotocolmessagetracesforbothreal-time
in-labbenchmarkingand˝eldtesting.WithNB-Scope,weconductalarge-scale˝eldmea-
surementstudybasedonthedeploymentof30NB-Scopenodesatover1,200locationsin
3regionsof2countriesduringthreemonths.Ourin-depthanalysisofthecollected49
GBdebuglogsandcurrentconsumptiontracesrevealsseveralimportantinsightsintothe
powerconsumptionofNB-IoTinthewild.Weshowedthatnodesyieldsigni˝cantlyim-
4
balancedenergyconsumptionacrossdi˙erentlocations,operators,andmodulevendors,
whichcanleadtounexpectedshortbatterylifeandfrequentnetworkpartitions.Forin-
stance,theratioofthehighestandlowestenergyconsumptionofnodescanbe75:1.By
decomposingtheenergyconsummationbyradioaccessphrasesina˝ne-grainedmanner,
weshowedthatsuchperformancevariancecanbeattributedtoseveralkeyfactorsinclud-
ingpoornetworkcoveragelevel,long-tailpowerpro˝leduetoconservativeinactivity
timersettings,andexcessivecontrolmessagerepetitionsduringrandomaccesscontrol.
Third,weexploretheoptimizationspaceoftheNB-IoTbasestationonasoftware-
de˝nedeNodeBtestbedandproposeseveraloptimizationsthatmaysaveupto66.4%of
thepacketenergyinsignal-limitedcoverageareas.Then,wediscussseveralimportant
designaspectsthatcanbeconsideredbyfutureNB-IoTspeci˝cationsandchipsetsforop-
timizingenergyconsumption.Moreover,wepresentourupgradestotheNB-Scopesys-
tem,includingin-devicereal-timemessagedecodingandLoRa-NB-IoTdual-modesup-
port,whichprovidenewparadigmsfortheLPWANresearchcommunity.
1.4ThesisOrganization
Therestofthisthesisisorganizedasfollows.Chapter2reviewstherelatedworksto
thisdissertation,especiallyondeviceidenti˝cationaswellasnetworkmeasurementand
optimization.Chapter3presentsQID,the˝rstsystemthatidenti˝esmobiledevicesvia
wirelesscharging˝ngerprints.Chapter4presentsNB-Scope,the˝rstembeddednetwork
measurementsystemfortheNB-IoTnetwork,addressingtheheterogeneityin˝eldmea-
surement,aswellasthestatisticalanalysisofalargeamountof˝eldmeasurementdata.
Chapter5proposesandevaluatesmultipleenergyoptimizationstoNB-IoTandpresents
theimportantupgradestotheNB-Scopeplatform.Finally,Chapter6concludesthisthesis.
5
CHAPTER2
RELATEDWORK
2.1DeviceFingerprinting,Localization,andWirelessChargingInfras-
tructure
Deviceidenti˝cationhasbeenstudiedforawiderangeofnetworkedcommunicationsys-
tems.Theexistingdevelopedtechniquescanbebroadlyclassi˝edintothreecategories.
Onecategoryusesthe˝ngerprintsoftheRFsignalintroducedbythehardwareimperfec-
tionofthefrequencygeneratoronthedevices.Thenextcategoryusestemporalfeatures,
i.e.theclockskewintroducedbytheminordi˙erenceintheoscillatoramongthede-
vices.Theclockskewmainlya˙ectsthetimeintervalofthetransmittedpackets.Thelast
categoryutilizesthesensorhardware˝ngerprintsonmobiledevices.Besidesthedevice
identi˝cation,webrie˛ycompareourproposedsystemQIDwithotherlocalizationmeth-
odsandmotion-assistedcyber-physicalsystems.Finally,wediscusspreviousworkthat
enablesapplicationsusingwirelesscharginginfrastructure.
RFSignalFingerprinting.
PARADIS[13]identi˝edthesourcenetworkinterfacecard
(NIC)ofanIEEE802.11framethroughpassiveradio-frequencyanalysis.Speci˝cally,it
usesI/Qorigino˙set,frequencyerror,andSYNCcorrelationtodistinguishthedevices.
Caraoke[2]separateddevicesbytheircarrierfrequencyo˙setdi˙erencestoavoidwireless
collisionsinane-tolltranspondernetwork.Similarly,Danevetal.[22]achievedwireless
sensorrecognitionusingRFtransientcharacteristics.Eletrebyetal.proposedChoir[28],
asystemthatdisentanglescollisionsinLoRaLP-WANbydistinguishingthesensornodes
usingtheirtime,frequency,andphaseo˙setscausedbyhardwareimperfection.Despite
thepreviousresearche˙orttoexploreRFsignalinthedevice˝ngerprinting,thesetech-
niquescannotbeappliedtowirelesscharging,becauseononehand,divingintothedetails
oftheRFsignalforthe˝ngerprintsrequiresexpensiveequipment,forexample,[13]used
6
theAgilent89641Svectorsignalanalyzer;ontheotherhand,wirelesschargingadopts
resonantcouplingtotransferenergy,whereboththecarrierfrequencyandamplitudeare
variable.Thus,oneisalmostnotabletoinferthedeviceidentityusingtheRFsignalin
wirelesscharging.
ClockSkewFingerprinting.
Kohnoetal.[44]usedtheTCPtimestampoptiontoestimate
adevice'sclockskew.Similarly,CristeaandGroza[21]studiedhowto˝ngerprintsmart-
phonesremotelyviatheInternetControlMessageProtocol(ICMP)timestampresponse.
Whilethesetwostudiesfocusedontra˚canddriver-levelsignatures,othersystemsex-
ploredhardware-levelfeaturestodistinguishdevices.Huangetal.[38]usedtemporalfea-
turesofBluetoothbasebandembeddedinthechipset˝rmwareto˝ngerprintBluetooth
devices.However,onekeydi˙erencebetweenthesescenariosandwirelesschargingis
thatthedeviceplacementa˙ectstheclockskew˝ngerprintsofthemobiledevice.More-
over,theplacementofthedeviceonthechargerpadisunpredictable,whichcastsmuch
di˚cultyinbuildingaprecisemodelforeachdevice.Wewillfurtherdiscussthechal-
lengesindetailinSection3.2.
SensorFingerprinting.
Anotherdeviceidenti˝cationtechniquesuse˝ngerprintsinthe
sensors,suchasacousticsensor[9,23],camera[31,78],andinertiasensor[24,88].Forexam-
ple,Dasetal.[23]utilizedmanufacturingimperfectioninthemicrophoneandspeakerto
distinguishdi˙erentmobiledevicesusingclassicalmachinelearningalgorithms.Valsesia
etal.[78]proposedacompressedcamera˝ngerprintalgorithmtoreducethecomplexity
infeaturecomputationandstoragerequirements,improvingthedevicerecognitionper-
formanceusingphoto-responsenonuniformity.Zhangetal.[88]utilizedper-deviceiner-
tialsensorfactorycalibrationdata,embeddedinsideamobiledevice˝rmware,toextract
˝ngerprints.Dasetal.[24]performedanin-depthstudyondevicerecognitionusingcom-
binedfeaturesextractedfromaccelerometerandgyroscopesensorstreamswithmachine
learningtechniques.Althoughthesemethodsmayachieveacceptableaccuracy,theyre-
quirereadingthedataorsensorsamplesfromthephonedirectly,whichcanbeintrusive.
7
Localization.
Amajorapplicationofoursystemistoidentifyandlocalizemobiledevices.
PreviouslocalizationsystemswerebasedonGPS,angleofarrival(AoA)[32,86],timeof
˛ight(TOF)[55,67,79],receivedsignalstrength(RSS)[6,87],ultrawideband(UWB)[47,
71],andmultipathsignalaggregation[81].Wirelesscharging-basedlocalizationissimilar
tolandmark-basedapproachessuchasWi-FiAPorCell-IDs[76],wherethelocationof
thecharger(accesspoint)isalreadyknownorregistered.Inthismanner,thelocation
ofthemobiledevicecanbeacquiredimmediatelyaftertheusersputthephoneonthe
chargingstation.Suchauser-initiatedlocalizationapproachishighlyprecise.WhileCell-
IDbasedmethodsusuallyhaveanerrorofuptotensorhundredsofmeters,wireless
charginginfrastructure-basedlocalizationcanachievecentimeter-levelaccuracy.Wireless
charging-basedlocalizationisalsorobustcomparedtoAoA/TOF/RSS-basedmethods
becausethelocationoftheformerisnota˙ectedbydynamicsofwirelesssystemslike
signalstrength.
Motion-AssistedSystemAugmentation.
Manysensingsystemsareaugmentedwiththe
assistanceofmotioncontrol.Graefensteinetal.[33]usedarotatingantennaonamo-
bilerobottolocalizewirelesssensornodebasingonRSSI.Theyimprovedtherobustness
ofthemeasuredRSSIandincreasedlocalizationaccuracy.Similarly,Malajneretal.[57]
employedasteppermotortorotatetheantennaarraytoestimatetheAoAoftheRFtrans-
mitter,achievinglowcostandhighaccurateAoAestimation.Chouetal.[17]addedaro-
tatingfour-barlinkagetoamobileplatformtoextendthe2Dlaserrange˝ndertosupport
3Denvironmentalsensingandmapping.Althoughmotionplatformhasbeenappliedto
varioussensingsystems,tothebestofourknowledge,thisideahasnotbeenadoptedby
wirelesschargingsystems.WewillshowinSection3.7.3that,withtheassistanceofa2-D
motionplatform,weimprovethedevicerecognitionaccuracysubstantially.
ApplicationBasedonWirelessChargingInfrastructure.
Inourpreviouswork,wehave
developedQiLoc[49],asystemthatextractsthesoftwareIDofthechargingdeviceand
localizesitslocationbasedontheknowndeploymentlocationofthechargingstation.
8
ComprehensiveAPIisprovidedtoimplementlocation-basedservice,occupancyanalysis,
andauthentication.ItalsoprovidesAPIforlocation-basedservices,occupancyanalysis,
andauthentication.However,accordingtotheQistandard[83],theidentityofapowerre-
ceivercanbeasoftware-generatedrandomsequencethatmaychangeeachtimethepower
receiverisbooted.Thus,the˝ngerprintingtechniquespresentedinthisdissertationcan
beintegratedwithQiLoctoprovideareliablelocalizationservice.Luetal.[56]pro-
posedawirelesschargingnetworkarchitecture,wheremultiplewirelesschargerscom-
municatewiththeserveroradjacentwirelesschargerstoprovidepay-per-usecharging
service.However,devicerecognitionduringchargingisnotstudiedin[56].Although
theirworkenvisionspotentialwirelesschargingapplications,theydidnotconsiderthe
situationwherethesoftwareIDisunreliable.Ourprojectfocusesonhowtoaccurately
recognizethedeviceunderQiwirelesschargingwithreliablehardwarefeatures.
2.2WirelessInfrastructureBenchmarkandDiagnostics
Severalpriorworksoncellularnetworksfocusonthedesignandimplementationof4G
LTEmeasurementtoolkits[51,60].Nikraveshetal.[60]proposedanopenplatformfor
conductingmobilenetworkmeasurementexperimentsinaprincipledmanner.Lietal.
[51]proposedMobileInsight,adiagnostictoolthatcollectsandanalyzesinformationfrom
theoperationalcellularnetworkata˝ne-grainedmessagelevel.However,themeasure-
mentof4GLTEisusuallyconductedthroughmassivelydeployedsmartphoneapplica-
tions,whichisnotviableforNB-IoTduetotheembeddednatureofNB-IoTapplications
andthelimitedcomputecapabilityandbatterylife.Thetoolsthatcanprovidebothpower
measurementandextractionofdebuglogsofNB-IoTarenotcurrentlyavailablewhich
makeslarge-scalemeasurementofNB-IoTverychallenging.
Powermeasurementandmodeling.
Alotofearlystudieshaveinvestigatedtheenergy
e˚ciencyofcellularnetworksoversmartphonesthroughpowermodeling[7,16,25,39].
Balasubramanianetal.[7]developedanenergyconsumptionmodelforthe3Gnetworkas
9
afunctionoftransfersizeandinter-transfertimes.Dingetal.[25]modeledpowerbased
onwirelesssignalstrength.However,theyfocusonmodelingthedownloadlinkwithout
consideringtheuplinkdataservice.Allthesepowermeasurementstudiesofthecellular
networkarebasedonsmartphones.In[11]and[54],theauthorsdesignednewLoRaend
nodesformeasuringtheenergyconsumptionofLoRa.Bougueraetal.[11]presenteda
powermodelfordi˙erentLoRaWANmodesandscenarios.Liandoetal.[54]focusedon
characterizingtheenergyconsumptionoftheLoRamodule.Di˙erentfromLoRa,NB-IoT
isdeployedbyoperatorsonlicensedbandsandthebasestationscannotbeaccessedfor
publicmeasurements.
Powerconsumptionoptimization.
Sehatietal.[70]proposedanonlinebundlingalgo-
rithmtoreducetheimpactofsmallpacketsonthelongtailenergyconsumptioninIoT
applications.Jangetal.[43]presentedanovelaccesscontrolmechanismforcellularIoT
networkstomeetvariousperformancemetrics.Azarietal.[5]proposedamodeltoana-
lyzetheimpactofchannelschedulingonlatencyandenergyconsumptionfornodesunder
di˙erentcoveragelevels.Astudilloetal.[3]proposedaprobabilisticre-transmissionap-
proachtoavoidcollisionsofrandomaccesscontrolmessagesandtoreducedelayand
energyconsumption.However,theseoptimizationsarebasedonanalyticalresultsofnet-
workprotocolswhichfallshortincapturingthepowerconsumptionpatternsanddirect
factorsthatcauseenergywasteinarealdeployment.Inourwork,weidentifythemain
factorscausinglowenergye˚ciencythrough˝eldtestsandproposee˙ectiveoptimiza-
tionstrategiescorrespondingly.
10
CHAPTER3
IDENTIFYINGMOBILEDEVICESVIAWIRELESSCHARGINGFINGERPRINTS
3.1Background
Qiisanopenstandardthatde˝neswirelesspowertransferovershortdistances.Atypical
Qisystemconsistsofapowertransmitter(PTx)installedonaQibasestationandapower
receiver(PRx)attachedtoorinstalledinaQi-compliantmobiledevice.ThePTxcom-
prisesatransmittingcoil,calledPrimaryCoil,whichgeneratesanoscillatingmagnetic
˝eld,whichinducesanalternatingcurrentinthereceivingcoil,namelytheSecondary
Coil,ofthePRx.ThePRxcommunicateswiththePTxviabackscattermodulationofthe
currentdraw,andprimarilysendstwotypesofmessagestooptimizethepowertrans-
fer.Thecontrolerrorpacket(CEP)carriesanintegerthatindicatesthedi˙erencebetween
thedesiredpowerlevelandthereceivedpowerlevel.Thereceivedpowerpacket(RPP)
reportstheaveragelevelofpowerreceivedinthepastperiod.Throughouttheprocess
ofcharging,CEPsandRPPsaretransmittedperiodically.Table3.1showstheCEPand
RPPintervalsspeci˝edbytheQistandard.BasedontheinformationinCEPsandRPPs,
thePTxadjuststhecarrierfrequencyandamplitudeoftheprimarypowersignaltoopti-
mizethecouplingbetweenthecoilsofPTxandPRx.Thecombinationofthecarrierwave
frequencyandamplitudeisde˝nedastheoperatingpoint.Figure3.1exempli˝esaset
ofoperatingpointscollectinginanexperiment.Whenthephonepositionchanges,the
couplingbetweenthePTxandPRxcoilsvaries,suchthatthePRxinformsthePTxwith
CEPstoregulatethewirelesspoweroutput.Then,thewirelesschargingadaptstoanew
operatingpointeventually.Wenotethat,ifthephoneplacementremainsunchanged,the
correspondingoperatingpointswillaggregatearoundaspeci˝csmallregioninFigure
3.1.
Qispeci˝esmultiplereferencereceiverandcoildesigns[84].Figure3.2exempli˝esone
11
Figure3.1:Operatingpointscollectedinanexperimentbymanuallychangingthe
mobiledeviceplacement.
Table3.1:PRxtimingconstraintsduringtheQipowertransferphase.
ParameterSymbolTarget(ms)Max(ms)
CEPInterval
t
interval
250.0350.0
RPPInterval
t
received
1500.04000.0
Figure3.2:AnattachableQi-compatiblepowerreceiverforSamsungGalaxyS3.
oftheavailabledesignsandSamsungGalaxyS3thatsupportsattachableQi-compatible
PRxmodules.Ithasapairofterminals(
+5V
and
GND
)thatconnectstotheoutputofthe
12
PRx.Insuchadesign,thePRxisanindependentmoduleanddoesnotcommunicatewith
thephone.TheattachablePRxmodulesprovidethewirelesschargingcapacitytothose
devicesthatoriginallydon'tshipwiththewirelesspowerreceivers.Weconsidereach
ofthemodulestorepresentauseridentitysinceitisanindependentcomponent(either
attachedoutsideorpre-installedinside).Itoutputsastablecurrentat5Vforcharging
withitsmaximumcapacitymostofthetime.
InadditiontothePRxdesign,Qialsospeci˝esmorethan30TypeAand7TypeBPTx
designs,wheretypeAdesignshaveoneormorePrimaryCoilsbut
onlyone
ofthemcanbe
activatedatatime,whiletypeBdesignssupportanarrayofPrimaryCoilsand
oneormore
PrimaryCoilscanbeactivatedtoprovidewirelesspowertomultiplePRxssimultaneously.
Figure3.3[18]showstwoexamplesofthemulti-coilchargers.Comparedtothesingle-coil
designs,multi-coilPTxenlargesthepossiblecouplingareawiththePRx,thusproviding
more˛exibilityinthedeviceplacement.Asaresult,thecoilarrayPTxdesignsbecome
moreprevalentonthemarket.
(a)Chargercoilmovementillustration
(b)Themobilecoilarray
Figure3.3:Examplesofthemulti-coildesignsinQi.
Qialsosupportsaserialnumberofatleast20bits,alsoknownastheBasicDeviceID.
However,aPRxcanalsousearandomnumbergeneratortodynamicallychangetheBasic
DeviceID,sothateverytimetheuserputsthemobiledeviceontoaPTx,theBasicDevice
IDupdates.SucharandomIDinvalidatesdeviceIDbasedapplications,whichinspires
13
ustodesignasystemtoidentifyadeviceusingitshardware˝ngerprints.
3.2DesignChallengesandSystemOverview
3.2.1DesignChallenges
ItischallengingtorecognizeamobiledevicefromtheQichargerduetotheintrinsic
characteristicsofthewirelesschargingenvironment.Speci˝cally,thefollowingchallenges
needtobeaddressed:
Noiseintemporalfeaturescausedbypowertransfer.
Thewirelesspowertransferhap-
pensintherapidly-changinghighpowerelectromagnetic˝eldbetweenthetwocoupling
coils,castingmorenoisethantypicalRFwirelesssystems.Forinstance,asshowninFigure
3.4(1),themeasuredpacketintervalshavesigni˝cant˛uctuations.Thestandarddeviation
oftheCEPtimeintervalismorethan4.4ms,correspondingto1.7%error,whichmakesit
di˚culttodistinguishbetweendi˙erentchargingdevices.
Undesirablestableoperatingpoint.
Qiwirelesscharginghasawell-designedfeedback
controlloop.Thewirelesspowertransferprocessisusuallystabilizedatanoperating
pointwithinhundredsofmilliseconds(3to5CEPs).Althoughthisisadesiredfeature
intermsofmaintaininghighcharginge˚ciency,itbringsamajorchallengeinrecogniz-
ingthetargetdevice.Figure3.4(1)andFigure3.5(1)showtheexperimentalresultofsuch
ascenario,wherethephoneremainsstationaryonthechargingpad.Asshown,these-
lectedfeatures,boththeCEPtimeintervalandCEPvalues,remainunchangedduringthe
chargingprocess,whicheventuallyraisestherecognitionerrorrate.
Unconstraineddeviceplacement.
Thethirdchallenge,themostdi˚cultoneinourcase,
isthattheselectedfeaturesaredependentonthephoneplacement.Inotherwords,if
theuseraltersthePRxposition,thefeaturevaluescanchangedramatically.Figure3.4(2)
andFigure3.5(2)demonstratehowtheCEPtimeintervalandcontrolerrorvaluechange
withrespecttothephoneplacement.Duringthemeasurement,afterwerotatethephone
witharandomangle,theCEPtimeintervaldecreasesfromabout250msto160ms,and
14
Figure3.4:TheCEPtimeintervalvs.samplingtimein3independentfeatureacquisition
experiments:(1)stationaryPRx;(2)PRxpositionchangedduringcharging;(3)QIDis
enabled.
theControlErrorvalueincreasesdramaticallyfrom0to30.Inareal-worldscenario,the
placementofamobilephoneisoftenunpredictable.Asaresult,theerrorsareaccumu-
latedovertime,whicheventuallyrenderstherecognitionunsuccessful.
3.2.2SystemOverview
WenowprovideanoverviewoftheQIDsystem.ThesystemarchitectureisshowninFig-
ure3.6.Itconsistsof3components,namelyaCOTSQiwirelesscharger,theQIDsensor,
andtheQIDserver.TheQIDsensorisresponsibleforcollectingaselectedsetoffeatures
fromwirelesscharginganduploadingthedatatotheserver,whiletheQIDserverisre-
sponsibleforthefeatureextractionanddeviceclassi˝cation.TheQIDservercanconnect
15
Figure3.5:TheCEPvaluevs.samplingtimein3independentfeatureacquisition
experiments:(1)stationaryPRx;(2)PRxpositionchangedduringcharging;(3)QIDis
enabled.
totheQIDsensordirectly(e.g.,throughUART)orresidesonthecloudandcommuni-
cateswithmultipleQIDsensorsthroughtheInternet,enablingtrackingthetargetdevice
atdi˙erentcharginglocations.
TheQIDsensorcanworkwithmostQi-compliantchargers.Itdoesnotmodifyany
ofthechargerpadcircuits.WhatQIDsensorneedsfromaQi-compliantchargerisa
test
pin
thatoutputsthe˝ltereddatabit˛ow.Wenotethatsuchadatapinisindispensable
fortheQichargingsystembecausethePTxrequiresfeedbackfromthePRx.Reading
data˛owfromthepindoesnota˙ecttheoperationoftheQichargingsystem.Therefore,
thankstotheminimalmodi˝cationrequirement,QIDcanbeeasilyintegratedwitho˙-
the-shelfQichargers.Afterconnectingthetestpinandmountingthechargercoiltothe
QIDsensor,theplatformisreadyfordevice˝ngerprinting.TheQIDsensorconsistsofa
16
Figure3.6:ThesystemarchitectureofQID.ItconsistsofQIDsensorandQIDserver.QID
sensorisresponsibleforcontrollingthemotionofthechargercoil,capturingthesignal
fromthewirelesscharger,aswellassendingthetimestampedpacketstoQIDserver.
QIDserverextractsthefeaturesfromthepacketsequenceandclassi˝esthedevice.
motioncontrolhardwarecomponentandasoftwarecomponentforfeaturecollection.The
designofthemotionunitisdiscussedinSection6.1.Themotionunithoststhecharging
padandmovesitaccordingtoacertainpattern,withinarangeof10cm.Thisallowsto
˝ngerprintPRxdynamicallyatdi˙erentrelativepositionsbetweenthePTxandPRxcoils,
resultinginhigheridenti˝cationaccuracy.Wenotethatthemotionunitisconnectedtoa
separatecontrolmodule,anditdoesnotrequireawireconnectionwiththechargeritself.
Asaresult,itcanbeintegratedwithanyo˙-the-shelfchargereasily.
Themotivationforadoptingthemotionunitistwo-fold.First,itcanbeeasilyinte-
gratedwithsingle-coilchargersandimprovetheperformanceofclassi˝cationaccuracy
aswellaspowerdelivery.Second,manyemergingnewchargersarebasedonmulti-coil
Qi-compliantpowertransmitterdesign[18,42,61].AsdescribedinSection3.1,eachcoil
17
onsuchtransmitteriscontrolledbyanindividualswitchoraseparatebridge.ThePTxcan
selecttheoptimalcoiltodeliverthewirelesspowertothePRx.Thusitenlargesthecou-
plingareabetweenthePTxandPRxandprovidesmore˛exibilityinthedeviceplacement.
Comparedwiththesingle-coildesign,themulti-coildesigno˙ersseveralkeyadvantages
forcharger˝ngerprinting.First,thenoisewithinthetemporalfeaturescanbecontrolled
andeven˝lteredoutinpost-processing,becausethe˝ngerprintsarecollectedfrommulti-
plecoillocations,amorecompletedevicepro˝lecanbebuilt.Second,thewirelesspower
transferprocesstohopbetweendi˙erentoperatingpointswhenthechargingcoilsare
switched.ThuswecaninferthePRxcontrolschemefromthetransientstatesbetweenthe
operatingpoints,whichcanbeusedtodi˙erentiatedi˙erentQimodules.Finally,thefea-
tureuncertaintycausedbythephoneplacementcanbeessentiallymitigatedbecausethe
coilarraycoversarangeofdevicepositionsonthechargerpad.Despitetheseadvantages,
itisdi˚culttoexploitthemultiplecoilsofQichargersfor˝ngerprintinginpractice,since
thereexistsalargenumberofheterogeneousdesignsasspeci˝edbyQi[84].Usually,the
existingmulti-coilchargerpadsuselargecoilswithsmalloverlappingareas.The˝nger-
printsamplinggranularityisthuslowevenitprovidesthecoilswitchingcapability.To
addressthischallenge,theQIDsensorextendsthedesignofthephysicalcoilarraytoa
mobilecoil
byequippingtheprimarytransmittercoilwithamotionunit.Figure3.7aillus-
tratestherelativemovementbetweenthePTxandthePRx.Whentherelativealignment
ofthePTxandPRxisadjustedina2-dimensionalplane,wecanconstructa˝ne-grained
mobilecoilasshowninFigure3.7b.Suchadesigne˙ectivelyemulatesavarietyofdif-
ferentmulti-coildesignsofQi.However,wenotethatthemotionunitisnotnecessarily
requirediftheQisystemalreadyadoptsamulti-coildesign.Insuchacase,therestofour
systemcanbeintegratedintoasmallmodulethatconnectstothechargerthroughtwo
pins,namelythedata˛owtestpinand
GND
,allowingforeasydeployment.
Inadditiontothemotionunit,theQIDsensoralsoextractsandtimestampsevery
packetinthedata˛ow.AchallengeinthedesignistoensurethePRxiscorrectlylocated
18
(a)Chargercoilmovementillustration
(b)Themobilecoilarray
Figure3.7:FingerprintingaPRxcoilwithamovementunit.
andmeasured.ThedetailsoftheQIDsensorarediscussedinSection3.3.Thelastcom-
ponent,namelytheQIDserver,readsallthedatasentbytheQIDsensor.Asthepacketis
inbyterepresentation,theserverneedstoparseeach˝eldinthepacket.Then,theserver
performsfeatureextractionandclassi˝cation,whicharediscussedinSection3.5.
3.3FeatureSelectionandAcquisition
3.3.1SelectingHardwareFingerprints
ToreliablyidentifyQi-compliantdevices,QIDleverageshardware˝ngerprintsextracted
fromthefollowingthreePRxcomponents.Theselected˝ngerprintsshouldbedevice-
speci˝c,time-invariant,anddiscriminative.
Onboardoscillator.
ThePRxcontrollerchipofQiutilizesaninternaloscillatortogenerate
theclocksignal.Itiswellknownthatoscillatorshavedistinctivedriftsduetofactorslike
hardwaremanufacturingvariations[21,38,44].WethusexploitthedriftofthePRxoscilla-
torasafeaturetoidentifythedeviceincharging.Forexample,PanasonicAN32258A[63],
acommerciallyavailableQireceiverIC,utilizesaninternaloscillator.NXPMWPR1516
[62]alsousesaninternalLow-powerOscillator(LPO)astheclocksource.Wenotethatthe
19
Figure3.8:Thescaledandzero-meanedCEPtimeintervaldistributionof42evaluated
devices.The˝rstlettersofthedevicesrepresentthebrandsofthereceivers,whilethe
followingdigitrepresentsthespeci˝clabelinitsbrand.Theerrorbarshowsthe
standarddeviationoftheCEPtimeinterval.Thecorrespondingactualtimeinterval
spansarangeof(238,270)ms.
QireceiverICstypicallyhavelowclockaccuracyastheyarenotdesignedfordatacom-
munication.Forinstance,thereceiverICNXPMWPR1516hasaclockaccuracytolerance
ofashighas

5%
;RohmBD57011AGWLdatasheet[69]alsoindicatesthatthedriving
frequencyofthecommunicationsignalisbetween1.92and2.08kHz,whichcorresponds
toa4
%
frequencyerrortolerance.Incomparison,theclockfrequencytoleranceis

50
ppmforBluetooth[8]and

40
ppmforZigbee[1].Therefore,theclockdrifte˙ectofQiis
highlydevice-dependentandmuchmoresigni˝cantthanotherwirelesscommunication
systems.Althoughdriftvariationslikethiscanbeusedtodi˙erentiatedi˙erentdevices,
itisdi˚cult,ifnotimpossible,todirectlymeasuretheclockdriftsinCOTSdevices.Our
keyobservationisthattheControlErrorPacket(CEP)timeintervalyieldshighvariance
amongthedevicesaroundthetargetvaluespeci˝edinQi(seeTable3.1).Figure3.8shows
thattheCEPtimeintervaldistributionof42devicesspansarangeof(238,270)msinthe
timedomain.Therefore,thePRxoscillatorcanbeinferredand˝ngerprintedbymeasur-
ingtheperioddriftofthecontrolpackets.However,somedevices,forexample,and
20
orandyieldcloseCEPtimeintervalvalues.
Figure3.9:Heterogeneouspowerreceivercoils.Thesizeandshapeofthecoilsresultin
di˙erentcontactrangemeanandstandarddeviation.
Receivingcoil.
Di˙erentQi-compliantdevicesmayhavedi˙erentcoilshapes,diameters,
andlayouts.Generally,alargerPRxcoilhasalargercontactareabetweenthePRxandthe
PRxcoils,leadingtomore˛exibilityinplacingthedevice.Inourscenario,thereceiving
coildiametercanbe˝ngerprintedbasedontheareathatthePTxinteractswiththePRx.
Figure3.9exempli˝esdi˙erent˝ngerprintsextractedfromheterogeneousPRxcoils.Itcan
beadeterminantfordevicebrand,butnotagoodindicatorofaspeci˝cdevicebecauseit
isalmostidenticalamongthesametypeofdevice.Wediscusshowtomeasurethecontact
rangeofthePRxcoilinSection3.4.2.
PRxcontroller.
TheQistandarddoesnotspecifytheexactperiodofcontrolpackettrans-
mission.WeobservethattheperiodsoftheCEPsdodi˙eracrossdevicesofdi˙erent
manufacturers.Suchvendor-dependentcontrollerimplementationscanbeexploitedas
a˝ngerprinttodi˙erentiatedevicesfromdi˙erentmanufacturers.Forexample,Texas
Instrumentsbq51013B[75]sendstheCEPswithanintervalof240ms,whilePanasonic
AN32258AsendstheCEPsataperiodof160ms.Thisfeatureisnotrelatedtoclockerror
butavaluechosenatdesigntimebythemanufacturer.Intuitively,determiningtheIC
manufacturerimprovestherecognitionaccuracybynarrowingthecategoriesofthede-
vices.Inadditiontothepacketperiod,thevaluecarriedintheCEPisalsospeci˝edby
thereceiverICmanufacturers.Forexample,weobservethatthemaximumcontrolerror
valuesentbybranddevicesis30,whilethebranddevicescansendthecontrol
21
errorvaluesashighas80.Therefore,itisanotherfeaturethatmaydistinguishthedevice
brand.
3.3.2TemporalFeatureAcquisition
Figure3.10:TemporalFeatureAcquisition.Eachpacketisdecodedandtimestampedby
themicrocontroller(MCU).
WenowdiscusshowtheQIDsensorcollectstemporalfeaturesofQipackets.Figure
3.10illustratessuchaprocedure.First,todecodethebits,theQIDsensorusesatimerto
measurethewidthofeachpulse.AsthedatasentbythePRxisencodedwithadi˙erential
bi-phasescheme,wecanconvertthepulsewidthstobitvalues.Then,thedecodedbits
arethengroupedintobytes.
AQipacketconsistsofpreamble,header,payload,andchecksum.TheQIDsensor
timestampsthepacketafterthe11thbitinthepreamblephaseofeachpacket.Thecorre-
spondingpackettimeintervalisthenthedi˙erencebetweentwoconsecutivetimestamps.
AsdescribedinSection3.1,theQiprotocolde˝nestwotypesofpacketsthathave˝xed
timeintervals.QIDsensormainlyobservesandanalyzestheCEPtimeintervaltoinferthe
PRxoscillatorbecausetheCEPisthemostfrequenttypeofpacketsthataresentduring
thewirelesschargingprocess.Evenifapacketiscorruptedduetodecodingerrors,its
22
timinginformationisstillvalidifonlythepacketintervalisinthedesiredrange.Finally,
thetimestampedpacketsaretransmittedtotheQIDserverforfurtherprocessing.
3.4QIDMotionControl
3.4.1MotionPlatformDesign
Figure3.11:Mechanicaldesign-thechargerpadiscontrolledbytwosteppermotor
linearslides,movingina2-Dsurface.
Inthissubsection,wepresentthemechanicaldesigntoenablethemovementofthe
chargercoil,asillustratedinFigure3.11.Itrequirestwolinearslidespoweredbyastepper
motorindividually.First,thebottomslideis˝xedonasurface.Next,theupperslideis
placedwithitsaxisdirectionperpendiculartothatofthebottomone.Theupperoneis
attachedtothebottomone'sslider.Finally,thechargercoilisattachedtothesliderof
theupperlinearslide.Thetwosteppermotorsarecontrolledindependentlytodrivethe
coilinanX-Yplanetoformamobilecoil.Itthusallowsformore˛exibilityinthePRx
placement.Theusercanplacethedeviceatanylocationandanyangleinthedesignated
area.Correspondingly,wede˝netheaxesofthebottomslideandtheupperslideasthe
x
axisand
y
axisrespectively.Asthelengthsofthetwoslidesarethesame,theworking
23
(a)Symmetricaxissearching.Theupperleftpoint
isthestartingpoint.
(b)Thedesignedtrajectoryofthechargercoilcenter
withinonecomplete˝ngerprintingscan.
Figure3.12:TrajectorydesignoftheQIDsensor.
spaceofthePTxcoilisde˝nedasasquarearea.Ourmeasurementresultsindicatethat
themotionplatformcanachieveacontrolaccuracyupto0.2mm,whichisadequateto
emulateheterogeneousPTxcoildesigns.WeenvisionthattheQIDmotionplatformcan
enableotherapplications,suchaslocatingthePRxandsearchingfortheoptimalcharging
operatingpoints,whicharecriticalforoptimizingthecharginge˚ciency[83].Weleave
theseapplicationsforopenresearchwork.
3.4.2QIDSensorMotionControl
Inthissubsection,wediscussthecontrolschemesfortheproposedQIDsensormotion
platform.
3.4.2.1Contactareaboundarydetection
ThedetectionofthePRxboundaryallowsforbettercoilmovementcontrol.Forexample,
thesteppermotorcanadapttoahigherspeedifthePRxisoutofthecontactrange,orthe
trajectorycanbeoptimizedtoavoidunnecessarymoves,suchthatthetotaltimeneeded
24
forcollectingsu˚cientfeaturescanbereduced.TheQIDsensorutilizesatimertodetect
thecontactboundary.EachtimetheQIDsensorreceivesanewpacket,itreadsthereal-
timetimer(RTT)toupdateavalue
t
last
.Inthemeantime,theQIDsensorreadstheRTT
withaperiodof10mstofetchthecurrenttime
t
n
andcomparesitwith
t
last
.Thenthe
conditionthatthePRxisoutofthecontactrangeisgivenby:
t
n
>
t
last
+
T
timeout
;
where
T
timeout
istheallowedtimethatthePRxdoesnotsendanyfeedback.Wechoose
T
timeout
tobe350ms,whichisthemaximumCEPtimeintervalintheQistandard,aspre-
sentedinTable3.1.Iftheconditionismet,theQIDsensordeterminesthatthePRxloses
itscontactwiththePTx.
3.4.2.2PRxsymmetricaxisalignment
Next,wediscusshowtheQIDsensor˝ndsthesymmetricaxisofthePRxcoilalongthe
y
axis.Findingthesymmetricaxisisimportantbecauseitisthereferenceforthe˝nger-
printingtrajectory.
Weassumethatthedeviceisinthecontactrangeoncetheuserputsitonthecharger
pad.ThePRxsymmetricaxisalignmentisachievedasfollows.Inthebeginning,thePTx
coilmovesalongthepositivedirectionofthe
y
axisuntilitisoutofthecontactrange.
Nextitmovestothenegativedirectionofboth
x
and
y
axis,reachingthestartingpoint
showninFigure3.12a(upperleftcorner).Fromthere,thecoilstartstomoveinan
patternandsweepsacrossthePRxcoilfourtimes,generatingasequenceofthedetected
boundary
»
x
0
;
x
1
;:::;
x
7
¼
.Thenthe
x
valueofthesymmetryaxisis
x
center
=
1
8
7
Õ
i
=
0
x
i
Finally,thePTxcoilisalignedtothe
x
center
withits
y
coordinatevaluerightoutofthe
contactrangeboundary.Thislocationisthestartingpointofthecoilinthe˝ngerprinting
phase.
25
Wenotethat,foramulti-coilPTx,thisphasecanbeachievedbyswitchingbetweenthe
coilsandidentifyingtheonewiththehighestcoupling.
3.4.2.3Fingerprintingtrajectoryplanning
NowwepresentthePTxcoiltrajectorydesignwhentheQIDsensorcollects˝ngerprints
fromthePRx.Wetaketwofactorsintoaccountwhendesigningit.Ontheonehand,it
iscrucialtoensuretheQIDsensorcapturesadequatedatafromthemobilecoilinFigure
3.7b,suchthatQIDrecordsthecompletefeaturepro˝leofthePRx.Ontheotherhand,
themoredatapointsaremeasured,themoretimeittakes.Typically4or5packetscan
becollectedduringonesecond.Ifweplantorecord3,000CEPs,itmaytakemorethan
10minutesandexceedthetimeoneleavesthephoneonthechargerpad.Therefore,we
needto˝ndatrade-o˙betweenspatialdatadiversityandmeasurementdelay.Inour
design,weassumethatthePRxwillbeleftstationaryontheplatformforatimewindow
ofatleast90seconds,suchthattheQIDsensorcapturesadequate˝ngerprintsfordevice
identi˝cation.
Thedesigned˝ngerprintingtrajectoryoftheQIDsensorisshowninFigure3.12b.It
comprisestwosessions,namelytheforwardoneandthebackwardone.Duringboth
sessions,theQIDsensorrecordsallthepacketssentbythePRxanduploadsthemtothe
server.TheforwardsessionstartsfromtheendpointofthePRxsymmetricaxisalignment
phase.ThePTxcoilisdriventomovealongthepositivedirectionofthe
y
axis.Once
itentersthecontactrange,thecoordinatevalue
y
start
isrecorded.Inthemeantime,the
movingspeedofthecoilissettoaslowerspeed.Itstopsfor1secondeachtimeafter
movingforwardforabout8mm(correspondingto40controlunitsinFigure3.12b)towait
fortheoperatingpointhopping,whichalsomimicsthecoilswitchinginanarray.Once
thePTxlosescontactwiththePRx,i.e.,thePRxisoutofthecontactrange,theboundary
point
y
end
isrecorded,whichalsomarkstheendoftheforwardsession.Thebackward
traceissimilartothecenteralignmentone,whichisinshape.Themajordi˙erence
26
isthatthedistance

x
betweenthefarthermostpointandthesymmetricaxisisabout10
mmalongthe
x
axis,correspondingto50controlunits.Themovementalongthenegative
y
directionisdividedinto6sections.Eachofthemis

y
=
y
end

y
start
6
Ateachturningpoint,thePTxcoilstopsfor1secondtowaitfortheoperatingpointhop-
ping.Afterthecoilreachestheforwardsessionstartingpoint
¹
x
center
;
y
start
º
,the˝nger-
printingphase˝nishes.Wede˝neacompletescanasthecompletionofboththeforward
andbackwardsessions,andthedatacollectedduringthisphasearede˝nedasa
scan
sample
correspondingly.Itislaterpost-processedattheQIDserver.
Thereareseveralreasonswhysuchatrajectoryisdesigned.First,itcoversthecentral
areaofthecontactrange.EvenifthePRxchangesitsplacementanglenexttime,thecentral
regionstilllargelyremainsoverlapping.Asaresult,thetwoindependentscansamples
donotdeviatesigni˝cantly.Second,thedistance

x
iscarefullychosentoaccommodate
di˙erentcoilshapesandsizes.NomatterhowthePRxisplaced,theplannedtrajectory
fallswithinthecontactrangeformostofthetime.Thetrajectoryisalsoabletotolerate
thesymmetricaxisalignmenterroruptoabout8mm(correspondingto40controlunits).
Finally,thesamelocationis˝ngerprintedforatmostonce,astheforwardandbackward
tracesdonotoverlapexcepttheregionwherethecoilcenterentersorexitsthecontact
area.
3.5FeatureExtractionandDeviceClassi˝cation
Inthissection,wepresenthowtheQIDserverextractsthefeaturesfromthemeasured
dataandclassi˝esthefeaturesintodi˙erentdeviceclasses.
3.5.1FeatureExtraction
Wenotethatthecontactrangediameterofthereceivingcoilphysicalfeaturecanbesimply
calculatedas
y
end

y
start
.TheoscillatorfeaturesandthePRxcontrolschemesrequire
27
Figure3.13:GaussiankerneldensityestimationofCEPtimeintervals.Theletters
indicatethedevicebrands.Thenumberindicateseachuniquedeviceofitsbrand.The0
inthehorizontalaxiscorrespondsto240msinrealtimescale.
additionalprocessingtoobtain.Wediscussthemasfollows.
3.5.1.1CEPintervalfeatures
TheQIDserverusesalocalmaximumsearchingalgorithmtoextracttheCEPtimein-
tervalsthatrepresentthefeatureofthePRxonboardoscillator.First,alltheCEPtime
intervalsareprocessedwitha˝xedbandwidthGaussiankerneldensityestimator(KDE).
Unlikethehistogram,theGaussianKDErepresentstheprobabilityofeachpointinthe
featurespacewitha˝xed-varianceGaussiandistribution,i.e.,theGaussiankernel,and
thentheestimationoutputistheaveragedsumofalltheindividualkernelprobability
estimations.TheoutputoftheKDEisactuallytheprobabilitydensityfunction(PDF)of
theCEPtimeinterval.
d
¹
t
º
=
pdf
¹
t
º
;
t
2»
40
;
270
¼
ms
28
Notethatthevariable
t
hereisintimedomainrepresentation,whilethefeaturevalues
correspondtotheQIDsensorcontrollertimervalues.
Next,theQIDserverextractstheCEPtimeintervalsthatachievelocalmaximumsinthe
PDF.WeobservethattheCEPtimeintervalstypicallyfallinto3domains,corresponding
to[40,60],[140,160],[235,270]msintimedomain(asshownasthethreelocalmaxima
inFigure3.13).Therefore,itisfeasibleto˝ndthepeaksdirectlywithoutcalculatingthe
derivativeoftheCEPtimeintervalPDF.Speci˝cally,the3domainsaredenotedas
D
1
,
D
2
,and
D
3
respectively.ThenthefeatureCEPtimeintervalsandtheircorresponding
log-probabilitiesare
t
pi
=
argmax
t
2
D
i
d
¹
t
º
;
i
=
1
;
2
;
3
:
p
Li
=
log
d
¹
t
pi
º
;
i
=
1
;
2
;
3
:
Thedetectedpeaksof8independentcompletescansamplesaremarkedinFigure3.13.
TheCEPtimeintervalthatcorrespondsto240msinthetimedomainisshiftedto0.Al-
thoughsomeofthecurvesappearclosetoeachotherinthe˝gure,theirpeak-indexed
CEPtimeintervalfeaturesactuallyspanaconsiderablewiderangeinthefeaturespace,as
showninFigure3.8andthezoom-insub-˝gureinFigure3.13.Inthezoom-in˝gure,we
seethattheindexedtimeintervalvalueshavelittleintra-classvariabilityandinter-class
similarity.Forexample,althoughandarefromthesamebrand,theirpeakin-
dexesdeviatefromeachotherwithadistanceupto20,whilethethreepeakindexesof
deviceareconsistentduringthethreeindependentscansthatarecollectedinawide
timespan.
3.5.1.2CEPvaluefeatures
QIDalso˝ngerprintsthecontrollerofaPRxbasedonthestatisticoftherecordedCEP
valuesduringacompletescan.WhattheCEPvaluedi˙ersfromtheCEPtimeintervalis
thattheformercanonlytakeintegervalues.WeanalyzeCEPvaluesusingtheprobability
29
massfunction(PMF).Speci˝cally,wecomputethePMFoftheCEPvaluesas
p
¹
V
º
=
Í
N
i
=
1
1
f
v
i
==
V
g
N
where
V
istheabsoluteCEPvalue,rangingfrom0to127,
1
f
a
==
b
g
isanindicatorfunc-
tion,and
N
isthetotalnumberofCEPsinascansample.Inparticular,
N
ischosentobe
oneoftheCEPvaluefeaturesbecauseitisanindirectmeasurementofthefrequencythat
thePRxsendsCEPs.AswenoteinSection3.3.1,itisaPRxcontrollerimplementation-
speci˝cfeatureratherthantheoscillatordrift.We˝ndthatthePMFoftheCEPvalues
isnotagoodfeature,asthePMFsspanawiderangeof[0,127],whichintroduceshigh
varianceintheoutputfeatures.Wealsoobservethateventhesamedevicemaygener-
atedi˙erentPMFswithindi˙erentscansamples.Toreducethevarianceintheoutput
CEPvaluefeatures,wefurthergrouptheCEPvaluesinto7ranges.Foreachrange,the
probabilitiesoftheCEPvalueswithintherangearesummedup.Speci˝cally,the7ranges
are:0,[1,5],[6,10],[11,20],[21,30),30,(30,127].Wechoosetheserangesempiricallyby
correlatingthestatisticalpatternsoftherangeswiththedevicebrand.
Figure3.14:ComparisonoftheCEPvaluefrequencyfor4di˙erencedivices.G0toG7
correspondtothesevenPRxcontrollerfeaturefrequencyrangeinTable3.2.
Table3.2summarizesthefeaturesusedinclassi˝cation.Thesefeaturesarecollectedin
bothsteadychargingstatesandoperatingpointswitchingtransientstates,throughwhich
30
Table3.2:Thelistoffeaturesextractedfromacompletescan.
FeatureGroupFeatureValueRange
Oscillator
feature
Domain1CEPinterval[40,60]ms
Domain1CEPintervalpeaklog-probability
Domain2CEPinterval[140,160]ms
Domain2CEPintervalpeaklog-probability
Domain3CEPinterval[235,270]ms
Domain3CEPintervalpeaklog-probability
SampletimeTimeneededinacompletescan>0
ContactrangeTherangethatPRxinteractswithPTx[220,260]
controlunit
PRxcontroller
feature
Numberofpackets>0
CEPvalue=0frequency[0,1]
CEPvalue
2
[1,5]frequency[0,1]
CEPvalue
2
[6,10]frequency[0,1]
CEPvalue
2
[11,20]frequency[0,1]
CEPvalue
2
[21,30)frequency[0,1]
CEPvalue=30frequency[0,1]
CEPvalue
2
(30,127]frequency[0,1]
QIDextractsthe˝ngerprintsintheoscillator,coilandthecontrollerforclassi˝cation.We
envisionthatthePRxcontrollerfeaturescanseparatethedevicebrandandtheoscillator
featurescanthenfurtherseparatethedeviceswithinthesamebrand.Figure3.14shows
thefrequencydistributiongroupedbytheCEPvaluerangefor4di˙erentdevices.Aswe
cansee,di˙erentPRxbrandsexhibitsigni˝cantlydistinctCEPvaluepreferencesduring
thewirelesschargingfeedbackcontrol.Therefore,thesePRxcontrollerfeaturescanbe
usedtocategorizethedevicebrande˙ectively.
3.5.2Classi˝cation
TheQIDserverclassi˝esQi-compliantdevicesbyanensembleclassi˝er,alsoknownas
comprisingofSupportVectorMachine(SVM)[10],AdaBoost[30]
withdecisiontreeasweaklearner,decisiontreeclassi˝er[12],
k
-NearestNeighbor(kNN)
[20],andLinearDiscriminantClassi˝er(LDC)[59].Thebaggingalgorithminourdesign
utilizesavotingsystem,asshowninFigure3.15.When3ormoreclassi˝ersareoutputting
31
Figure3.15:Classi˝cationprocesswithabaggingclassi˝ersinQIDserver.
thesamedevicelabel,thebaggingclassi˝erchoosesitasthe˝naldecision.Otherwise,
theoutputoftheSVMischosenbecauseithasrelativelyhigheraccuracythantheother
classi˝ers.Wedesignthisclassi˝erarchitecturebytuningtheclassi˝ersempirically.
TheQIDserverstoresalltheextractedfeaturesandtheircorrespondingdevicelabels
inafeaturetable.Thenitutilizestherepeatedrandomsub-samplingcross-validation,also
knownasMonteCarlocross-validation[27],tosplitthedataintotrainingandtestingset
randomly.Finally,theclassi˝ermodelsaretrainedwiththetrainingsetandvalidatedwith
thetestingset.Themeanandthestandarddeviationofaccuracyfromtheresultsofthe
sub-samplingexperimentsarerecorded.Itisshown[36]thatcross-validationevaluation
introducesneighborhoodbiastothetime-continuousslidingwindowframedata,which
resultsinoverlyoptimisticmodelevaluationestimations.However,inourexperiments,
eachofthesamplesiscollectedinawidespaninthetimedomain.Inotherwords,allthe
featuresextractedfromacompleteexperimentscanareindependentofeachother.Asa
result,thecross-validationissuitableforourexperiments.
TheobjectiveoftheQIDserverisfocusedonclassifyingthedeviceintooneofthe
knownclasses.Thisdesignisapplicabletothescenarioswherethedevicesarealready
˝ngerprinted.Forinstance,acompanymayregisterand˝ngerprintalltheworkdevices
ofemployees,andthenuseQIDtotrackthelocationofeachdevice.However,QIDcan
beeasilyextendedtorecognizenewdevicesviaonlinelearning.Forinstance,bysettinga
detectionthresholdintheclassi˝er,QIDcanidentifywhetherthenewlycollectedsample
32
correspondstoanydevicethatisalreadyrecorded.Ifthesample'sprobabilityofcorre-
spondingtoanexistingdeviceislow,QIDcanrecognizethedeviceasanewone.
TheQIDserverstoresalltheextractedfeaturesandtheircorrespondingdevicelabels
inafeaturetable.Thenitutilizestherepeatedrandomsub-samplingcross-validation,
alsoknownasMonteCarlocross-validation[27],tosplitthedataintotrainingandtesting
setrandomly.Finally,theclassi˝ermodelsaretrainedwiththetrainingsetandvalidated
withthetestingset.Themeanandthestandarddeviationofaccuracyfromtheresultsof
thesub-samplingexperimentsarerecorded.
TheobjectiveoftheQIDserverisfocusedonclassifyingthedeviceintooneofthe
knownclasses.Thisdesignisapplicabletothescenarioswherethedevicesarealready
˝ngerprinted.Forinstance,acompanymayregisterand˝ngerprintalltheworkdevices
ofemployees,andthenuseQIDtotrackthelocationofeachdevice.However,QIDcan
beeasilyextendedtorecognizenewdevicesviaonlinelearning.Forinstance,bysettinga
detectionthresholdintheclassi˝er,QIDcanidentifywhetherthenewlycollectedsample
correspondstoanydevicethatisalreadyrecorded.Ifthesample'sprobabilityofcorre-
spondingtoanexistingdeviceislow,QIDcanrecognizethedeviceasanewone.
3.6Implementation
Inthissection,wepresenttheimplementationoftheQIDsystem.Figure3.16showsa
QIDsensorprototype.
QIDsensorbasestation.
ThebasestationisthemechanicalcomponentoftheQIDsensor,
whichisbuiltonaclearacrylicboard.Thetwosteppermotorlinearslidersenablethe
motionalongthe
x
and
y
directionrespectively,withamovingdistanceof90mmeach.
Aswitchisaddedtooneendofeachscrew,suchthattheMCUcanresettheposition
eachtimethesystemispoweredon.Anotherclearacrylicboard(notshowninthe˝gure)
supportedbyfournylonhexspacersisthesurfacethatthemobiledeviceisputon.The
costofthemechanicalcomponentsislessthan$20.Thereforeitisfeasibletobemassively
33
Figure3.16:AprototypeoftheQIDsensor.
deployedinthepublicarea.
Embeddedcontrollerandmotordriver.
AtthecenteroftheQIDsensor,theAtmelSAMG53N19
[4]MCUisemployed,whichisresponsiblefordecodingandtimestampingpackets,driv-
ingthesteppermotors,andsendingcollecteddatatotheQIDserver.TheMCUsupports
theUARTcommunicationwiththeserverviaaUSBvirtualCOMMport.Themotordriver
ICisToshibaTB6612FNG,whichsharesthepowerwiththeQiPTx.Thepeakmotordriv-
ingcurrentisaround150to200mA,whichisnegligibletotheQiwirelesschargingsystem
becauseatypicalCOTSUSBchargercanprovide2000mAcurrentat5V.
Qi-compatiblepowertransmitter.
WechooseaCOTSGMYLEMiniQiChargingPad
asthePTx,whichisconnectedtotheMCUviaadata˛owdebugpin.ThePTxcoilis
extendedwithapairofwires,whichprovidesextra˛exibility,suchthatthecoilmoves
withoutdraggingthechargercircuitboardaround.
TheQIDserver.
Attheserverside,thefeatureextractionandclassi˝cationmodulesare
34
implementedusingapproximately1,100linesofPythoncodes,includingthe
pySerial
UARTlibraryfortheQIDsensorcommunicationhandlerandthemachinelearninglibrary
scikit-learn
[64]forclassi˝cation.
3.7Evaluation
Inthissection,wepresenttheperformanceevaluationofQIDbasedon52Qi-compliant
devices.We˝rstpresenttheevaluationsettingsandthendiscussfeatureanalysis,mea-
surementdelayanalysis,classi˝cationaccuracy,featurebackwardsearch,andaccuracy
breakdowntest.
3.7.1EvaluationSettings
Weevaluate52Qi-compliantdevicesintotal,including7GoogleNexus4(labeledas
and45attachablePRxmodulesfrom6di˙erentmanufacturers,includingDigiYes,
Hugchg,andRAVPower.WenotethattheICsinthesemodulesarewidelyusedinmain-
streammobiledevices.Forexample,theTexasbq51013BintheDigiYesmodulesisalso
adoptedbyGoogleNexus5.Foreachdevice,weconduct10completeindependentscans
tocollect˝ngerprints.Intotal,thereare520scansamples.Tosimulatetheusers'device
placementbehaviorintherealworld,wealterthephoneplacementmanually.Speci˝-
cally,forthe˝rstscan,thephoneisalignedwiththe
x
axisofthemotionplane.Forthe
nextsevenscans,thedeviceisrotatedcounter-clockwisefor45

eachtime.Forthelast
twoscans,thephoneisplacedonthepadatarandomangle.
WevisualizetheCEPpacketintervalswithrespecttothePTxcoillocationinFigure
3.17.AsshowninFigure3.17a,merelyusingthesamplecollectedinoneexperimentmay
leadtobiasedresultsbecausethefeaturesareextractedfromalimitednumberofcou-
plingsbetweenthetwocoils.Whilethedatapointsfrommultiplemeasurementrounds
areaggregated,asshowninFigure3.17b,thepointcloudcoversthemajorityofthecontact
rangebetweenthetwocoils,providingadequategroundtruthforclassi˝cation,whichcan
35
(a)Pointcloudin3Dspaceforonesamplingex-
periment.
(b)Pointcloudafteraggregationfrommultipleex-
periments.Di˙erentyersofthepointscorre-
spondtodi˙erentpeaksinFigure3.13.
Figure3.17:Pointcloudillustration.
accommodateunpredictabledeviceplacements.
Toquantifythecontributionofthemotionplatform,werepeatthiswholeprocessfor
once
without
movingthechargercoilwithrespecttothePRx.Weconsiderthisasour
baseline
andwilldiscussitinSection3.7.3.
Inclassi˝cation,thetraining-testingsplitratiois7:3.Inotherwords,7outofthe10
samplesforeachdevicearerandomlychosentotraintheQIDclassi˝ermodel,andthe
remainingscansamplesarefortesting.Suchaprocessisrepeated10times.Theaverage
accuracyandthestandarddeviationofeachclassi˝erarereported.Inaddition,thehyper-
parametersinalltheimplementedclassi˝ersaretunedbythegridsearch.Asdiscussed
inSection3.5.2,weassumeallthedevicesarealready˝ngerprintedandrecordedinthe
database.
3.7.2MeasurementDelay
Themeasurementdelayisde˝nedasthetimedelayfromthemomentwhenthepower
receiverisbootedtothemomentthattheserverproducesadevicelabel.Speci˝cally,the
36
Table3.3:ThemeasurementdelayintheQIDsystem
SymbolDe˝nitionMean(s)Std(s)
T
1
Coilsymmetricaxisalignmenttime8.0500.927
T
2
Fingerprintingtime55.4786.092
T
3
Featureextractiontime0.1470.006
T
4
Classi˝cationtime0.001N/A
measurementdelay
T
M
is
T
M
=
T
1
+
T
2
+
T
3
+
T
4
where
T
1
isthecoilsymmetricaxisalignmenttime,
T
2
isthe˝ngerprintingtime,
T
3
isthe
featureextractiontime,and
T
4
istheclassi˝cationtime.Themeansandstandarddevia-
tionsofthesemeasurementdelaytermsarepresentedinTable3.3.
Asonecansee,the˝ngerprintphasetime
T
2
isaround55.5s,whichcontributesthe
mosttothetotalmeasurementdelay.Thusreducingthetime
T
2
iscrucialinfurtheropti-
mizingthemeasurementdelay
T
M
.
Themeasurementdelayisactuallyacceptableduetothecharacteristicsofwireless
charging.First,unlikeotherwirelesscommunicationsystemswheretheuserisusually
inmobility,thechargingprocessusuallytakesmorethan10minutes,duringwhichthe
userdeviceremainsstationary.Second,inthetargetedscenarios,suchasaco˙eeshop
thato˙erslocationandpersonalizedservicestocustomers,theusersneedtoregistertheir
devicesbeforeusingsuchuser-identi˝cationservice.Duringtheregistrationprocess,QID
cancollect8-10di˙erentsamplesforfuturerecognition.Finally,previoussystemsthat
exploitclockdriftsfordeviceidenti˝cationhavesimilardelayperformance.Forexample,
BlueID[38]takes21secondsfordatatra˚cor65secondsforvoicetra˚ctoguarantee
thelowmeasurementerror.In[44],ittakesthesystemhourstocollectenoughpackets
inordertodistinguishdevices.Therefore,the60-secondmeasurementdelayinQIDis
acceptable.
37
Figure3.18:Thecross-validationscoreanddevicebranddetectionaccuracyofdi˙erent
classi˝ers.
Figure3.19:Theimpactoffeatureselectionontheclassi˝cationaccuracy.G1:
classi˝cationwithouttheCEPtimeintervalfeatures;G2:allfeaturesareincluded,but
theyaremeasuredwithoutthemotionplatform;G3:classi˝cationperformanceusing
theCEPtimeintervalfeaturesonly;G4:allfeaturesareincluded.
3.7.3Classi˝cationAccuracy
We˝rstpresenttheoveralltestaccuracyofthecross-validationstudy.Theoverallaccu-
racyistheratioofthenumberofcorrectlyclassi˝edscansamplestothesizeofthetest
38
Figure3.20:Confusionmatrixofthe52evaluateddevices.
set.Figure3.18showsthemeansandstandarddeviationsoftheimplementedclassi˝ers
from10repeatedrandomsub-samplingcross-validationfolds.Asshowninthe˝gure,
alltheimplementedclassi˝erscanrecognizethedevicebrandwithameanvalidation
accuracyupto96.1%.Particularly,thebaggingclassi˝eridenti˝esthebrandwithupto
97.9%meanaccuracy.Themobiledevicebrandclassi˝cationaccuracyisofinterestbe-
causeofthefollowingtworeasons.First,itisthefoundationofdevicerecognition.As
mentionedinSection3.3.1,althoughtheCEPintervalisagooddeviceseparator,itcon-
39
fusessomedevicesfromdi˙erentbrands.Ifthedevicebrandissuccessfullyidenti˝ed,
theQIDservercanreducetherangeofdevicecandidatesandincreasetheoveralldevice
classi˝cationaccuracy.Moreover,brandrecognitioncanenableapplicationslikedevice
brand-speci˝cadvertisement.Fordeviceidenti˝cation,thebaggingclassi˝erachievesan
averageaccuracyof85.2%.ThehighestaccuracyachievedbyQIDis89.7%.Toillustrate
theclassi˝erperformance,aconfusionmatrixisplottedinFigure3.20.Generally,themis-
classi˝edsamplesarefromthedevicesofthesamebrandthathavecloseclockdrifts.For
instance,therearetwodevices,namelyandwhoseall3testsamplesaremis-
classi˝ed.However,somedevicesareclassi˝edintodi˙erentbrandsduetotheirclose
valuesinfeaturespace.
Next,wequantifytheperformanceofthemotionplatform,namelythemulti-coilarray.
TheG2inFigure3.19showsthebaselineresult,wherethemotionunitisnotenabled.
Eachdeviceissampledwithoutthemotioncontrolfor55seconds,correspondingtothe
delay
T
2
inSection3.7.2.Weplottheclassi˝cationaccuracyofQIDinFigure3.19G4for
comparison.Aswecansee,thedevicerecognitionrateincreasesby17%bybothSVMand
baggingclassi˝erswhenthemotionplatformisenabled.Thebrandrecognitionaccuracy
isalsoboostedby8%.Itisindicatedthatthemotionplatformplaysanimportantrole
inachievingreliableandsu˚cientdevicefeaturesforclassi˝cationduetoitsabilityto
extract˝ngerprintsfrommorespots,whichcapturesamorecompletepro˝leofadevice.
3.7.4ImpactofFeatureSelection
Notallfeaturesareequallyimportant.Figure3.21andFigure3.22showsthedistribution
oftwofeaturesrespectively,obtainedfrom42outofthe52devices,namelythetotalnum-
berofpacketsperscanandthefrequencyoftheCEPvalue0.ThedistributionofotherCEP
valuefrequenciesyieldssimilartrendsasshowninFigure3.22andisthusomitted.These
twofeaturescontainmorenoisethantheCEPinterval(asshowninFigure3.8).Nonethe-
less,intuitively,thesefeaturesareabletoseparatedeviceclassestosomeextent.Wenext
40
Figure3.21:Numberofpacketperscanfeaturedistributionof42devices(10samplesper
device).
Figure3.22:ThefrequencyofCEPvalueequaling0distributionof42devices(10
samplesperdevice).
conductthebackwardsearchtoevaluatethee˙ectivenessofeachselectedfeature.
Weperformtwocasestudies.Inthe˝rstcaseweevaluatethebaggingclassi-
˝erwithouttheCEPtimeintervalfeatures,i.e.,theonboardoscillator˝ngerprints.In
otherwords,onlytheCEPvaluefeaturesareused.Inthesecondcaseweevaluate
thebaggingclassi˝erwithonlytheCEPtimeintervalfeatures.Theresultsofthesetwo
casestudiesareshowninFigure3.19.Weobservethatthedevicerecognitionaccuracies
41
ofboththebaggingandtheSVMclassi˝erdegradetoabout21%inG1,whichindicates
thesigni˝cantcontributionoftheonboardoscillator˝ngerprinttodeviceidenti˝cation
performance.Anotherobservationisthat,althoughtheCEPvaluefeaturesfailindevice
recognition,theyarestillabletodistinguishthebrandswith75%accuracybythebagging
classi˝er.Next,wecompareG3andG4.Wecanseethatboththedeviceandbrandrecog-
nitionaccuraciesofthebaggingclassi˝erareimprovedbyabout2.5%byaddingtheCEP
valuefeaturestotheCEPtimeintervalfeatures.ThisindicatesthatalthoughtheCEP
valuefeaturesarenotasimportantastheonboardoscillator˝ngerprints,ithelpsQID
toreduceuncertaintyandachievehigheraccuracy.However,asthenumberofdevices
increases,thechanceofCEPinterval(PRxoscillator)featureoverlappingisexpectedto
increase.Insuchacase,thePRxcontroller˝ngerprintswillprovidethenecessarydevice
brandidenti˝es,thusreducingthecollisioninthefeaturespace.
3.7.5RecognitionAccuracyBreakdown
AnothercharacteristicoftheQIDsystemisthathowrobusttheselected˝ngerprintsare.
Inotherwords,howistheclassi˝erperformancein˛uencedwhenmoredevicesareadded
tothefeaturedatabase?Herewepresenttheresultsoftherecognitionaccuracybreak-
down.Inthiscasestudy,weevaluateboththedeviceandbrandrecognitionaccuracyof
thebaggingclassi˝erconcerningasequenceofthedevicenumbersfrom5to50,withan
incrementof5.Foreachdevicenumber
N
i
inthelist,we˝rstrandomlychoose
N
i
devices
outofthe52devicesandthenperformtheMonteCarlocross-validationontheirscansam-
ples10timestoobtainthemeantestaccuracy.Foreach
N
i
,suchaprocessisrepeatedfor
6rounds.Finally,themeanandstandarddeviationfromtheresultsofthese6roundsare
recorded,asshowninFigure3.23.Thebrandrecognitionaccuracykeepsatahighlevel
around97%regardlessoftheincreaseinthenumberofdevices.However,thedevice
recognitionaccuracydecreasesbyabout1.3%eachtimethenumberofdevicesincreases
atincrementsof5.Ifthistrendcontinues,whenthenumberofthedevicereachesabout
42
Figure3.23:Devicerecognitionaccuracychangeswiththenumberofdevices
180,thedeviceaccuracydecreasesto50%.However,wenotethatthepowerreceiversmay
havemuchhigherdiversityregardingthedevicebrandinreal-lifescenariosthanthatin
ourevaluationsetting.Therefore,theQIDcanpotentiallybene˝tfromthehighbrand
accuracyandthusaccommodatemoredevicesthanthenumberofdevice180calculated
above.
3.8ConclusionandDiscussion
Inthisresearchwork,wepresentourdesignandimplementationofQID,the˝rstsystem
thatrecognizesQipowerreceiversduringwirelesschargingusing˝ngerprintsfromthe
onboardoscillator,coilcharacteristics,andcontrolschemeofthewirelesschargingsystem.
QIDalsoemploysamovementunittoemulatemulti-coilpowertransmitters,whichallows
for˝ne-grained˝ngerprinting.OurevaluationresultsshowthatQIDachievesanoverall
identi˝cationaccuracyofupto89.7%,withanaverageof85.2%.Moreover,QIDcanrec-
ognizethedevicebrandwithanaverageaccuracyof97.9%.Therefore,wedemonstrate
43
thefeasibilityofleveragingpublicwirelesscharginginfrastructurefortrackingmobile
usersandprovidingID/location-basedservices.Ourresultsalsoopenupnewresearch
questionsonhowtopreventtheleakageofuser'slocationwiththeincreasingwireless
chargingstationdeploymentinpublic.
QIDhasseverallimitations.First,unlikeotherwirelesscommunicationsystemswhere
passiveremotesensingandrecognitionarepossible,QIDadoptsauser-initiateddevice
recognitionapproach.Thisnarrowsitsapplicationsbecauseitrequiresphysicalcontact
betweenthedeviceandthesensor.However,thiscouldalsobeanadvantagebecauseit
preservestheuser'sawarenessandthusprotectstheuser'sprivacy.Second,atthisstage,
QIDrequiresmotionpartstoachieve˝ne-grained˝ngerprinting.Weenvisionachieving
devicerecognitioninwirelesschargingusingonlystationarymulti-coilchargers.How-
ever,sincethecommerciallyavailablemulti-coilchargersarenotreadyfordevicerecog-
nitionyet,ourQIDsensorimplementationmainlyfocusesonemulatingamulti-coilarray
withmotioncontrol.Weexpectnomotionunitisneededinthereal-worldimplementation
anddeployment.Nevertheless,themechanicalstructurecouldbepossiblyre-designedto
achieveasmallerformfactor.Finally,wenotethatthechargingprocessmaycauseseveral
short-timechargingdisruptions(about1to2secondseach)duetothedecouplingbetween
thePTxandPRxcoils.Insuchacase,theuserexperiencemaybepotentiallyimpacted.
However,asdiscussedabove,themeasurementdelayisabout55seconds.Afteradevice
issuccessfullyidenti˝ed,thePTxcoilwillmovetoaposition(orswitchtoaparticular
physicalcoil)thatachievesthemaximumcoilcouplingtocontinuethepowerdelivery
process.
Our˝ndingshaveimportantimplicationsforuserprivacy.Privacyisaprimarycon-
cernindevicerecognitionsystemslikeQID.Infact,theQispeci˝cationitselfkeepsdevice
informationsecurely.Forexample,QIDcanonlyidentifyadevicebasedonthephysical
˝ngerprintsoftheQiPRxmodule.Itwillnotandcannotrecordanyinformationaboutthe
phoneitselfincludingoperatingsystem,phonenumber,aswellasbattery-relatedvalues,
44
suchasvoltagelevel,energypercentage,andhealthrecord.
Fromanotherperspective,thepublicshouldbeawareoftheirprivacywhenusing
wirelesschargingbecauseitwouldpossiblyleakthelocationinformationofaparticular
device.Hackersmaypreciselylocalizeatargeteduserformaliciouspurposes.Thereare
su˚cientreasonsfortheQiPRxmoduletoo˙erusersthechoicetogeneratetheirDevice
IDrandomly.Themobilephonemanufacturerandthemobilephoneoperatingsystem
shouldalsoo˙erthechoicetoshutdownthewirelesschargingfunctionalitywhenthe
userintendsto.Tothebestofourknowledge,theyarenotimplementedinanyQi-based
wirelesschargeabledeviceyet.Thelocationofamobiledevicemaybetrackedwhenthe
userchargesmobiledevicesinpublicwirelesschargers.Mitigatingsuchpossibleuser
privacybreachesisopentofutureproblems.
Anotheropenproblemistodesignacompactcoilantennatoextractthedatadirectly
fromthewirelesspowerinterface,suchthattheQIDsensorcanbenon-intrusivetothe
PTx.ItisalsopossibletoexplorenewQIDsensor˝ngerprintingtrajectoriestofurther
reducethemeasurementdelay.Althoughtheusersusuallyinitializetheirmobiledevice
registrationbythemselvesinourtargetedscenarios,wecallforthedesignofe˚cienton-
linemachinelearningalgorithmstoclassifyunknowndevices,suchthatQIDprovidesan
easy-to-useinterfaceandenablesawiderrangeofapplications.Wecanachievethisby
quantifyingthesimilaritybetweentheincomingsamplefeatureswiththeonesalreadyin
ourdatabase.Ifthedi˙erenceexceedsathreshold,QIDdeterminesthesamplebelongs
toadevicethathasnotbeenseenbefore.
45
CHAPTER4
UNDERSTANDINGPOWERCONSUMPTIONOFNB-IOTINTHEWILD:TOOL
ANDLARGE-SCALEMEASUREMENT
4.1ChapterIntroduction
NarrowbandInternet-of-Things(NB-IoT)isalow-powerwide-areanetwork(LPWAN)
speci˝cationdevelopedbythe3rdGenerationPartnershipProject(3GPP)in2016.NB-IoT
envisionsananytime,anythingconnectivityparadigmforawidespectrumoflowdata
rate,largevolume,andlonglifetimeIoTapplications,includingsmartgrid,smartstreet-
lamp,parkingmanagement,airqualitysensing,andintelligentagriculture.Currently,
NB-IoThasbeenlaunchedgloballywith93commercialnetworks,whilethereare140op-
eratorsin69countriesinvestinginNB-IoTnetworkdeployment.Oneofthekeyfeatures
oftheNB-IoTnetworkisthepromiseoflongbatterylife,upto10years.Understanding
howtheenergyisspentandidentifyingpossibleenergyloopholesintheNB-IoTnetwork
arethusofgreatimportance.
Unfortunately,todate,thekeyaspectsofNB-IoTperformanceandpowerconsump-
tionhavenotbeenwellunderstood,especiallytodevelopersandacademicresearchers.
Thisisduetothreekeychallenges.First,NB-IoTisaclosedcellularnetworkdeployed
byoperatorsonlicensedspectrum,wherethebasestationscannotbeaccessedforpub-
licmeasurements.Themessage-levelinteractionsbetweenthenodeandbasestationare
largelyinaccessibletothedevelopersandresearchers.Second,NB-IoTmeasurementis
fundamentallydi˙erentfrom3/4Gcellularnetworkmeasurement,wherethelattercould
beconductedthroughmobileapplicationsinstalledonmassivemobiledevices.Incon-
trast,anIoTapplicationmayconsistofnumerousnodesembeddedintheenvironment
overalargegeographicregion,whichpresentsahighbarrierforunderstandingtheper-
formanceofNB-IoTinthewild.Inparticular,NB-IoTnetworksdi˙ersigni˝cantlydueto
46
variationsofoperatorcon˝gurations,modulesfromdi˙erentvendors,andlocationpro-
˝les.Finally,therelacke˙ectivetoolsthatcanexposethelow-leveldiagnostictracesfrom
NB-IoTnodes,supportlarge-scalemeasurementstudies,andcapturethehighlevelofhet-
erogeneityofnetworkoperators,NB-IoTmodules,andlocationpro˝les.
Inthischapter,weproposeourdesignofNB-Scope,the˝rsthardwareNB-IoTdiag-
nostictoolthatsupports˝ne-grainedfusionofpowerconsumptionandprotocolmessage
tracesforbothreal-timein-labbenchmarkingand˝eldtesting.NB-Scopeisapowerful
toolthatcanadvancetheresearchofNB-IoTbyallowingtoinstrumentlarge-scaleopera-
tionalNB-IoTnetworksandexperimentwithvariousprotocol-leveloptimizations.Next,
weconductalarge-scale˝eldmeasurementstudybasedonthedeploymentof30NB-
Scopenodesatover1,200locationsin3regionsof2countriesduringaperiodofthree
months.Ourin-depthanalysisofthecollected49GBdebuglogsandcurrentconsumption
tracesrevealsseveralimportantinsightsintothepowerconsumptionofNB-IoTinthewild.
Weshowedthatnodesyieldsigni˝cantlyimbalancedenergyconsumptionacrossdi˙er-
entlocations,operators,andmodulevendors.Forinstance,theratioofthehighestand
lowestenergyconsumptionofnodescanbe75:1.Bydecomposingtheenergyconsumma-
tionbyradioaccessphrasesina˝ne-grainedmanner,weshowedthatsuchperformance
variancecanbeattributedtoseveralkeyfactorsincludingpoornetworkcoveragelevel,
long-tailpowerpro˝leduetoconservativeinactivitytimersettings,andexcessivecontrol
messagerepetitionsduringrandomaccesscontrol.
Therestofthischapterisorganizedasfollows.First,Section4.2brie˛yintroducesthe
NB-IoTtechnology,aswellastheradioaccessproceduresandtheenergymanagement.
Nest,Section4.3presentsNB-Scopedesign,aplatformforlargescaleNB-IoTmeasure-
mentstudy.Finally,Section4.4presentsourdiscoverythroughalarge-scalemeasurement
study.
47
4.2NB-IoTPrimer
Inthissection,weprovidethebackgroundofNB-IoTtechnology,includingitsmainfea-
tures,framestructure,physicalchannels,randomaccessprocedure,andenergymanage-
ment.
4.2.1FeaturesofNB-IoTTechnology
NB-IoThasseveraladvantagesovermanyotherwirelesscommunicationtechnologies,
suchas4G-LTE,Wi-Fi,andZigBee.

Widecoverage
.ComparedtoGPRSandLTE,themaximumcouplinglossbudget
ofNB-IoTincreasesby20dB,whichimprovesitscoverageabilityinsignal-limited
environments,suchasundergroundparkinglot,basement,andgarage.

Lowpowerconsumption
.Bystreamliningthemessageexchangesandleveraging
multiplepower-savingmethods,theendnodehasthechancetoreach5-yearsor
even10-yearbatterylifeinspeci˝cscenarios.

Lowcost
.Thenarrowbandwidth,lowpowerconsumption,andlowdataratelead
tothelowcomplexityintheNB-IoTmodemandchipsetdesign,whichlowersthe
costatthenodeside.Inthemeantime,NB-IoTcanreusetheexisting4G-LTEin-
frastructures,whichlargelydecreasesthedeploymentcostatthenetworkoperator
side.

Massiveconnection
.OnesingleNB-IoTcellcansupportmorethan50,000nodes
connectingtothenetworkcore,whichis50to100timeslargerthanthe2G,3G,and
4Gnetwork.

Licensedbands
.NB-IoTsupportsinbandmodedeployment,whichcoexistswith
thecurrentLTEnetwork.Inthemeantime,itcanreusethelicensedbandof2Gand
48
3G.Allthesebandsarelicensed,meaningthatthereislessinterferencethanother
ISM-basedtechnologies,andthenetworkcoverageinawideareacanbeguaranteed.

Security
.NB-IoTleveragesthesecurityapproachesfrom4GLTE,with2-wayau-
thenticationanddataencryptionovertheair,providingamoresecurepipelinefor
thepacketdatathanotherLPWANtechnologies.
4.2.2FramesandChannels
InanNB-IoTnetwork,anendnode,commonlyknownasaUserEquipment(UE),iscon-
nectedtotheEvolvedPacketCore(EPC)viaaneNodeBbasestation.Toachievethis,
NB-IoTspeci˝esadedicatedframestructureandasetofchannelsbothphysicallyand
logicallytoensurethesynchronizationande˙ectivecommunicationbetweentheUEsand
theeNodeB.Webrie˛yintroducethemasfollows.

Framesandtime-frequencydomainresources
.Figure4.1showstheframestructure
ofNB-IoTintimedomain.Itisahierarchicalstructure,fromhyperframestoradio
frames,thentosubframesandslotsasthegranularityincreases.Eachslotconsistsof
7OrthogonalFrequencyDivisionMultiplexing(OFDM)symbols.Inthefrequency
domain,NB-IoTutilizes12subcarriers,15kHzeach(inSingle-tonemode),180kHz
bandwidthintotal(200kHzinrealityduetotheemploymentofguardband).
ToallowtheUEtosynchronizebeforeattachingtothenetwork,theeNodeBbroad-
caststwosynchronizationsignal
NarrowbandPrimarySynchronizationSignal
(NPSS)
and
NarrowbandSecondarySynchronizationSignal
(NSSS)periodicallyintheradio
frames,asshowninFigure4.2inredandyellowcolor,respectively.Aftersynchro-
nizationinclocksignals,UEstartstolistentothesysteminformationfromthedown-
linkchannels.

Downlinkphysicalchannels
.Therearethreephysicalchannelsinthedownlink
(DL)direction,i.e.,fromeNodeBtotheUEs,namely
NarrowbandPhysicalBroadcast
49
Channel
(NPBCH),
NarrowbandPhysicalDownlinkControlChannel
(NPDCCH),and
NarrowbandPhysicalDownlinkSharedChannel
(NPDSCH).NPBCHcarriesthesys-
temcon˝gurationinformationtoguidetheUEtoattachtothenetwork.NPDCCH
andNPDSCHcarrytheschedulingorcontrollingmessagesandtheDLdatapackets
fortheUE,respectively.NPDCCHandNPDSCHarethemostcommonlyallocated
channelsintheNB-IoTdownlink,asshowninFigure4.2.
Figure4.1:NB-IoTframestructure.

Uplinkphysicalchannels
.Therearetwophysicalchannelsspeci˝edforuplink(UL)
transmissions,namely
NarrowbandPhysicalRandomAccessChannel
(NPRACH)and
NarrowbandPhysicalUplinkSharedChannel
(NPUSCH).NPRACHbearstherandom
accesspreamblefromUE,whileNPUSCHcarriesalltheULpacketdatafromthe
UE.
4.2.3RandomAccessProcedure
TheNB-IoTUEfollowsaseriesofprocedurestoestablish
RadioResourceControl
(RRC)
Connectionandsenddatapacketstoapplicationservers,asshowninFigure4.3.The
procedureissummarizedasfollows.
50
(a)Framewithevennumber.
(b)Framewithoddnumber.
Figure4.2:NB-IoTsubframestructureineitherStandaloneorGuardbanddeploymode.
Every10subframesmakearadioframe.
51
Figure4.3:SignalingsbetweenUEandeNodeBbasestationduringaULpacket
transmission.
1.TheUEinitiatesacontention-based
RandomAccess
(RA)bysendinga
RandomAccess
Preamble
(
MSG1
)totheeNodeBinNPRACH.TheeNodeBreplieswitha
RandomAccess
Response
(RAR),alsoknownas
MSG2
,whichallocatesresourcesfortheUEtosendsub-
sequentrequests.
2.Next,theUEtransmitsthe
MSG3
totheeNodeB,carryingtherequestedresources,inthe
NPUSCHusingtheresourceallocatedbytheeNodeB.Inthemeantime,itstartsatimer
immediately.TheUEconsidersitselffailedifthetimerexpired.
3.Afterreceiving
MSG3
,theeNodeBresolvescontentionfromalltheUErequests,allocates
resource,andthennoti˝estheUEbysendingaContentionResolution(
MSG4
).IftheUE
receives
MSG4
beforeCRTtimeout,theRAprocedurecompletessuccessfullyandtheUE
setsupanRRCconnectiontotheeNodeB.Otherwise,theUEneedstogobacktostep-1
andsends
MSG1
tore-initiateRA.
4.TheUEthensendsdatapacketstotheeNodeBusingthescheduledresourceinNPUSCH.
52
5.Afterdatatransmission,theUEenterspassivereception,called
Inactivity
stateuntil
theRRCconnectionisreleased,initiatedbytheeNodeB.
6.Finally,theUEsendsthe
RRCConnectionReleaseCon˝rm
via
MSG1
and
MSG3
againtothe
eNodeBtomarktheendofapackettransmissioncycle.
Wenotethat
MSG1
istransmittedintheNarrowbandRandomAccessChannel(NPRACH).
Both
MSG3
andthedatapackettransferblocksaretransmittedintheNPUSCH,whichis
oneofthemajorcontributingfactorstototalenergyconsumption.
4.2.4EnergyManagement
UEworkingmodes.
Toreducepowerconsumption,theUEisoperatedinfourworking
modes,namely
Active
,
Idle
,extendedDiscontinuousReception(
eDRX
),andPowerSav-
ingMode(
PSM
).TheUEisin
Active
modewhentheradioistransmittingorreceiving,
consumingcurrentuptotensorhundredsmA.In
Idle
mode,theradioisinactivebut
remainsawake.In
eDRX
mode,theUEturnso˙itsradioforaspeci˝cperiodnegotiated
withtheeNodeB.The
eDRX
modeofNB-IoTinheritsthe
DRX
modeofLTE,butspeci˝es
additionalhigherintervalcon˝gurations,targetingtheIoTapplicationscenarios.The
PSM
modeisthemostenergy-e˚cientmode,whereallUEcomponentsareturnedinactivede-
spiteawake-uptimeruntilthetimerexpiresandissuesaninterruptiontoactivatetheUE.
Inthismanner,thecurrentin
PSM
canbereduceddramaticallytoonlyseveral

A.
IntypicalNB-IoTapplications,thenodeshibernatewith
PSM
formostofthetimeand
transmitasmallnumberofpacketsdaily.
Enhancedcoveragelevel(ECL).
NB-IoTadoptsanopenlooppowercontrol,wheretheUE
decidesitsTxpowerbasedonasetofpre-de˝nedparametersbroadcastedbytheeNodeB
andthelivelymeasuredreferencesignalstrength.NB-IoTde˝nesuptothree
Coverage
EnhancementLevels
(ECLs):ECL0,ECL1,andECL2thatareadoptedingood,moderate,
andbadchannelconditions,respectively.EachECLcorrespondstoaspeci˝cuplinkra-
53
diopro˝le,whichspeci˝esthenumberofrepetitionsof
MSG1
and
MSG3
,thenumberof
sub-carriers,etc.TheselectionofECLisdeterminedbyeNodeBandmayvaryacrossdif-
ferentnetworkoperatorsandlocations.Beforeuplinkradioaccess,theUEcharacterizes
itschannelconditionbymeasuring
ReferenceSignalReceivedPower
(
RSRP
).Itthencompares
theRSRPwiththethresholdsspeci˝edbyeNodeBtodetermineitsECL.
4.3NB-ScopeDesign
WehavedevelopedNB-Scope,whichisanopen-sourceexperimentalplatformdesigned
toenable˝ne-grainedpowerconsumptionanalysisforNB-IoT.Inthissection,wedescribe
thedesignofNB-Scopeindetail.
4.3.1SystemOverview
ThedesignobjectiveofNB-Scopeistwo-fold.First,itshouldenablein-depthdiagnosesof
theenergye˚ciencyofanNB-IoTnetwork.Second,itshouldsupportheterogeneousNB-
IoTmoduleswithminimalsystemmodi˝cations,sinceUEmodulesofdi˙erentvendors
maydi˙erinpinassignment,commandlanguage,andsignalingmessageformatofradio
accesslogs.Toachievetheaboveobjectives,NB-Scopefeaturesthreekeydesigns.

Layeredhardwarearchitecture.
NB-Scopelayersthehardwaresystemintothreeparts,
includingthemainboard,theshieldboard,andtheUEmodule.Theshieldboardis
gearedtohosttheUEmoduleofaspeci˝cvendor.Itservesasanabstractionlayerthat
hidesmoduleheterogeneityfromthemainboard.Themainboardintegratesgeneral
components,suchaspowersupply,sensors,SDcardinterfaces,andexposesagroupof
pinstosupporttheplug-and-playofshieldboards.

Softwareabstraction.
NB-Scopeo˙ersAPIsthatallowdeveloperstoaccessandcontrol
heterogeneousUEmodules.ThemostimportantfunctionofNB-Scopeisthatithostsli-
54
brariestodecodetheradioaccesslogsofdi˙erentUEmodulesandreportsthedecoded
eventsinauni˝edformat.

Tracefusionofpowerconsumptionandradioaccess.
Atrun-time,NB-Scopecollects
andsynchronizespowerconsumptiontraceandradioaccesslogs.Thisiscriticalfor
correlatingthecurrentvariationwiththenetworkstatetransitionandfurtherdiscover-
ingthepossiblestrategiestominimizeenergywaste.Toourbestknowledge,NB-Scope
isthe˝rst˝ne-graintracefusiontoolsetforNB-IoTnetworkdiagnostics.
Figure4.4:SystemarchitectureofNB-Scope.
AsshowninFigure4.4,NB-Scopesupportstwodi˙erentmeasurementmodes:real-
timebenchmarkmodeand˝eldtestmode.Speci˝cally,inthe˝eldtestmode,thesystem
canworkinastandalonemanner,loggingcurrentanddebugtracesinitsonboardstorage.
Inreal-timebenchmarkmode,theNB-IoTshieldboardcanbeconnectedtoacomputer
thatretrievesthelogsfromtheI/Oextensionadapterandanalyzesthemtogetherwith
powermeasurementsfromapowermonitor.
55
4.3.2NB-ScopeHardwareDesign
NB-IoTmoduleshieldboard
.NB-Scopeconsistsofashieldboardthatabstractsthein-
terfacesofheterogeneousUEmodules,providingauni˝edfootprintassignmenttothe
hosts.WeselectalistofpopularcommercialNB-IoTmodulesfromQuectel,Gosuncn,
anduBlox,andanalyzetheirconnectivity,asshowninTable4.1.Thenweidentifythe
necessarypinstobeinteractedwith:anintersectionsetofpins,includingpowersup-
ply,SIMcardinterface,mainUART,debugUART,andRESET,whichareessentialtolet
amoduleworkproperly,andspecialpurposeconnectivityfordi˙erentmodules,such
asPWR_ONkey,USBinterface,SPI,orI2C.Next,alltheselectedpinsareaggregated
into2rowsofpinheaders,suchthatallthemodulesshareauni˝edtoexter-
nalhosts,whichalsoenablesstraightforwardPCBdesignformoduleintegration.Inthis
manner,weachievetheplug-and-playfeatureandinterchangeabilityforheterogeneous
modules.Moreover,thankstothemodulardesign,theshieldboardenergyconsumption
isseparatedfromothernodecomponents,providingafaircomparisonbetweendi˙erent
NB-IoTmodules.Wehavedeveloped7typesofshields,supportingupto8di˙erentNB-
IoTmodules,includingQuectelBC28/BC35/BC26/BC66/BG96,GosuncnME3616,and
uBloxSARA-R410M-02B.Weshow5typesoftheshieldboardsinFigure4.5duetospace
limit.
Table4.1:ListofmodulesthatNB-Scopesupports.
ModulemodelManufacturerChipRegion
1
SARA-R410M-02B
uBloxQualcommMDM9206Global
BC35QuectelHiSiliconHi2110Europe,Asia-Paci˝c
BC28QuectelHiSiliconHi2115Europe,Asia-Paci˝c
BC26QuectelMediaTekMT2625China
BC66QuectelMediaTekMT2625Global
BG36QuectelQualcommMDM9206China
BG96QuectelQualcommMDM9206Global
ME3616GosuncnMediaTekMT2625Global
1
BC26andBG36sharethesamechipsetwithBC66andBG96respectively.Thedi˙erenceisthatQuectel
placesarestrictionontheiravailablenetworkoperatorssothattheycanbesoldindi˙erentregions.
56
(a)BC35/BC95shield
(b)ME3616shield
(c)SARA-R410M-02Bshield
(d)BC28shield
(e)BG96shield
Figure4.5:NB-IoTUEmoduleshieldboards.
Real-timebenchmarkmode
.Inthebenchmarkmode,NB-Scopeallowsonetointeract
withandanalyzetheenergyperformanceoftheNB-IoTmodulesinreal-time.Thisis
achievedbyinstallingthemoduleshieldboardonanIOextensionboard.Itsupportsa
widerangeofmeasurementcapabilitiesviaconnectingtoacomputer.Forexample,the
developercanemittheATcommandandobservetheUEbehaviorimmediately.Inthis
case,theUARTports,includingthemainATanddebuglogexportfunctionalities,are
routedtotheUSB-Serialadapters.WeuseaMonsoonHVPM[41]tomeasurethecurrent
consumedbytheNB-IoTnode.Inthismanner,theusercaneasilyknowwhenspeci˝c
eventsoccurandhowtheyintroducethevariationinthecurrent.
Fieldtestmode
.WedesignamainboardtohosttheUEmoduleboard,asshowninFigure
4.6,toenablereal-worlddeployment.Itisessentiallyalightweightandlow-powerNB-IoT
57
Figure4.6:STM32-basedmainboardforNB-IoT˝eldtest.
applicationnodethatlogsthecurrentandthedebuglogsintoamicroSDcardforo˜ine
analysis.Themainboardcarriesan84MHzSTM32F103serieschipastheprocessingunit,
atemperatureandhumiditysensor,acurrentsensor,anEEPROM,andamicroSDcard.
Anotherimportantfeatureofthe˝eldmeasurementnodeisthecapabilityofcurrent
sensingwithaTexasInstrumentsINA226chip,whichiscapableofupto7,60016-bitres-
olutionsamplespersecond,withanerrorrateoflessthan2%atthetensorhundredsof
mAmagnitude.Moreover,thenodeispoweredbyeitherasingleorapairof18650Li-ion
batteries,supportingthenodemeasurementforupto1,000packets.
4.3.3NB-ScopeSoftwareDesign
Figure4.7showsthearchitectureofNB-Scopesoftwarestack,whichconsistsofthree
pipelinesfordatacollection,modulecontrol,anddataprocessing,respectively.
Datacollectionandmodulecontrol
.ThedatacollectioncomponentofNB-Scopereceives
debuglogsandcurrentmeasurementsamplesfromtheshieldboard,andthenstorescol-
lecteddatainanSDcard.Bothcurrentmeasurementsanddebuglogsaretimestampedso
58
Figure4.7:NB-Scopesoftwarearchitecture(˝eldtestmode).Thedebuglogcollection
pipelineissimilartothecurrentsensingpipeline,thusisnotshowninthe˝gure.
thattheycanbelateralignedinthetimedomaintoenableenergyperformancediagnosis
ofradioaccess.
ThemodulecontrollerofNB-ScopeallowsuserstocomposecontrollogicoftheNB-
IoTmodulewithoutknowinglow-leveldetailsofchipcommands,whichmaydi˙eracross
di˙erentNB-IoTmodules.Itachievesthisbyabstractingbasicfunctionalitiesofthecontrol
logicasatomfunctions,whicharethenexposedasuni˝edAPIstohidemodule-speci˝c
implementations.Forexample,di˙erentmodulesmayde˝nedi˙erentATcommandsto
turnthemoduleintoairplanemode.Weimplementlow-levelAPIsforeachmodule.Asa
result,theusercancontrolallthemodulesviathehigh-levelAPI
at_enable_airplane_mode()
,
withoutbeingconcernedwiththeimplementationdetails.Newmodulescanbeeasily
addedtothelibrarybyimplementingthecorrespondingatomfunctionsinthelibrary.
UsingtheAPIs,wefurtherdevelopagroupofrepresentativeNB-IoTapplicationsand
services,suchasenvironmentalsensing,uplinkpacketsending,downlinkpacketpars-
ing,currentsensing,SDcardR/W,etc.
Dataprocessingpipeline
.Thedataprocessingpipeline˝rstdecodesdebuglogsusing
abackendservice,asexempli˝edinFigure4.8,whichhandlesandhidessubtleseman-
59
Figure4.8:Messagedecodingexample.Therawdebuglogdatais˝rstsegmentedinto
di˙erent˝eldsbythebytelength,andthenistranslatedtohuman-readabletexts
accordingtothemessagede˝nitiondatabase.
ticdi˙erenceamongthedebuglogsofdi˙erentNB-IoTmodules.Speci˝cally,thetaskof
debuglogdecodingistwo-fold.First,thedecoderneedstodissectaradioaccesscycle
anddeterminethetimingofeachphase(suchascontention,controlmessage,datatrans-
mission,receiving,andidle).Second,thedecoderneedstoextractthecon˝gurationsand
performanceoftheNB-IoTnetwork,suchastransmissionschedule,RSRP/SNRmeasure-
ment,ECLselection,andblockerrorrate,whichallowfor˝ne-graineddiagnosisoftheir
impactsontheenergyofUE.
Tounderstandenergyconsumptionindi˙erentradioaccessphases,NB-Scope˝rst
splitscontinuouscurrentmeasurementsusingathreshold-basedmethodandthenasso-
ciateseachpartofthecurrentwitharadioaccessphasebasedonthetiminginformation
decodedfromdebuglogs.AmajorchallengeinthisstepisthatsomeNB-IoTmodules
maynotproducedebuglogsforradioaccessphases.Toaddressthisissue,we˝rstutilize
thesynchronizedcurrentanddebugtracesfromtheUEwithdebuglogoutputtotrain
60
analgorithmtodeterminethestatetransition,triggeredbythecurrentpulsewidthand
amplitudeintimesequence.Inthisalgorithm,wemainlyfocusontheTxstates,includ-
ing
MSG1
,
MSG3
,
ACK
and
Data
.AsdiscussedinSection4.2,theoccurrencesofthestates
duringthepacketuplinktransmissionfollowaspeci˝corder.Forexample,oncewe˝nd
the
MSG3-ACK
,wecanimmediatelydeclarethatthenextstateis
Data
.Oneintuitivesimple
forwardlabelingalgorithm,from
MSG1
to
Idle
,istoleveragethestatetransitionrulesto-
getherwiththestatefeatures,e.g.currentmagnitude,pulsewidth.However,somestates
repeat(i.e.re-transmission)duetobadsignalqualityorfailureinreceivingtheACKfrom
theeNodeB.Therefore,weutilizeotherpassivestates,suchas
Idle
and
Inactvitity
as
auxiliaryanchorstodeterminetheTxstates.Moreover,weproposeabi-directionalstate-
machine-basedlabelingalgorithm,whichdividestheuplinkprocessintotwopartsbythe
starttimeof
Data
andleveragesthestatetransitionrulesandfeaturesofbothforwardand
backwarddirectionstoincreasethelabelingaccuracy.Bysegmentingthecurrentaccord-
ingtothestates,wecanobtainadetailedpictureofthepowerconsumptionforeachstate
formoduleseitherwithorwithoutthedebugtracecapability.Theresultsofthecurrent
labelingalgorithmarediscussedinSection4.4.4.
4.4NB-IoTMeasurementStudy
Inthissection,weconductthemeasurementinthewildmassivelywithNB-Scopeand
analyzetheenergyperformancein˝negranularity.Ataglimpse,ourmeasurementde-
ploymentlasts3monthsandconsistsof30NB-ScopenodesonNB-IoTnetworksfrom
majoroperatorsin3regions,includingtwomajorcitiesinChinaandamid-sizedcityin
theUS.
Theroadmapofthemeasurementstudy˝rststartsfromplanningtheexperimentsto
addresstheheterogeneityinlocation,networkoperators,andmodulevendors.Then,we
analyzetheUEenergyconsumptionw.r.ttothesefactorsandidentifyasubstantiallyhigh
UEpowerconsumptionimbalance.Next,tounderstandthecausesofthehighenergy
61
variance,weanalyzetheECLratioindeploymentandrevealitsselectionmechanism.
Next,a˝ne-grainedenergydecompositionisconducted,bywhichweidentifytwoheavy
networkcontroloverheads:longtailduetolarge
InactivityTimer
andtheexcessive
RAmessagerepetition.Byin-depthstudyonthesetwofactors,weshowtheopportunity
ofoptimizingthemtosaveUEpower.Finally,theUEbatterylifeisestimatedwiththe
measurementstudyresults.
4.4.1FieldMeasurementMethodology
NB-IoTmeasurementisfundamentallydi˙erentfromLTEcellularnetworkmeasurement,
wherethelattercouldbeconductedthroughmobileapplications[50,52]installedonmas-
sivemobiledevices.Incontrast,anNB-IoTnodemustbephysicallydeployedtomeasure
networkperformanceinplace.AsdiscussedinSection4.3.2,webuildaseriesofNB-IoT
modulestoaddressthevendorheterogeneity.Inaddition,westillfacetwochallengesin
conductingalarge-scale˝eldmeasurementofNB-IoTnetworks.First,NB-IoTenablesa
widerangeofapplicationswithhighspatialdiversity,fromindoortooutdoor,fromthe
ruralareatothemetropolisdowntownarea.Ourresultsmayincludesigni˝cantbiasif
thedeploymentofmeasurementnodescouldnotcoverthewidespectrumoftheseap-
plications.Second,thereusuallyexistmultiplenetworkoperatorsinthesamearea,of-
feringdi˙erentrates,services,andIoTbackendplatforms.Eachnetworkoperatorhas
itsnetworkcon˝gurations,whichmaya˙ectthemeasurementresultsintermsofpower
consumption,networkcoverage,etc.
Tomitigatetheimpactofbiasedlocationselectiononourmeasurementresults,we
choosethemeasurementlocationbytypesofapplications.Speci˝cally,˝vecommonNB-
IoTapplications
2
areselectedinthiswork:outdoorparking,indoorparking(ramp),smart
doorlock,smokedetection,andsmartwater/electricitymeter.Theseapplicationsrepre-
sentaclassoftypicallocations,rangingfromoutdooropenareastoresidential/o˚ce
2
Wemainlyfocusonstationaryapplicationsinthiswork.Mobileapplications,suchascoldchaintrack-
ing[89]orsharedbikeservice[74],areleftforopenproblems.
62
indoorenvironmentsandbasement.Wereferthemtoaspro˝lesintherestof
thischapter.Figure4.9exempli˝esthelocationpro˝lesofthemeasurementnodedeploy-
ment.
(a)Outdoorparking
(b)Indoorparking
(c)Smartlock
(d)Watermeter
Figure4.9:Actualnodedeploymentofdi˙erentlocationpro˝les.
Second,weconductour˝eldmeasurementinthreeregions:twomajorcitiesinChina
andamid-sizedcityintheUS.IneachofthethreecitiesinChina,wemeasurethenet-
worksoftwodi˙erentmajoroperatorsreferredtoasandwhile
thenetworkofonlyoneoperator,ismeasuredintheUS.Becausedi˙erent
operatorsmaydi˙erinthecoverage,wechoosemultiple(

10
)locationstodeployour
nodesforeachnetworkoperator,suchthatthevarianceoftheUEperformancedueto
environmentalandoperator-speci˝cfactorscouldbecapturedintheresults.Toevaluate
63
theperformanceofUEsfromdi˙erentvendors,wedeployatleastthreetypesofUEsfor
eachoperatorateachspot.
Insummary,ourdeploymentcovers5locationpro˝les,eachconsistingofmorethan10
measurementspots.Atleast6nodesaredeployedateachmeasurementspotinChina,cor-
respondingtotheCartesianproductofthe2networkoperatorsandthe3modules(BC26,
BC28,andME3616).WechooseBC66,BG96,andSARA-R410M-02BNB-IoTmodulesin
theUS,runningontheUS-OP1network.
Finally,wediscussthesettingofULcommunicationinourdeployment.Sincethe
powerdrainforthe
PSM
modeishighlypredictableandnegligible,wefocusonmeasuring
thebehaviorofUEwhenitisawake.IneachroundofULtransmission,theUEwakesup
fromPSM,searchesandattachestoanNB-IoTnetwork,carriesoutaULpackettransmis-
sionfollowingtheradioaccessproceduredescribedinSection4.2,andthengoesbackto
PSMfor10seconds.Ateachmeasurementlocation,theaboveprocedureisrepeatedfor25
to30ULpackets,usuallylastingabout30minutes.ForNB-Scopenodesdeployedaround
thesamemeasurementspots,consideringtheshortULtransmissiontime(1-3seconds),
theinterferenceduetothenodeconcurrentULtransmissionisnegligible.Eventhough
twoormorenodesmayinitiaterandomaccesssimultaneously,thecontentioncanbere-
solvedbyeNodeB(seeSection4.2)byschedulingdi˙erentresourceunitsforthosenodes,
whichavoidspossiblemutualinterferenceforthesubsequent
MSG3
anddatatransmission.
DuetothesmallnumberofULpacketsandthelowdutycycleofNB-Scopenodes,the
impactofourmeasurementcampaignontheNB-IoTnetworkisnegligible.
4.4.2MeasurementResultAnalysis
FollowingthemethodologydescribedinSection4.4.1,webuilt30NB-Scopenodesof6
di˙erenttypesofmodules
3
,andthenconductalarge-scale˝eldmeasurementbymoving
themaroundover1,200locationsduringathree-monthmeasurementcampaign,collect-
3
Thereare30mainboardsand30shieldboardsthatareassembled.AnNB-IoTnodeconsistsofashield
boardandamainboardpluggedtogether.
64
ingmorethan49.0GBdataincludingcurrenttracesanddebuglogsformorethan36,000
ULpackets,whereeachcurrenttraceanddebuglogisrecordedforacompleteradioac-
cesscycle,fromissuingapackettransferATcommandtoentering
PSM
.Wenowpresent
thestatisticalresultsfromthemeasurementstudy.Inparticular,ourresultsrevealthat
theUEbatterylifecanbehighlyimbalancedinareal-worlddeployment.Thecausesof
suchhighenergyimbalanceareanalyzedindetailthroughSection4.4.3toSection4.4.6.
4.4.2.1Powerconsumptionw.r.tlocationpro˝les
We˝rstcomparetheUEpowerperformanceunderdi˙erentlocationpro˝lesfordi˙erent
networkoperators.AsshowninFigure4.10a,asthedeploymentlocationchangesfrom
openareastosemi-indoorthentothebasements,themeanactiveenergycostperUL
packettransmissionincreasessigni˝cantly.Speci˝cally,withCN-OP2,
theindoorpark-
ingnodesconsumeabout2.7xmoreenergythanthewatermeteringnodestotransmit
onepacket
.
Inadditiontoenergyvariance
across
di˙erentapplications,wealsonoticehighenergy
imbalance
within
eachlocationpro˝le.Inparticular,
formostindoorapplications,the
75thpercentileofnodeenergyconsumptioncanbeupto3timeshigherthanthe25th
percentile
.Inwatermeterandsmokedetectionpro˝les,
theratioofthehighestand
lowestenergyconsumptionofdi˙erentnodescanbeupto75:1
.Thismayresultin
networkpartitions,becauseaportionofthenodesconsumessigni˝cantlymoreenergy
thantheirpeers,leadingtohighlyimbalancedbatterylife.Moreover,weobservethatthe
speci˝clocationofanindoorUE(e.g.,thedistancetothebuildingwalls)doesnotshow
asigni˝cantimpactonenergyconsumption,asexempli˝edinFigure4.11.Forinstance,
someUEsinthebasementsyieldlowenergyconsumption.Thisisbecause,asindicated
byourmeasurement,theoperatorsusuallydeployindoormicro-cellsinthebuildings,
providinglocalNB-IoTaccess.
65
(a)Allmodules
(b)BC26andBC66
Figure4.10:Meanactiveenergyperpacketdistributionbylocationpro˝lesandnetwork
operators.Theupperandlowererrorbarareatmost1.5xinterquartilerangeawayfrom
the75thand25thpercentilerespectively.OP:outdoorparking,SL:smartlock,WM:
watermeter,SD:smokedetection,IP:indoorparking.
4.4.2.2Powerconsumptionw.r.tnetworkoperators
FromFigure4.10a,weobservethat,forthesamelocationpro˝le,thenetworkoperators
haveanon-negligibleimpactonthepacketenergy.Forexample,nodesofUS-OP1yield
thelowestenergyconsumptionandvarianceinmostlocationpro˝les.Forexample,the
packetenergyinsmartlocklocationpro˝lesisonly1Jonaverage.Forafaircomparison
betweennetworkoperatorsinthetwocountries,wefurtherstudytheenergyperformance
ofapairofNB-IoTmodules,namelyQuectelBC26andBC66,whicharedeployedinChina
andtheUS,respectively.WenotethatbothBC26andBC66adopttheMediaTekMT2625
chipset,thusallowingustoexcludeanymeasurementbiasintroducedbytheheterogene-
ityofmodules.InFigure4.10b,weobservethat,inmostapplications,BC66deployedin
theUShasrelativelowerenergyconsumptionandvariancethanBC26deployedinChina,
whichisconsistentwiththeresultsshowninFigure4.10a.Wealsoobservelessdeviation
66
Figure4.11:Averagepowerconsumptionperpackettransmissionforindoorapplications
inabuilding.Notethatsomeco-locatedpointsmaybeondi˙erent˛oors.
Table4.2:eNodeBCon˝gurationsofdi˙erentNetworkOperators.MSG1repetitionand
ECLthresholdarenotavailableinthedebuglogsofNB-IoTmodulesdeployedintheUS.
OperatorUS-OP1CN-OP1CN-OP2
MSG1RepetitionsinECL0/1/2N/A2/8/322/8/32
MSG3RepetitionsinECL0/1/21/2/81/2/321/2/32
ECLThresholdN/A-107,-117-109,-119
InactivityTimer
3s20s20s
Band1358
inthepacketenergydistributioninUS-OP1,whiletheBC66(inCN-OPs)spendssigni˝-
cantlyhigherenergythanaverage.
Tofurtherunderstandwhynodeenergyconsumptionvariessigni˝cantlyacrossdif-
ferentoperators,welisttheeNodeBcon˝gurationsofdi˙erentoperatorsinTable4.2.We
noticethatCN-OP1andCN-OP2employmoreconservativecon˝gurationsfeaturedby
prolonged
InactivityTimer
andexcessive
MSG3
repetitions,whichimprovetheULlink
67
reliabilitybutresultinrelativehighernodeenergyconsumption.WewillshowinSec-
tion4.4.5and4.4.6that
InactivityTimer
and
MSG3
repetitionhavecriticalimpactson
UEenergyconsumption,leavingasigni˝cantspaceforoptimization.AlthoughUS-OP1
outperformsCN-OP1andCN-OP2intermsofenergyperformance,oure˙ortsiniden-
tifyingtheenergyloopholesarestillimportant,becauseononehand,notallnetwork
operatorsadoptthesamecon˝gurationasUS-OP1;ontheotherhand,anenergy-e˚cient
con˝gurationmaycomeatthecostoflowerlinkconnectivityunderbadsignalquality.So
eachnetworkoperatorshouldsetthecon˝gurationwithadesirabletrade-o˙betweenthe
networkcoverageandthenodelifespan.
4.4.2.3ComparisonofNB-IoTmodules
TheNB-IoTmodulesemployedinthe˝eldtestdemonstratenoticeabledi˙erences.We
plottheperformanceoftheNB-IoTmoduleinthesmokesensinglocationpro˝lesinFigure
4.12.Wenumberthesemoduleswithoutshowingtheirmodelstoconcealtheidentitiesof
vendors.
First,fromFigure4.12a,wecanseethatthemaximumcurrentinaULpackettransmis-
sioncyclevariessigni˝cantly.Forexample,moduleM1hasahighermaximumcurrent
thanallothermodules,whileM5tendstoplaceasmallupperlimitonthemaximum
current.WenotethatNB-ScopemeasuresthepowerconsumptionofthehostedNB-IoT
modulesinsteadoftheentireboard.Thisallowsustoexcludetheimpactofboardde-
signfeatures.Therefore,thevariationsofpowerconsumptionbetweendi˙erentmodules
reportedinFigure4.12ashouldbelargelyattributedtothedi˙erentdesignsofNB-IoT
modules.Wenotethat
thedi˙erentmaximumcurrentsofmodulescancauseasigni˝-
cantenergyvariance.
InatypicalULpacketcycle,thetotaltransmissionperiodusually
lasts2.8seconds.Supposethemaximumcurrentdi˙erencebetweentwomodulesis100
mA,theenergydi˙erenceduringthetransmissionperiodcanbe0.92J(assuming3.3V
voltage),whichyieldssigni˝cantenergydi˙erenceinthelongterm.Wenotethatalower
68
(a)Maximumcurrentdistribution.(M2doesnotre-
portECLs)
(b)Packetdeliveryratedistribution.
(c)Packetactiveenergydistribution.(M2doesnot
reportECLs)
(d)Timedurationtoupload20packets.
Figure4.12:Performanceofdi˙erentmodelsinsmokesensinglocationpro˝le.M1-M3
aredeployedintheUS,whileM4-M6inChina.
maximumcurrentcanleadtodegradationinthepacketdeliveryrate,asshowninFigure
4.12b.Insuchacase,theenergywastefromthelosspacketsshouldnotbeoverlooked.
Second,wecon˝rmagaininFigure4.12cthatthenodesinECL2havesigni˝cantlyhigher
energythaninECL0andECL1,forthemajorityoftheNB-IoTmodules,whichmeansthat
theenergyimbalanceisprimarilyintroducedbytheECLinsteadofthemodule.Finally,
wecanseefromFigure4.12dthatalmostallthemodulescan˝nishtransmitting20pack-
ets(assumethesleeptimeris10secondsforallmodules)inabout20-30minutes,meaning
69
thatgenerally,theNB-IoThasasimilarleveloflatency.
Moreover,wenoticethatsomemoduleshavedi˚cultyincellsearchingandnetwork
attaching.Forexample,oneofthemodulesfailsinattachingthenetworkin20outofthe
125spots,whiletheothermodulesunderthesamenetworkcon˝gurationsucceeded.
Themodulescanvaryinmanyotheraspects,suchasSNR,blockerrorrate,ECLse-
lectionstrategy,cellselectionapproach,andsoon.Whilewecannotexhaustallthese
variances,ourresultsabovesuggestedthatthediversityintheperformanceofdi˙erent
moduleshasanimportantimpactonthedevelopmentanddeploymentoflarge-scaleNB-
IoTsystems.
4.4.2.4Temporalvariationofpowerconsumption
Westudythetemporalvariationofnodeenergyconsumptionbydeploying3di˙erent
modulesin3locationpro˝lesandthenmeasuretheirenergyperULpackettransmission
inaperiodof12.5hours.
Figure4.13:Distributionofthepacketenergyina12.5-hourperiod.
Figure4.13plotsthedistributionofenergyconsumptionperULpacket.Weobserve
thatallnodesexperiencelargeenergyvarianceovertime,especiallyfornodesintheloca-
70
tionpro˝leofthewatermeter,wherethemaximumperpacketenergyconsumptioncan
be45timeshigherthantheminimumvalue.Wefoundthatthemajorreasonisthatthe
RSRPintheindoorlocationpro˝leshasasigni˝cantvariance.Eventhenodesarestation-
aryduringmeasurement,thewirelessqualityishighlydynamic.Oncethenodechooses
ECL2toperformradioaccess,theenergycanincreasesigni˝cantly.Wewillfurtherana-
lyzethisinthelatersections.
4.4.2.5Powerconsumptionv.s.distancetoeNodeB
TostudytheimpactofdistancetoeNodeBonUEenergyconsumption,weconductamea-
surementinanoutdoorarea,whereaUEisdeployedattheline-of-sight(LoS)pathofthe
eNodeB,andthenmovedawayfromtheeNodeBatastepof100metersuntiltheconnec-
tionislost.Ineachstep,theUEiscon˝guredtotransmit15packets.
Figure4.14:Packetenergyw.r.tthedistancebetweentheUEandtheeNodeB.
Figure4.14plotstheenergyperpacket(
Inactivity
periodexcluded)andtheRSRP
ofUEasafunctionofdistancetoeNodeB.Asshowninthe˝gure,theenergyperpacket
demonstratesarapidsurgeaftertheUEismovedto0.8kmaway.Inparticular,theaverage
71
per-packetenergyat1.2kmisabout28xhigherthanthatat0.1km.Wealsoobservethat
per-packetenergyhasastrongcorrelationwiththeECLofUE.Speci˝cally,duringthe
measurement,weobservethattheECLoftheUEremainsinECL0intherangeof0.1-0.7
kmconsistently,andthendropstoECL1andECL2after0.8km,whichexplainsthedrastic
surgeofper-packetenergybetween0.7-0.8km.WewillstudytheimpactofECLonUE
energyconsumptioninmoredepthinSection4.4.3.
4.4.2.6Measurementsummary
First,bydecomposingtheenergyconsumptionbylocationpro˝les,weseethatdi˙erent
applicationsmayhavesigni˝cantlydi˙erentenergyconsumption.Insomeapplications,
suchasindoorparking,thereexistsasigni˝cantenergyimbalanceamongthenodes.Sec-
ond,wenoticethatthenetworkoperatorsplayanimportantroleinenergyconsumption
becausenotonlythenetworkcon˝gurationsmaycausedi˙erentUEbehaviors,butalso
thecelldeploymentcanbeoneofthedecisivefactorsfornodesignalstrength.Third,dif-
ferentmodulesinthesamespotcanconsumeenergyatdi˙erentratesduetothehardware
designandchipsetimplementation.Finally,thedistancetothebasestationcanalsoim-
pactenergyconsumption.Particularly,wenoticeasharptransitionofenergyconsumption
withrespecttothenode-celldistance,whichiscausedbytheECLmechanisminNB-IoT.
WewillfurtherdiscusstheimpactofECLandpresentthedetailedenergybreakdown
todiagnosethecausesfortheUEenergybehaviorsintherestofthissection.
4.4.3TheImpactofECL
TheresultsinSection4.4.2showthatheterogeneityofmodules,locationpro˝les,andnet-
workoperatorscana˙ectthenodeenergyconsumptiontodi˙erentextents.Asaresult,
thenodeshaveasigni˝cantenergyimbalance,wherethenodesunderthesametypeof
locationpro˝ledrainenergyatadistinctrate.Fromtheenergyv.s.distanceexperiment,
weseethatECLcanbeoneofthemajorfactorsthatcausesuchanimbalance.Sincethe
72
Figure4.15:ECLratiow.r.tlocationpro˝lesandnetworkoperators.
NB-IoTnetworkreliesontheECLtodeterminetheTxpower,theUEdrainsdi˙erentlevels
ofenergyunderdi˙erentECLs.Therefore,we˝rstdiagnosethehighenergyconsumption
andvarianceofUEsshowninSection4.4.2andtheroleofECL.Tothisend,wedecompose
theECLdistributionandcorrelateitwiththeenergypro˝les.TheECLhistogramisplot-
tedforeachlocationpro˝leinFigure4.15.WeobservethattheUEselectsECL0andECL1
inamajorityoftheoutdoorlocations.However,forindoorparking,buildingcorridors,
andwatermeterdeploymentspots,ECL1andECL2begintodominate.Thisisexpected
becausetheeNodeBbasestationsignalwillbeattenuatedbytheconcretewallsbefore
beingreceivedbytheUE.Anotableoutlieristheindoorsmartlocklocationpro˝lewith
US-OP1.Thereasonisthat,asindicatedbyourmeasurement,US-OP1installsmicro-cells
inthebuildingcorridors,leadingtoabettersignalstrengtharoundthedoorway.Forex-
ample,thebuildinginFigure4.11iscoveredbyupto11eNodeBs,whileonly3ofwhich
aretheoutdoormacrobasestations.Therefore,thesmartlocknodesusuallyreceivea
strongRSRP,leadingtothedominantECL0selection.Overall,wenotethatalthoughthe
ratioanoderunsunderECL2isrelativelysmallerthanthatrunninginECL0andECL1in
alllocationpro˝lesandoperators,theenergyconsumptioninECL2isstillsigni˝cantbe-
73
causeUEinECL2su˙ersupto4timeshighertransmissionpowerconsumptionthanthat
inECL0(asshowninFigure4.12).Theproblemisparticularlyacuteinindoorscenarios,
wheretheratioofECL2ismuchhigherthanthatofoutdoor.
Figure4.16:ECLselectionv.s.RSRPandSNRmeasurement.
(a)Threelocationpro˝les:(1)smokesensing;(2)
smartlock;(3)watermeter.
(b)Twolocationpro˝les:(1)indoorparking;(2)out-
doorparking.
Figure4.17:RSRPandSNRdistributionw.r.t˝vetypesoflocationpro˝les.
74
UnderstandingtheECLselectionmechanismisimportant.AsmentionedinSection
4.2,theUEdecidesitsTxpoweradaptivelybyitselfbasedonthechannelRSRP.Since
UEconsumesmuchmorepowerinECL2thanECL0andECL1,weareinterestedinthe
factorsthata˙ecttheselectionofECL.Accordingtothe3GPPspeci˝cation,theUEde-
cidesitsECLbycomparingthelatestRSRPwiththetwothresholdsgivenbytheeNodeB.
However,theactualECLdeterminationalgorithmisnotspeci˝edandtheimplementa-
tionisuptotheNB-IoTmodemmanufacturers.Forexample,thedebugtracesindicate
thattheUEalsoreliesontheSNRtodeterminetheECL,asshowninFigure4.16.Aswe
cansee,
itadoptsintuitivehardSNRandRSRPthresholdstodecidetheECLs
,forming
onerectangleandtwoL-shaperegionsontheSNR-RSRP2-Dspace.SuchanaiveECL
determinationalgorithmislikelytointroduceenergywasteduetoseveralreasons.First,
theselectedthresholdsmaynotbeoptimal,suchthatahigherECLisutilizedtotransmit
thepacketthatcouldbepotentiallyuploadedwithlessrandomaccessresources.Second,
sucha˝xedmappingbetweenthe(RSRP,SNR)pairandECLscannotadapttocomplex
dynamicwirelessenvironmentsduetotheheterogeneityofsignalpropagation.Ourmea-
surementsshowthatthe(RSRP,SNR)pairsinoutdoorlocations,suchasoutdoorparking,
concentratearoundthetoprightcornerofFigure4.16,whilethesemi-indoorlocations,
suchassmartlock,smokedetection,andsmokedetection,havelargeRSRPandSNRvari-
ance,spanningacrossthe˝gurefromtoprighttobottomleft,whichexplainstheirlarger
ECL1andECL2percentagesinFigure4.15.Moreover,inotherindoorlocations,suchas
indoorparking,(RSRP,SNR)pairsfocusonthebottomleftareawithlowervariancethan
thesemi-indoorlocations,whichleadstoahigherchanceofselectingECL2.Wenotethat
highervarianceofRSRPandSNRusuallycauseshigherenergyimbalance,butnotneces-
sarilyhighermaximumenergyconsumption.
Fortunately,theUEhasanotherstrategyinchoosingtheECLcalledbynext
levwheretheUEadoptsahigherECL
after
therandomaccessfailureusingthelower
one.Thisisadesirablefeatureatthe˝rstglimpsebecauseitoptsforaparametersetthat
75
hasahigherprobabilityofsucceedingtherandomaccess,suchasincreasingtheTxpower
ormessagerepetitions.However,ifthehigherECLisproventobeabetterchoice,then
thepowerconsumptionspentonthepreviousattemptsiswasted.Ourmeasurementre-
sultsshowthatthereisabout
5%probabilityonaveragethattheUEchoosestheECL
byRSRPmeasurementbutfailsinRA
.Therefore,theexistingECLselectionstrategy
inthecurrentUEcanbepotentiallyimprovedtoavoidenergywasteduetochoosingan
inappropriateECL.
TofurtherunderstandtheECLvarianceacrosslocationpro˝les,weplottheGaussian
kerneldensityestimation(KDE)contoursoftheirSNRandRSRPinFigure4.17.Asshown
inthe˝gure,thelocationsofsmokesensing,smartlock,andwatermeterhavelargevari-
ationinRSRPandSNR,whiletheindoorandoutdoorparkinghavemoreconcentrated
distributions.ThisisconsistentwiththeresultsshowninFigure4.15.Wenotethatalarge
variationofsignalqualitymetricswouldresultinsevereenergyimbalanceamongthe
nodes,resultinginpotentiallyhighermaintenancecosts.
4.4.4EnergyConsumptionBreakdown
OneofthekeyfeaturesoftheNB-IoTnetworkisthepromiseoflongbatterylife,upto10
years.NB-IoTUEadoptsseveraltechniquestominimizetheenergyconsumption,includ-
ingcoverage-level-basedpowercontrol,
eDRX
,and
PSM
.OurresultsinSection4.4.2showed
thattheUEssu˙erfromhighenergydraininsignal-limitedenvironments,suchasindoor
andundergroundfacilities.Understandinghowtheenergyisspentandidentifyingpos-
sibleenergyloopholesintheNB-IoTnetworkisthusofgreatimportance.Inthissection,
wepresentourobservationinbreakingdowntheNB-IoTUEpowerconsumptionunder
di˙erentsignalconditions.
We˝rstpresenthowthetypicalcurrentvarieswiththetimeunderdi˙erentECLsin
Figure4.18.TherightcolumnshowsacompletepacketULTxcycle.Aswecansee,there
arefourdistinctcurrentpatternsinthecurrentpro˝le:(1)Theperiodwiththehighest
76
Figure4.18:Thetypicalpowerconsumptionpro˝lesunderdi˙erentECLs.Theleft
columnshowstheULpacketTxcurrentpro˝leforeachECL.Therightcolumnshows
UE'spowerpro˝leinacompletepacketTxcycle.
magnitudeandpulsewidth,whenboththeTxandRxareturnedon.(2)around60mA,
distributedacrossthemajorityofthetime,whenonlytheRxisturnedontoreceiveDL
messages.(3)around20mA,whichisthebasemodulepowerwithouteitherTxorRx.(4)
lessthan1mA,wherethemoduleentersPSMmodeoreDRXmodetopreserveenergy.
TheUEcurrentswitchesbetweenthesecurrentpatternsfrequentlyduringthespanof
packettransmission,duetothenumerousmessageexchangesandstatetransitions.How-
ever,itishard,ifnotimpossible,todeterminewhatmessagesaredeliveredtotheUEand
whatcausesthevariationofthecurrentbyrelyingonlyonthecurrentpro˝le.Therefore,
wealignthecurrentandthedebuglogsintime,usingtheNB-Scopereal-timebenchmark-
ingfunction,asdescribedinSection4.3.
AswecanseeinFigure4.18,acompletepacketcycleconsistsofthesameprocedures
amongthethreeECLs.
MSG1
,
MSG3
,
ACK
,packetdata,and
RRC
ConnectionReleaseRequest
aretransmittedonebyone,andtheUElistenstotheDLchannelsbetweenthesemessages.
Theleftcolumnshowsthezoom-inpacketULTxcurrentpro˝le,whichisthedistinctpart
betweendi˙erentECLs.
77
Tobeginwith,theUEturnsonitsreceivertoacquirethesysteminformationblocksand
synchronizewiththenetwork,preparingfortherandomaccess.Thenitfollowsthepro-
ceduresdiscussedinSection4.2toestablishtheRRCconnectionforuploadingthepacket
data.Totransmitthepacketwiththesamesize,theUEinECL0consumesalowercurrent
andlesstime,whileinECL1theUEtransmitsthedatawithaslightlylongertimeand
highercurrent.However,theECL2requirestheUEtotransmitthedataatitsmaximum
powercapacity,withanextendedtimeforrepetition,whichintroducessigni˝cantlyhigh
powerdissipation.ItturnsoutthatthetransmissionofMSG3variessigni˝cantlyamong
thesethreeECLs.Weacknowledgefromthedebugloganalysis,thatthe
MSG3
pulsewidth
t
MSG
3
in
ms
iscalculatedby
t
MSG
3
=
N
REP
¹
N
RU

8
º
where
N
RU
istheallocatednumberofresourceunits;
N
REP
isthenumberofscheduled
repetitionsoftheresourceunit.ThenetworkdiagnostictracesforCN-OP1andCN-OP2
showthat,forECL0,1,2,the
N
RU
are1,3,4respectively,whilethe
N
REP
are1,2,32re-
spectively,meaningthat
MSG3
currentinECL2hassigni˝canthigherpulsewidththanthe
othertwocoveragelevels.Overall,thereisa4dBcoveragegain(1dBwhentherepeti-
tiondoubles)byincreasingtherepetitionfrom2to32,whilethepowerconsumptionis
16xhigher.ThelackofatransitionzonerendersthepowerconsumptionbetweenECL1
andECL2deviatedramatically.Moreover,thenodeinECL2transmitsatitsmaximumTx
capacitywithoutpowercontrol.Thewidepulseandthehighcurrentmagnitudearethe
tworeasonsforthehighenergyconsumptionunderECL2randomaccess.
Onecanalsonoticefromthe˝gurethatthereisalongtailinthecurrentpro˝le,in-
troducedbythepassiveDLchannellistening.Werefertothisperiodasan
statebecauseitslengthisspeci˝edbyatimercalled
InactivityTimer
,con˝guredbythe
eNodeB.TheRRCconnectionbetweentheUEandtheeNodeBisstillactiveduringthis
period,buttheUEdoesnotperformanyuplinktransmission.Ouranalysisofthedebug
tracesindicatesthattheUEturnsonthereceptionmoduleregularlytolistentothedown-
78
Table4.3:Powerconsumptionbreakdown(meanandstandarddeviation)byradioaccess
proceduresintheULcycleunderdi˙erentECLs.Unit:mJ.
ECLWake-upMSG1MSG3ACKDataInactivityReleaseIdleTotal
ECL0109.43
(5.38)
5.61
(3.02)
7.05
(5.14)
2.57
(0.59)
55.68
(16.46)
3025.97
(180.46)
37.57
(5.68)
57.79
(20.67)
3301.68
(164.44)
ECL1107.28
(11.32)
52.68
(65.30)
23.94
(9.70)
8.90
(3.33)
102.84
(31.60)
3364.03
(250.96)
22.10
(7.76)
73.19
(20.49)
3754.98
(238.16)
ECL2108.05
(19.91)
184.16
(72.74)
407.05
(52.37)
56.33
(11.26)
228.55
(29.29)
3616.66
(370.27)
147.62
(192.78)
83.06
(20.60)
4831.47
(409.96)
linkchannelsforthebroadcastednetworkcon˝guration,orwaitforpossibledownlink
packets.Itmayalsoperformcellsearches.However,wecouldnot˝ndanyevidencein
thedebuglogofhowtheUEutilizestheinformationcollectedduringthisperiod.
Thisis
surprisingbecausetheUEmaywastesigni˝cantenergyduringthelongtail.
Wealso
notethatthe
Inactivity
stateispresentinallECLs.
Afterthelongtail
Inactivity
period,theUEstartsanotherrandomaccessprocedure,
includingsending
MSG1
and
MSG3
,toinformtheeNodeBthattheUEisreadytorelease
theRRCconnectionandenter
Idle
mode.Thesearethe˝naltwoTxeventsbeforeaUE
˝nishesaULpacketcycle.Sinceitfollowsthesameprocessastheinitialrandomaccess,
theUEmaychoosetheECL2resourcestoaccess,observedinmanycurrentlogs,leading
toextrapowerconsumption.
ToquantitativelycharacterizethepartialenergycontributionintheULpackettrans-
missioncycle,wecalculatetheenergyaccordingtothetimesegmentationderivedfrom
thedebuglogs,asshowninFigure4.19(detailedinTable4.3).Weseethatthe
Inactivity
periodcanoccupyupto90%ofthepacketenergyinECL0,whiletheenergyconsumption
of
MSG3
TxinECL2issigni˝cantlyhigh,comparedtothatofECL0andECL1.Thetotal
energyofanECL2packetcanbeabout1.46xand1.29xmorethantheECL0andECL1re-
spectively.However,ifweignorethelargestpart,namelythe
Inactivity
period,
theUE
inECL2consumes4.41xand3.11xmoreenergythanECL0andECL1respectively
,which
wouldcausesevereimbalancebatterylifeamongtheNB-IoTnodesinthelongterm.
79
(a)ECL0
(b)ECL1
(c)ECL2
Figure4.19:Averagedenergyconsumptionbreakdownbyradioaccessproceduresand
ECLs.Thewedgesarearrangedclockwiseaccordingtothelegend.Theexploded
wedgesrequireULtransmission.
4.4.5ImpactoftheInactivityPeriod
Fromtheenergybreakdownabove,mitigatingthe
Inactivity
energywasteisimportant
toprolongtheUEbatterylife.
InactivityTimer
iscon˝guredineNodeBtoindicatethat
theUEdoesnothaveanydownlinkanduplinktra˚cwithinthisperiod.Theobjectiveis
toreducetheUEenergyconsumptionbypreventingitfromstayingintheRRCconnected
statusfortoolong.Fromthatperspective,wecanconcludethatthecurrentcon˝guration
intheeNodeBissuboptimal.Forexample,thetwonetworkoperatorsinChinasetthe
timervalueas20seconds,whiletheUS-OP1chooses3seconds,whichisoneofthekey
factorsthatcontributetothesigni˝cantdi˙erencesinpacketenergyinthesetworegions.
However,thenegativee˙ectofthelongtailcanbemitigatedbyafeaturecalledrelease
80
assistanceindication(RAI)introducedin3GPPRel.14[68].Itisashortmessagesentby
theUE,informingtheeNodeBthatthereisnomoreULdataanditdoesnotanticipate
receivingfurtherDLdata,suchthattheRRCconnectioncanbereleasedearlierbefore
the
InactivityTimer
expires.Accordingly,theenergywasteduring
Inactivity
period
canbeavoidedbecausetheNB-IoTapplicationdeveloperscaneitherskipthewholepe-
riodimmediatelyifthereisnoDLpackettoreceiveorskipitrightaftertheanticipated
DLpacketsaredelivered.However,optimizingthe
InactivityTimer
isstillofgreatsig-
ni˝cancefortworeasons.First,someapplicationdevelopersmaynotbeawareofsucha
feature.Second,theNB-IoTnetworkhasbeenwidelydeployedsince2018,whenthe3GPP
Rel.14hasnotyetbeenimplementedinthecommercialNB-IoTmodules.One-thirdof
themodulesusedinour˝eldtestsdonotincludeRAIcontrolintheirdocumentation.Itis
believedthatthereexistnumerousNB-IoTnodesonthemarketthatdonotsupportRAI.
Fortheselegacynodes,changingthe
InactivityTimer
oneNodeBwouldbeabetter
solutionwithoutrequiringdeveloperstomanuallyupdatethe˝rmwareofUE.
Wediscussourevaluationofchangingthe
InactivityTimer
valueinSection5.2.
4.4.6RepetitionofRandomAccessMSGs
MSG1
and
MSG3
arethetwomessagestransmittedbytheUEintherandomaccesstoin-
formtheeNodeBaboutitsconnectionrequestsandtherequireduplinkresources.As
showninSection4.4.4,
MSG3
transmissiondominatesthetotalenergyconsumptionofup-
linktransmissionunderECL2.Unlikedatapackettransferblocks,whereeverysuccessful
blockdeliverywillbeacknowledgedbytheNB-IoTeNodeB,therandomaccess
MSG1
and
MSG3
transferblocksaretransmittedwiththe˝xednumberofrepetitionwithoutstopping.
AlthoughtheNB-IoTnodeenjoysanincreasedcoveragegain(1dBwhentherepetition
doubles)fromtherepetition,thedebugloganalysisshowsthatthehigh
MSG3
repetition,
whichisa˝xednumber32inECL2,isunnecessary,leadingtosigni˝cantenergywaste.
Wecomparetherepetitionofthedatatransferblockwiththatofthe
MSG3
formorethan
81
2,300packets,asshowninFigure4.20.Theresultsindicatethatmorethan66%ofthe
packetshavemore
MSG3
repetitionsthanthedatatransferblockrepetitions.
(a)Categoricalstatisticsofrepetition
(b)Thecountbyrepetitioncombination
Figure4.20:Thedistributionof
MSG3
repetitionsv.s.datatransferblockrepetitions.
AsplottedinFigure4.20b,wenoticethatthedatablockrepetitioninmostofthepack-
etsis
1
,regardlessoftheECL.Moreover,asindicatedinourmeasurement,thepacketdata
deliveryrate,whichis100%inthemajorityofthetests,doesnotsu˙ertoomuchfromthe
lowdatablockrepetition.Ifweassumethatthewirelesschannelqualityremainsrelatively
stableduringtheshortULtransmissionperiod,the
MSG3
repetitionissigni˝cantlylarger
thanneeded,providinganopportunitytoreduceenergywaste.FromtheeNodeB'spoint
ofview,ithastowaituntil
MSG3
completestherepetitiontoproceedtothenextstep,even
ifthemessageisalreadyreceived.Sincethe
MSG3
andthepacketdatasharethe
NPUSCH
,
theunnecessaryrepetitionof
MSG3
mayleadtonetworkcongestionorlowthroughput.
Additionally,althoughtheexactnumberof
MSG3
repetitionsremainsunknowndueto
theabsenceofdebuglogs,thepulsewidthof
MSG3
transmissionbynodesofUS-OP1is
observedtobesmaller(about0.5x)thanthatofCN-OP1andCN-OP2,whichisanother
factorthatcontributestolowerpacketenergyofnodesonUS-OP1thanontheothertwo
operatorsasshowninFigure4.10a.
82
Figure4.21:Batterylifeestimationunderdi˙erentconditions.referstoonly
theNB-IoTmoduleenergy;oincludestheenergyconsumptionofboththemodule
andothercomponentsontheboard;means
InactivityTimer
.
4.4.7UEBatteryLifeEstimation
Our˝ne-grainedpro˝lingofUEpowerconsumptionandthecommodityeNodeBcon˝g-
urationsallowustoestimateUEbatterylifeinreal-worlddeployments.Thetotalpacket
energycanbecalculatedbysumminguptheenergyoftheradioaccessphases,whileeach
phaseenergycanbetunedaccordingtonetworkparameters.WeassumethattheUEstays
in
PSM
whenitisnottransmitting.TheUEvoltageandbatterycapacityare3.3Vand5
Wh,respectively.WeassumethattheUEconsumes50mAextracurrent,atypicalenergy
pro˝leforanembeddedsystem,toaccountforthepowerconsumptionofothersystem
components,suchasMCUandonboardsensors,duringthepacketcycle.Wethencalcu-
latetheenergyduringthepackettransmissioncycles.Thebatterylifeindaysisestimated
bydividingthebatterycapacitybytheenergyspentperday,dependingonthedatatra˚c.
Figure4.21showstheestimatedbatterylifeunderdi˙erentECLs,
InactiveTimers
.
First,thebatterylifedecreasessharplywiththenumberofpacketstransmitted.Second,
83
consistentwithourobservationinSection4.4.3,thecoveragelevelplaysacriticalrolein
thetotalenergyconsumption,andindoorUEssu˙ersigni˝cantlyshorterlifethantheir
peersingoodsignalcoverage.Wenowuseanexampletoillustratetheimpactofbadcov-
eragelevels.Inatypicalindoorparkingmonitoringsystem(whichisoneofthepopular
NB-IoTapplications[72]),supposeeachnodemonitoringaparkingspottransmits5pack-
etsduringaworkdayandworksunderECL2,thebatterylifeisonly270days.However,
thisisanoptimisticestimation,becausethebatterycanbea˙ectedbyvariousenvironmen-
talfactors.Thiswouldleadtofrequentnodereplacementandhighmaintenancecosts.As
aresult,itisofgreatimportancetooptimizeUEpowerconsumption.Inparticular,a
smallamountofsavedpacketenergycanleadtotensorhundredsofdaysofprolonged
nodelife.Forexample,consideringtheabovescenario,ifthe
InactivityTimer
issetto
3seconds,thebatterylifeextendsto440days,whichimprovesbyabout63%.
4.5Conclusion
Inthischapter,wepresentNB-Scopethe˝rstNB-IoTdiagnostichardwaretoolthatsup-
ports˝ne-grainedfusionofpowerandprotocoltraces,andalarge-scale˝eldmeasure-
mentstudyconsistingof30nodesdeployedatover1,200locationsin3regionsduring
threemonths.OurstudiesshowthatNB-IoTnodesyieldsigni˝cantlyimbalancedenergy
consumptioninthewild,duetopoornetworkcoveragelevel,long-tailpowerpro˝le,and
excessivecontrolmessagerepetitions.Basedonourestimation,the10-yearbatterylife
expectationisdi˚cultifnotimpossibletoachieveduetotheheterogeneousfactorsthat
shortenthebatterylife.Moreover,thehardware/softwarearchitectureofNB-Scopeis
largelyindependentoftheevolutionofNB-IoT.Therefore,itprovidesapowerfultoolto
instrumentlarge-scaleNB-IoTnetworksandwillfacilitatetheunderstandingandopti-
mizationofNB-IoTduringitsevolution.
OurstudyinthischapterfocusesontheenergyconsumptionofNB-IoTUE.Bycom-
biningthedebuglogwithpacket-levelmeasurements,ourtoolNB-Scopecanbeusedto
84
instrumentlarge-scaleNB-IoTnetworkstostudyvariousfactorsrelatedtonetworkper-
formancesuchasreliability,latency,interference,etc.Weleavethesetoopenproblemsfor
theresearchcommunity.
85
CHAPTER5
NB-IOTNETWORKENERGYOPTIMIZATIONANDBEYOND
5.1Introduction
NarrowbandInternetofThings(NB-IoT)providesnewinfrastructureforthelow-power
wideareanetwork,targetingmassiveconnection,deepcoverage,andlongbatterylife.
Toachievethe10-yearbatterylifepromise,NB-IoTadoptsmultipleenergy-savingtech-
niques,includingextendedDiscontinuousReception(eDRX),PowerSavingMode(PSM),
andEnhancedCoverageLevels(ECL).However,thee˙ectivenessoftheenergypreserv-
ingmethodsandthemessagesignalingbetweenthenodesandthebasestationwasnot
well-understood.
TounderstandtheNB-IoTpowerconsumptioninsightsinthewild,inpreviousChap-
ter4,weproposethedesignofthetoolset,NB-Scope,forNB-IoTnetworkbenchmarkand
diagnosis.Bylarge-scalemeasurementsinthe˝eld,wepresenttheenergyconsumption
pro˝lesofthedeployedNB-IoTnetworksbyaddressingthein˛uenceofvarioushetero-
geneousfactors,suchaslocationpro˝les,networkoperator,modulechipsetdesign,and
distancebetweenthenodeandthebasestation.Werevealthattheenergydrainissig-
ni˝cantlyimbalancedacrossthesefactors.Thisleadstoshortbatterylifeandfrequent
networkpartition,wheresomenodesmaydieoutinashortertimethantheirsiblings.
Asaconsequence,theIoTapplicationmaysu˙erfromhighmaintenancecostsinbattery
replacement,ordatalossissues.Bydecomposingtheenergyconsumptionwithrespectto
datapacketprocedures,weshowthattheECLmechanism,thelong-tailtimercon˝gura-
tion,andtherandomaccessprocedurecanbeblamedforthelargeenergyconsumption.
Fortunately,we˝ndthattheroomforoptimizingenergyconsumptionfromtheNB-IoT
protocolishuge.
Inthischapter,we˝rstproposeourexperimentalplatformforstudyingtheNB-IoT
86
energyoptimization,thenweproposethreeenergyoptimizationtechniques.Particularly,
weoptimizethe
InactivityTimer
andthe
MSG3
repetitioncount.Next,ourevaluationin-
dicatesthat,bycombiningtheseenergyoptimizations,itispossibletosaveupto66.4%of
theaveragepowerconsumption.Thenweproposethreeadditionaloptimizations,how-
ever,evaluationviaexperimentisnotyetpossibleduetothelimitationinthehardware
features.Finally,weproposeanupdatedversionofNB-Scopehardwaretosupportboth
NB-IoTandLoRamodules,whichopensnewresearchopportunitiesforfurtherexploiting
theemergingwirelessinfrastructures.
5.2Methodology
Ourmeasurementsshowthatinappropriatecon˝gurationsofeNodeBbasestation,such
asprolonged
InactiveTimer
andexcessive
MSG3
repetitioncount,causeasigni˝cantpor-
tionofenergydrainatUE.IncurrentNB-IoTspeci˝cation,
InactiveTimer
and
MSG
srep-
etitioncountaredeterminedandenforcedbyeNodeBas˝xedvalues.Inthissection,
weexplorethepossibilityofoptimizing
InactiveTimer
and
MSG3
repetitionbyeNodeB.
Ourresultsprovideimportantguidelinesfornetworkoperatorstooptimizethepower
consumptionofUEdevices.
Speci˝cally,anoptimal
MSG3
repetitionshouldassurereliableuploadof
MSG3
while
avoidingunnecessaryretransmissions.Anoptimal
InactiveTimer
shouldminimizethe
waitingtimeofUEaftercompletingpacketupload.Meanwhile,itshouldavoiddown-
linkpacketloss,whichoccurswhentheUEentersPSMoreDRXbeforethearrivalof
downlinkpackets.Ideally,the
InactiveTimer
shouldbecon˝guredbasedondownlink
latency,whichisdeterminedbynetworkroundtriptime(RTT)andtheapplicationserver
processingdelay.
CommercialeNodeBsareclosedsystems,whichcannotbeaccessedforexperiments.
Toaddressthisissue,webuildanNB-IoTeNodeBtestbedusingsoftwareradios.Weim-
plementtheeNodeBbyusingAmarisoftLTE100asbasebandcore,andemployingaUSRP
87
Figure5.1:TheSDReNodeBimplementation,withAmarisoftLTE100andUSRPN210.
N210withanSBX-40asRFfrontend,asshowninFigure5.1.ToemulateacommodityeN-
odeB,wecon˝gureoureNodeBusingthesame
MSG
srepetitionand
InactivityTimer
as
thecommodityone,runningatBand5(EARFCN=2530).Thedetailedcon˝gurationsare
listedinTable5.1.OureNodeBachievescoverageof1kminopenareas,whichiscompa-
rabletothecoverageofcommodityeNodeB.Then,wedeploy9BC35UEsinthenetwork,
suchthattheiraverageRSRPsaremonotonicallydecreasing.Speci˝cally,2,3,and4nodes
aresettoworkunderECL0/1/2respectively.
Inourexperiment,theRTTisde˝nedasthedelayfromissuingthepacketuplinkAT
commandtothedownlinkpacketdelivery.TheserverreplieswithaDLpacketimmedi-
atelyonceitreceivesaULpacket.Intotal,thereare400packetstransmittedtoaserveron
thelocalCloud.
Toexploretheimpactof
MSG3
repetition,we˝rsttrytodecreaseitinECL2from32to
16ineNodeB,thenfurtherdownto8.EachUEinthenetworkisprogrammedtotransmit
50ULpacketsperrecon˝guration.Ifthe
MSG3
isdeliveredtotheeNodeB,theUEreceives
MSG4
andproceedstodatatransmission.Otherwise,itretriesrandomaccessfrom
MSG1
again.Thus,wecanquantifythee˙ectivenessoftherepetitioncon˝gurationbycalculat-
ingtheprobabilityofexcessive
MSG3
schedulesinthenodesintheECL2coveragearea.
88
Table5.1:ListofeNodeBdefaultcon˝guration
Parameter
Value
ECL0ECL1ECL2
NB-IoTmodeStandalone
Band5
Txpower(dBm)15
EARFCN2530
InactivityTimer(s)20
MSG1
Repetition2832
MSG3
Repetition1232
ECLRSRPthreshold(dB)N/A-97-107
5.2.1InactivityTimerOptimizationEvaluation
Figure5.2showsthedistributionoftheRTTunderdi˙erentECLs.Aswecansee,the
UEsinECL2typicallyhavelargerpacketRTTthanUEsofECL1andECL0.SincetheRTT
betweentheeNodeBandtheapplicationserverissimilaracrosstheseECLs,thelarge
RTTinECL2isprimarilyduetothedelayinthedownlinktransmission.Comparedto
the20-secondtimervalueinCN-OP1andCN-OP2,atimervaluearound8secondscan
saveupto
60%
oftheenergyconsumptionduringthe
Inactivity
periodwhile98%of
theECL0andECL1nodesand81%oftheECL2nodescanreceivetheDLpacketbefore
the
InactivityTimer
expires.ConsideringtheportionofECL2nodesrelativelysmaller,
amoreaggressivestrategyistofurtherreducethetimerto5seconds,whiletheECL2
nodescanreleasetheRRCconnectionearlierandenableeDRXtolistentotheDLpaging
signal.ThedrawbackofsuchanapproachistheslightincreaseintheRRCconnection
requestsinthenetwork.However,itisworthconsideringanextra10%ofthe
Inactivity
periodenergycanbesaved.Ourexperimentaimsto˝ndalowerboundforthetimer
con˝guration,asaproofofconcept.WenotethatthetimervalueincommercialeNodeBs
shouldalsoconsidervariousfactorsthatmayinduceextradelays,suchasnodedensity,
89
downlinktra˚c,andtheRRCconnectionrequesttra˚c.
Figure5.2:RoundtriptimeCDFintheevaluationexperiment.
Figure5.3:Prob.ofpacketswith
MSG3
re-transmissionw.r.tECL2
MSG3
repetition.
5.2.2MSG3RepetitionCountOptimizationEvaluation
Ourgoalistoinvestigatetheminimumnumberofrepetitionsthatcanstillensureahigh
probabilityofone-time
MSG3
delivery.The
MSG3
retransmissionprobabilityisshownin
Figure5.3.Allthenodesinthe˝gurearedesignatedtoworkinECL2,andtheiraverage
90
Table5.2:Meanenergyconsumptionofthe
MSG3
periodfordi˙erentECL2
MSG3
repetitions.
NodeRep.=8Rep.=16Rep.=32
#1170.93(1.04)350.68(1.46)807.68(11.63)
#2170.60(1.10)346.44(1.33)680.63(2.59)
#3173.40(0.91)347.98(3.21)838.31(26.04)
#4169.70(7.32)354.13(5.09)697.69(3.41)
signalstrengthisdecreasingfromlefttoright.Aswecansee,whenthenodesareina
relativelygoodsignalconditioninECL2,suchasNode#1and#2,di˙erent
MSG3
repetitions
yieldasimilar
MSG3
retransmissionrate,whichmeansthereducedrepetitioncountcan
stillensuredeliveryof
MSG3
atthe˝rstattempt.Wemeasuretheenergyconsumption
ofthe
MSG3
transmissiontobe171.1/349.8/756.1mJfor8/16/32
MSG3
repetitioncounts
respectivelyonthetestnodes.Asaresult,about
77
%oftheMSG3Txenergycanbesaved
ifaUEsucceedsinRAbyusing8repetitioncountsof
MSG3
.Therefore,ourexperimental
resultsdemonstratethefeasibilityofreducingtheenergybyusingalower
MSG3
repetition
withouthurtingtherandomaccesssuccessrate.However,whenthesignalcontinuesto
attenuate,the
MSG3
repetitionnumberof8yieldssubstantiallyhigherrandomaccessretry
probability,asshownbyNode#3and#4,resultinginenergywastage.
Bycombiningthetwooptimizationsabove,aUEinECL2canpotentiallysaveupto
66.4%
ofthepacketenergyconsumption.
5.3NewDirectionsinEnergyOptimization
Basedonourmeasurementresults,wenowdiscussseveralimportantdesignaspectsthat
canbeconsideredbyfutureNB-IoTspeci˝cationsandchipsetsforoptimizingenergycon-
sumption.
91
5.3.1Per-UEInactivityTimer
Ourresultsindicatedthatacell-wise
InactivityTimer
canleadtosigni˝cantenergy
wasteforsomeUEs.AbettersolutionwouldbetoalloweachUEtosetthetimerby
negotiationwitheNodeB.AUEwithoutDLtra˚ccanreleasetheRRCconnectionimme-
diatelyaftertheUL,savingasigni˝cantamountofenergy.Forexample,aUEinECL0
cansaveupto90%packetenergybyskippingtheentire
Inactivity
periodwhenitdoes
notexpectanyincomingDLpackets.Moreover,aUEcanupdatethetimerbasedonits
measurementofnetworkRTTorsignalstrength,whichcanachieveadesirablebalance
betweentheenergyconsumptionandtheRRCconnectionre-establishmentrate.
5.3.2ECLAdaptationofUE
Ourresultsshowedthatthesimplethreshold-basedECLselectionpolicyplaysacritical
roleinthesigni˝cantenergywasteandimbalanceofUE.Wenowdiscussseveralwaysto
improvetheECLdecisionalgorithm.First,othermetricscouldbeintegratedwithRSRP
andSNRtodeterminetheECLselection,includingtheblockerrorratewhichdirectly
measurestheblocktransmissionstatus.TheUEmayalsorefertoitsECLdecisionhistory
toexplorebetterECLchoices.IftheUEfailsinusingalowerECLatcertainchannel
qualityinthepast,itmayconsiderusingahigherECLinasimilarchannelcondition,
avoidingtheenergywasteinthelowECLattempts.Finally,insteadofrespondingtothe
ULpacketATcommandimmediately,theUEmaypostponetherandomaccessfordelay-
tolerantapplications,waitingforatimewindowwithbetterchannelquality.Wenotethat
theimplementationofthesepolicieswouldrequirethesupportofNB-IoTchipsets,e.g.,
allowingdeveloperstoaccessandoverrideECLdecisions.
92
5.3.3Fine-grainedECLs
OurresultsshowedthatECL2yieldssigni˝cantlymoreenergyconsumptionthanother
ECLs,duetoexcessivecontrolmessagerepetitionsandunnecessaryrandomaccessre-
tries.Toachieveamoredesirabletrade-o˙betweenenergyconsumptionandrandom
accesse˚ciency,wesuggestincludingextraECLsand˝ner-grainedRSRPthresholdsand
RAresourceallocationbetweentheECLs.Forinstance,aUEinarelativelygoodsignal
conditionmaychooseanewECLbetweenthelegacyECL1andECL2,whichentailsa
lowerrepetitioncountof
MSG3
tosavepower.WenotethataddingnewECLsmayintro-
duceextrasignalingbetweentheeNodeBbasestationandUE.
5.3.4CollaborativeEnergySaving
Theevolutionofedgecomputingprovidesnewopportunitiesforenergyoptimization.
Speci˝cally,thenodesdeployedinawideareacanuploadtheirsignalstrengthandblock
errorratetotheedgecomputingserver.Ifthenodesupportsmobility,thenthesignaling
canbeassociatedwiththegeolocationinreal-time.Then,bybuildingthespatio-temporal
qualityofservice(QoS)pro˝lefromcrowdsourcing,theedgecomputingserverisable
torecommendthenodesfortheirnextrandomaccesstimestampaswellastheECLfor
randomaccess.Inthismanner,thepower-savingtimercanbedynamicallycon˝gured,
avoidingcrowdedchannels,signalblindspots,orperiodswithlowsignalstrength.We
notethatthisisdi˚cult,ifnotimpossible,ifthereareonlyhundredsorfewernodesin
thearea.Instead,whentensofthousandsofnodescoexistinthearea,themegatrends
underlyingtheLPWANandtheglobalknowledgeofthemassiveconnectivitywillenable
thenovelpatternsforenergyoptimization.
5.4BeyondNB-Scope
Inthissection,wepresentourupgradedNB-Scopedesign,whichisreferredtoas
NB-
ScopeV2
.ItsupportsLongRange(LoRa)communicationandin-situdiagnosticmessage
93
decodingwhileinheritsallthemajorfunctionalitiesfromitspredecessor.
5.4.1In-deviceSignalingDecoding
OneofthenotableupgradesinNB-ScopeV2softwaredesignisthein-devicedebugging
messagedecoding.TheoriginalNB-Scopesupportsstreamingthedebuggingmessages
fromtheNB-IoTmoduletotheSDcard.However,understandingthereal-timeUEbehav-
iorinthe˝eld-testmodewasnotsupportedbythenode.Retrospectingandreconstructing
theUE'sbehaviorarerequiredtofurtheranalyzethenetworkstatus.
Fortunately,thein-devicemessagedecodingisimplementedinthelatestversionof
NB-Scope.Toachievethis,˝rstofall,werecompileandcompressthedebuggingmessage
de˝nitiondatabaseusinghexadecimalindicestoallowforastorage-constrainedembed-
dedsystem.Next,weimplementthemessagedecoder˝nitestatemachine(FSM)inthe
MCU.Finally,bycombiningthemessagedecoderandthemessagedatabase,weachieve
real-timein-devicedebugmessagedecoding,suchthatthedeviceisawareofthecompre-
hensivenetworkstatuswithouttheneedofqueryingtheNB-IoTmoduleusingthelow
e˚cientATcommands.Enabledbythisfunctionality,thenodecannotonlyexplorereal-
timedynamiccontrolstrategiestoimprovethecommunicatione˚ciencybutalsoableto
feedbackthenetworkstatusinthepacketpayloadtotheapplicationserversforreal-time
collaboration.
5.4.2TowardstheCoexistenceofNB-IoTandLoRa
TheNB-IoTnetworkadoptsastartopology,wherethenodesonlycommunicatewiththe
basestationbutnotawareoftheirneighborNB-IoTnodes.Toaddressthis,weupgrade
NB-Scopetoversion2,asshowninFigure5.4.OneofthemajorhardwareupdatesofNB-
ScopeistosupportthecommercialinAIR9BLoRamodulewhilebackwardcompatible
withallofourNB-IoTshieldboards.
94
(a)NB-ScopeV2mainboard.
(b)NB-ScopeV2node,withtheinAIR9BmoduleandtheNB-IoT
shieldboardpluggedtogether.
Figure5.4:NB-ScopeV2hardwaredesign.
BycommunicatingwiththeneighborNB-IoTnodes,theV2nodescanestablishamesh
network,whichopensupnewresearchopportunities.Forexample,wecanachievecollab-
orativesensing,wheremultiplenodes˝nishthetasksbydistributedconsensus.Itisalso
possibletosavemuchenergyifthenodesintheECL2conditionusingthehelpoftheir
neighbornodeswithgoodsignalconditionstoroutetheuplinkdatapackettotheserver.
AsshowninSection4.4.4,thenodesinECL2consumeupto4.41xhigherenergythanthe
nodesinECL0.Therefore,suchamulti-hoproutingstrategyisabletosaveenergysignif-
icantly,andtheenergyimbalancecanbesubstantiallymitigatedbyusingoptimalrouting
protocols.
ThecoexistenceofNB-IoTandLoRapoweredbyNB-ScopeV2providesanewparadigm
fortheLPWANresearchcommunity.
5.5Conclusion
Inthischapter,weproposedtwoenergyoptimizationsregardingthe
InactivityTimer
andthe
MSG3
Repetition,bothofwhichpreservetheenergysigni˝cantly.Speci˝cally,upto
66.4%ofenergycanbesavedfornodesundercriticalsignalconditions.Then,wepropose
4di˙erentenergyoptimizationsundertheNB-IoTframework,providingnewresearch
directionstothecommunity.Next,wepresentourupgradetotheNB-Scopedesign,which
nowsupportsin-devicereal-timediagnosticmessagesdecodingandNB-IoT-LoRadual-
95
modewirelesscommunication.Oure˙ortsopennewparadigmsforLPWANresearch
andapplications.
96
CHAPTER6
CONCLUSION
Thewirelesstechnologieshavebeenevolvedspeedily,whoseinfrastructureisbuiltand
deliveredspeedily.Thefastgrowthofwirelessnetworksgeneratesnotonlyopportunities
fornewapplications,butalsoissuesinhighenergyconsumption,unexpectedlatency,and
potentialprivacybreach.
Inthisdissertation,weproposetwonovelcyber-physicalsystemstodemonstratethe
possibilityofenablingnewapplicationsbyleveragingtheemergingwirelesscharging
infrastructures,andbenchmarktheenergyperformanceofendnodesintherecentlyde-
butedNB-IoTnetworks,respectively.
First,wepresentQID,the˝rstsystemthatcanidentifyaQi-compliantdevicedur-
ingwirelesscharginginreal-timeusingwirelesscharging˝ngerprints.QIDemploysa
2-dimensionalmotionunittoemulateavarietyofmulti-coildesignsofQi,whichallows
for˝ne-graineddevice˝ngerprinting.Withthenovelmobilecoildesignandasetofnovel
features,suchascontrolerrorpacketintervaldistributionandcontrolerrorvaluedistribu-
tion,QIDachievesabout90%devicerecognitionaccuracyandalmost100%devicebrand
recognitionaccuracy.QIDdemonstratesthepossibilityofleveragingwirelesscharging
stationstoidentifymobiledevicesandtracktheusers.Withtheprevalenceofpublic
wirelesschargingstations,ourresultsalsohaveimportantimplicationsformobileuser
privacy.
Second,wedevelopanovelbenchmarkingecosystem,called
NB-Scope
,tostudythe
energyperformanceoftheNarrowbandInternet-of-things(NB-IoT)network.NB-Scope
adoptsahierarchicaldesign,resolvingtheheterogeneityinnetworkoperators,nodemod-
ulevendors,andlocationpro˝les,toallowforthefusionof˝ne-graineddiagnostictraces
andcurrentmeasurement.ThesmallformfactorsoftheNB-Scope˝eldtestcon˝guration
enabletheagileand˛exibledeployment,whichsupportsconcurrentmulti-spotmeasure-
97
ment,makingafaircomparisonbetweenthenodeswithdi˙erentsettings.Wethencon-
ductalarge-scale˝eldmeasurementstudyconsistingof30nodesdeployedatover1,200
locationsin3regionsduringaperiodofthreemonths.Ourin-depthanalysisofthecol-
lected49GBtracesshowedthatNB-IoTnodesyieldsigni˝cantlyimbalancedenergycon-
sumptioninthewild,uptoaratioof75:1,whichmayleadtoshortbatterylifetimeand
frequentnetworkpartition.Byextensivedataanalysis,weidentifyseveralkeyfactors
includingdiversenetworkcoveragelevels,long-tailpowerpro˝le,andexcessivecontrol
messagerepetitions,thatleadtohighvarianceintheenergyperformance.Basedonour
data,weconcludethattheNB-IoTUEsarenotabletoachieve10-yearprojectedbattery
life,eveninthemostoptimisticscenario,whichisnoteworthyfortheNB-IoTapplication
developers.
Third,weexploretheoptimizationofNB-IoTbasestationsettingsonasoftware-de˝ned
eNodeBtestbedandsuggestseveralimportantdesignaspectsthatcanbeconsideredby
futureNB-IoTspeci˝cationsandchipsets.Overall,ourworkforthe˝rsttimeaddressing
theenergyperformanceoftheNB-IoTnetwork,providinginsightsfortheNB-IoTresearch
anddevelopmentcommunities.Asoure˙ortstokeepNB-Scopeevolved,weproposeits
successor,withboththehardwareandsoftwareupgraded.Bysupportingin-devicemes-
sagedecodingandLoRa-NB-IoTcoexistence,NB-ScopeV2providesnewopportunities
forLPWANresearchandapplications.
98
BIBLIOGRAPHY
99
BIBLIOGRAPHY
[1]Ieeestandardforlow-ratewirelessnetworks.
IEEEStd802.15.4-2015(RevisionofIEEE
Std802.15.4-2011)
,pagesApril2016.
[2]OmidAbari,DeepakVasisht,DinaKatabi,andAnanthaChandrakasan.Caraoke:
Ane-tolltranspondernetworkforsmartcities.In
ACMSIGCOMMComputerCom-
municationReview
,volume45,pagesACM,2015.
[3]CarlosAAstudillo,FernandoHSPereira,andNelsonLSdaFonseca.Probabilisticre-
transmissionsfortherandomaccessprocedureincellulariotnetworks.In
ICC2019-
2019IEEEInternationalConferenceonCommunications(ICC)
,pagesIEEE,2019.
[4]AtmelCorporation.
SAMG53NSMARTARM-basedFlashMCUDatasheet
,11240fedi-
tion,July2015.32-bitARMCortex-M4RISCprocessor.
[5]AminAzari,GuowangMiao,CedomirStefanovic,andPetarPopovski.Latency-
energytradeo˙basedonchannelschedulingandrepetitionsinnb-iotsystems.In
2018IEEEGlobalCommunicationsConference(GLOBECOM)
,pagesIEEE,2018.
[6]ParamvirBahlandVenkataNPadmanabhan.Radar:Anin-buildingrf-baseduser
locationandtrackingsystem.In
INFOCOM2000.NineteenthAnnualJointConference
oftheIEEEComputerandCommunicationsSocieties.Proceedings.IEEE
,volume2,pages
Ieee,2000.
[7]NiranjanBalasubramanian,ArunaBalasubramanian,andArunVenkataramani.En-
ergyconsumptioninmobilephones:ameasurementstudyandimplicationsfornet-
workapplications.In
Proceedingsofthe9thACMSIGCOMMConferenceonInternet
Measurement
,pagesACM,2009.
[8]SIGBluetooth.Bluetooth4.2corespeci˝cation.
BluetoothSIG
,2009.
[9]HristoBojinov,YanMichalevsky,GabiNakibly,andDanBoneh.Mobiledeviceiden-
ti˝cationviasensor˝ngerprinting.
arXivpreprintarXiv:1408.1416
,2014.
[10]BernhardEBoser,IsabelleMGuyon,andVladimirNVapnik.Atrainingalgorithm
foroptimalmarginclassi˝ers.In
Proceedingsofthe˝fthannualworkshoponComputa-
tionallearningtheory
,pagesACM,1992.
[11]Taou˝kBouguera,Jean-FrançoisDiouris,Jean-JacquesChaillout,RandaJaouadi,and
GuillaumeAndrieux.Energyconsumptionmodelforsensornodesbasedonloraand
lorawan.
Sensors
,18(7):2104,2018.
[12]LeoBreiman.
Classi˝cationandregressiontrees
.Routledge,2017.
[13]VladimirBrik,SumanBanerjee,MarcoGruteser,andSanghoOh.Wirelessdevice
identi˝cationwithradiometricsignatures.In
Proceedingsofthe14thACMinternational
conferenceonMobilecomputingandnetworking
,pagesACM,2008.
100
[14]AlistairCharlton.Wirelesslychargeanywherewiththeseqi-enabledta-
bles,lamps,speakersandaccessories.
https://www.gearbrain.com/
qi-wireless-charging-tables-lamps-2528825500.html
.Accessed:2018-07-
25.
[15]ShichaoChen,GangXiong,JiaXu,ShuangshuangHan,Fei-YueWang,andKun
Wang.Thesmartstreetlightingsystembasedonnb-iot.In
2018ChineseAutoma-
tionCongress(CAC)
,pagesIEEE,2018.
[16]XiaomengChen,NingDing,AbhilashJindal,YCharlieHu,MarutiGupta,andRath
Vannithamby.Smartphoneenergydraininthewild:Analysisandimplications.
ACM
SIGMETRICSPerformanceEvaluationReview
,2015.
[17]Yu-ShinChouandJing-SinLiu.Aroboticindoor3dmappingsystemusinga2dlaser
range˝ndermountedonarotatingfour-barlinkageofamobileplatform.
Interna-
tionalJournalofAdvancedRoboticSystems
,10(1):45,2013.
[18]WirelessPowerConsortium.Magneticresonanceandmagneticinduction
-whatisthebestchoiceformyapplication?
https://tinyurl.com/
wireless-charging-choices
,2017.Accessed:2019-02-13.
[19]WirelessPowerConsortium.Qiwirelesscharginggoesmainstream.
http://www.
air-charge.com/news/21/19/Qi-wireless-charging-goes-mainstream
,2017.Ac-
cessed:2019-01-09.
[20]ThomasCoverandPeterHart.Nearestneighborpatternclassi˝cation.
IEEEtransac-
tionsoninformationtheory
,1967.
[21]MariusCristeaandBogdanGroza.Fingerprintingsmartphonesremotelyviaicmp
timestamps.
CommunicationsLetters,IEEE
,2013.
[22]BorisDanevandSrdjanCapkun.Transient-basedidenti˝cationofwirelesssensor
nodes.In
Proceedingsofthe2009InternationalConferenceonInformationProcessingin
SensorNetworks
,pagesIEEEComputerSociety,2009.
[23]AnupamDas,NikitaBorisov,andMatthewCaesar.Doyouhearwhatihear?˝n-
gerprintingsmartdevicesthroughembeddedacousticcomponents.In
Proceedings
ofthe2014ACMSIGSACConferenceonComputerandCommunicationsSecurity
,pages
2014.
[24]AnupamDas,NikitaBorisov,andMatthewCaesar.Trackingmobilewebusers
throughmotionsensors:Attacksanddefenses.In
NDSS
,2016.
[25]NingDing,DanielWagner,XiaomengChen,AbhinavPathak,YCharlieHu,and
AndrewRice.Characterizingandmodelingtheimpactofwirelesssignalstrength
onsmartphonebatterydrain.In
ACMSIGMETRICSPerformanceEvaluationReview
,
pagesACM,2013.
101
[26]SarunDuangsuwan,AekarongTakarn,RachanNujankaew,andPunyawiJamjareeg-
ulgarn.Astudyofairpollutionsmartsensorslpwanvianb-iotforthailandsmart
cities4.0.In
201810thInternationalConferenceonKnowledgeandSmartTechnology(KST)
,
pagesIEEE,2018.
[27]WernerDubitzky,MartinGranzow,andDanielPBerrar.
Fundamentalsofdatamining
ingenomicsandproteomics
.SpringerScience&BusinessMedia,2007.
[28]RashadEletreby,DianaZhang,SwarunKumar,andOsmanYa§an.Empoweringlow-
powerwideareanetworksinurbansettings.In
ProceedingsoftheConferenceoftheACM
SpecialInterestGrouponDataCommunication
,pagesACM,2017.
[29]Ericsson.Theericssonmobilityreport.
https://www.ericsson.com/en/blog/2019/
10/what-is-NB-IoT
,2019.
[30]YoavFreundandRobertESchapire.Adesicion-theoreticgeneralizationofon-line
learningandanapplicationtoboosting.In
Europeanconferenceoncomputationallearn-
ingtheory
,pagesSpringer,1995.
[31]JessicaFridrich.Digitalimageforensics.
IEEESignalProcessingMagazine
,
2009.
[32]JonGjengset,JieXiong,GraemeMcPhillips,andKyleJamieson.Phaser:Enabling
phasedarraysignalprocessingoncommoditywi˝accesspoints.In
Proceedingsofthe
20thannualinternationalconferenceonMobilecomputingandnetworking
,pages
2014.
[33]JuergenGraefenstein,AmosAlbert,PeterBiber,andAndreasSchilling.Wirelessnode
localizationbasedonrssiusingarotatingantennaonamobilerobot.In
Position-
ing,NavigationandCommunication,2009.WPNC2009.6thWorkshopon
,pages
IEEE,2009.
[34]GSACOM.Globalnarrowbandiotlte-mnetworksmarch2019.
https://
gsacom.com/paper/global-narrowband-iot-lte-m-networks-march-2019/
,2019.
Accessed:2020-03-19.
[35]GSMA.Mobileiotnetworklaunches.
https://www.gsma.com/iot/
mobile-iot-commercial-launches/
,2020.Accessed:2020-02-19.
[36]NilsYHammerlaandThomasPlötz.Let's(not)sticktogether:pairwisesimilarity
biasescross-validationinactivityrecognition.In
Proceedingsofthe2015ACMinter-
nationaljointconferenceonpervasiveandubiquitouscomputing
,pagesACM,
2015.
[37]CanlongHe,MingxiaShen,LongShenLiu,COkinda,JiYang,HongShi,etal.Design
andrealizationofagreenhousetemperatureintelligentcontrolsystembasedonnb-
iot.
JournalofSouthChinaAgriculturalUniversity
,2018.
102
[38]JunHuang,WahhabAlbazrqaoe,andGuoliangXing.Blueid:apracticalsystemfor
bluetoothdeviceidenti˝cation.In
INFOCOM,2014ProceedingsIEEE
,pages
2857.IEEE,2014.
[39]JunxianHuang,FengQian,AlexandreGerber,ZMorleyMao,SubhabrataSen,and
OliverSpatscheck.Acloseexaminationofperformanceandpowercharacteristics
of4gltenetworks.In
Proceedingsofthe10thinternationalconferenceonMobilesystems,
applications,andservices
,pagesACM,2012.
[40]FaheemIjaz,HeeKwonYang,ArbabWaheedAhmad,andChankilLee.Indoorposi-
tioning:Areviewofindoorultrasonicpositioningsystems.In
AdvancedCommunica-
tionTechnology(ICACT),201315thInternationalConferenceon
,pagesIEEE,
2013.
[41]MonsoonSolutionsInc.Highvoltagepowermonitor.
https://www.msoon.com/
high-voltage-power-monitor
,2019.Accessed:2019-09-09.
[42]In˝neonTechnologies.
Applicationbrochure-Wirelesschargingforconsumer
,32018.
Rev4.0.
[43]HanSeungJang,HuJin,BangChulJung,andTonyQSQuek.Versatileaccesscon-
trolformassiveiot:Throughput,latency,andenergye˚ciency.
IEEETransactionson
MobileComputing
,2019.
[44]TadayoshiKohno,AndreBroido,andKimberlyCCla˙y.Remotephysicaldevice
˝ngerprinting.
DependableandSecureComputing,IEEETransactionson
,
2005.
[45]ManikantaKotaru,KiranJoshi,DineshBharadia,andSachinKatti.Spot˝:Decimeter
levellocalizationusingwi˝.In
ACMSIGCOMMComputerCommunicationReview
,
volume45,pagesACM,2015.
[46]SuraponKraijakandPanwitTuwanut.Asurveyoninternetofthingsarchitecture,
protocols,possibleapplications,security,privacy,real-worldimplementationandfu-
turetrends.In
2015IEEE16thInternationalConferenceonCommunicationTechnology
(ICCT)
,pagesIEEE,2015.
[47]SivanandKrishnan,PankajSharma,ZhangGuoping,andOngHweeWoon.Auwb
basedlocalizationsystemforindoorrobotnavigation.In
2007IEEEInternationalCon-
ferenceonUltra-Wideband
,pagesIEEE,2007.
[48]MadsLauridsen,HuanNguyen,BennyVejlgaard,IstvánZKovács,PrebenMo-
gensen,andMadsSorensen.Coveragecomparisonofgprs,nb-iot,lora,andsigfox
ina7800km
2
area.In
2017IEEE85thVehicularTechnologyConference(VTCSpring)
,
pagesIEEE,2017.
[49]YilongLi,YunCheng,XiuchengLi,YuWang,GuoliangXing,andXiaofanJiang.
qi-wirelessbasedplatformforrobustuser-initiatedindoorlocationservices:
103
Demoabstract.In
Proceedingsofthe1stACMConferenceonEmbeddedSystemsforEnergy-
E˚cientBuildings
,BuildSys'14,pagesNewYork,NY,USA,2014.ACM.
[50]YuanjieLi,HaotianDeng,ChunyiPeng,ZengwenYuan,Guan-HuaTu,JiayaoLi,
andSongwuLu.icellular:Device-customizedcellularnetworkaccessoncommodity
smartphones.In
13th
f
USENIX
g
SymposiumonNetworkedSystemsDesignandImple-
mentation(
f
NSDI
g
16)
,pages2016.
[51]YuanjieLi,ChunyiPeng,ZengwenYuan,JiayaoLi,HaotianDeng,andTaoWang.
Mobileinsight:Extractingandanalyzingcellularnetworkinformationonsmart-
phones.In
Proceedingsofthe22ndAnnualInternationalConferenceonMobileComputing
andNetworking
,MobiCom'16,pagesNewYork,NY,USA,2016.ACM.
[52]YuanjieLi,JiaqiXu,ChunyiPeng,andSongwuLu.A˝rstlookatunstablemobility
managementincellularnetworks.In
Proceedingsofthe17thInternationalWorkshopon
MobileComputingSystemsandApplications
,pages2016.
[53]YukeLi,XiangCheng,YangCao,DexinWang,andLiuqingYang.Smartchoicefor
thesmartgrid:Narrowbandinternetofthings(nb-iot).
IEEEInternetofThingsJournal
,
2017.
[54]JansenCLiando,AmalindaGamage,AgustinusWTengourtius,andMoLi.Known
andunknownfactsoflora:Experiencesfromalarge-scalemeasurementstudy.
ACM
TransactionsonSensorNetworks(TOSN)
,15(2):16,2019.
[55]KaikaiLiu,XinxinLiu,andXiaolinLi.Guoguo:Enabling˝ne-grainedindoorlo-
calizationviasmartphone.In
Proceedingofthe11thannualinternationalconferenceon
Mobilesystems,applications,andservices
,pages2013.
[56]XiaoLu,DusitNiyato,PingWang,DongInKim,andZhuHan.Wirelesscharger
networkingformobiledevices:Fundamentals,standards,andapplications.
IEEE
WirelessCommunications
,2015.
[57]MarkoMalajner,PeterPlaninsic,andDusanGleich.Angleofarrivalestimationusing
rssiandomnidirectionalrotatableantennas.
IEEESensorsJournal
,
2012.
[58]IHSMarkit.Halfabillionsmartphonesandotherdeviceswithwirelesspowertech-
nologyshippedin2017,ihsmarkitsays.
https://tinyurl.com/qi-half-billion
,
2018.Accessed:2018-05-19.
[59]TomMMitchell.Machinelearning.1997.
BurrRidge,IL:McGrawHill
,45:995,1997.
[60]AshkanNikravesh,HongyiYao,ShichangXu,DavidCho˙nes,andZ.MorleyMao.
Mobilyzer:Anopenplatformforcontrollablemobilenetworkmeasurements.In
Proceedingsofthe13thAnnualInternationalConferenceonMobileSystems,Applications,
andServices
,MobiSys'15,pagesNewYork,NY,USA,2015.ACM.
104
[61]NXPSemiconductors.
FreescaleWirelessChargingICs,MWCT1000CFM,
MWCT1200CFM,MWCT1101CLH
,52014.REV1.
[62]NXPSemiconductors.
MWPR1516:HigherintegrationreceivercontrollerMCUforwire-
lesspowertransferapplication
,12015.Rev.2.00.
[63]PanasonicCorporation.
AN32258A:IntergratedWirelessPowerSupplyReceiver,Qi
(WirelessPowerConsortium)Compliant
,102014.Rev.2.00.
[64]F.Pedregosa,G.Varoquaux,A.Gramfort,V.Michel,B.Thirion,O.Grisel,M.Blon-
del,P.Prettenhofer,R.Weiss,V.Dubourg,J.Vanderplas,A.Passos,D.Cournapeau,
M.Brucher,M.Perrot,andE.Duchesnay.Scikit-learn:MachinelearninginPython.
JournalofMachineLearningResearch
,2011.
[65]MarcoPennacchioni,Maria-GabriellaDiBenedette,TommasoPecorella,Camillo
Carlini,andPietroObino.Nb-iotsystemdeploymentforsmartmetering:Evaluation
ofcoverageandcapacityperformances.In
2017AEITInternationalAnnualConference
,
pagesIEEE,2017.
[66]DrewPrindle.Impressyourguests(andtopo˙theirphones)withthis
diywirelesschargingtable.
https://www.digitaltrends.com/how-to/
diy-wireless-charging-table/
.Accessed:2018-07-25.
[67]NissankaBPriyantha,AnitChakraborty,andHariBalakrishnan.Thecricket
location-supportsystem.In
Proceedingsofthe6thannualinternationalconferenceon
Mobilecomputingandnetworking
,pagesACM,2000.
[68]Rohde&Schwarz.Powersavingmethodsforlte-mandnb-
iotdevices.
https://www.rohde-schwarz.com/lt/solutions/
test-and-measurement/wireless-communication/iot-m2m/
whitepaper-power-saving-lte-m-nb-iot-register_251417.html
,2019.Accessed:
2020-02-16.
[69]ROHMSemicondunctor.
BD57011AGWL:Astand-aloneintegratedICforwirelesspower
receiver
,12018.Rev.003.
[70]AliSehatiandMajidGhaderi.Onlineenergymanagementiniotapplications.In
IEEEINFOCOM2018-IEEEConferenceonComputerCommunications
,pages
IEEE,2018.
[71]JunyangShenandAndreasFMolisch.Passivelocationestimationusingtoamea-
surements.In
2011IEEEInternationalConferenceonUltra-Wideband(ICUWB)
,pages
IEEE,2011.
[72]JiongShi,LipingJin,JunLi,andZhaoxiFang.Asmartparkingsystembasedon
nb-iotandthird-partypaymentplatform.In
201717thInternationalSymposiumon
CommunicationsandInformationTechnologies(ISCIT)
,pagesIEEE,2017.
105
[73]HyojeongShin,YohanChon,YungeunKim,andHojungCha.Mri:Model-based
radiointerpolationforindoorwar-walking.
IEEETransactionsonMobileComputing
,
2015.
[74]RashmiSharanSinha,YiqiaoWei,andSeung-HoonHwang.Asurveyonlpwatech-
nology:Loraandnb-iot.
IctExpress
,2017.
[75]TexasInstruments.
bq51013BHighlyIntegratedWirelessReceiverQi(WPCv1.2)Compli-
antPowerSupply
,32018.REVISEDMARCH2018.
[76]EmilianoTrevisaniandAndreaVitaletti.Cell-idlocationtechnique,limitsandben-
e˝ts:anexperimentalstudy.In
SixthIEEEworkshoponmobilecomputingsystemsand
applications
,pagesIEEE,2004.
[77]ArvinWenTsuiTsui,Wei-ChengLin,Wei-JuChen,PollyHuang,andHao-HuaChu.
Accuracyperformanceanalysisbetweenwardrivingandwarwalkinginmetropoli-
tanwi-˝localization.
IEEETransactionsonMobileComputing
,2010.
[78]DiegoValsesia,GiulioColuccia,TizianoBianchi,andEnricoMagli.Compressed˝n-
gerprintmatchingandcameraidenti˝cationviarandomprojections.
IEEETransac-
tionsonInformationForensicsandSecurity
,2015.
[79]DeepakVasisht,SwarunKumar,andDinaKatabi.Decimeter-levellocalizationwith
asinglewi˝accesspoint.In
13th
f
USENIX
g
SymposiumonNetworkedSystemsDesign
andImplementation(
f
NSDI
g
16)
,pages2016.
[80]JianxinWang,JunpanSu,andRuyuanHua.Designofasmartindependentsmoke
sensesystembasedonnb-iottechnology.In
2019InternationalConferenceonIntelligent
Transportation,BigData&SmartCity(ICITBS)
,pagesIEEE,2019.
[81]JueWangandDinaKatabi.Dude,where'smycard?r˝dpositioningthatworkswith
multipathandnon-lineofsight.In
ProceedingsoftheACMSIGCOMM2013conference
onSIGCOMM
,pages2013.
[82]RoyWant,AndyHopper,VeronicaFalcao,andJonathanGibbons.Theactivebadge
locationsystem.
ACMTransactionsonInformationSystems(TOIS)
,1992.
[83]WirelessPowerConsortium.
TheQiWirelessPowerTransferSystemPowerClass0Spec-
i˝cation
,1.2.3edition,February2017.Parts1and2:InterfaceDe˝nitions.
[84]WirelessPowerConsortium.
TheQiWirelessPowerTransferSystemPowerClass0Spec-
i˝cation
,1.2.3edition,February2017.Part4:ReferenceDesigns.
[85]DiWu,DmitriIArkhipov,YuanZhang,ChiHaroldLiu,andAmeliaCRegan.On-
linewar-drivingbycompressivesensing.
IEEETransactionsonMobileComputing
,
2015.
[86]JieXiongandKyleJamieson.Arraytrack:a˝ne-grainedindoorlocationsystem.
Usenix,2013.
106
[87]FaheemZafariandIoannisPapapanagiotou.Enhancingibeaconbasedmicro-
locationwithparticle˝ltering.In
2015IEEEGlobalCommunicationsConference
(GLOBECOM)
,pagesIEEE,2015.
[88]JiexinZhang,AlastairRBeresford,andIanSheret.Sensorid:Sensorcalibration˝n-
gerprintingforsmartphones.In
2019IEEESymposiumonSecurityandPrivacy(SP)
,
pagesIEEE,2019.
[89]NingZhangandYingjieLiu.Nb-iotdrivesintelligentcoldchainforbestapplica-
tion.In
2019IEEE9thInternationalConferenceonElectronicsInformationandEmergency
Communication(ICEIEC)
,pagesIEEE,2019.
107