Low-Power and Dependable Embedded Design

Introduction and Context

Internet of Things (IoT) nodes increasingly operate in locations where battery replacement, wired power, physical access, and communication quality cannot be guaranteed. Examples include environmental monitors, medical wearables, industrial sensors, agricultural devices, structural-health monitors, and distributed energy meters. In such systems, low power and dependability are not independent design goals. A node that conserves energy but loses data is not useful; a node that is highly dependable but requires frequent maintenance may be economically infeasible.

Low-power design concerns the controlled use of energy while preserving required functionality, performance, security, and communication quality. Dependable design concerns the ability of a system to deliver specified services with an acceptable probability and duration despite faults, disturbances, uncertainty, and ageing. Dependability includes reliability, availability, maintainability, safety, integrity, and often security.

At postgraduate level, the design problem should be treated as a constrained optimization problem rather than as a search for the lowest possible current. The engineer must establish requirements, identify failure mechanisms, model energy and reliability, implement countermeasures, and validate the complete system under realistic operating conditions.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Explain the relationship between energy, power, lifetime, reliability, and availability.
2. Construct an energy budget for a battery-powered embedded node.
3. Analyse dynamic and static power in digital and mixed-signal systems.
4. Apply duty cycling, power management, energy harvesting, and energy-aware communication techniques.
5. Distinguish reliability, fault tolerance, safety, security, and resilience.
6. Select suitable hardware and software techniques for dependable operation.
7. Interpret failure-rate, lifetime, and availability models, including their assumptions.
8. Design and evaluate a low-power dependable IoT node through a structured case study.

1. Fundamental Concepts

1.1 Energy, power, and lifetime

Power is the rate of energy consumption. For a device drawing instantaneous power P(t), the energy consumed over an interval is:

Here, E is energy in joules, P(t) is power in watts, and T is the observation interval in seconds. If power is approximately constant, E = PT. Electrical energy may also be expressed in watt-hours:

where P_W is power in watts and t_h is time in hours. A battery’s nominal energy is approximately:

where V_nom is nominal voltage and C_Ah is rated capacity in ampere-hours. This estimate is not the usable energy under all conditions. Temperature, discharge rate, ageing, converter losses, voltage cut-off, and battery chemistry affect actual capacity.

For a periodic node with active power P_a for duration t_a and sleep power P_s for duration t_s, the average power is:

The duty cycle is D = t_a/(t_a+t_s). If active and sleep power are constant, an equivalent form is P_avg=DP_a+(1-D)P_s. These formulas assume a periodic steady-state cycle and include neither start-up transients nor power-management losses unless those are explicitly included in the active interval.

For an ideal battery and constant average load, operating time is:

where E_usable is usable battery energy. In practice, a design margin is required because battery capacity and load are uncertain.

1.2 Dependability attributes

Dependability is a collective property composed of several attributes:

A failure is the inability of a system to perform a required function. A fault is a hypothesized or actual cause of a failure, while an error is an incorrect internal state that may or may not become externally visible. For example, radiation may cause a memory-bit fault; the resulting incorrect variable is an error; an incorrect actuator command is a failure.

1.3 Dependability versus energy efficiency

Energy-saving actions can create dependability risks. Aggressive voltage reduction may reduce noise margins. Deep sleep may disable watchdogs or delay fault detection. Longer communication intervals save energy but increase data loss when a node fails. Compression reduces radio transmission but increases processor activity. Consequently, the design objective is usually multi-dimensional:

• satisfy functional and timing requirements;
• maximize useful lifetime;
• achieve a target probability of successful service;
• respect safety and security constraints;
• minimize cost and environmental impact.

2. Sources and Models of Power Consumption

2.1 Dynamic and static power

In CMOS logic, a simplified dynamic-power model is:

Here, α is the activity factor, C_L is effective switched capacitance in farads, V_DD is supply voltage in volts, and f is switching frequency in hertz. This model assumes capacitive charging and discharging dominate and that short-circuit and leakage currents are treated separately.

Reducing voltage is especially effective because dynamic power varies with the square of voltage. Reducing frequency lowers dynamic power but may increase execution time, so energy rather than instantaneous power must be evaluated. Leakage power is approximately:

Leakage becomes important in advanced semiconductor processes and during long sleep intervals. Peripheral clocks, voltage regulators, memories, sensors, LEDs, pull-up resistors, and radio transceivers can dominate the system budget even when the processor is efficient.

2.2 Energy per operation and per bit

For a sensing application, useful metrics include energy per sample, energy per inference, and energy per transmitted bit. Radio energy can be represented approximately as:

This expression separates transmit, receive, and start-up contributions. It is applicable when power levels are reasonably stable during each interval. A short packet is not necessarily energy-efficient if radio start-up energy is large.

2.3 System-level energy accounting

An energy budget should list every operating state, its duration, and its power. A useful table includes sensing, processing, radio transmission, radio reception, idle, sleep, memory access, conversion, and power-management overhead. The budget must distinguish current at the component supply from current drawn from the battery. A regulator with efficiency η gives approximately:

for a switching regulator under steady-state conditions. Quiescent current and conversion losses must be added, particularly at light load.

3. Low-Power Design Techniques

3.1 Power-state architecture

A robust design defines explicit power states, such as active, idle, light sleep, deep sleep, transmit, receive, sensing, and fault-recovery. Each state should specify enabled clocks, memory retention, interrupt sources, wake-up latency, current, and permitted transitions. State transitions must be deterministic; otherwise, intermittent failures can arise from partially initialized peripherals.

The power manager should use a single authoritative state model, log abnormal transitions, and place hardware in a safe state before sleep. Wake-up sources should be limited to those required by the application. A watchdog that remains active during deep sleep can provide an independent recovery mechanism, but its timing must account for expected sleep duration.

3.2 Duty cycling and event-driven operation

Duty cycling activates a subsystem only when useful work exists. Periodic sampling is simple but may waste energy when the environment changes slowly. Event-driven designs use threshold detectors, interrupt-capable sensors, or low-power comparators to wake the main controller only when an event occurs.

Duty cycling must include transition overhead. If a subsystem consumes start-up energy E_s each cycle, the average power contribution from start-up is:

where T_c is the cycle period. Increasing the period reduces this contribution but may conflict with latency and detection requirements.

3.3 Dynamic voltage and frequency scaling

Dynamic voltage and frequency scaling (DVFS) adjusts clock frequency and supply voltage according to workload. It is beneficial when a task can be completed at a lower voltage without violating deadlines. However, voltage transitions, regulator inefficiency, timing uncertainty, and leakage must be included. The lowest clock frequency is not automatically the lowest-energy choice because a longer execution interval can increase leakage and static peripheral consumption.

3.4 Memory and data movement

Moving data often costs more energy than arithmetic. Techniques include local aggregation, feature extraction, compression, delta encoding, selective logging, and memory-aware buffering. Non-volatile memory writes may have high energy and endurance costs; wear levelling and batching can reduce both. Data reduction must not remove information needed for diagnosis, safety, or legal traceability.

3.5 Communication-aware design

Wireless communication commonly dominates an IoT node’s energy budget. Appropriate methods include:

• reducing payload size without compromising required evidence;
• choosing an appropriate transmission interval;
• aggregating samples;
• using acknowledgements selectively;
• adapting data rate and transmit power;
• scheduling communication during known connectivity windows;
• retaining data locally when the network is unavailable.

Reliability and energy must be co-designed. Retransmitting every packet may improve delivery but consume excessive energy; transmitting without confirmation may produce unacceptable data loss. Application-level sequence numbers, timestamps, acknowledgements, and duplicate suppression are often necessary because link-layer delivery does not guarantee end-to-end correctness.

3.6 Energy harvesting and energy-neutral operation

Energy harvesting sources include light, vibration, thermal gradients, and radio-frequency fields. A harvested system is energy-neutral over a sufficiently long interval only if average harvested energy meets or exceeds average consumption and storage supports temporal mismatch:

This is a necessary average condition, not a sufficient guarantee of operation. A solar node may receive adequate daily energy but fail during several cloudy days. Energy-aware scheduling should estimate state of charge, forecast available energy, assign priorities, and degrade gracefully.

4. Reliability and Dependability Models

4.1 Reliability function and failure rate

Let T_f be the random time to failure. Reliability at time t is:

The failure-rate or hazard function is:

where f(t) is the probability-density function of failure time. For a constant failure rate λ, the exponential model gives:

and mean time to failure is MTTF = 1/λ. The exponential model is appropriate only when the hazard is approximately constant, such as during a useful-life period without dominant infant-mortality or wear-out effects.

For independent components connected in series, where every component must operate, system reliability is:

For two independent components arranged in parallel, where either can perform the required function:

These expressions assume independence and clearly defined functional success. Real systems may have common-cause failures, shared power supplies, correlated software faults, and environmental stresses, so simple multiplication can be optimistic.

4.2 Availability and repair

Steady-state availability is often approximated by:

where MTBF is mean time between failures and MTTR is mean time to repair or restore. The formula assumes a repairable system with stable rates and well-defined operating and repair states. For battery-only remote nodes, repair may be impossible; useful measures then include mission reliability, probability of data loss, and successful recovery probability rather than conventional availability alone.

4.3 Fault tolerance and graceful degradation

Fault tolerance may use redundancy, watchdog recovery, error-correcting codes, replicated sensors, plausibility checks, checkpointing, and safe fallback modes. Redundancy should be analysed at the level of failure independence. Two identical sensors exposed to the same temperature excursion do not provide full independence.

Graceful degradation defines reduced but acceptable service. For example, a node may reduce sampling rate, disable a nonessential display, store data locally, or transmit only alarms when energy or communication quality is low. Safety-critical functions must not be sacrificed merely to extend battery life.

4.4 Reliability block diagrams and fault trees

A reliability block diagram models success paths. A fault tree begins with a hazardous top event and decomposes it through logical AND and OR relationships into basic events. Fault-tree analysis is valuable for identifying common causes and single points of failure. Failure Mode and Effects Analysis (FMEA) instead proceeds from component failure modes toward their local and system effects. These methods are complementary: FMEA is strong for systematic component review, while fault trees are strong for top-down hazard analysis.

5. Dependable Hardware and Software Architecture

5.1 Hardware practices

Important hardware measures include:

• supply supervision, brownout detection, and reset generation;
• watchdog timers with independent clock sources where justified;
• input protection and electromagnetic compatibility measures;
• clock-failure detection;
• current limiting and thermal protection;
• qualified components with appropriate temperature and lifetime ratings;
• non-volatile storage with integrity checks and wear management;
• secure boot and protected key storage;
• physical separation of noisy power and sensitive analogue paths.

Power integrity is central to dependability. Voltage drops caused by radio bursts can create processor resets or corrupted memory writes. Decoupling, regulator transient response, battery impedance, layout, and worst-case current must be evaluated together.

5.2 Software practices

Embedded software should use deterministic initialization, bounded execution time, defensive input validation, explicit timeout handling, and clear ownership of peripherals. A watchdog should not simply be periodically “petted” by an unverified task. A better architecture requires health evidence from critical tasks before servicing the watchdog.

Persistent data should use versioning, checksums or authenticated integrity codes, atomic update strategies, and recovery from interrupted writes. Communications should use sequence numbers, replay protection where necessary, timeouts, and idempotent commands. Formal methods, static analysis, unit testing, hardware-in-the-loop testing, and fault injection improve confidence but cannot replace operational evidence.

5.3 Security as a dependability concern

A compromised device may remain electrically functional but no longer dependable. Threats include malicious firmware, falsified sensor data, denial of service, battery-draining commands, and unauthorized actuation. Secure boot, signed updates, encrypted communication, least privilege, key rotation, secure provisioning, and vulnerability-management procedures should be integrated from the beginning. Security controls also consume energy and memory; their cost must be budgeted rather than added after deployment.

6. Design Methodology

A practical design workflow is:

1. Define service requirements. Specify sensing accuracy, latency, availability, mission duration, environmental range, update policy, safety constraints, and security objectives.
2. Model operating scenarios. Include normal, peak, startup, network loss, low battery, sensor fault, thermal extremes, and recovery states.
3. Create an energy budget. Measure current and duration for every state; include regulator, leakage, startup, and communication overhead.
4. Perform hazard and failure analysis. Use FMEA, fault trees, reliability block diagrams, and threat modelling.
5. Select architecture and countermeasures. Choose power states, redundancy, recovery mechanisms, storage strategy, and communication protocol.
6. Implement observability. Record reset causes, battery estimates, fault counters, firmware version, sensor status, and communication quality without excessive energy cost.
7. Verify and validate. Test timing, energy, temperature, vibration, electromagnetic stress, brownouts, packet loss, corrupted storage, repeated resets, and long-duration ageing.
8. Monitor field performance. Use telemetry and controlled updates to identify drift, emerging faults, and deviations from the energy model.

7. Worked Example: Energy Budget and Lifetime

An environmental node has the following 24-hour operating profile:

The daily energy is:

E_d = (0.02 mW)(23.833 h) + (30 mW)(0.1333 h) + (120 mW)(0.0333 h)

E_d ≈ 0.477 + 4.000 + 4.000 = 8.477 mWh/day.

Suppose a battery provides 2,000 mAh at 3.7 V. Its nominal energy is:

E_nom=3.7×2.0=7.4 Wh.

Assume only 70% is usable because of cut-off voltage, temperature, ageing, and a reserve margin. Then E_usable=0.70×7.4=5.18 Wh. The idealized lifetime is:

t_life=5.18 Wh/(8.477 mWh/day)≈611 days.

This result is an estimate, not a guarantee. If the regulator efficiency is 85% and its quiescent consumption is significant, the battery-side energy will be higher. A design review should therefore repeat the calculation using measured battery-side current across temperature and battery state of charge.

8. Applied Case: Illustrative Cold-Chain Monitoring Node

Background

Consider an illustrative battery-powered IoT node attached to a pharmaceutical container. It must measure temperature every five minutes, detect excursions rapidly, retain measurements during network outages, and report alarms. Battery replacement during transport is undesirable.

Problem

A first prototype sampled continuously, maintained a permanent cellular connection, and transmitted every measurement. It achieved good visibility but operated for only three days. Field tests also showed resets during radio transmission and missing records after interrupted flash writes.

Analysis

The energy audit identified the cellular modem as the dominant load. Radio start-up energy was large, but keeping the modem connected also consumed substantial idle power. The resets were traced to a supply droop caused by battery impedance and inadequate transient support. The storage problem resulted from updating a record header and payload in separate, non-atomic operations.

Reliability analysis identified three important hazards: missed temperature excursions, loss of stored evidence, and unsafe operation after a low-voltage reset. Security analysis added the risk of forged alarm messages and unauthorized firmware.

Approach and solution

The redesigned node used a low-power temperature sensor with an interrupt threshold. The microcontroller remained in deep sleep and woke every five minutes, while an independent threshold path could wake it immediately during an excursion. Measurements were stored in a circular log with sequence numbers, length fields, checksums, and commit markers. A record was considered valid only after the commit marker was written.

The modem was powered through a load switch and activated in scheduled communication windows. Records were aggregated, compressed using delta encoding, and transmitted with authenticated acknowledgements. When communication failed, data remained in non-volatile storage and the retry interval increased to prevent battery exhaustion. A low-energy alarm packet was attempted first for urgent excursions.

The power subsystem was redesigned with adequate bulk capacitance, a regulator selected for transient response, brownout detection, and a battery-side measurement point. The firmware recorded reset cause, minimum measured voltage, modem status, and storage errors. Secure boot and signed firmware updates protected the monitoring function.

Outcome

In an engineering evaluation, the redesigned architecture reduced average power by eliminating continuous modem attachment and unnecessary sampling activity. It also converted several unrecoverable failures into detectable states: corrupted records were rejected, communication outages caused backlog rather than data loss, and low voltage triggered a controlled degraded mode. The exact lifetime and reliability improvement would require statistically valid environmental and field data; a short laboratory demonstration cannot establish a production failure rate.

Learning points

1. The largest energy consumer should be identified by measurement rather than assumption.
2. Power integrity must be tested during worst-case current transients.
3. Data integrity requires atomic storage protocols, not merely a checksum.
4. Local buffering and graceful degradation improve both lifetime and availability.
5. Dependability claims require explicit operating conditions and evidence.

9. Challenges, Trade-offs, and Contemporary Developments

Low-power dependable design faces uncertain workloads, ageing batteries, intermittent connectivity, component obsolescence, software complexity, and environmental variability. Artificial intelligence at the edge can reduce communication by transmitting decisions or features rather than raw data, but model execution consumes energy and may produce uncertain or biased results. A safety-related decision should retain sufficient raw evidence and include confidence thresholds, fallback behaviour, and model-update governance.

Tiny machine-learning accelerators, non-volatile memories, energy-harvesting power management, wake-up radios, and ultra-low-power wide-area networks are expanding design possibilities. However, new technology introduces new failure modes, tool-chain dependencies, and security risks. Contemporary designs should therefore evaluate lifecycle sustainability, repairability, electronic waste, battery safety, software support duration, and responsible data governance.

Regulatory obligations may apply to radio emissions, electrical safety, medical use, functional safety, cybersecurity, privacy, and environmental disposal. Compliance is not equivalent to dependability, but standards provide useful processes for risk management, traceability, verification, change control, and incident response.

Best Practices

• Start with measurable service requirements rather than a component choice.
• Budget energy at the battery terminals and validate it experimentally.
• Include startup, leakage, regulator losses, retries, and fault recovery.
• Treat power states as a formally defined architecture.
• Use independent detection and recovery paths for important faults.
• Design storage and communication for interruption, duplication, and corruption.
• Analyse common-cause failures and environmental extremes.
• Use graceful degradation instead of uncontrolled shutdown.
• Protect firmware, keys, updates, and diagnostic data.
• Maintain field observability while respecting privacy and energy limits.
• Report assumptions whenever lifetime or reliability is claimed.

Chapter Summary

Low-power and dependable embedded design is a systems-engineering discipline. Energy is obtained by reducing active work, voltage, switching, data movement, communication overhead, and unnecessary standby consumption, while preserving required service. Energy budgets must use state durations, measured power, regulator losses, battery limitations, and realistic margins.

Dependability includes reliability, availability, maintainability, safety, integrity, resilience, and security. Reliability models such as exponential failure distributions, series and parallel structures, and availability equations are useful only under their stated assumptions. Fault tolerance, watchdogs, supervision, redundancy, integrity checks, secure updates, graceful degradation, and observability convert potential faults into controlled outcomes.

The most effective designs co-optimize power and dependability. They define operating states, analyse hazards, validate worst-case conditions, preserve data during outages, and use field evidence to refine assumptions. A low-power node is successful only when it delivers trustworthy service for the required mission duration and environment.

Key Terms

Energy: Capacity to perform work, measured in joules or watt-hours.

Power: Rate of energy consumption, measured in watts.

Duty cycle: Fraction of time a subsystem is active.

Dynamic power: Switching-related power dependent on activity, capacitance, voltage, and frequency.

Leakage power: Power consumed by nonideal current paths when circuits are not actively switching.

Energy budget: Accounting of energy used by all operating states and losses.

Energy harvesting: Obtaining energy from environmental sources such as light or vibration.

Reliability: Probability of performing a required function without failure for a stated period.

Availability: Probability that a system is operational when required.

Maintainability: Ease and speed of restoring a failed system.

Fault: A hypothesized or actual cause of an incorrect system state.

Error: An incorrect internal state produced by a fault.

Failure: Loss of a required external function.

Fault tolerance: Ability to continue an acceptable service despite faults.

Graceful degradation: Controlled reduction of service under constrained conditions.

FMEA: Systematic analysis of failure modes and their effects.

Fault tree: Top-down logical analysis of causes of a hazardous event.

Watchdog timer: Timer-based mechanism for detecting and recovering from software malfunction.

Brownout: Supply-voltage reduction sufficient to threaten correct operation.

Secure boot: Verification that only authorized firmware is executed.

Review Questions

5 Short Answer Questions

1. Distinguish energy from power and give their SI units.
2. What assumptions underlie the exponential reliability model?
3. Why can radio start-up energy be important in a low-duty-cycle node?
4. Define graceful degradation and give one embedded example.
5. Distinguish a fault, an error, and a failure.

5 Long Answer Questions

1. Explain how duty cycling, DVFS, data reduction, and communication scheduling affect energy and dependability.
2. Derive and discuss the average-power expression for a periodic embedded node.
3. Compare FMEA, fault-tree analysis, and reliability block diagrams.
4. Explain hardware and software mechanisms for dependable recovery from brownouts and corrupted storage.
5. Discuss why security should be treated as a component of IoT dependability.

3 Analytical / Application Questions

1. Design an energy budget for a sensor node that samples every minute, transmits once per hour, and remains in deep sleep otherwise. State all assumptions and identify the measurements required for validation.
2. An IoT node has a high-energy primary function and a low-energy backup sensor. Analyse when parallel redundancy improves reliability and when common-cause environmental faults make the improvement misleading.
3. Propose a degraded operating strategy for a battery-powered medical or industrial node experiencing low energy, intermittent communication, and repeated sensor faults. Justify the safety and security implications.

Multiple Choice Questions with Answers

Question 1

Which expression gives the average power of a periodic node with active power Pₐ for time tₐ and sleep power Pₛ for time tₛ?

A. Pₐtₐ + Pₛtₛ

B. (Pₐtₐ + Pₛtₛ)/(tₐ + tₛ)

C. (Pₐ + Pₛ)/(tₐtₛ)

D. Pₐ/Pₛ

Correct Answer: B. (Pₐtₐ + Pₛtₛ)/(tₐ + tₛ)

Question 2

In the simplified CMOS dynamic-power model P_dyn=αC_LV_DD²f, which change has the square-law effect?

A. Activity factor

B. Capacitance

C. Supply voltage

D. Frequency

Correct Answer: C. Supply voltage

Question 3

For a constant failure rate λ, the exponential reliability function is:

A. R(t)=λt

B. R(t)=1−e^{−λt}

C. R(t)=e^{−λt}

D. R(t)=1/λt

Correct Answer: C. R(t)=e^{−λt}

Question 4

A battery is rated at 3.7 V and 2 Ah. Its nominal energy is approximately:

A. 0.54 Wh

B. 1.85 Wh

C. 5.70 Wh

D. 7.4 Wh

Correct Answer: D. 7.4 Wh

Question 5

Which technique most directly prevents an interrupted flash write from being accepted as a valid record?

A. Increasing processor clock frequency

B. Using a commit marker and integrity check

C. Reducing the radio transmit power

D. Disabling brownout detection

Correct Answer: B. Using a commit marker and integrity check

Question 6

The principal purpose of a watchdog timer is to:

A. Measure battery capacity precisely

B. Increase radio bandwidth

C. Recover from software that fails to make expected progress

D. Encrypt all sensor readings

Correct Answer: C. Recover from software that fails to make expected progress

Question 7

For two independent components in parallel, where either component can provide the required function, system reliability is:

A. R₁R₂

B. R₁+R₂

C. 1−(1−R₁)(1−R₂)

D. R₁−R₂

Correct Answer: C. 1−(1−R₁)(1−R₂)

Question 8

Which statement about energy harvesting is correct?

A. Average harvested energy alone guarantees uninterrupted operation

B. Storage is unnecessary when harvesting is used

C. Temporal variation and storage must be considered

D. Harvesting eliminates the need for power management

Correct Answer: C. Temporal variation and storage must be considered

Question 9

What does a fault tree primarily analyse?

A. Causes leading to a specified top event

B. The instruction count of a processor

C. Battery chemical composition only

D. User-interface usability

Correct Answer: A. Causes leading to a specified top event

Question 10

Which practice best supports secure and dependable firmware updates?

A. Accepting any binary received over the network

B. Using signed images and authenticated installation

C. Disabling reset supervision during updates

D. Storing private keys in unprotected external memory

Correct Answer: B. Using signed images and authenticated installation