Design of UHF RFID Emulators with Applications to RFID Testing and Data Transport Rich Redemske MIT AutoID Lab Cambridge, MA, USA redemske@mit.edu Rich Fletcher TagSense, Inc. Cambridge, MA, USA rf@tagsense.com Abstract The electronic design requirements and applications for a UHF RFID tag emulator are presented. As motivated by present-day industry needs, several implementations of UHF RFID tag emulators are discussed with particular focus given to the use of the emulators as a generalpurpose testing tool for RFID system design and on-site measurements. Several noteworthy results of UHF system testing are mentioned. As a longer-term development, the emerging use of UHF RFID protocols for general-purpose wireless data communications is also discussed Keywords RFID, UHF, sensors, emulator, testing, tools, pallet, troubleshooting, electromagnetic, propagation, communication, tag modem, wireless, data, IEEE 802.15, EPC. INTRODUCTION Although Radio Frequency Identification (RFID) in its present form has existed for several decades, the application of RFID technology to supply chain automation has more recently generated great interest as a cost-effective solution for inventory management. In the warehouse as well as the retail environment, RFID has the ability to make the whole inventory tracking process more transparent, more efficient, and ultimately less expensive. For example, thousands of products packaged on a single pallet could be identified nearly instantaneously as they enter or exit specific points in the supply chain, such as a warehouse portal or loading dock door. This ability to track each individual item from every manufacturer with a unique RFID tag promises a number of financial benefits, and many large retailers (such as Wal-Mart) as well as government organizations have begun to request this technology. Although RFID technology is well-established at several different operating frequencies (e.g. 125 KHz, 13.56 MHz), industry organizations and standards bodies (e.g. EPC Global, ISO) around the world have given preference to the UHF frequency band (865-955 MHZ) for most supply-chain applications. The UHF frequency band has a number of advantages for operation. Among the advantages, this frequency range offers longer reading distances than other RFID frequencies due to a relatively compact high-gain antenna and good antenna cross section achievable at the UHF bands. Also, greater transmitter power is permitted at UHF frequencies than at microwave frequencies, such as 2.4 GHz. Since modulated backscatter is employed as the signaling mechanism rather than inductive coupling, a simple signallayer tag antenna is sufficient and therefore cheaper to manufacture. Compared to lower operating frequencies, the electromagnetic skin depth is also shorter at UHF frequencies (few microns) which enables thinner metallization layers to be used, which in tunr saves additional materials cost and also enables low-cost printed antennas. Despite these advantages, however, the UHF frequency band presents several challenges for RFID applications. While great technological progress continues to be made in reader design, IC design, and protocol design, the fundamental problem of electromagnetic propagation has required a great deal of care in commercial deployment of this technology. Unlike lower-frequency RFID propagation, at UHF frequencies, the radio waves are significantly reflected by many common materials (not just metals), such as water, and various other liquids and solids. These significant reflections are due primarily to the impedance mismatch between air ( r =1) and the other material (e.g. r =80 for water at UHF). As the wave propagates from the reader antennas, these partial reflections produce constructive and destructive interference effects. Since the wavelength of UHF radio waves is on the same scale as the operating distances and the items being tagged, multi-path effects have a significant effect on the performance of UHF RFID systems, and near-field or far-field approximations cannot be made. The complexities of UHF signal propagation in an industrial environment has thus given rise to the need for good tools for analyzing and troubleshooting a UHF RFID installation. UHF Tag Emulator Although battery-powered backscatter tags have been used for many years as RFID transponders (e.g. for highway toll-collection systems or tracking radioactive materials), we present here the use of a battery-powered backscatter tag for use as a UHF RFID Tag emulator in conjunction with passive RFID infrastructure. Such a device can be employed in many ways as a testing tool for RFID systems as well as a general-purpose communications link to other electronic devices.
In accordance with the generally accepted industry RFID classification, a UHF tag emulator can be considered a Class 3 semi-passive tag (as opposed to the Class 1 passive tags employed in supply-chain tagging applications). The tag emulator does not transmit any power, and it uses the same protocol as Class 1 tags to communicate with the RFID reader, such as the EPC (Electronic Product Code) Class 1 Generation 1 protocol (EPC C1G1) 1 which is one of the emerging industry standards. The existence of battery, however, enables the tag emulator to operate (processing and sensing) without the need for the electromagnetic field from the reader. This also enables the tag emulator to achieve significantly greater communication distance relative to a battery-less RFID tag. In order to interface with a passive RFID environment, the UHF tag emulator is implemented by adding a separate communications layer on top of the EPC C1G1 protocol to allow for the bi-directional communication of data packets. As a result, within the existing RFID infrastructure, the tag emulator can communicate more than just it s own ID; it can transmit multiple data packets to communicate sensor information, or and can be used by other devices as a modem to stream data. In this paper, we discuss the design of an RFID tag emulator and present two general categories of applications: 1) As a tool for testing and evaluation of UHF RFID systems 2) As a general purpose data transport device for interfacing to RFID infrastructure. MODULATOR DEMODULATOR RECTIFIER/ REGULATOR MICRO- SENSORS Figure 1. RFID tag emulator functional block diagram also to on-board sensors, as well as to optional gain stages in the de-modulator for improving the sensitivity of the reader-tag communication link. The microcontroller implements the EPC C1G1 protocol by decoding the incoming reader signal and encoding the outgoing signal through backscatter modulation. Additionally, the firmware can be designed to implement a custom, higher-level protocol layer on top of EPC C1G1 in order to enable functionality similar to that of a tag modem. Additionally, the microcontroller coordinates sampling and digitization of the sensor readings, optional averaging, and communicating the resulting information to one or more remote readers via the RFID protocol. The sensor block can contain any number and type of sensors, depending on the application. In a diagnostic application, a field strength sensor obtains a voltage value measured from the antenna. Figure 2 shows a circuit implementation of such a circuit, using a voltage doubler as a rectifier. In an item monitoring application, a temperature sensor could provide continual temperature readings at specified time intervals. MICRO Figure 2. Circuit diagram of field strength indicator The de-modulator block handles the detection and amplification of the ASK (amplitude shift keying) modulated signal received from the RFID reader. This can be done minimally by implementing an edge detector circuit, or, for better performance, transistors or an RF integrated circuit can be used. The back-scatter modulator section is designed to alter the resistance or preferably the reactance of the tag antenna in order to alter its scattering cross-section. This can be implemented in its simplest case with a MOSFET, such that when switched off, the antenna s impedance is matched to the impedance of the remaining emulator circuitry, and when switched on, produces a mismatch between these impedances. A typical implementation, referenced in the literature 2 is shown in Figure 3. UHF Tag Emulator Design The design of the UHF Tag Emulator consists of several parts. Figure 1 shows a functional block diagram of the emulator. The power management block provides a regulated voltage from the battery along with a low battery indicator. Power can be supplied not only to the microcontroller, but MICRO
Figure 3. Circuit diagram of modulator A variety of UHF antennas can be employed for the tag emulator; however, for longer distances, precise impedance matching and large scattering cross-section is preferred. It is important to maximize the bandwidth of the antenna since UHF RFID systems typically implement frequency hopping over a range of frequencies (e.g. 902-928 MHz in North America). This bandwidth requirement for tag antennas is often difficult to achieve, but is necessary for consistent tag operation. In free-space, folded dipole designs are common, although more creative designs may be optimized to minimize total antenna size, or improve readability when near certain materials such as metals or water. Figure 4 is a photograph of one of the tag emulator designs employed in our research containing both a field strength-sensor as well as a temperature sensor. FIELD STRENGTH DETECTOR MODULATOR CIRCUIT READER RF AMPLIFIER TEMPERATURE SENSOR TAG READ TAG NOT READ or not a particular tag in a particular location was read. Using a tag emulator however, it is possible to create a continuous measurement of the electromagnetic fields throughout different parts of the pallet. At the MIT Auto-ID Labs, a special version of a UHF tag emulator was developed to study the problems of electromagnetic propagation in electronically tagged cases and pallets for supply chain applications. This version of the tag emulator, known as the "Field Probe," was designed to sample the local strength of the RF field and report this data back to a standard RFID reader via the EPC (electronic product code) protocol. This UHF "field probe" enabled the measurement and detection of field maxima as well as "null spots" inside a pallet created by constructive or destructive interference caused by reflections from objects within the pallet as well as the surrounding environment. MICRO- Figure 5. Illustration of case-level RFID tagging and identification within a large pallet. Figure 4. RFID tag emulator module BATTERY Applications to RFID System Testing UHF Tag Emulators are particularly useful in the system design and deployment of UHF RFID systems in order to maximize performance or achieve high read rates in challenging environments containing liquids or metal objects. A typical RFID pallet application is illustrated in Figure 5. Here, it can be seen that using ordinary passive RFID tags, the only information that can be derived from this experiment is binary yes/no information indicting whether The tag emulator Field Probe developed at MIT also contained a set of flashing LED lights and an audio beeper which was capable of providing a variety of live real-time feedback to the user independently of the information transmitted to the reader. Over a 12-month period (May 2004-May2005), the UHF RFID emulator field probe was used for a variety of experiments to investigate electromagnetic propagation and develop improved methods for tagging and stacking of cases and pallets. Since the UHF tag emulator was programmed to support the EPC anti-collision protocol, it was also possible to use many UHF tag emulators simultaneously to communicate with a single RFID reader. In this way, it was possible to embed several UHF tag emulators inside a large pallet alongside other conventional passive labels in order to examine an existing RFID warehouse portal installation. A photograph of RFID emulator Field Probes embedded in a test pallet containing 56 individually tagged cases is shown in Figure 6.
Figure 8. Results from water penetration experiment showing the RFID signal strength as a function of water depth at three separate RFID frequencies. Figure 6. Photograph of test pallet with embedded Field Probes. Two of the five portal reader antennas are shown. Figure 7. Field Probe data visualization program showing array of passively tagged objects as well as larger colored circles indicating the position and sensor value of the embedded RFID emulator Field Probes. In order to easily view and interpret the data being collected from multiple RFID Field Probes, a visualization program was written in Visual Basic to display the data from the RFID reader in real-time. Using this approach, it was possible to optimize the placement and stacking of RFID labels within a pallet, as well as optimize the alignment of the RFID reader antennas. A sample screen shot of the real-time color display is shown in Figure 7. The UHF RFID emulator field probe also proved to be a valuable tool for measuring the RF signal propagation and protocol performance through various media. Through the use of a linearly-polarized RFID reader antenna and a large fishtank, it was possible to use the field probe to measure RF signal penetration through various liquids. As an example of these measurements, Figure 8 shows the RF field strength after penetration through a layer of water. Applications to RFID Waveform Analysis The UHF RFID tag emulator is also particularly suited for uncovering very challenging subtle variations in RFID signal waveforms that lead to inconsistent RFID performance. Abnormalities in the RFID signal waveform are encountered during simultaneous operation of multiple adjacent readers; however, timing variations also exist between RFID readers from different manufacturers. A sample variation between two reader waveforms is shown in Figures 9 and 10. Using an oscilloscope to examine the de-modulated signals the field probe was receiving at a fixed distance from the reader antenna, subtle timing differences were recorded between two older model readers manufactured by two different companies. In particular, the durations of the individual pulses corresponding to both a 1 and 0 bit respectively were found to be different. The RFID emulator can be used to measure these timing differences and report it back to the reader in real-time. Figure 9. Data received from reader 1. The long 8 microsecond pulse represents a one, while the shorter 3.6 microsecond pulse represents a zero.
Figure 10. Data received from reader 2. The long 10 microsecond pulse represents a one, while the shorter 6 microsecond pulse represents a zero. Applications to Data Transport With the increasing deployment of UHF RFID infrastructure, an emerging application of RFID emulators is for use as a general data transport layer for low-power data peripherals. Over the past several years, the use of lowerfrequency RFID emulators as general data transport method has been well established 3. Industry standards, such as NFC (Near-Field Communications) 4 have now emerged to enable data peripherals, such as cell phones and payment cards, to take advantage of RFID infrastructure. This basic concept is illustrated in Figure 11. Due to a lack of open industry standards, the use of UHF RFID systems for general data transport has been limited to specialized applications, such as personalized electronic name badges (e.g. http://www.ntag.com). However, given the emergence of global open standards, such as EPC and ISO 18000-6, a variety of new data applications are now possible. In order to meet the requirements for data peripherals and sensors, we designed and built a version of the UHF RFID emulator that can be used as a plug-in module for other electronic devices. A generalized file transfer protocol was created for streaming multiple data packets over the EPC C1G1 protocol using a standard EPC UHF RFID reader. This protocol was implemented as another layer above the EPC C1G1 protocol such that no special programming was required on the RFID reader. For the tag to reader channel, the data stream was divided into 8 byte packets and sent one at a time to the reader in the form of EPC IDs. The Quiet command, transmitted by the reader by default upon reading a tag ID, has the effect of halting a given RFID tag and preventing it from sending its ID again until it receives a Talk command. We programmed the emulator to used this Quiet command as an ACK (acknowledgement signal) which enabled the emulator to then load its next 8 byte packet, which would be transmitted as its new ID bytes. Using this implementation, the highest achievable data rate for this channel is approximately 2 Kbaud. This data rate, in practice, can vary from reader to reader depending on the manufacturer chooses to implement the tag protocol and how efficient its tag discovery algorithms are implemented. Additionally, the presence of other tags will slow down this data rate considerably due to the necessity of the reader to use anti-collision techniques to read all the tag population. However, multiple parallel data streams can be implemented in this way. Data packets are sent along the reader to tag channel by use of the ProgramID command. Much like the reverse channel, the data stream is divided up into 8 byte packets. However, due to the slow implementation of the ProgramID command, a data rate of only about a 0.1 Kbaud can be achieved in this direction using such implementation of the EPC Generation 1 UHF protocol. If it is not necessary to conform to the standard EPC protocol, it is certainly possible to extend the EPC C1G1 protocol with a few additional commands that would enable streaming file transfers and multiple contiguous data packets. In theory then, much higher data rates could be achieved, as indicated by the actual bit rates of the existing EPC commands themselves. For example, given the bit rates employed in the EPC Gen 1 protocol, the reader to tag channel would have a data rate of 62.5 Kbaud, while the tag to reader channel would have a data rate of 125 Kbaud. The modulation schemes contained in the more recent EPC Gen 2 protocol provides for a significantly higher data rate. HOST DEVICE TAG MODEM TAGREADER Figure 11. An RFID Emulator configured as a Tag Modem enables any host device to interface to tag reader. Tag modem translates host data into RFID protocol data and vice versa. Tag modem chip is powered but wireless transmission is passive. Given the emergence of UHF infrastructure as well as new UHF protocols (e.g. EPC Generation 2, ISO18000-
6C), there is currently the opportunity to create new file transfer protocols analogous to the NFC protocols (ECMA340, ECMA352) that exist at 13.56 MHz. and with even greater data rates. Through the use of these UHF RFID emulators, many new data applications can be created or expanded, including vehicle sensors and telematics, industrial alarm systems, parking garage entry/payment, low-power datalogger sensors for tele-robotics and space applications, as well as mobile devices such as PDA s and mobile phones.. Conclusions Several different UHF RFID emulators have been presented motivated by existing industry needs. We have discussed the salient issues in the design of UHF RIFD emulator and have illustrated how particular design features can be exploited or enhanced for a particular application. At present, the UHF tag emulator can serve a valuable role as a much-needed testing tool for evaluating, debugging, and measuring existing RFID installations. In the long-term, however, UHF tag emulators will likely enable a variety of new applications as a means of wireless data communications between low-power devices and existing ubiquitous RFID infrastructure. REFERENCES 1 MIT Auto-ID Center. 860 MHz 930 MHz Class 1 Radio Frequency (RF) Identification Tag Radio Frequency & Logical Communication Interface Specification. http://www.epcglobalinc.org/standards_technology/secure/v1.0/uhf-class1.pdf, November, 2002. 2 Cole, Peter H., Loukine, Michael Y., Hall, D.M. Integral Backscattering Transponders for Low Cost RFID Applications, Fourth Annual Wireless Symposium and Exhibition, Santa Clara, February 1996, pp 328-336. 3 Fletcher, R., Omojola, O., Gray, S. Application of RFID to Remote Sensors and Wireless Data Peripherals, 3nd IEEE Conference on Automatic Identification Technologies, March 2002. 4 For more information, see http://www.nfc-forum.org/home.