Moving Tag Detection via Physical Layer Analysis for Large-Scale RFID Systems Chuyu Wang,Lei Xie,Wei Wang,Tao Xue,Sanglu Lu State Key Laboratory for Novel Software Technology,Nanjing University,China Email:{wangcyu217,txue@dislab.nju.edu.cn,fIxie,ww,sanglu@nju.edu.cn Abstract-In a number of RFID-based applications such as essential to devise a moving tag detection scheme to detect the logistics monitoring,the RFID systems are deployed to monitor motion status of all tags.In this way,we only need to focus on a large number of RFID tags.They are usually required to tracking the moving tags,saving a lot of effort which might track the movement of all tags in a real-time approach,since the tagged-goods are moved in and out in a rather frequent approach. be wasted in tracking stationary tags. However,a typical cycle of tag inventory in COTS RFID system According to the prior art,in order to track the moving tags usually takes tens of seconds to interrogate hundreds of RFID in the monitoring area,two schemes are essentially required, tags.This hinders the system to track the movement of all tags i.e..a fast tag inventory scheme to interrogate tags,and an in time.One critical issue in such type of tag monitoring is to effective positioning scheme to detect the motion status of the efficiently distinguish the motion status of all tags,i.e..stationary or moving.According to the motion status of different tags,the tags.For the tag inventory in RFID systems,polling protocols state-of-art localization schemes can further track those moving [3,4]have been proposed to improve the time efficiency. tags,instead of tracking all tags.In this paper,we propose a However,they still take tens of seconds to interrogate RFID real-time approach to detect the moving tags in the monitoring tags in a real environment,when the cardinality of tags is area,which is a fundamental premise to support tracking the movement of all tags.We achieve the time efficiency by decoding more than several hundreds.The inefficiency is primarily due collisions from the physical layer.Instead of using the EPC ID to the waste of the collision slots,which usually occupy a fairly which cannot be decoded in collision slots,we are able to extract large proportion in the overall time slots.Hence,even schemes two kinds of physical-layer features of RFID tags,i.e.,the phase based on the pooling protocols [5,6]can efficiently detect the profile and the backscatter link frequency,to distinguish among moving tags based on the statistical signal information.but different tags in different positions.By resolving the two physical- also suffer from the effect of collision slots.Recent research layer features from the tag collisions,we are able to derive the motion status of multiple tags simultaneously,and greatly works consider to redesign new protocols or modify the EPC improve the time-efficiency.Experiment result shows that our C1G2 protocols to make use of the collision slots for better solution can accurately detect the moving tags while reducing time efficiency [7-9].However,they have not yet considered to 80%of inventory time compared with the state-of-art solutions. detect the motion status of the tags.Some protocols [3,10]are Index Terms-RFID,Collision Decoding,Tag Inventory also proposed to detect the missing tags via the physical-layer symbols.But they cannot be used to detect the moving tags I.INTRODUCTION since a moving tag can still exist in the monitoring area instead With the rapid proliferation of RFID-based applications, of missing.For the positioning scheme of RFID systems,the RFID tags have been deployed into various applications in state-of-the-art localization schemes [11,12]usually locate the increasingly large numbers.For example,in the application of tags one by one,and the time delay of localizing a unique logistics monitoring,there are usually more than hundreds of object is up to several hundreds of milliseconds.When dealing goods attached with RFID tags in the monitoring area.Since with more than hundreds of RFID tags it is impossible to the tagged-goods are moved in and out in a rather frequent concurrently locate all tags in a real time approach. approach,the RFID systems are usually required to track the In this paper,we propose a real-time approach to detect movement of all tags in a real-time approach.However.a the moving tags in large scale RFID systems,which is a typical round of tag inventory in COTS RFID system usually fundamental premise to support tracking the movement of takes tens of seconds to interrogate hundreds of RFID tags all tags.Since a missing tag must be moved first,it can [1,2].This greatly hinders the system to track the movement also be simplified as a moving tag detection problem.In of all tags in time.One critical issue in such type of tag our problem,we achieve the time efficiency by effectively monitoring is to efficiently distinguish the motion status of all decoding collisions from the physical layer.Instead of using tags,i.e.,stationary or moving.For the"moving"tags,we can the EPC ID,which cannot be decoded in collision slots,we leverage the state-of-art localization schemes to track them;for are able to extract two kinds of physical-layer features of the "stationary"tags,we do not need to track them any more, RFID tags,i.e.,the phase profile and the backscatter link since they are supposed to be statically placed in a specified frequency,to distinguish the tags in different positions.These position.In most situations,the stationary tags occupy a rather physical-layer features serve as fingerprints of tag identities large proportion while the moving tags occupy only a small and positions.By resolving the two physical-layer features proportion in regard to a certain moment.Therefore,it is from the tag collisions,we are able to derive the motion
Moving Tag Detection via Physical Layer Analysis for Large-Scale RFID Systems Chuyu Wang, Lei Xie, Wei Wang, Tao Xue, Sanglu Lu State Key Laboratory for Novel Software Technology, Nanjing University, China Email: {wangcyu217, txue}@dislab.nju.edu.cn, {lxie, ww, sanglu}@nju.edu.cn Abstract—In a number of RFID-based applications such as logistics monitoring, the RFID systems are deployed to monitor a large number of RFID tags. They are usually required to track the movement of all tags in a real-time approach, since the tagged-goods are moved in and out in a rather frequent approach. However, a typical cycle of tag inventory in COTS RFID system usually takes tens of seconds to interrogate hundreds of RFID tags. This hinders the system to track the movement of all tags in time. One critical issue in such type of tag monitoring is to efficiently distinguish the motion status of all tags, i.e., stationary or moving. According to the motion status of different tags, the state-of-art localization schemes can further track those moving tags, instead of tracking all tags. In this paper, we propose a real-time approach to detect the moving tags in the monitoring area, which is a fundamental premise to support tracking the movement of all tags. We achieve the time efficiency by decoding collisions from the physical layer. Instead of using the EPC ID, which cannot be decoded in collision slots, we are able to extract two kinds of physical-layer features of RFID tags, i.e., the phase profile and the backscatter link frequency, to distinguish among different tags in different positions. By resolving the two physicallayer features from the tag collisions, we are able to derive the motion status of multiple tags simultaneously, and greatly improve the time-efficiency. Experiment result shows that our solution can accurately detect the moving tags while reducing 80% of inventory time compared with the state-of-art solutions. Index Terms—RFID, Collision Decoding, Tag Inventory I. INTRODUCTION With the rapid proliferation of RFID-based applications, RFID tags have been deployed into various applications in increasingly large numbers. For example, in the application of logistics monitoring, there are usually more than hundreds of goods attached with RFID tags in the monitoring area. Since the tagged-goods are moved in and out in a rather frequent approach, the RFID systems are usually required to track the movement of all tags in a real-time approach. However, a typical round of tag inventory in COTS RFID system usually takes tens of seconds to interrogate hundreds of RFID tags [1, 2]. This greatly hinders the system to track the movement of all tags in time. One critical issue in such type of tag monitoring is to efficiently distinguish the motion status of all tags, i.e., stationary or moving. For the “moving” tags, we can leverage the state-of-art localization schemes to track them; for the “stationary” tags, we do not need to track them any more, since they are supposed to be statically placed in a specified position. In most situations, the stationary tags occupy a rather large proportion while the moving tags occupy only a small proportion in regard to a certain moment. Therefore, it is essential to devise a moving tag detection scheme to detect the motion status of all tags. In this way, we only need to focus on tracking the moving tags, saving a lot of effort which might be wasted in tracking stationary tags. According to the prior art, in order to track the moving tags in the monitoring area, two schemes are essentially required, i.e., a fast tag inventory scheme to interrogate tags, and an effective positioning scheme to detect the motion status of the tags. For the tag inventory in RFID systems, polling protocols [3, 4] have been proposed to improve the time efficiency. However, they still take tens of seconds to interrogate RFID tags in a real environment, when the cardinality of tags is more than several hundreds. The inefficiency is primarily due to the waste of the collision slots, which usually occupy a fairly large proportion in the overall time slots. Hence, even schemes based on the pooling protocols [5, 6] can efficiently detect the moving tags based on the statistical signal information, but also suffer from the effect of collision slots. Recent research works consider to redesign new protocols or modify the EPC C1G2 protocols to make use of the collision slots for better time efficiency [7–9]. However, they have not yet considered to detect the motion status of the tags. Some protocols [3, 10] are also proposed to detect the missing tags via the physical-layer symbols. But they cannot be used to detect the moving tags since a moving tag can still exist in the monitoring area instead of missing. For the positioning scheme of RFID systems, the state-of-the-art localization schemes [11, 12] usually locate the tags one by one, and the time delay of localizing a unique object is up to several hundreds of milliseconds. When dealing with more than hundreds of RFID tags it is impossible to concurrently locate all tags in a real time approach. In this paper, we propose a real-time approach to detect the moving tags in large scale RFID systems, which is a fundamental premise to support tracking the movement of all tags. Since a missing tag must be moved first, it can also be simplified as a moving tag detection problem. In our problem, we achieve the time efficiency by effectively decoding collisions from the physical layer. Instead of using the EPC ID, which cannot be decoded in collision slots, we are able to extract two kinds of physical-layer features of RFID tags, i.e., the phase profile and the backscatter link frequency, to distinguish the tags in different positions. These physical-layer features serve as fingerprints of tag identities and positions. By resolving the two physical-layer features from the tag collisions, we are able to derive the motion
status of multiple tags simultaneously,and greatly improve II.RELATED WORKS the time-efficiency.Specifically,we propose a two-phase tag Collision Recovery Many works focus on how to extract monitoring scheme including the tag inventory and continuous tag cardinality [13]or recover the tag signal [8,9]from polling.In the tag inventory phase,the RFID reader constructs the collision signals based on the specialized instruments like a physical fingerprint for each tag individually via traditional USRP.Since Buettner et al.propose a Software Defined Ra- tag inventory.In the continuous polling phase,the RFID reader dio based UHF-RFID reader [14],several researchers further continuously issues multiple query cycles to interrogate the leverage this platform to deal with the collision problems tags.For each polling cycle,the RFID reader measures a new [7-9,15].Wang et al.[7]implement a new scheme which distribution of physical-layer features via both the singleton enables rateless code transmitting.[8,9]use the time-domain and collision slots.By matching the updated distributions to separation to recovery the data from the collision signals.Hou the original distributions,our solution is able to efficiently et al.[13]present a physical-layer cardinality estimator from detect the moving tags.The above two phases are executed the collision signals for large scale RFID system. alternately,and the time overhead of the tag inventory phase Physical Layer Identification Previous studies [16,17]focus can be amortized by the following multiple polling cycles, on physical-layer identification by leveraging the hardware im- such that the overall time-efficiency is achieved. perfection in tag manufacturing.Davide et al.[16]distinguish There are three key technical challenges.The first challenge from different tags based on the frequency difference orE is to achieve real-time time efficiency in large scale RFID caused by manufacturing imperfection of tags.Han et al.[18] systems.In a large scale RFID system,it is rather difficult to leverage the internal similarity among pulses of tags'RN16 continuously update the monitoring results within limited time preamble signals as the fingerprint for distinguishing.Zheng intervals.To address this challenge,we propose a two-phase et al.[10]employ a method to detect the missing tags based monitoring scheme including a normal tag inventory phase on physical-layer signals. and multiple fast tag polling phases,we significantly improve Different from previous work,in this paper,we focus on the time efficiency in extracting the physical-layer features via how to design a real-time tag monitoring scheme to efficiently decoding the tag collisions.The second challenge is to detect detect the motion status of all tags,so as to further support the motion status of all tags via the physical-layer features. tracking the movement of all tags.We aim to improve both To address this challenge,we exploit the relationship between the time efficiency in tag inventory and the accuracy in detect the physical-layer features and the motion status of tags.We the motion status of all tags. find that the phase value from the tag's response changes even if the specified tag is moved with a small distance, III.SYSTEM OVERVIEW while the backscatter link frequency of the tag's response A.Design Goals has high degree of distinction among different tags.We thus In this paper,we propose a real-time approach to detect leverage these physical-layer features to detect the motion the motion status of all tags in the monitoring area,so as to status of specified tags.The third challenge is to extract the further support tracking the movement of all tags.Because above physical-layer features from the collisions of multiple the tags may change their motion status any time,we need tag responses.To address this challenge,we recover each tag to continuously update the motion status within a limited response according to the geometrical characteristic of the time interval.Therefore,our objective in designing a moving collision signals in I-Q plane,and extract the phase profile tag detection scheme is to improve both the time efficiency of each tag response.Further,we refer to special patterns to in tag inventory and the accuracy in detecting the motion identify the starting and ending parts of recovered RF signals status of all tags.1)The average time for each cycle of tag based on cross-correlation,and extract the backscatter link inventory should be sufficiently reduced to achieve the real- frequency from the signal length of each tag. time requirement for large scale RFID systems.2)There are We make three contributions in this paper.First,to the two kinds of errors in the problem:a)False positive errors:the best of our knowledge,we are the first to propose a moving stationary tags are identified as moving tags.b)False negative tag detection scheme for tag monitoring by leveraging the errors:the moving tags are identified as stationary tags.Both physical-layer features,which is a fundamental premise for of the two errors should be effectively reduced in detecting tracking the movement of RFID tags in large-scale RFID the motion status. systems.Second,our solution is able to accurately detect the motion status of all tags,by referring to the physical-layer B.System Framework features,including the phase profile and backscatter link fre- In order to effectively detect the motion status of all tags, quency.Moreover,we extract these physical-layer features of we exploit the relationship between the physical-layer features multiple tags from collision slots,which significantly improves and the motion status of tags.The following two physical- the time efficiency.Third,we implemented a prototype system layer features are investigated:1)Phase profile:it is the phase and evaluated its performance in realistic settings.Experiment value of an RF signal.The phase value from the tag's response result shows that our solution can accurately detect the moving changes even if the tag is moved with a small distance.2) tags while reducing 80%of inventory time compared with state Backscatter link frequency (BLF):it is the frequency of the of arts solutions. tag-to-reader link,which determines the tag's data rate in
status of multiple tags simultaneously, and greatly improve the time-efficiency. Specifically, we propose a two-phase tag monitoring scheme including the tag inventory and continuous polling. In the tag inventory phase, the RFID reader constructs a physical fingerprint for each tag individually via traditional tag inventory. In the continuous polling phase, the RFID reader continuously issues multiple query cycles to interrogate the tags. For each polling cycle, the RFID reader measures a new distribution of physical-layer features via both the singleton and collision slots. By matching the updated distributions to the original distributions, our solution is able to efficiently detect the moving tags. The above two phases are executed alternately, and the time overhead of the tag inventory phase can be amortized by the following multiple polling cycles, such that the overall time-efficiency is achieved. There are three key technical challenges. The first challenge is to achieve real-time time efficiency in large scale RFID systems. In a large scale RFID system, it is rather difficult to continuously update the monitoring results within limited time intervals. To address this challenge, we propose a two-phase monitoring scheme including a normal tag inventory phase and multiple fast tag polling phases, we significantly improve the time efficiency in extracting the physical-layer features via decoding the tag collisions. The second challenge is to detect the motion status of all tags via the physical-layer features. To address this challenge, we exploit the relationship between the physical-layer features and the motion status of tags. We find that the phase value from the tag’s response changes even if the specified tag is moved with a small distance, while the backscatter link frequency of the tag’s response has high degree of distinction among different tags. We thus leverage these physical-layer features to detect the motion status of specified tags. The third challenge is to extract the above physical-layer features from the collisions of multiple tag responses. To address this challenge, we recover each tag response according to the geometrical characteristic of the collision signals in I-Q plane, and extract the phase profile of each tag response. Further, we refer to special patterns to identify the starting and ending parts of recovered RF signals based on cross-correlation, and extract the backscatter link frequency from the signal length of each tag. We make three contributions in this paper. First, to the best of our knowledge, we are the first to propose a moving tag detection scheme for tag monitoring by leveraging the physical-layer features, which is a fundamental premise for tracking the movement of RFID tags in large-scale RFID systems. Second, our solution is able to accurately detect the motion status of all tags, by referring to the physical-layer features, including the phase profile and backscatter link frequency. Moreover, we extract these physical-layer features of multiple tags from collision slots, which significantly improves the time efficiency. Third, we implemented a prototype system and evaluated its performance in realistic settings. Experiment result shows that our solution can accurately detect the moving tags while reducing 80% of inventory time compared with state of arts solutions. II. RELATED WORKS Collision Recovery Many works focus on how to extract tag cardinality [13] or recover the tag signal [8, 9] from the collision signals based on the specialized instruments like USRP. Since Buettner et al. propose a Software Defined Radio based UHF-RFID reader [14], several researchers further leverage this platform to deal with the collision problems [7–9, 15]. Wang et al. [7] implement a new scheme which enables rateless code transmitting. [8, 9] use the time-domain separation to recovery the data from the collision signals. Hou et al. [13] present a physical-layer cardinality estimator from the collision signals for large scale RFID system. Physical Layer Identification Previous studies [16, 17] focus on physical-layer identification by leveraging the hardware imperfection in tag manufacturing. Davide et al.[16] distinguish from different tags based on the frequency difference ∂TIE caused by manufacturing imperfection of tags. Han et al. [18] leverage the internal similarity among pulses of tags’ RN16 preamble signals as the fingerprint for distinguishing. Zheng et al. [10] employ a method to detect the missing tags based on physical-layer signals. Different from previous work, in this paper, we focus on how to design a real-time tag monitoring scheme to efficiently detect the motion status of all tags, so as to further support tracking the movement of all tags. We aim to improve both the time efficiency in tag inventory and the accuracy in detect the motion status of all tags. III. SYSTEM OVERVIEW A. Design Goals In this paper, we propose a real-time approach to detect the motion status of all tags in the monitoring area, so as to further support tracking the movement of all tags. Because the tags may change their motion status any time, we need to continuously update the motion status within a limited time interval. Therefore, our objective in designing a moving tag detection scheme is to improve both the time efficiency in tag inventory and the accuracy in detecting the motion status of all tags. 1) The average time for each cycle of tag inventory should be sufficiently reduced to achieve the realtime requirement for large scale RFID systems. 2) There are two kinds of errors in the problem: a) False positive errors: the stationary tags are identified as moving tags. b) False negative errors: the moving tags are identified as stationary tags. Both of the two errors should be effectively reduced in detecting the motion status. B. System Framework In order to effectively detect the motion status of all tags, we exploit the relationship between the physical-layer features and the motion status of tags. The following two physicallayer features are investigated: 1) Phase profile: it is the phase value of an RF signal. The phase value from the tag’s response changes even if the tag is moved with a small distance. 2) Backscatter link frequency (BLF): it is the frequency of the tag-to-reader link, which determines the tag’s data rate in
the response signal.Due to manufacturing imperfection,BLF and wireless environment can be regarded unchanged.So we varies among different tags.Therefore,it is suitable to combine can extract the physical-layer feature directly from the RN16 the two features to detect the motion status of tags.Moreover, and omit the EPC-ID signal. we recover each tag response according to the geometrical 800 JQUERY ACK characteristic of the collision signals in I-Q plane,and extract the aforementioned physical-layer features. EPCID Tag inventory phase Extract Features Physical-layer Fingerprints 10 15 Tag Signal Time(ms) nnnnnnAn BLF Fig.2:A typical singleton slot in RFID systems Continuous pooling B.Phase Profile Collision Signal In RFID systems,the tag transmits data using backscattering modulation.Hence,the received signal of one tag is: Fig.1:System framework y(t)=(A1+r(t)A2·cos(2πfit+8))-cos(2πfet+B)+n(t) (1) As for detecting the motion status of tags,we propose a where A1·cos(2πfct+B)is the signal of carrier,.x(t)A2· two-phase monitoring scheme,including the tag inventory and cos(2πfit+a)·cos(2πfet+)is the signal of tag and n(t) continuous polling phase,to efficiently extract the physical- is the ambient noise.Here,x(t)is the binary bits sent by the layer features for detection.In the tag inventory phase,the tag.After converting the signal to baseband by the removing reader issues multiple query cycles to extract the physical-layer carrier cos(2mfet),the baseband signal can be represented as: features of all the tags in stationary status.In the continuous polling phase,the reader continuously issues multiple query s(t)=Ajei+(t)Azei()+i(t).(2) cycles to extract physical-layer features of tags in real-time.By Therefore,the actual received signal is a superposition of comparing the real-time features with the stationary features, carrier wave and backscattered signal. we utilize a Graph Matching Method (GMM)to detect the Intuitively,we can model the received signal from a single motion status of tags in every query cycle of continuous tag response in I-Q plane as shown in Fig.3.The received polling phase.The continuous polling phase contains multiple signal consists of two parts:1)leakage signal:the constant real-time query cycles to amortize the time spent in the carrier signal (i.e.,CW),2)backscattered signal:the modu- inventory phase.We show the whole framework in Fig.1. lated tag signal.As for the phase value of the backscattered signal,it can be represented as: IV.PHYSICAL-LAYER FEATURES In this section,we demonstrate the concept of our physical- 0=Φ-6. (3) layer features via realistic experiments.We implement a which is the difference between the carrier signal phase B and software defined reader (SDR reader)according to the Gen2 the backscattered signal phase in Fig.3.We call the phase project [14].Specifically,we operate the Gen2 project on profile of the tag in this work. our USRP platform with two FLEX-900 daughter boards and two Larid S9028 antennas on each board for transmitting and Backscattere receiving respectively.For the receiving module,we set the signal sampling rate to 2MHz,which represents 0.5us per sample. Leakage A.The Response of a Normal Singleton Slot Fig.2 illustrates a typical slot in RFID systems,which is collected from USRP.The reader sends a QUERY/QRep Fig.3:Model of the received signal of a single tag command to start a slot.All the tags that select this slot, We carry out trace-driven evaluations to study the property will transmit its RN16 to the reader.If the reader succeeds in of the phase profile.Firstly,we evaluate the stability by decoding the RN16 bits,it then sends an ACK to the tag,that conducting an empirical experiments on 50 tags with random tells the tag to transmit its EPC-ID.During the tag response, deployments.For each setting,we measure 100 phase values the reader keeps transmitting continuous wave(CW)to supply by querying each tag 100 times.The results are normalized power.Hence,there are two kinds of tag response generally:1) by subtracting the average phase value of each result set.As RN16 period,responding the QUERY or QRep command from shown in Fig.4(a),the phase profile varies from-5 to 5 the reader,2)EPC-ID period,answering the ACK command. following a typical Gaussian distribution.So we can treat the In fact,both the RN16 signal and the EPC-ID signal contain phase profile as a stable feature for motion detection. preamble,data bits and check bits.As a result,the time of Secondly,we compare the phase profile of SDR reader with the EPC-ID period is about 4 times longer than that of the the phase value of commercial reader(ImpinjR420)by issuing RN16 period as shown in Fig.2.Meanwhile,since the time the same tag.We vary the distance between the antenna and the interval between the two responses is so small,the position tag,which ranges from 20cm to 70cm stepping by 1cm.For
the response signal. Due to manufacturing imperfection, BLF varies among different tags. Therefore, it is suitable to combine the two features to detect the motion status of tags. Moreover, we recover each tag response according to the geometrical characteristic of the collision signals in I-Q plane, and extract the aforementioned physical-layer features. !"#$%&'(&)*+,$ -."/( !"#$%&#'"( 0*&)%&1*1/$-**2%&#$ -."/( )*((&+&*'$%&#'"( ,-./"0.$$12".3/2+ ,-./"0.$12".3/2+ 45"+2 671 8/"95$:".05&'#$;"+2<$ ,+.&=".&*'$:2.5*< 45>+&0"(?(">2/$ 1&'#2/9/&'.+ Fig. 1: System framework As for detecting the motion status of tags, we propose a two-phase monitoring scheme, including the tag inventory and continuous polling phase, to efficiently extract the physicallayer features for detection. In the tag inventory phase, the reader issues multiple query cycles to extract the physical-layer features of all the tags in stationary status. In the continuous polling phase, the reader continuously issues multiple query cycles to extract physical-layer features of tags in real-time. By comparing the real-time features with the stationary features, we utilize a Graph Matching Method (GMM) to detect the motion status of tags in every query cycle of continuous polling phase. The continuous polling phase contains multiple real-time query cycles to amortize the time spent in the inventory phase. We show the whole framework in Fig. 1. IV. PHYSICAL-LAYER FEATURES In this section, we demonstrate the concept of our physicallayer features via realistic experiments. We implement a software defined reader (SDR reader) according to the Gen2 project [14]. Specifically, we operate the Gen2 project on our USRP platform with two FLEX-900 daughter boards and two Larid S9028 antennas on each board for transmitting and receiving respectively. For the receiving module, we set the sampling rate to 2MHz, which represents 0.5µs per sample. A. The Response of a Normal Singleton Slot Fig. 2 illustrates a typical slot in RFID systems, which is collected from USRP. The reader sends a QUERY/QRep command to start a slot. All the tags that select this slot, will transmit its RN16 to the reader. If the reader succeeds in decoding the RN16 bits, it then sends an ACK to the tag, that tells the tag to transmit its EPC-ID. During the tag response, the reader keeps transmitting continuous wave (CW) to supply power. Hence, there are two kinds of tag response generally: 1) RN16 period, responding the QUERY or QRep command from the reader, 2) EPC-ID period, answering the ACK command. In fact, both the RN16 signal and the EPC-ID signal contain preamble, data bits and check bits. As a result, the time of the EPC-ID period is about 4 times longer than that of the RN16 period as shown in Fig. 2. Meanwhile, since the time interval between the two responses is so small, the position and wireless environment can be regarded unchanged. So we can extract the physical-layer feature directly from the RN16 and omit the EPC-ID signal. !"#$% $&'( )*+ #,*-. /////////01234256 ///////7 ////'8 ////'7 )29:1;<=3 Fig. 2: A typical singleton slot in RFID systems B. Phase Profile In RFID systems, the tag transmits data using backscattering modulation. Hence, the received signal of one tag is: y(t)=(A1 +x(t)A2 · cos(2πflt+θ))· cos(2πfct+β) +n(t), (1) where A1 · cos(2πfct + β) is the signal of carrier, x(t)A2 · cos(2πflt + θ) · cos(2πfct + β) is the signal of tag and n(t) is the ambient noise. Here, x(t) is the binary bits sent by the tag. After converting the signal to baseband by the removing carrier cos(2πfct), the baseband signal can be represented as: s(t) = A1ejβ + x(t)A2ej(2πfl t+θ+β) + ˆn(t). (2) Therefore, the actual received signal is a superposition of carrier wave and backscattered signal. Intuitively, we can model the received signal from a single tag response in I-Q plane as shown in Fig. 3. The received signal consists of two parts: 1) leakage signal: the constant carrier signal (i.e., CW), 2) backscattered signal: the modulated tag signal. As for the phase value of the backscattered signal, it can be represented as: θ = Φ − β, (3) which is the difference between the carrier signal phase β and the backscattered signal phase Φ in Fig. 3. We call θ the phase profile of the tag in this work. ! " #$%&%'$( )*'+%, -%.&).%//$0$1( )*'+%, Fig. 3: Model of the received signal of a single tag We carry out trace-driven evaluations to study the property of the phase profile. Firstly, we evaluate the stability by conducting an empirical experiments on 50 tags with random deployments. For each setting, we measure 100 phase values by querying each tag 100 times. The results are normalized by subtracting the average phase value of each result set. As shown in Fig. 4(a), the phase profile varies from −5◦ to 5◦, following a typical Gaussian distribution. So we can treat the phase profile as a stable feature for motion detection. Secondly, we compare the phase profile of SDR reader with the phase value of commercial reader (Impinj R420) by issuing the same tag. We vary the distance between the antenna and the tag, which ranges from 20cm to 70cm stepping by 1cm. For
to 7690.This indicates that the signal length can be used to distinguish among tags.Furthermore,we draw the histogram of the normalized variance of signal length in Fig.6(b).The 0.2 signal length is relatively stable with an average deviation of 2 samples,which is equal to lus.Therefore,BLF is stable and 10 (a)The distinctive even though they are at different positions.But there the extracted (b)Comp arison of hase between phase profile commercial reader and SDR reader are also some tags with the same BLF value which means we need to combine it with other attributes. Fig.4:Evaluation of the distinctiveness of the phase profile 770 1500 each step we measure 100 phase values individually.As shown in Fig.4(b),the phase profile of SDR reader is almost the same as the phase value of commercial reader,where the correlation coefficients calculated on MATLAB is 0.9979.As shown in this figure,the phase profile is sensitive to any tiny movements, 20 e.g.,Icm movement,which guarantees the distinctiveness in (a) The distribution of the signal (b)Histogram of of sig- motion detection. length of different tags nal length C.Backscattered Link Frequency Fig.6:Evaluation of the distinctiveness of BLF Due to manufacturing imperfection,the backscatter link V.EXTRACT PHYSICAL-LAYER FEATURES frequency (BLF)of the response signal,i.e.,f in Eg.(1). In the previous section,we have demonstrated the physical- varies among different tags.Thus,it can be used to distinguish layer features in the singleton slots.We can collect the tags as in [16,18].In fact,f determines the length of a square physical-layer features in these singleton slots in the tag wave,i.e.,the duration of high/low voltage in Fig.5(a).In inventory phase.However,it is still time inefficiency because regard to the typical modulation schemes in RFID systems, we cannot avoid useless collisions in RFID system.If c tags i.e.,FMO and Miller Modulation.data-0 and data-1 share the same amount of square waves.Taking Miller-4 Modulation select the same slot to transmit the data,a c collision happens. When N tags select slots randomly from a frame with f slots as an example,both data-0 and data-1 contain eight square according to the Binomial distribution,the probability of a waves as shown in Fig.5(a).Since the length of RN16 signal c-collision slot can be expressed as: is fixed,it is reasonable to use the corresponding signal length of RN16 to represent BLF.The signal length of RN16 can be (4) also transmitted to the BLF based on the actual sampling rate. Pr(c)= Example of preamble 6T11 01101111 Ending of RN16 风 (a)The preamble and (b)Cross-correlation between measured sam- 0 44 ending of RN16 signal ples and theoretical preamble Number of tags in one slot Fig.5:Calculate the signal length through cross-correlation Fig.7:Theoretical probability of collision slots We use the cross-correlation technology to extract the signal Fig.7 shows the theoretical probability distribution of length by locating the starting and ending point of RN16 collision slot.The C1G2 standard improves the time efficiency by maximizing Pr(1),thus at most 36.8%slots are singleton signal.Specifically,we adopt a slide window to calculate In this case,2-collision and 3-collision slots occupy 18.4%and the cross-correlation value between the measured samples in the window and the special data sequence as shown in Fig. 6.13%slots respectively,while only 1.89%slots are remained 5(b).Then we find the window whose cross-correlation value in 4+-collisions.So if we can efficiently resolve all the tags in singleton,2-collision and 3-collision slots,we can identify is the maximum,and record the position of the window.In this example,we locate the starting point of RN16 based on 92%tags in a frame,which is 2.5 times compared with current the special preamble sequence.Similarly we can locate the protocol.Hence,we focus on how to extract physical-layer ending point using"dummy 1".We use the number of samples features from 2-collision and 3-collision slots between the starting and the ending point to represent BLF. A.Model of Collision Signal To validate the distinctiveness of BLF,we conduct experi- Based on Eq.(2),the received baseband signal of a c- ments on 50 different tags at 9 random positions in front of the collision slot can be expressed as: antennas.We repeat querying each tag 100 times to extract the signal lengths in different positions.As shown in Fig.6(a),the s(t)=Aei+;(t)hi+(t) (5) signal length of 50 tags are randomly distributed from 7620 =1
Phase variation(degree) -10 -5 0 5 10 CDF 0 0.2 0.4 0.6 0.8 1 (a) The variance of the extracted phase profile Transmitting distance(cm) 20 40 60 80 100 Phase value(degree) 0 100 200 300 400 Phase of SDR reader Phase of impinj reader (b) Comparison of phase between commercial reader and SDR reader Fig. 4: Evaluation of the distinctiveness of the phase profile each step we measure 100 phase values individually. As shown in Fig. 4(b), the phase profile of SDR reader is almost the same as the phase value of commercial reader, where the correlation coefficients calculated on MATLAB is 0.9979. As shown in this figure, the phase profile is sensitive to any tiny movements, e.g., 1cm movement, which guarantees the distinctiveness in motion detection. C. Backscattered Link Frequency Due to manufacturing imperfection, the backscatter link frequency (BLF) of the response signal, i.e., fl in Eq. (1), varies among different tags. Thus, it can be used to distinguish tags as in [16, 18]. In fact, fl determines the length of a square wave, i.e., the duration of high/low voltage in Fig. 5(a). In regard to the typical modulation schemes in RFID systems, i.e., FM0 and Miller Modulation, data-0 and data-1 share the same amount of square waves. Taking Miller-4 Modulation as an example, both data-0 and data-1 contain eight square waves as shown in Fig. 5(a). Since the length of RN16 signal is fixed, it is reasonable to use the corresponding signal length of RN16 to represent BLF. The signal length of RN16 can be also transmitted to the BLF based on the actual sampling rate. 1 0 dummy 1 dummy 1 0 1 0 1 1 1 Example of preamble Ending of RN16 (a) The preamble and ending of RN16 signal 1 0 1 1 1 Slide window Cross correlation (b) Cross-correlation between measured samples and theoretical preamble Fig. 5: Calculate the signal length through cross-correlation We use the cross-correlation technology to extract the signal length by locating the starting and ending point of RN16 signal. Specifically, we adopt a slide window to calculate the cross-correlation value between the measured samples in the window and the special data sequence as shown in Fig. 5(b). Then we find the window whose cross-correlation value is the maximum, and record the position of the window. In this example, we locate the starting point of RN16 based on the special preamble sequence. Similarly we can locate the ending point using “dummy 1”. We use the number of samples between the starting and the ending point to represent BLF. To validate the distinctiveness of BLF, we conduct experiments on 50 different tags at 9 random positions in front of the antennas. We repeat querying each tag 100 times to extract the signal lengths in different positions. As shown in Fig. 6(a), the signal length of 50 tags are randomly distributed from 7620 to 7690. This indicates that the signal length can be used to distinguish among tags. Furthermore, we draw the histogram of the normalized variance of signal length in Fig. 6(b). The signal length is relatively stable with an average deviation of 2 samples, which is equal to 1µs. Therefore, BLF is stable and distinctive even though they are at different positions. But there are also some tags with the same BLF value which means we need to combine it with other attributes. Tag counts 0 10 20 30 40 50 Signal length 7600 7620 7640 7660 7680 7700 (a) The distribution of the signal length of different tags Signal length deviation -10 -5 0 5 10 Counts 0 5000 10000 15000 (b) Histogram of the variance of signal length Fig. 6: Evaluation of the distinctiveness of BLF V. EXTRACT PHYSICAL-LAYER FEATURES In the previous section, we have demonstrated the physicallayer features in the singleton slots. We can collect the physical-layer features in these singleton slots in the tag inventory phase. However, it is still time inefficiency because we cannot avoid useless collisions in RFID system. If c tags select the same slot to transmit the data, a c collision happens. When N tags select slots randomly from a frame with f slots according to the Binomial distribution, the probability of a c-collision slot can be expressed as: P r(c) = Ç N c å Å 1 f ãc Å 1 − 1 f ãN−c . (4) Number of tags in one slot 0 1 2 3 4+ f/N 0 1 2 3 4 5 0 0.2 0.4 0.6 0.8 Fig. 7: Theoretical probability of collision slots Fig. 7 shows the theoretical probability distribution of collision slot. The C1G2 standard improves the time efficiency by maximizing P r(1), thus at most 36.8% slots are singleton. In this case, 2-collision and 3-collision slots occupy 18.4% and 6.13% slots respectively, while only 1.89% slots are remained in 4+-collisions. So if we can efficiently resolve all the tags in singleton, 2-collision and 3-collision slots, we can identify 92% tags in a frame, which is 2.5 times compared with current protocol. Hence, we focus on how to extract physical-layer features from 2-collision and 3-collision slots. A. Model of Collision Signal Based on Eq. (2), the received baseband signal of a ccollision slot can be expressed as: s(t) = Aejβ +!c i=1 xi(t)hi + ˆn(t). (5)
S2 I S 200 Tag BO Leakage signal 00 10001500 200 0 0 ample time (us) (a)Model of a 2-collision slot in (b)The preamble of a 2-collision sig- (c)Case I for 3-collision signal in (d)Case 2 for 3-collision signal I-Q plane I-Q plane in I-Q plane Fig.8:Model of collision signal Here,i(t)is the binary bits sent by tag i over time t.hi is are transmitting the same data during the preamble,signals the channel coefficient of tag i and can be written as: are switching between state So and Sa during the preamble hi Biei(2ft+0+B)) as shown in Fig.8(b).Therefore,we can determine the (6) state S3 using the preamble part.Hence,the remained two where B;is the amplitude and 0;is the phase profile of tag i. states are S and S2 respectively.At last,we calculate the Actually,hi represents a vector in I-Q plane,thus the collided channel coefficients of each tag as h=C(S1)-C(So)and signal can be represented as the superposition of the vectors. h2 =C(S2)-C(So),where C(Si)is Si in the I-Q plane. Taking a 2-collision as an example in Fig.8(a),since both 2)Channel Coefficients Estimation for 3-collision Slot: tag A and B send a binary bit,we can use four different states When the number of collided tags increases to three,the signal So~S3 in I-Q plane to represent the two binary bits.State So states can be represented with a three-bit binary.This means means both tag A and B are transmitting i(t)=0,therefore there are 8 states,which is much more complex,because we the signal contains only one component:the leakage signal. need to define 4 more states compared to 2-collision problem. State S3 means both tag A and B are transmitting xi(t)=1, Based on the combination of signal vectors in I-Q plane,the 8 therefore the signal is superposition of the three vectors.For states constitute a parallelepiped.Our basic idea is that since 3- state S1 and S2,only one tag is transmitting bit 1,therefore collision signal can be always represented as the superposition the signal is the combination of the leakage signal and the of 2-collision signal and one tag signal,we can find and backscattered signal of the corresponding tag. resolve a 2-collision problem inside the 3-collision problem and then handle the 3rd tag signal.For example,parallelogram B.Recover Signal States from Collision Slots SoS2SS4 and S1S3S7Ss in Fig.8(c)are the superposition of Based on the above model,the combination of the signal two tags and the vector pointing from one parallelogram to vectors constitute different states in I-Q plane,which repre- another represents the signal of the 3rd tag.By resolving one sents different binary bits sent by the collided tags.Hence, parallelogram,we can get the channel coefficients of two tags the key step to extract features from collision signal is to and further calculate the coefficients of the 3rd tag. resolve the signal states.Firstly,we need to find out which To find the parallelogram in the parallelepiped,we divide combination of binary bits each state represents.Secondly, the states into two parts according to their ranks of amplitude. we calculate the channel coefficient h;of each tag using the Due to the geometric feature,the four states with smaller positions of states.Lastly,for each sample s(t)we estimate amplitudes can either constitute a parallelogram as shown in the binary bits i(t)of tag i according to Eq.(5)as: Fig.8(c),or a plane tetrahedron as shown in Fig.8(d).For the parallelogram case,we have found the parallelogram such as arg min s(t)- (:(t).h)-Arel,where i(t)=0or 1. Fig.8(c).For the plane tetrahedron case,the edges among the four states inside the parallelepiped intersect at one state,e.g., (7) in Fig.8(d)three vectors intersect at S2.For this situation.we Eq.(7)chooses the combination of zi(t).such that the error can exchange one of the other three states with a symmetrical between the sample s(t)and the generated collided signal,i.e..state,e.g.,replacing S3 with S4 in Fig.8(d),to constitute a ∑=1(xi(t)-h:）is minimized. parallelogram.Then,we will find the parallelogram so as to 1)Channel Coefficients Estimation for 2-collision Slot: further extract the channel coefficients. According to the above analysis,a 2-collision slot contains The detailed steps for estimating the channel coefficients in four states,which is the size of two-bit binary.When we get 3-collision slot are as follows:Firstly,we cluster signals into the collision signals,we first acquire the positions of each state 8 clusters,similar as in the 2-collision problem.Secondly,we by clustering all the samples into clusters based on the sample determine state So and S7 from the preamble,because all the distribution in I-Q plane.Then we pick the peaks of density three tags transmit the same data and signal switches between function as the centers of clusters as in [13]. state So and S7.Here,So means all the three tags transmit After clustering,we will get four cluster centers,which xi(t)=0 and S7 means xi(t)=1. represent four states similar to Fig.8(a).As So only contains Thirdly,we search for the parallelogram in the paral- the leakage signal which can be estimated from the continuous lelepiped.We sort the eight states based on the amplitudes of wave,we can first determine the state So.Since both tags cluster centers.Based on the analysis above,then we search
I Q Leakage signal Tag A Tag B S0 S3 S1 S2 (a) Model of a 2-collision slot in I-Q plane Sample # 1000 2000 3000 4000 Magnitude 6000 6200 6400 Sample time (µs) 500 1000 1500 2000 Amplitude S0 S3 S0 S3 (b) The preamble of a 2-collision signal S1 S0 S2 S3 S4 S5 S6 S7 I Q O (c) Case 1 for 3-collision signal in I-Q plane S1 S0 S2 S3 S4 S5 S6 S7 I Q O (d) Case 2 for 3-collision signal in I-Q plane Fig. 8: Model of collision signal Here, xi(t) is the binary bits sent by tag i over time t. hi is the channel coefficient of tag i and can be written as: hi = Biej(2πfl t+θi+β)), (6) where Bi is the amplitude and θi is the phase profile of tag i. Actually, hi represents a vector in I-Q plane, thus the collided signal can be represented as the superposition of the vectors. Taking a 2-collision as an example in Fig. 8(a), since both tag A and B send a binary bit, we can use four different states S0 ∼ S3 in I-Q plane to represent the two binary bits. State S0 means both tag A and B are transmitting xi(t)=0, therefore the signal contains only one component: the leakage signal. State S3 means both tag A and B are transmitting xi(t)=1, therefore the signal is superposition of the three vectors. For state S1 and S2, only one tag is transmitting bit 1, therefore the signal is the combination of the leakage signal and the backscattered signal of the corresponding tag. B. Recover Signal States from Collision Slots Based on the above model, the combination of the signal vectors constitute different states in I-Q plane, which represents different binary bits sent by the collided tags. Hence, the key step to extract features from collision signal is to resolve the signal states. Firstly, we need to find out which combination of binary bits each state represents. Secondly, we calculate the channel coefficient hi of each tag using the positions of states. Lastly, for each sample s(t) we estimate the binary bits xi(t) of tag i according to Eq. (5) as: arg minx |s(t) −!c i=1 (xi(t) · hi) − A1ejβ|, where xi(t)=0 or 1. (7) Eq. (7) chooses the combination of xi(t), such that the error between the sample " s(t) and the generated collided signal, i.e., c i=1(xi(t) · hi) is minimized. 1) Channel Coefficients Estimation for 2-collision Slot: According to the above analysis, a 2-collision slot contains four states, which is the size of two-bit binary. When we get the collision signals, we first acquire the positions of each state by clustering all the samples into clusters based on the sample distribution in I-Q plane. Then we pick the peaks of density function as the centers of clusters as in [13]. After clustering, we will get four cluster centers, which represent four states similar to Fig. 8(a). As S0 only contains the leakage signal which can be estimated from the continuous wave, we can first determine the state S0. Since both tags are transmitting the same data during the preamble, signals are switching between state S0 and S3 during the preamble as shown in Fig. 8(b). Therefore, we can determine the state S3 using the preamble part. Hence, the remained two states are S1 and S2 respectively. At last, we calculate the channel coefficients of each tag as h1 = C(S1) − C(S0) and h2 = C(S2) − C(S0), where C(Si) is Si in the I-Q plane. 2) Channel Coefficients Estimation for 3-collision Slot: When the number of collided tags increases to three, the signal states can be represented with a three-bit binary. This means there are 8 states, which is much more complex, because we need to define 4 more states compared to 2-collision problem. Based on the combination of signal vectors in I-Q plane, the 8 states constitute a parallelepiped. Our basic idea is that since 3- collision signal can be always represented as the superposition of 2-collision signal and one tag signal, we can find and resolve a 2-collision problem inside the 3-collision problem and then handle the 3rd tag signal. For example, parallelogram S0S2S6S4 and S1S3S7S5 in Fig. 8(c) are the superposition of two tags and the vector pointing from one parallelogram to another represents the signal of the 3rd tag. By resolving one parallelogram, we can get the channel coefficients of two tags and further calculate the coefficients of the 3rd tag. To find the parallelogram in the parallelepiped, we divide the states into two parts according to their ranks of amplitude. Due to the geometric feature, the four states with smaller amplitudes can either constitute a parallelogram as shown in Fig. 8(c), or a plane tetrahedron as shown in Fig. 8(d). For the parallelogram case, we have found the parallelogram such as Fig. 8(c). For the plane tetrahedron case, the edges among the four states inside the parallelepiped intersect at one state, e.g., in Fig. 8(d) three vectors intersect at S2. For this situation, we can exchange one of the other three states with a symmetrical state, e.g., replacing S3 with S4 in Fig. 8(d), to constitute a parallelogram. Then, we will find the parallelogram so as to further extract the channel coefficients. The detailed steps for estimating the channel coefficients in 3-collision slot are as follows: Firstly, we cluster signals into 8 clusters, similar as in the 2-collision problem. Secondly, we determine state S0 and S7 from the preamble, because all the three tags transmit the same data and signal switches between state S0 and S7. Here, S0 means all the three tags transmit xi(t)=0 and S7 means xi(t)=1. Thirdly, we search for the parallelogram in the parallelepiped. We sort the eight states based on the amplitudes of cluster centers. Based on the analysis above, then we search