| Roll | A. Brandt |
| Internet-Draft | Sigma Designs |
| Intended status: Informational | E. Baccelli |
| Expires: February 18, 2014 | INRIA |
| R. Cragie | |
| Gridmerge | |
| P. van der Stok | |
| Consultant | |
| August 17, 2013 |
Applicability Statement: The use of the RPL protocol set in Home Automation and Building Control
draft-ietf-roll-applicability-home-building-01
The purpose of this document is to provide guidance in the selection and use of RPL protocols to implement the features required in building and home environments.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on February 18, 2014.
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
Home automation and building control application spaces share a substantial number of properties. The purpose of this document is to give guidance in the use of the RPL protocol suite to provide the features required by the requirements documents "Home Automation Routing Requirements in Low-Power and Lossy Networks" [RFC5826] and "Building Automation Routing Requirements in Low-Power and Lossy Networks" [RFC5867].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
Additionally, this document uses terminology from [RFC6997], [I-D.ietf-roll-trickle-mcast], and [RFC6550].
Applicable requirements are described in [RFC5826] and [RFC5867].
The considered network diameter is limited to a max diameter of 10 hops and a typical diameter of 5 hops, which captures the most common cases in home automation and building control networks.
This document does not consider the applicability of RPL-related specifications for urban and industrial applications [RFC5548], [RFC5673], which may exhibit significantly larger network diameters.
The use of communications networks in buildings is essential to satisfy the energy saving regulations. Environmental conditions of buildings can be adapted to suit the comfort of the individuals present. Consequently when no one is present, energy consumption can be reduced. Cost is the main driving factor behind utilizing wireless networking in buildings. Especially for retrofit, wireless connectivity saves cabling costs.
A typical home automation network is comprised of less than 100 nodes. Large building deployments may span 10,000 nodes but to ensure uninterrupted service of light and air conditioning systems in individual zones of the building, nodes are typically organized in sub-networks. Each sub-network in a building automation deployment typically contains tens to hundreds of nodes.
The main purpose of the home or building automation network is to provide control over light and heating/cooling resources. User intervention may be enabled via wall controllers combined with movement, light and temperature sensors to enable automatic adjustment of window blinds, reduction of room temperature, etc. In general, the sensors and actuators in a home or building typically have fixed physical locations and will remain in the same home- or building automation network.
People expect an immediate and reliable response to their presence or actions. A light not switching on after entry into a room may lead to confusion and a profound dissatisfaction with the lighting product.
Monitoring of functional correctness is at least as important. Devices typically communicate their status regularly and send alarm messages notifying a malfunction of equipment or network.
In building control, the infrastructure of the building management network can be shared with the security/access, the IP telephony, and the fire/alarm networks. This approach has a positive impact on the operation and cost of the network.
In general, The home automation network or building control network consists of wired and wireless sub-networks. In large buildings especially, the wireless sub-networks can be connected to an IP backbone network where all infrastructure services are located, such as DNS, automation servers, etc. The wireless sub-network is typically a multi-node network with a border router located at a convenient place in the home (building).
In a building control network, there may be several redundant border routers to each sub-network. Sub-networks often overlap geographically and from a wireless coverage perspective. Due to two purposes of the network, (i) direct control and (ii) monitoring, there may exist two types of routing topologies in a given sub-network: (i) a tree-shaped collection of routes spanning from a central building controller via the border router, on to destination nodes in the sub-network; and/or (ii) a flat, un-directed collection of intra-network routes between functionally related nodes in the sub-network.
The majority of nodes in home and building automation networks are typically devices with very low memory capacity, such as individual wall switches. Only a few nodes (such as multi-purpose remote controls) are more expensive devices, which can afford more memory capacity.
Traffic may enter the network originating from a central controller or it may originate from an intra-network node. The majority of traffic is light-weight point-to-point control style; e.g. Put-Ack or Get-Response. There are however exceptions. Bulk data transfer is used for firmware update and logging, where firmware updates enter the network and logs leave the network. Group communication is used for service discovery or to control groups of nodes, such as light fixtures.
Often, there is a direct relation between a controlling sensor and the controlled equipment. The bulk of senders and receivers are separated by a distance that allows one-hop direct path communication. A graph of the communication will show several fully connected subsets of nodes. However, due to interference, multipath fading, reflection and other transmission mechanisms, the one-hop direct path may be temporally disconnected. For reliability purposes, it is therefore essential that alternative n-hop communication routes exist for quick error recovery. Looking over time periods of a day, the networks are very lightly loaded. However, bursts of traffic can be generated by the entry of several persons simultaneously, the occurrence of a defect, and other unforeseen events. Under those conditions, the timeliness must nevertheless be maintained. Therefore, measures are necessary to remove any unnecessary traffic. Short routes are preferred. Long multi-hop routes via the border router, should be avoided whenever possible.
Group communication is essential for lighting control. For example, once the presence of a person is detected in a given room, lighting control is focused in that room and no other lights should be dimmed, or switched on/off. In many cases, this means that a multicast message with a 1-hop and 2-hop radius would suffice to control the required lights. To reduce network load, it is advisable that messages to the lights in a room are not distributed any further in the mesh than necessary based on intended receivers.
Whilst air conditioning and other environmental-control applications may accept response delays of tens of seconds or longer, alarm and light control applications may be regarded as soft real-time systems. A slight delay is acceptable, but the perceived quality of service degrades significantly if response times exceed 250 msec. If the light does not turn on at short notice, a user may activate the controls again, thus causing a sequence of commands such as Light{on,off,on,off,..} or Volume{up,up,up,up,up,...}.
This paradigm translates to many sources sending messages to the same sink, sometimes reachable via the border router. As such, source-sink (SS) traffic can be present in home and building networks. The traffic is generated by environmental sensors (often present in a wireless sub-network) which push periodic readings to a central server. The readings may be used for pure logging, or more often, processed to adjust light, heating and ventilation. Alarm sensors also generate SS style traffic. The central server in a home automation network will be connected mostly to a wired sub-network. The central server in a building automation network may be connected to a backbone or be placed outside the building.
With regards to message latency, most SS transmissions can tolerate worst-case delays measured in tens of seconds. Alarm sensors, however, represent an exception. Special provisions with respect to the location of the Alarm server(s) need to be put in place to respect the specified delays.
This paradigm translates to a number of devices expressing their interest for a service provided by a server device. For example, a server device can be a sensor delivering temperature readings on the basis of delivery criteria, like changes in acquisition value or age of the latest acquisition. In building automation networks, this paradigm may be closely related to the SS paradigm as servers, which are connected to the backbone or outside the building, can subscribe to data collectors that are present at strategic places in the building automation network. The use of PS will probably differ significantly from installation to installation.
This paradigm translates to a device transferring data to another device often connected to the same sub-network. Peer-to-peer (P2P) traffic is a common traffic type in home automation networks. Some building automation networks also rely on P2P traffic while others send all control traffic to a local controller box for advanced scene and group control. The latter controller boxes can be connected to service control boxes thus generating more SS or PS traffic.
P2P traffic is typically generated by remote controls and wall controllers which push control messages directly to light or heat sources. P2P traffic has a strong requirement for low latency since P2P traffic often carries application messages that are invoked by humans. As mentioned in Section 2.2.1 application messages should be delivered within a few hundred milliseconds - even when connections fail momentarily.
This paradigm translates to a device sending a message as many times as there are destination devices. Peer-to-multipeer (P2MP) traffic is common in home and building automation networks. Often, a thermostat in a living room responds to temperature changes by sending temperature acquisitions to several fans and valves consecutively.
This paradigm translates to a device sending a message to many destinations in one network transfer invocation. Multicast is well suited for lighting where a presence sensor sends a presence message to a set of lighting devices. Multicast increases the probability that the message is delivered within the strict time constraints. The chosen multicast algorithm (e.g. xref target="I-D.ietf-roll-trickle-mcast"/>) assures that messages are delivered to ALL destinations.
In the case of SS over a wireless sub-network to a server reachable via a border router, the use of RPL [RFC6550] is recommended. Given the low resources of the devices, source routing will be used for messages from outside the wireless sub-network to the destination in the wireless sub-network. No specific timing constraints are associated with the SS type messages so network repair does not violate the operational constraints. When no SS traffic takes place, it is recommended to load only RPL-P2P code into the network stack to satisfy memory requirements by reducing code.
All P2P and P2MP traffic, taking place within a wireless sub-network, requires P2P-RPL [RFC6997] to assure responsiveness. Source and destination are typically close together to satisfy the living conditions of one room. Consequently, most P2P and P2MP traffic is 1-hop or 2-hop traffic. Appendix A explains why RPL-P2P is preferable to RPL for this type of communication.
Additional advantages of RPL-P2P for home and building automation networks are, for example: Section 4.1.2.
Due to the limited memory of the majority of devices, RPL-P2P MUST be used with source routing in non-storing mode as explained in
N-cast over the wireless network will be done using multicast with MPL [I-D.ietf-roll-trickle-mcast]. Configuration constraints that are necessary to meet reliability and timeliness with MPL are discussed in Section 4.1.7.
This document applies to [IEEE802.15.4] and [G.9959] which are adapted to IPv6 by the adaption layers [RFC4944] and [I-D.brandt-6man-lowpanz].
The above mentioned adaptation layers leverage on the compression capabilities of [RFC6554] and [RFC6282]. Header compression allows small IP packets to fit into a single layer 2 frame even when source routing is used. A network diameter limited to 5 hops helps to achieve this.
Dropped packets are often experienced in the targeted environments. ICMP, UDP and even TCP flows may benefit from link layer unicast acknowledgments and retransmissions. Link layer unicast acknowledgments MUST be enabled when [IEEE802.15.4] or [G.9959] is used with RPL and RPL-P2P.
RPL-P2P MUST be present in home and building automation networks, as point-to-point style traffic is substantial and route repair needs to be completed within seconds. RPL-P2P provides a reactive mechanism for quick, efficient and root-independent route discovery/repair. The use of RPL-P2P furthermore allows data traffic to avoid having to go through a central region around the root of the tree, and drastically reduces path length [SOFT11] [INTEROP12]. These characteristics are desirable in home and building automation networks because they substantially decrease unnecessary network congestion around the root of the tree.
When reliability is required, multiple independent paths are used with RPL-P2P. For 1-hop destinations this means that one 1-hop communication and a second 2-hop communication take place via a neigboring node. The same reliability can be achieved by using MPL where the seed is a repeater and a second repeater is 1 hop removed from the seed and the destination node.
RPL-P2P MUST be used in home and building networks. Non-storing mode allows for constrained memory in repeaters when source routing is used. Reactive discovery allows for low application response times even when on-the-fly route repair is needed.
In one constrained deployment, the link layer master node handing out the logical network identifier and unique node identifiers may be a remote control which returns to sleep once new nodes have been added. There may be no global routable prefixes at all. Likewise, there may be no authoritative always-on root node since there is no border router to host this function.
In another constrained deployment, there may be battery powered sensors and wall controllers configured to contact other nodes in response to events and then return to sleep. Such nodes may never detect the announcement of new prefixes via multicast.
In each of the above mentioned constrained deployments, the link layer master node SHOULD assume the role as authoritative root node, transmitting singlecast RAs with a ULA prefix information option to nodes during the inclusion process to prepare the nodes for a later operational phase, where a border router is added.
A border router SHOULD be designed to be aware of sleeping nodes in order to support the distribution of updated global prefixes to such sleeping nodes.
One COULD implement gateway-centric tree-based routing and global prefix distribution as defined by [RFC6550]. This would however only work for always-on nodes.
When operating P2P-RPL on a stand-alone basis, there is no authoritative root node maintaining a permanent RPL DODAG. A node MUST be able to join one RPL instance as an instance is created during each P2P-RPL route discovery operation. A node MAY be designed to join multiple RPL instances.
Non-storing mode MUST be used to cope with the extremely constrained memory of a majority of nodes in the network (such as individual light switches).
A node MAY be designed to join multiple RPL instances; in that case DAO policies may be needed.
DAO policy is out of scope for this applicability statement.
OF0 is RECOMMENDED. [RFC6551] provides other options. Using other objective functions than OF0 may affect inter-operability.
OF0 MUST be supported and is the RECOMMENDED Objective Function to use. Other Objective Functions MAY be used as well.
Since RPL-P2P only creates DODAGs on a temporary basis during route repair, there is no need to repair DODAGs.
Commercial light deployments may have a need for multicast. Several mechanisms exist for achieving such functionality; [I-D.ietf-roll-trickle-mcast] is RECOMMENDED for home and building deployments.
Guaranteeing timeliness is intimately related to the density of the MPL routers. In ideal circumstances the message is propagated as a single wave through the network, such that the maximum delay is related to the number of hops times the smallest repetition interval of MPL. Each repeater that receives the message, passes the message on to the next hop by repeating the message. Repetition of the message can be inhibited by a small value of k. Therefore the value of k should be chosen high enough to make sure that messages are repeated immediately. However, a network that is too dense leads to a saturation of the medium that can only be prevented by selecting a low value of k. Consequently, timeliness is assured by choosing a relatively high value of k but assuring at the same time a low enough density of repeaters to reduce the risk of medium saturation. Depending on the reliability of the network channels, it is advisable to choose the network such that at least 2 repeaters (one repeater located on the seed) can repeat messages to the same set of destinations.
There are no rules about selecting repeaters for MPL. In buildings with central managment tools, the repeaters can be selected, but in the home is not possible to automatically configure the repeater topology at this moment.
In order to support low-cost devices and devices running on battery, RPL MAY use either unsecured messages or secured messages. If RPL is used with unsecured messages, link layer security SHOULD be used. If RPL is used with secured messages, the following RPL security parameter values SHOULD be used:
[RFC6997] MUST be used to accommodate P2P traffic, which is typically substantial in home and building automation networks.
Assigned IP addresses MUST be routable and unique within the routing domain.
No particular requirements exist for layer 2 but for the ones cited in the IP over Foo RFCs.
The following sections describe the recommended parameter values for RPL-P2P, Trickle, and MPL.
RPL-P2P [RFC6997] provides the features requested by [RFC5826] and [RFC5867]. RPL-P2P uses a subset of the frame formats and features defined for RPL [RFC6550] but may be combined with RPL frame flows in advanced deployments.
Parameter values for RPL-P2P are:
Trickle is used to distribute network parameter values to all nodes without stringent time restrictions. Trickle parameter values are:
MPL is used to distribute values to groups of devices. In MPL, based on Trickle algorithm, also timeliness should be guaranteed. Under the condition that the density of MPL repeaters can be limited, it is possible to choose low MPL repeat intervals (Imin) connected to k values such that k>2. The minimum value of k is related to:
Suggested MPL parameter values are:
Manageability is out of scope for home network scenarios. In building automation scenarios, central control should be applied based on MIBs.
Refer to the security considerations of [RFC6997], [RFC6550], and [I-D.ietf-roll-trickle-mcast].
Communications network security is based on providing integrity protection and encryption to messages. This can be applied at various layers in the network protocol stack based on using various credentials and a network identity.
The credentials which are relevant in the case of RPL are: (i) the credential used at the link layer in the case where link layer security is applied or (ii) the credential used for securing RPL messages. In both cases, the assumption is that the credential is a shared key. Therefore, there MUST be a mechanism in place which allows secure distribution of a shared key and configuration of network identity. Both MAY be done using (i) pre-installation using an out-of-band method, (ii) delivered securely when a device is introduced into the network or (iii) delivered securely by a trusted neighboring device. The shared key MUST be stored in a secure fashion which makes it difficult to be read by an unauthorized party. An example of a method whereby this can be achieved is detailed in [SmartObj]
Refer to the security considerations of [RFC6997].
Application transport protocols may be CoAP over UDP or equivalents. Typically, UDP is used for IP transport to keep down the application response time and bandwidth overhead.
Several features required by [RFC5826], [RFC5867] challenge the P2P paths provided by RPL. Appendix A reviews these challenges. In some cases, a node may need to spontaneously initiate the discovery of a path towards a desired destination that is neither the root of a DAG, nor a destination originating DAO signaling. Furthermore, P2P paths provided by RPL are not satisfactory in all cases because they involve too many intermediate nodes before reaching the destination.
No considerations for IANA pertain to this document.
This document reflects discussions and remarks from several individuals including (in alphabetical order): Mukul Goyal, Jerry Martocci, Charles Perkins, Michael Richardson, and Zach Shelby
Changes from version 0 to version 1.
| [SOFT11] | Baccelli, E., Phillip, M. and M. Goyal, "The P2P-RPL Routing Protocol for IPv6 Sensor Networks: Testbed Experiments", Proceedings of the Conference on Software Telecommunications and Computer Networks, Split, Croatia, September 2011., September 2011. |
| [INTEROP12] | Baccelli, E., Phillip, M., Brandt, A., Valev , H. and J. Buron , "Report on P2P-RPL Interoperability Testing", RR-7864 INRIA Research Report RR-7864, Janurary 2012. |
| [SmartObj] | Jennings, C., "Transitive Trust Enrollment for Constrained Devices", Web http://www.lix.polytechnique.fr/hipercom/SmartObjectSecurity/papers/CullenJennings.pdf, February 2012. |
This document reflects discussions and remarks from several individuals including (in alphabetical order): Charles Perkins, Jerry Martocci, Michael Richardson, Mukul Goyal and Zach Shelby.
The DAG, being a tree structure is formed from a root. If nodes residing in different branches have a need for communicating internally, DAG mechanisms provided in RPL [RFC6550] will propagate traffic towards the root, potentially all the way to the root, and down along another branch. In a typical example two nodes could reach each other via just two router nodes but in unfortunate cases, RPL may send traffic three hops up and three hops down again. This leads to several undesired phenomena described in the following sections
If many P2P data flows have to move up towards the root to get down again in another branch there is an increased risk of congestion the nearer to the root of the DAG the data flows. Due to the broadcast nature of RF systems any child node of the root is not just directing RF power downwards its sub-tree but just as much upwards towards the root; potentially jamming other MP2P traffic leaving the tree or preventing the root of the DAG from sending P2MP traffic into the DAG because the listen-before-talk link-layer protection kicks in.
Battery-powered nodes originating P2P traffic depend on the route length. Long routes cause source nodes to stay awake for longer periods before returning to sleep. Thus, a longer route translates proportionally (more or less) into higher battery consumption.
The RPL DAG mechanism uses DIO and DAO messages to monitor the health of the DAG. In rare occasions, changed radio conditions may render routes unusable just after a destination node has returned a DAO indicating that the destination is reachable. Given enough time, the next Trickle timer-controlled DIO/DAO update will eventually repair the broken routes, however this may not occur in a timely manner appropriate to the application. In an apparently stable DAG, Trickle-timer dynamics may reduce the update rate to a few times every hour. If a user issues an actuator command, e.g. light on in the time interval between the last DAO message was issued the destination module and the time one of the parents sends the next DIO, the destination cannot be reached. There is no mechanism in RPL to initiate restoration of connectivity in a reactive fashion. The consequence is a broken service in home and building applications.
Experience from the telecom industry shows that if the voice delay exceeds 250ms, users start getting confused, frustrated and/or annoyed. In the same way, if the light does not turn on within the same period of time, a home control user will activate the controls again, causing a sequence of commands such as Light{on,off,off,on,off,..} or Volume{up,up,up,up,up,...}. Whether the outcome is nothing or some unintended response this is unacceptable. A controlling system must be able to restore connectivity to recover from the error situation. Waiting for an unknown period of time is not an option. While this issue was identified during the P2P analysis, it applies just as well to application scenarios where an IP application outside the LLN controls actuators, lights, etc.