Un article scientifique accepté et présenté dans "IEEE International Conference on IoT, Embedded Systems and Communications" IINTEC2017

1. Formal Modeling and Verification of a Wireless
Body Area Network (WBAN) Protocol: S-TDMA
Protocol
Roua Ben Hamouda
University of Tunis El Manar
Higher Institute of Computer Science (ISI)
Email: benhamoudaroua@gmail.com
Imene Ben Hafaiedh
University of Tunis El Manar
Higher Institute of Computer Science (ISI)
Email: ben.hafaiedh.imen@gmail.com
Abstract—WBANs integrate wearable and implanted devices
with wireless communication and information processing sys-
tems to monitor the well-being of an individual. Various MAC
(Medium Access Control) protocols with different objectives have
been proposed for WBANs. The fact that any flaw in these
critical systems may lead to the loss of one’s life implies that
testing and verifying MAC’s protocols for such systems are on
the higher level of importance. In this paper, we firstly propose
a high-level formal and scalable model with timing aspects for
a MAC protocol particularly designed for WBANs, named S-
TDMA (Statistical frame based TDMA protocol). The protocol
uses TDMA (Time Division Multiple Access) bus arbitration
which requires temporal aspect modeling. Secondly, we propose a
formal validation of several relevant properties such as deadlock
freedom, fairness and mutual exclusion of this protocol at a
high level of abstraction. The protocol was modeled using a
composition of timed automata components, and verification was
performed using a real-time model checker.
Index Terms—Formal Verification, WSN, WBAN, TDMA,
MAC Protocols, model checking, timed automata.
I. INTRODUCTION
Advances in wireless communication, sensor design, and
energy storage technologies make Wireless Sensor Network
(WSN) with pervasive concept rapidly becoming a reality [1].
Pervasive health or patient monitoring systems integrated into
a telemedicine system are novel information technology that
will be able to support early detection of abnormal conditions
and prevention of serious consequences [2].
Recently, WSN is becoming a promising technology for
various applications. One of its potential deployments is
WBAN which signifies emerging technology with the potential
to revolutionize health care by allowing unobtrusive health
monitoring for extended periods of time [3]. A WBAN is
body-centric and it comprises in-body, on-body or around-
body sensor nodes, and a coordinator equipped on human
body.
WBANs are considered as critical system applications as
they are intended to support life saving. Hence reliability,
safety and security of such systems are considered as crucial
metrics. The aforementioned metrics depend considerably on
the efficiency of the channel access and the resource allocation
mechanism. Therefore, providing reliable and efficient MAC
protocols for WBANs becomes mandatory.
MAC layer is used to coordinate the access of the set
of sensor nodes to the shared wireless medium. Indeed,
TDMA is a scheduled-based multiple access technique where
transmission of packets are managed in the form of time
frames and time slots. A time slot can be seen as a dedicated
transmission resource used to carry data with minimum or no
overhead. Since slots are pre-allocated to individual nodes at
initialization, they are collision-free.
Recently, in [4], [5], authors proposed a TDMA-based
protocol called the S-TDMA protocol which is specifically de-
signed to meet WBANs challenges. They claim that, compared
to the traditional protocols, the S-TDMA protocol successfully
meets the delay and transmission efficiency requirements of
WBANs while keeping a low energy consumption. To this
end, they use a beacon frame containing synchronous and
poll information to reduce the possibility of collisions of
request frames. A second frame called the statistical frame
broadcasting the unified scheduling information is adopted to
avoid packet collisions, idle listening and overhearing.
In this paper, we focus on the formal design, analysis and
validation of the S-TDMA protocol. In particular we propose
a rigorous formal description of this protocol using timed
automata. This formal model is based on formal semantics
of a component-based framework called BIP [6]. The model
we propose in this paper is scalable which means that any
validation results could be easily observed for any given
number of sensors. We also propose a verification of our model
using a real-time model checker for different possible network
sizes. Using the BIP toolset, different relevant properties of the
S-TDMA protocol have been verified automatically.
II. RELATED WORK
As far as we know there is no research effort on formal
verification of MAC based WBAN protocols, in particular for
the S-TDMA MAC protocol which is specifically designed
and implemented for WBANs. To verify its feasibility, the
S-TDMA protocol has been fully implemented on an in-
dependently developed Human Body Communication (HBC)978-1-5386-2113-4/17/$31.00 c 2017 IEEE

2. platform [7] where only four sensor nodes and a coordinator
are fastened on a human body. After having implemented
the MAC protocol tasks on the sensor nodes through pro-
gramming, the authors evaluated the performance of their
MAC protocol in burst traffic scenarios focused on energy-
efficiency, latency and transmission efficiency [4], [5]. Hence,
The validation results are mainly based only on simulations
and test sequences and not on formal validation. Moreover,
these simulation results have been measured for the case of
only four sensor nodes, which means that no results could
be derived for a system with more nodes without a real
implementation.
However, the technology allows us now to make coherent
formal validation of MAC protocols of WSNs and so of
WBANs. Indeed, WBANs are usually tested and simulated for
their performance by measuring the theoretical system perfor-
mance and design parameters, and then providing simulations
for the system under study in a real environment. For example,
in [8] a simulator was built using Java to verify the efficiency
of their security protocol for a WBANs system by simulating
a set of parameters.
Formal methods have been, however, used to verify some
aspects in health-care systems but not in the context of
WBANs. For example, in [9] model checking has been used
to verify the reliability of medical device software that is used
in an infusion pump. A second example, in [10], where they
formalized and verified safety requirements in a commercial
PCA infusion pump.
However, minor researches have been performed on the
formal validation of WBANs related issues. In [11] for exam-
ple, the authors proposed a formal validation based on Event-
B of the functional issue of WBANs sensors, Which means
that they do not take into consideration any communication
protocol between the set of sensor nodes and their coordinator.
Recently, in [12], a formal validation of a WSNs secu-
rity protocol has been proposed using model-checking and
they also propose an extension of their formal model to
the verification of an authentication protocol for WBAN.
However, the proposed verification model only focuses on
node authentication aspects and did not address WBANs at the
functional communication MAC level in order to validate its
critical operations, such as data transmission based on critical
thresholds. Therefore, several functional properties related to
the communication protocol need to be verified in WBANs in
order to increase our trust in their operation.
In this paper, we propose a formal verification methodology
based on model-checking that provides a formal model of a
WBAN architecture and formal property verification results for
the validation of the S-TDMA MAC protocol. The verification
process is performed automatically using a real-time model-
checker provided by BIP.
III. PRELIMINARIES: BIP FRAMEWORK
In this section, we present a high-level modeling formal-
ism for the description of a WBAN architecture and the S-
TDMA protocol. We choose to specify our model using the
BIP (Behavior-Interaction-Priority) component-based frame-
work [6] as it is a framework with formal semantics that relies
on rich interaction models between components. It supports
a component-based modeling methodology based on the as-
sumption that components are obtained as the superposition
of three independent layers, that is:
• Behavior, specified as a set of finite-state machines (basic
components);
• Interactions, used to coordinate the actions of different
behaviors;
• Priorities, used to schedule among multiple enabled in-
teractions.
Real-time (RT) BIP [13] is an extension of the BIP component-
based framework to continuous time model where components
are timed automata and systems are compositions of timed
automata with respect to multi-party interactions.
In practice, an atomic component can be extended with
variables which are used to store (private) local data. Variables
can be exported through ports allowing exchange of data
among components. Moreover, each component transition can
be associated with a boolean condition specifying for which
values of the local variables it is enabled, and an (internal)
update function triggered along with transition execution
which modifies values of variables.
In BIP, interactions are structured by connectors. A con-
nector is a macro notation for representing sets of related
interactions in a compact manner. To specify the interactions
of a connector, two types of synchronizations are defined:
• Strong synchronization or rendez-vous, when the only
interaction of a connector is the maximal one, i.e., it
contains all the ports of the connector.
• Weak synchronization or broadcast, when interactions are
all those containing any port initiating the broadcast.
To characterize these two types of synchronizations, a
connector may associate to the set of ports it connects two
types:
• A trigger port of a connector is a complete port which can
initiate an interaction without synchronizing with other
ports of the connector. It is represented graphically by a
triangle.
• A synchron port of a connector which is an incomplete
port, hence needs synchronization with other ports, and
is denoted by a circle.
IV. A HIGH LEVEL FORMAL MODEL OF S-TDMA
PROTOCOL
In this section, we describe our formal model of WBAN
architecture and in particular for the verification of the S-
TDMA protocol. Thus, we first start by a brief overview about
the considered protocol.
A. Sketch of the S-TDMA protocol
The S-TDMA protocol is a recently proposed MAC protocol
based on TDMA architecture designed to WBANs [4], [5],

3. and which has been implemented on a HBC (Human Body
Communication) platform. In S-TDMA, the beacon period of
the S-TDMA protocol, which is generally called superframe,
lasts for 1 sec and consists of two types of periods: active
period and inactive period. Active period includes 4 kinds
of frames: beacon frame, request frame, statistical frame and
data frame. S-TDMA is designed for a star network which
is controlled by a coordinator. The beacon frame contains
the necessary information for synchronizing the devices and
it is regularly transmitted from the coordinator to all nodes
in a broadcast manner. The request frame was reserved for
sensor nodes to send their requests to the hub throughout
predetermined time slots which makes sense because the
number of sensor nodes in a WBAN is always limited (64
nodes at most).
After receiving the request frames, the coordinator will add
up all the requested time slots needed by the sensor nodes
to form a statistical frame which contains the total time slot
request and the scheduling information. Three cases can occur
in this state; If no request events occurred after receiving the
statistical frame, sensor nodes set their radios into sleep mode
until the next scheduled active frame; Otherwise, in order to
save energy, each sensor node enters into sleep mode and only
wakes up to send data frame when the granted time slot is
dedicated for it; else the sensor node is in his granted time
slot and so it can send its data packet. The duration of the
data frame is adapted by the hub based on the current traffic
characteristics. In order to save energy, a period of inactivity
is reserved for sensor nodes, allowing them to enter into sleep
mode. Each data frame has a packet number assigned, so
that the received packets are counted, thus to maintain data
integrity.
B. The Formal Model
To describe our formal model, we start by providing a
formal model for the description of the global WBAN archi-
tecture. The model proposed is scalable, which means that the
number of sensor nodes in our model is a variable parameter
named N. We model a coordinator as a BIP atomic component
named C and similarly, a sensor node is also modeled as BIP
atomic component named Ni. Thus, our WBAN model, shown
in Figure 1, is the composition of two types of atomic BIP
components:
1- Coordinator Component: which is responsible for the
control of the other components in the star topology network.
It must be linked to all the other components of the model.
2- Node Component: which is the atomic component repre-
senting the sensor nodes in the network. They are related to the
Coordinator with BIP connectors allowing the synchroniza-
tion, the transmission and the receive of the diverse packets
through ports.
Note that, our model is defined to the description of a network
with N sensor nodes. Thus, the protocol under study could
be analyzed to any given number of sensor nodes. In the
validation phase (Section V), the model has been instantiated
and verified for different values of N.
Now, the modeling of the S-TDMA protocol is performed
through the different behaviors of BIP components and in
particular through connectors relating these components.
The Coordinator Component C: Figure 2 describes the
behavior and the set of ports of the coordinator component.
It has four states namely; Start, Req, Data and Sleep ,
where Start is the initial state. The different transitions of the
component are labeled by one of its ports. These ports define
how components interact with the rest of components. The
set of variables associated with these ports can be read and
updated through connectors.
Fig. 2. The Coordinator component C behaviour
The behavior of the coordinator C can be described as
follows:
- Initially, in state Start, C transmits the beacon frame to all
the model’s components by firing up the transition labeled
by the port SB (Send Beacon) which contains its hardware
clock value. Moreover, by firing this transition, the two clock
variables y and ts (time slot), representing the global time and
a local time respectively, start counting.
- In state Req, the transition labeled by RRi, which models
the receive request procedure, fires up when ts ≡ tsi, with
i ∈ [1..N]. Therefore, C receives a request frame from each
node at its assigned time slot. Likewise, in Req an invariant
Inv1 = (ts ≤ 500µs) is defined, which guarantees that the
coordinator cannot stay receiving from each node his request
frame more than a 500µs period of time, and which is called
the AllocationSlotMin [14].
- After receiving all the request frames, C fires up the
transition labeled by SS which defines the statistical frame
transmission. The scheduling information sent in this frame is
represented as the set of variables: FT (Frame type), IDC
(ID of the coordinator), IDni
(ID of the recipient node),
TTs (Total Time Slots), InfoS (Scheduling Information) and
CRC (Cyclic Redundancy Check). By firing this transition,
the coordinator component resets the counter x, which will
count the number of data packets received.
- In state Data, C chooses to fire one transition over the set
of transitions labeled by {RDi}i∈[1..N] which corresponds to
the receive data procedure of S-TDMA. The choice is done
with respect to the guard associated to each transition. Hence,
the coordinator receives data packets from each node at their

4. Fig. 1. A Formal model of a WBAN architecture
assigned time slots [ts ≡ tsi] as long as it has packet to send
[x ≤ sizeDi
]. When there is no more time slots assigned to
any node, the transition labeled by SLP spontaneously fires
up and C goes to the state Sleep.
- Finally, when the cycle is finished ([y ≡ 1sec]), the transition
labeled by the internal port END fires up.
The Node Component Ni: Figure 3 describes the behav-
ior and the set of ports of a node component. This component
has five states namely; Start, Req, Stat, Data and Sleep , where
Start is the initial state. All the nodes have the same behavior
thus technically we can easily instantiate as many sensor nodes
as needed. The behavior of a given Node component Ni can
be described as follows:
- First, in state Start, Ni fires up the transition labeled by RBi
which corresponds to the receive beacon procedure of the S-
TDMA protocol, and synchronizes its hardware clock value
with the value of the global time clock y.
- In state Req, Ni can make a request by firing up the transition
labeled by the port SRi at its assigned time slot [t ≡ tsi].
- After sending all request frames, in state Stat, the node fires
up the transition labeled by RSi to receive the scheduling
information from the coordinator.
- In state Data, Ni can send its data frame by firing up the
transition labeled by SDi, in two cases; whether it has the
first time slot in the scheduling information or when it has
a successive granted time slots. In order to save energy, Ni
can enter into sleep mode by firing up the transition labeled by
SLPi and only wakes up to send data frame when the granted
time slot is dedicated for it [t ≡ tsi] and so it executes the
transition SDi from the state Sleep.
- At last, Ni stays in state Sleep until the end of cycle
[y ≡ 1sec] to fire up the transition labeled by the port ENDi.
Note that, the coordinator, as well as all nodes are Radio
devices, which means that they could be in 3 possible Radio
modes namely; a Transmit mode denoted ”T”, a Receive mode
”R” and a Sleep mode ”S”. To model switching from one Ra-
dio mode to another, we define the function Radio(M1, M2),
with M1,M2 ∈ {”R”, ”T”, ”S”}. This function is called as
an action in different transitions of the components behavior,
where Radio(M1, M2) models the fact of switching each
component’s radio transceiver from the mode M1 to the mode
M2.
Fig. 3. The Node component Ni behaviour
The set of the model Connectors: In our model, the set
of BIP components {C, {Ni}i∈[1..N]} interact using a set of
BIP connectors namely {αB,{αRi
}i∈[1..N],αS,{αDi
}i∈[1..N]}
(see Figure 1):
- αB: a multiparty broadcast connector which connects the
set of ports {SB, {RBi}i∈[1..N]}. This connector allows the
coordinator to send the beacon frame to all nodes. Note that,
as the port SB is a trigger port, the coordinator can fire
the corresponding transition even though there is no sensor
nodes ready to receive the beacon. Thus, we can guarantee
the progress of our model.
- {αRi
}i∈[1..N]: a set of binary rendez-vous connectors con-
necting each node Ni to the coordinator. Such a connector
allows each node to send a request to the coordinator. Note
that, when there is no data packets to send, each node Ni has
to send a request through its associated connector αRi with a
number of packets sizeRi equal to 0 .
- αS: a multiparty broadcast connector which connects the set
of ports {SS, {RSi}i∈[1..N]}. It describes the broadcast of the
statistical frame sent from C to all the model’s nodes.
- {αDi }i∈[1..N]: a set of binary rendez-vous connectors linking
the port SDi of each node to the corresponding port RDi of

5. the coordinator. It describes the transmission of data frame
procedure by each node.
V. FORMAL VERIFICATION AND EXPERIMENTAL RESULTS
In this section, and given the already described model, we
propose to formally verify a set of relevant properties of the
S-TDMA protocol. To this end, we use the set of tools offered
by BIP, in particular, we use RT-DFinder tool [13] to verify the
property of deadlock-freedom. RT-DFinder is a compositional
verification tool based on model-checking for the verification
of safety properties such as invariants and deadlock-freedom.
Note that, given a BIP model an automatically generated
code is provided which means that further analysis could
be performed at the execution level. So, in addition to the
verification of properties at the model level, we also provide
a set of experimental results such as energy consumption
extracted at the execution level.
Deadlock freedom: Using the RT-DFinder tool, we have
proven the property of deadlock-freedom of our model to
different numbers of sensor nodes at a high-level with no need
to code generation. This is very interesting, when one wants
to see how a given protocol may react in the context of more
complex architectures and thus with more conflicts to manage
without having to go into its implementation. Note that, the
S-TDMA protocol has been validated only by executions on
an implementation of a set of only 4 sensors [4]. Numerical
results depicted in Figure 4, shows how the system complexity
increases when increasing the number of sensor nodes. As our
verification is based on model-checking, the verification has
been exhaustive for all the considered possible configurations.
Fig. 4. Verification time for detecting deadlocks
Invariant Verification: We also propose to check
Invariant properties for our model. Such properties are very
important to check, in the case of real systems because they
guarantee the respect of a set of time-constraints associated
to system states. In particular, in the case of the S-TDMA
protocol, a sensor node cannot stay in the state Data more
than the assigned time-slot duration to send its data. Similarly,
the coordinator cannot stay in states Req or Data more than
the predefined time-slot duration. These invariant properties
are formally described using Linear Temporal Logic (LTL)
as follows :
1- AG (Datani =⇒ (tsDni
≤ 500))
2- AG (Reqc =⇒ (tsReqc
≤ 500))
3- AG (Datac =⇒ (tsDc
≤ 500))
The verification of these properties have been performed
automatically and the verification time is depicted in Figure 5
for different models with different number of sensor nodes.
Fig. 5. Verification time (ms) for Mutual-Exclusion and Invariant properties
for S-TDMA
Mutual exclusion: In a given protocol the mutual
exclusion is a crucial property when a set of devices share
a given resource. In particular, in the case of the S-TDMA
protocol, all sensor nodes share the same channel. Thus
mutual exclusion over the channel access has to be verified.
For this purpose our model has to satisfy the following set of
properties:
- ∀i, j ∈ {1, ..., N}i=j , AG ¬(SRi ∧ SRj)
- ∀i, j ∈ {1, ..., N}i=j , AG ¬(SDi ∧ SDj)
Fairness: As the S-TDMA protocol is considered fair, the
verification of fairness property is essential. Ensuring fairness
by a protocol means that all sensor nodes will eventually get
the channel access if they ask for it. Moreover, each node will
eventually get as much frames to send as required. Table I
gives the results related to the fairness property which are ob-
tained based on a real-time execution of our S-TDMA model
for N = 15. We compute for each node the number of access
to the channel to send frames (data frames) for 10 minutes of
real-time executions. Note that, in each cycle, for each node
the number of required data frames namely sizeR is sent to the
coordinator within the request frame. However, the number of
effectively allocated data frames namely sizeD is known in the
received statistical frame. So fairness of S-TDMA, consists of
checking for each node whether sizeRi ≡ sizeDi. In Table I,
we compute and compare for an arbitrary set of chosen nodes,
the two variables sizeRi and sizeDi. The Results show that
all chosen nodes get exactly as much allocated frames as
required. Moreover, What is interesting in our model is that
fairness property could be checked automatically using BIP
Tools. To this end, fairness needs to be formally described
using Temporal Logic as follows:

6. i = 1 i = 5 i = 10 i = 15
sizeRi 25 10 15 0
sizeDi 25 10 15 0
TABLE I
THE NUMBER OF REQUIRED AND ALLOCATED FRAMES FOR SEVERAL
NODES IN DIFFERENT CYCLES
AG (SRi =⇒ (SDi U (sizeRi == 0)))
Energy analysis: WBANs have an additional interesting
aspect: as sensor nodes are generally battery-operated, energy
consumption is very important. The radio on a sensor node is
usually the device that uses most energy. A radio device could
have four possible modes: listen, transmit, receive and sleep,
and each mode has a different energy consumption level. Note
that the sleep mode has the lowest energy consumption (≈
Negligible). Protocol design for WBAN focuses on minimizing
energy consumption. In the case of the S-TDMA protocol,
the energy consumption depends on the time spent by each
node in a given period, which can be active or inactive. More
precisely, being in the active period for a given node, means
that the 3 radio modes namely listen, transmit and receive
are possible. However, the inactive period of the S-TDMA
protocol corresponds to the sleep mode of a radio device. In
our proposed model, using BIP tools, we can easily measure
the exact time spent by each node in each mode in a real-
time execution and thus compute the energy consumption of
our model for any given configuration and scenarios. The
energy consumption analysis performed in this work, takes
into consideration 3 body states, namely: walking, running
and falling down. Note that, energy consumption changes
dynamically depending on the body state. In [5], authors give
a proof that computing the time spent by each node in the
inactive period is sufficient to have an approximation about
the energy consumption of the protocol. Thus, in Figure 6,
we compute for each body state the time spent in the inactive
period.
Fig. 6. Time spent in the inactive period depending on body states
VI. CONCLUSION
In this paper, we have proposed a high-level and a formal
model for a well-known MAC protocol recently proposed for
WBANs, namely the S-TDMA protocol. The proposed model
provides a way to describe the protocol in an abstract and a
high level manner which allows to easily analyze and verify
different properties without having to implement them in a
concrete system. Moreover, the model we have proposed is
scalable as it has been defined for a network with N sensors
and the set of verification experiments have been applied for
different values of N. However, the only existing validation
proposed for the S-TDMA protocol has been proposed for only
4 nodes. We have taken into account several timing aspects,
to model the TDMA procedure, which makes our model
easily extendable to different TDMA based protocols like
the bodyMAC protocol or those presented in [15]. Different
WBAN protocols, which are not necessarily based on TDMA
could be also modeled and formally verified using the same
methodology.
REFERENCES
[1] S. Borkar, “Design challenges of technology scaling,” IEEE micro,
vol. 19, 1999.
[2] R. S. Istepanian, E. Jovanov, and Y. Zhang, “Guest editorial introduction
to the special section on m-health: Beyond seamless mobility and global
wireless health-care connectivity,” IEEE Transactions on information
technology in biomedicine, vol. 8, 2004.
[3] D. Raskovic, T. Martin, and E. Jovanov, “Medical monitoring applica-
tions for wearable computing,” The Computer Journal, vol. 47, 2004.
[4] Z. Nie, Z. Li, R. Huang, Y. Liu, J. Li, and L. Wang, “A statistical
frame based tdma protocol for human body communication.” BioMedical
Engineering OnLine, vol. 14, 2015.
[5] H. Chen, Z. Nie, K. Ivanov, L. Wang, and R. Liu, “A statistical
mac protocol for heterogeneous-traffic human body communication,” in
Circuits and Systems (ISCAS), 2013 IEEE International Symposium on,
2013, pp. 2275–2278.
[6] A. Basu, M. Bozga, and J. Sifakis, “Modeling heterogeneous real-time
components in BIP,” in SEFM, 2006, pp. 3–12.
[7] N. Cho, J. Yoo, S.-J. Song, J. Lee, S. Jeon, and H.-J. Yoo, “The human
body characteristics as a signal transmission medium for intrabody
communication,” IEEE TRANSACTIONS ON MICROWAVE THEORY
AND TECHNIQUES, vol. 55, no. 5, 2007.
[8] L. Chen, Z. Cao, R. Lu, X. Liang, and X. Shen, “EPF: an event-
aided packet forwarding protocol for privacy-preserving mobile health-
care social networks,” in Proceedings of the Global Communications
Conference, GLOBECOM 2011, 2011, pp. 1–5.
[9] R. P. Jetley, S. P. Iyer, and P. L. Jones, “A formal methods approach
to medical device review,” IEEE Computer, vol. 39, no. 4, pp. 61–67,
2006.
[10] P. Masci, A. Ayoub, P. Curzon, M. D. Harrison, I. Lee, and H. W.
Thimbleby, “Verification of interactive software for medical devices:
PCA infusion pumps and FDA regulation as an example,” in ACM
SIGCHI Symposium on Engineering Interactive Computing Systems,
2013, pp. 81–90.
[11] H. M. N. A. Hamadi, A. Gawanmeh, and M. Al-Qutayri, “A verification
methodology for a wireless body sensor network functionality,” in
Proceedings of IEEE-EMBS International Conference on Biomedical
and Health Informatics, 2014, pp. 635–639.
[12] T. Chen, Z. Yu, S. Li, and B. Chen, “From wireless sensor networks
to wireless body area networks: Formal modeling and verification on
security using PAT,” J. Sensors, pp. 8 797 568:1–8 797 568:11, 2016.
[13] T. Abdellatif, J. Combaz, and J. Sifakis, “Model-based implementation
of real-time applications,” in Proceedings of the tenth ACM international
conference on Embedded software, 2010, pp. 229–238.
[14] A. Astrin et al., “Ieee standard for local and metropolitan area networks
part 15.6: Wireless body area networks: Ieee std 802.15. 6-2012,” The
document is available at IEEE Xplore, 2012.
[15] S. J. Marinkovic, E. M. Popovici, C. Spagnol, S. Faul, and W. P.
Marnane, “Energy-efficient low duty cycle mac protocol for wireless
body area networks,” IEEE Transactions on Information Technology in
Biomedicine, vol. 13, no. 6, pp. 915–925, 2009.