Activating Wireless Voice for E-Toll Collection Systems with Zero Start-up Cost Zhenlin An*,Qiongzheng Lin*,Lei Yang*and Lei Xiet *Department of Computing,The Hong Kong Polytechnic University,Hong Kong fState Key Laboratory for Novel Software Technology,Nanjing University,China Email:*fan,lin,young}@tagsys.org,TIxie@nju.edu.cn Abstract-This work enhances the machine-to-human commu- nication between electronic toll collection (ETC)systems and drivers by providing an AM broadcast service to deployed ETC systems.This study is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver.Such a phenomenon allows the development of a previously infeasible cross-technology and cross-frequency communication,called Tagcaster,which converts an ETC reader to an AM station for broadcasting short messages (e.g.,charged- fees and traffic forecast)to drivers at tollbooths.The key innovation in this work is the engineering of Tagcaster over 2Rp》 ④isening off-the-shelf ETC systems using shadow carrier and baseband Fig.1:Tagcaster-enhanced wireless voice service for ETC system. whitening without the need for hardware nor firmware changes This feature allows zero-cost rapid deployment in existing ETC 1 The ETC reader queries the transponder attached on the vehicle.2 infrastructure.Two prototypes of Tagcaster are designed,imple- The transponder is identified through its reply.Tagcaster broadcasts mented and evaluated over four general and five vehicle-mounted the wireless voice to the identified vehicle.The driver can listen AM receivers (e.g.,Toyota,Audi,and Jetta).Experiments reveal to the AM radio through the vehicle-mounted radio receiver. that Tagcaster can provide good-quality (PESQ>2)and stable AM broadcasting service with a 30 m coverage range.Tagcaster credit balance,real-time traffic and road condition).Achiev- remarkably improves user experience at ETC stations and two- ing direct machine-to-human (M2H)communication between thirds volunteer drivers rate it with a score of 4+out of 5. drivers and ETC systems requires extra peripherals and efforts. For example,drivers must slow down their cars to view an I.INTRODUCTION LED screen installed at the tollbooth for charge details.The Electronic toll collection(ETC)is a system enabling elec- information acquired by drivers is usually quite limited due to tronic collection of toll payments,thus allowing for near- the small screen size.Slowing down also worsens the conges- nonstop toll collection and traffic monitoring.ETC (e.g., tion during rush hours.Facing this practical issue,we ask "Is Z-Pass and I-PASS)has become the most successful and there any convenient and user-friendly M2H communication widespread application of Radio Frequency IDentification way to provide informative interaction fast?" (RFID).Approximately,70%to 89%of cars are equipped with In this study.we introduce a novel ETC service,called ETC transponders (or tags)in the US.In particular,over 80% Tagcaster,which supplements the function of an AM radio of Illinois'1.4 million daily drivers currently use I-PASS [11. to the existing ETC infrastructure with zero start-up cost. ETC can eliminate delay on toll roads,HOV lanes,and toll Tagcaster can activate a deployed ETC tollbooth to provide the bridge by collecting tolls without requiring cars to stop.Owing wireless voice service for direct M2H communication.Fig.I to this wide adoption,the industry and academia are looking illustrates our service scenario.When a driver passes through a into delivering new services via the currently deployed ETC tollbooth,the ETC reader automatically identifies the vehicle's infrastructure.Examples include paying for food at drive- ID and retrieves its related data from backend servers.Then, through restaurants or parking lots with an e-toll transponder, the reader broadcasts the data in the form of an AM radio.The tracking the number of cars at every road intersection for traffic driver can listen to the broadcast using the vehicle-mounted control,and detecting and ticketing over-speeding cars without radio receiver or smart-phone inside. the need for car-mounted radars and hidden police officers. "Wireless voice"is more user-friendly and spontaneous ETC offers an opportunity for using ETC systems to enable than current interactive medias(e.g.,LED screens or external smart cities in the future [2]. speakers).It provides a new means to deal with the issue As a typical technology of the Internet of Things,ETC of poor visibility in bad weather conditions,such as stormy, systems are designed for machine-to-machine communication foggy or smoggy,when viewing feedback from ETC screens only (e.g.,identifying cars or monitoring traffic).Drivers is difficult for drivers.Such functionality is also useful in cannot directly obtain related information (e.g.,charge amount, a wide range of application scenarios.Apart from charging
Activating Wireless Voice for E-Toll Collection Systems with Zero Start-up Cost Zhenlin An∗ , Qiongzheng Lin∗ , Lei Yang∗ and Lei Xie† ∗Department of Computing,The Hong Kong Polytechnic University, Hong Kong †State Key Laboratory for Novel Software Technology, Nanjing University, China Email: ∗{an, lin, young}@tagsys.org, † lxie@nju.edu.cn Abstract—This work enhances the machine-to-human communication between electronic toll collection (ETC) systems and drivers by providing an AM broadcast service to deployed ETC systems. This study is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver. Such a phenomenon allows the development of a previously infeasible cross-technology and cross-frequency communication, called Tagcaster, which converts an ETC reader to an AM station for broadcasting short messages (e.g., chargedfees and traffic forecast) to drivers at tollbooths. The key innovation in this work is the engineering of Tagcaster over off-the-shelf ETC systems using shadow carrier and baseband whitening without the need for hardware nor firmware changes. This feature allows zero-cost rapid deployment in existing ETC infrastructure. Two prototypes of Tagcaster are designed, implemented and evaluated over four general and five vehicle-mounted AM receivers (e.g., Toyota, Audi, and Jetta). Experiments reveal that Tagcaster can provide good-quality (PESQ> 2) and stable AM broadcasting service with a 30 m coverage range. Tagcaster remarkably improves user experience at ETC stations and twothirds volunteer drivers rate it with a score of 4+ out of 5. I. INTRODUCTION Electronic toll collection (ETC) is a system enabling electronic collection of toll payments, thus allowing for nearnonstop toll collection and traffic monitoring. ETC (e.g., Z-Pass and I-PASS) has become the most successful and widespread application of Radio Frequency IDentification (RFID). Approximately, 70% to 89% of cars are equipped with ETC transponders (or tags) in the US. In particular, over 80% of Illinois’ 1.4 million daily drivers currently use I-PASS [1]. ETC can eliminate delay on toll roads, HOV lanes, and toll bridge by collecting tolls without requiring cars to stop. Owing to this wide adoption, the industry and academia are looking into delivering new services via the currently deployed ETC infrastructure. Examples include paying for food at drivethrough restaurants or parking lots with an e-toll transponder, tracking the number of cars at every road intersection for traffic control, and detecting and ticketing over-speeding cars without the need for car-mounted radars and hidden police officers. ETC offers an opportunity for using ETC systems to enable smart cities in the future [2]. As a typical technology of the Internet of Things, ETC systems are designed for machine-to-machine communication only (e.g., identifying cars or monitoring traffic). Drivers cannot directly obtain related information (e.g., charge amount, !"#$%&$'()*+,-./( 1 3 2 ETC READER ETC READER Vehicle-mounted AM Radio Good morning, sir. Charging fee is 5$. Notice the road ahead is under maintenance. Have a nice day! 4 Reply 1 Query Broadcasting 2 3 4 Listening Fig. 1: Tagcaster-enhanced wireless voice service for ETC system. ❶ The ETC reader queries the transponder attached on the vehicle. ❷ The transponder is identified through its reply. ❸ Tagcaster broadcasts the wireless voice to the identified vehicle. ❹ The driver can listen to the AM radio through the vehicle-mounted radio receiver. credit balance, real-time traffic and road condition). Achieving direct machine-to-human (M2H) communication between drivers and ETC systems requires extra peripherals and efforts. For example, drivers must slow down their cars to view an LED screen installed at the tollbooth for charge details. The information acquired by drivers is usually quite limited due to the small screen size. Slowing down also worsens the congestion during rush hours. Facing this practical issue, we ask “Is there any convenient and user-friendly M2H communication way to provide informative interaction fast?” In this study, we introduce a novel ETC service, called Tagcaster, which supplements the function of an AM radio to the existing ETC infrastructure with zero start-up cost. Tagcaster can activate a deployed ETC tollbooth to provide the wireless voice service for direct M2H communication. Fig. 1 illustrates our service scenario. When a driver passes through a tollbooth, the ETC reader automatically identifies the vehicle’s ID and retrieves its related data from backend servers. Then, the reader broadcasts the data in the form of an AM radio. The driver can listen to the broadcast using the vehicle-mounted radio receiver or smart-phone inside. “Wireless voice” is more user-friendly and spontaneous than current interactive medias (e.g., LED screens or external speakers). It provides a new means to deal with the issue of poor visibility in bad weather conditions, such as stormy, foggy or smoggy, when viewing feedback from ETC screens is difficult for drivers. Such functionality is also useful in a wide range of application scenarios. Apart from charging
information,Tagcaster can also broadcast greetings,real-time (i.e.,OOK).On the contrary,AM stations and receivers are traffic conditions,account balance,and advertisements.More- analog systems in which the quantized analog audio data are over,drivers do not need to slow down to acquire information represented using multiple level voltages.Therefore,analog from an ETC system as they are pushed actively.Additional radio receivers cannot decode the digital binary signals trans- scenarios that motivate our design and the reason why not mitted from the reader.To deal with this issue,Tagcaster lever- choose other technologies are displayed in section II ages the controllability of RF power to adjust the transmitting The fundamental challenge in Tagcaster is in the seemingly power dynamically for the required amplitude modulation. impossible cross-technology communication between ETC Specifically,Tagcaster initially quantizes the analog audio data RFID and AM radio due to the large frequency gap.ETC RFID into four-bit discrete values.then manipulates the transmitting systems operate at ultra-high frequency (UHF)(e.g..800-900 power among 16 levels correspondingly.In such a way,the MHz),whereas an AM radio works at radio frequency (e.g., audio data can be carried onto the desired frequencies. 500-1700 kHz).A real AM station is usually equipped with a We implement two prototypes of Tagcaster using an R2000 60 m long antenna because the length of transmitting antenna chip from ImpinJ [3]and USRP N210 respectively.Nine off- must be close to half of the carrier wavelength.Clearly,a 16 the-shelf radio receivers including five vehicle-mounted and cm long directional antenna for ETC reader fails to propagate five general-purpose radio receivers are tested.Our results AM radio signals into the air.Our insight is that non-linearity demonstrate that Tagcaster can fully provide AM radio service effect in the circuits of radio receivers can receive and pull and enhance the ETC user experience on these devices.The the UHF signal down to the low-frequency band if the signals perceptual evaluation of speech quality(PESQ)of the received are transmitted via two UHF carriers.Specifically,on the voice is around 2,which is equal to that of the current transmitter side,the RFID reader broadcasts two signals at telephone communication system.The coverage range is 30 f1 and f2 (e.g.,f1 =820.5 MHz and f2 =820 MHz) m with two-way antennas.Demo audios are uploaded in [4]. simultaneously.Given that both signals are at UHF,they can Contributions:This work presents Tagcaster,the first be propagated successfully by the existing UHF antenna.On system utilizing the non-linearization phenomenon in radio the radio receiver side,a new signal is created at |fi-f2 (e.g., receivers to provide high-quality radio service for ETC readers. 500 kHz)due to the nonlinearity effect of the pre-amplifier at The design of Tagcaster provides three key contributions. the radio receiver.The process is equivalent to performing an First,it proves the engineering possibility of down-converting additional downconversion called the zeroth downconversion communication with hardware non-linearity.Second,it intro- before the radio signal is further downconverted and decoded duces a new amplitude modulation scheme by controlling RF to an audio signal.Unlike traditional wisdom that regards non- power.Finally,Tagcaster presents a practical prototype and a linearity as detrimental,we use it as a natural downconverter. comprehensive evaluation. Engineering a Tagcaster must address two practical issues that stem from the pursuit of zero start-up cost(i.e.,without II.BACKGROUND AND MOTIVATION requiring modification in the hardware of the ETC system). In this section,we introduce system background,typical How to generate two carriers?The zeroth downconver- application scenarios and potential alternative solutions. sion requires two signals from an ETC reader to operate at fe A.System Background and Scope and fe+fr so that their difference of fe+fr-fel is exactly equal to the fr that the radio receiver can process.Here,fe ETC systems are a combination of techniques and tech- and fr are operating frequencies of the ETC reader and the nologies that allow vehicles to pass through a toll facility AM radio,respectively.Therefore,we must enable the ETC without requiring any action from drivers.The core of ETC reader to modulate signals at two carriers (fe and fe+f). is a typical RFID system where an active or passive e-toll Although total 52 frequency channels are available for an transponder(RFID tag)responds to a query command trans- RFID reader,only a single channel can be used at any moment mitted by the reader.The readers are installed in tollbooths, for the reading.Our transparent design views the reader as whereas transponders are attached to vehicle's windshields. a "black box",whose input is limited to predefined reader ETC systems are typical closed-loop systems that only work commands.Finally,Tagcaster whitens the baseband to a square within particular regions.Therefore,no agreement on the ETC signal by inputting a long sequence of RFID commands. standard has been achieved so far.For example,dozens of ETC Given that the reader uses pulse interval encoding (PIE) networks exist in the US [5]and these include E-ZPass,I-Pass, for modulation.multiple harmonics can be observed on the SunPass,TxTAG and Fastrack.Even so,these ETC networks receiving side.Inspired by this physical-layer characteristic, have three common factors as follows: we set the parameter of length of bit tactically to "frame" Readers work at the UHF band (i.e.,860-960 MHz)to the first-order (i.e.,fundamental)and fifth-order harmonics to achieve good penetration because transponders are located appear at frequencies of fe and fe+fr,respectively. inside vehicles.For example,E-ZPass works at 915MHz. How to modulate audio signals?An ETC reader is a.The simplicity of the transponders results in a cheap typical digital communication system whose baseband signal and low-power device.The forward link from readers to contains two different level voltages (i.e.,high and low)only. transponders uses PIE-like encoding to facilitate the decod- The envelop of its modulated signals changes at two levels ing at powerless transponders
information, Tagcaster can also broadcast greetings, real-time traffic conditions, account balance, and advertisements. Moreover, drivers do not need to slow down to acquire information from an ETC system as they are pushed actively. Additional scenarios that motivate our design and the reason why not choose other technologies are displayed in section II. The fundamental challenge in Tagcaster is in the seemingly impossible cross-technology communication between ETC RFID and AM radio due to the large frequency gap. ETC RFID systems operate at ultra-high frequency (UHF)(e.g., 800-900 MHz), whereas an AM radio works at radio frequency (e.g., 500-1700 kHz). A real AM station is usually equipped with a 60 m long antenna because the length of transmitting antenna must be close to half of the carrier wavelength. Clearly, a 16 cm long directional antenna for ETC reader fails to propagate AM radio signals into the air. Our insight is that non-linearity effect in the circuits of radio receivers can receive and pull the UHF signal down to the low-frequency band if the signals are transmitted via two UHF carriers. Specifically, on the transmitter side, the RFID reader broadcasts two signals at f1 and f2 (e.g., f1 = 820.5 MHz and f2 = 820 MHz) simultaneously. Given that both signals are at UHF, they can be propagated successfully by the existing UHF antenna. On the radio receiver side, a new signal is created at |f1−f2| (e.g., 500 kHz) due to the nonlinearity effect of the pre-amplifier at the radio receiver. The process is equivalent to performing an additional downconversion called the zeroth downconversion before the radio signal is further downconverted and decoded to an audio signal. Unlike traditional wisdom that regards nonlinearity as detrimental, we use it as a natural downconverter. Engineering a Tagcaster must address two practical issues that stem from the pursuit of zero start-up cost (i.e., without requiring modification in the hardware of the ETC system). • How to generate two carriers? The zeroth downconversion requires two signals from an ETC reader to operate at fe and fe +fr so that their difference of |!fe +fr −!fe| is exactly equal to the fr that the radio receiver can process. Here, fe and fr are operating frequencies of the ETC reader and the AM radio, respectively. Therefore, we must enable the ETC reader to modulate signals at two carriers (fe and fe + fr). Although total 52 frequency channels are available for an RFID reader, only a single channel can be used at any moment for the reading. Our transparent design views the reader as a “black box”, whose input is limited to predefined reader commands. Finally, Tagcaster whitens the baseband to a square signal by inputting a long sequence of RFID commands. Given that the reader uses pulse interval encoding (PIE) for modulation, multiple harmonics can be observed on the receiving side. Inspired by this physical-layer characteristic, we set the parameter of length of bit tactically to “frame” the first-order (i.e., fundamental) and fifth-order harmonics to appear at frequencies of fe and fe + fr, respectively. • How to modulate audio signals? An ETC reader is a typical digital communication system whose baseband signal contains two different level voltages (i.e., high and low) only. The envelop of its modulated signals changes at two levels (i.e., OOK). On the contrary, AM stations and receivers are analog systems in which the quantized analog audio data are represented using multiple level voltages. Therefore, analog radio receivers cannot decode the digital binary signals transmitted from the reader. To deal with this issue, Tagcaster leverages the controllability of RF power to adjust the transmitting power dynamically for the required amplitude modulation. Specifically, Tagcaster initially quantizes the analog audio data into four-bit discrete values, then manipulates the transmitting power among 16 levels correspondingly. In such a way, the audio data can be carried onto the desired frequencies. We implement two prototypes of Tagcaster using an R2000 chip from ImpinJ [3] and USRP N210 respectively. Nine offthe-shelf radio receivers including five vehicle-mounted and five general-purpose radio receivers are tested. Our results demonstrate that Tagcaster can fully provide AM radio service and enhance the ETC user experience on these devices. The perceptual evaluation of speech quality (PESQ) of the received voice is around 2, which is equal to that of the current telephone communication system. The coverage range is 30 m with two-way antennas. Demo audios are uploaded in [4]. Contributions: This work presents Tagcaster, the first system utilizing the non-linearization phenomenon in radio receivers to provide high-quality radio service for ETC readers. The design of Tagcaster provides three key contributions. First, it proves the engineering possibility of down-converting communication with hardware non-linearity. Second, it introduces a new amplitude modulation scheme by controlling RF power. Finally, Tagcaster presents a practical prototype and a comprehensive evaluation. II. BACKGROUND AND MOTIVATION In this section, we introduce system background, typical application scenarios and potential alternative solutions. A. System Background and Scope ETC systems are a combination of techniques and technologies that allow vehicles to pass through a toll facility without requiring any action from drivers. The core of ETC is a typical RFID system where an active or passive e-toll transponder (RFID tag) responds to a query command transmitted by the reader. The readers are installed in tollbooths, whereas transponders are attached to vehicle’s windshields. ETC systems are typical closed-loop systems that only work within particular regions. Therefore, no agreement on the ETC standard has been achieved so far. For example, dozens of ETC networks exist in the US [5] and these include E-ZPass, I-Pass, SunPass, TxTAG and Fastrack. Even so, these ETC networks have three common factors as follows: • Readers work at the UHF band (i.e., 860-960 MHz) to achieve good penetration because transponders are located inside vehicles. For example, E-ZPass works at 915MHz. • The simplicity of the transponders results in a cheap and low-power device. The forward link from readers to transponders uses PIE-like encoding to facilitate the decoding at powerless transponders
Readers maintain continuous wave (CW)to supply energy to passive transponders or to awaken active transponders. In view of diversity,our design concentrates on two main- stream standards,namely ISO18000-6 and EPCglobal Gen2 Deteeto which have been widely adopted in the world.ISO18000- Antenn 6 defines one model (i.e.,Interrogator-Talks-First)with four utomatie Gain Control ist dow AM/FM types:A.B.C,and D.EPCglobal Gen2 is considered the de Radio Reciver facto standard instance of ISO18000-6 at 860-960 MHz for Fig.2:Internal structure of an AM Radio receiver.Input radio types B and C.We use type C as an example to introduce signals are processed through three downconversions where the zeroth our design and implementation.Nevertheless,extending the downconversion is explicitly performed by the amplifier. design to other types is similar. B.Application Scenarios A.Exploiting the Nonlinearity Effect Tagcaster enables a spontaneous setup of a radio broadcast service for vehicle-mounted radio receivers.Such a service is Primer on AM Radio.All AM radio systems work from useful in a wide range of application scenarios.We provide 520 to 1700 kHz without a license from FCC.Radio receivers a few examples.(1)Charging notification.This scenario is a usually adopt the superheterodyne design,as displayed in fundamental service of ETC systems for drivers,who should Fig.2.The RF signal (fr)is amplified by the pre-amplifier be precisely informed of how they are charged when passing to improve the signal-to-noise ratio (SNR).Then,the amplified through an ETC tollbooth.The traditional means is to watch RF signal enters a superheterodyne mixer along with the an LED indicator installed at the tollbooth.With Tagcaster, output of the local oscillator,which is tuned to a frequency drivers are informed by listening to the radio.(2)Overspeed (fr)that is higher or lower than the intended reception warning.An increasing number of states or regions have frequency.As a result,the mixer output includes two signals, begun adopting an average speed (i.e.,total distance traveled that operate at fr+fr and fr-fr.The sum signal at fr+fr divided by the time interval)for overspeeding surveillance. is immediately filtered out by the following IF filter.This ETC systems deployed at adjacent critical junctions can now difference can always be at a fixed value of the frequency warn drivers of potential violences of local traffic regulations. offset and is called the intermediate frequency (IF).This (3)Road traffic broadcast.Drivers can listen to special traffic stage is called the first downconversion or superheterodyning. news and the latest traffic conditions around the ETC station. Superheterodyning exhibits good performance because radio components can be optimized to work at a single intermediate C.Comparison against Alternatives frequency.The desired baseband signal is then extracted by the Why not install an AM station at the tollbooth?ETC detector (e.g.,an envelope detector of Foster-Seeley discrimi- service is private for each driver but AM station is designed nator),which performs the second downconversion by tuning for large-scale public radio service.The radio signal can be the center frequency to the expected.The downconverted audio received kilometres away.Installing an AM station to each are transmitted to the speaker. tollbooth for ETC broadcasting will leak user's privacy and Nonlinearity Effect.In RF system,circuits are designed to disturb the surrounding radio.Instead,RFID is a short-range work linearly.If an RF amplifier receives an input signal S. communication and many existing RFID systems with beam- then output signal,denoted by Sout,is given as forming technology [6]-[8]or directional antenna can provide desired directional communication.Therefore,an RFID sys- Sout =AS (1) tem can only cover the desired area (ETC lane)so that to where A is the amplification factor.The amplifier is supposed protect user's privacy..Why not use Bluetooth or Wi-Fi?Cars to scale the signal magnitude and introduce a constant phase equipped with Bluetooth chip have their Bluetooth antennas distortion.Unfortunately,the non-linearity effect of the ampli- inside to communicate with smart devices or wearables [9].An fier can generate many harmonics.Consequently,the practical antenna inside a car can be shielded from signals from an ETC output signal is given by: station by the car's metal body.By contrast,radio antennas are already outside the car where FM or AM signals are the Linear Nonlinear strongest.Finally,we stress that the primary merit of Tagcaster Sout=】 AkS*=A1S+A282+A3S3+.. (2) 1 is that it does not require the firmware or physical layer of ETC transceivers to be modified.Therefore,Tagcaster can where A are the gains of the various harmonics introduced by fully co-exist with the given alternatives for complementarity the circuit.These components are called fundamental,second- even when they are already deployed in several stations. order,third-order and so on.The third-order and higher-order harmonics attenuate fast and become undetectable.Therefore, III.TAGCASTER DESIGN our focus is on the first-and second-order terms only.If the In this section,we first exploit the nonlinearity effect and input signal S is a superimposition of two sine waves with zeroth downconversion in radio receivers and describe how different frequencies fi and f2,that is,S(t)=sin(2fit)+ Tagcaster can utilize the zeroth downconversion for its design. sin(2f2t),where t is time,then the equation can be expanded
• Readers maintain continuous wave (CW) to supply energy to passive transponders or to awaken active transponders. In view of diversity, our design concentrates on two mainstream standards, namely ISO18000-6 and EPCglobal Gen2, which have been widely adopted in the world. ISO18000- 6 defines one model (i.e., Interrogator-Talks-First) with four types: A, B, C, and D. EPCglobal Gen2 is considered the de facto standard instance of ISO18000-6 at 860-960 MHz for types B and C. We use type C as an example to introduce our design and implementation. Nevertheless, extending the design to other types is similar. B. Application Scenarios Tagcaster enables a spontaneous setup of a radio broadcast service for vehicle-mounted radio receivers. Such a service is useful in a wide range of application scenarios. We provide a few examples. (1) Charging notification. This scenario is a fundamental service of ETC systems for drivers, who should be precisely informed of how they are charged when passing through an ETC tollbooth. The traditional means is to watch an LED indicator installed at the tollbooth. With Tagcaster, drivers are informed by listening to the radio. (2) Overspeed warning. An increasing number of states or regions have begun adopting an average speed (i.e., total distance traveled divided by the time interval) for overspeeding surveillance. ETC systems deployed at adjacent critical junctions can now warn drivers of potential violences of local traffic regulations. (3) Road traffic broadcast. Drivers can listen to special traffic news and the latest traffic conditions around the ETC station. C. Comparison against Alternatives • Why not install an AM station at the tollbooth? ETC service is private for each driver but AM station is designed for large-scale public radio service. The radio signal can be received kilometres away. Installing an AM station to each tollbooth for ETC broadcasting will leak user’s privacy and disturb the surrounding radio. Instead, RFID is a short-range communication and many existing RFID systems with beamforming technology [6]–[8] or directional antenna can provide desired directional communication. Therefore, an RFID system can only cover the desired area (ETC lane) so that to protect user’s privacy. • Why not use Bluetooth or Wi-Fi? Cars equipped with Bluetooth chip have their Bluetooth antennas inside to communicate with smart devices or wearables [9]. An antenna inside a car can be shielded from signals from an ETC station by the car’s metal body. By contrast, radio antennas are already outside the car where FM or AM signals are the strongest. Finally, we stress that the primary merit of Tagcaster is that it does not require the firmware or physical layer of ETC transceivers to be modified. Therefore, Tagcaster can fully co-exist with the given alternatives for complementarity even when they are already deployed in several stations. III. TAGCASTER DESIGN In this section, we first exploit the nonlinearity effect and zeroth downconversion in radio receivers and describe how Tagcaster can utilize the zeroth downconversion for its design. PreAMP Mixer Local Oscillator IF AMP IF Filter AM/FM Detector AM/FM Radio Reciver Antenna Automatic Gain Control 1st downconversion 2nd downconversion 0th downconversion Fig. 2: Internal structure of an AM Radio receiver. Input radio signals are processed through three downconversions where the zeroth downconversion is explicitly performed by the amplifier. A. Exploiting the Nonlinearity Effect Primer on AM Radio. All AM radio systems work from 520 to 1700 kHz without a license from FCC. Radio receivers usually adopt the superheterodyne design, as displayed in Fig. 2. The RF signal (@ fr) is amplified by the pre-amplifier to improve the signal-to-noise ratio (SNR). Then, the amplified RF signal enters a superheterodyne mixer along with the output of the local oscillator, which is tuned to a frequency (@ f ′ r ) that is higher or lower than the intended reception frequency. As a result, the mixer output includes two signals, that operate at fr + f ′ r and fr − f ′ r . The sum signal at fr + f ′ r is immediately filtered out by the following IF filter. This difference can always be at a fixed value of the frequency offset and is called the intermediate frequency (IF). This stage is called the first downconversion or superheterodyning. Superheterodyning exhibits good performance because radio components can be optimized to work at a single intermediate frequency. The desired baseband signal is then extracted by the detector (e.g., an envelope detector of Foster-Seeley discriminator), which performs the second downconversion by tuning the center frequency to the expected. The downconverted audio are transmitted to the speaker. Nonlinearity Effect. In RF system, circuits are designed to work linearly. If an RF amplifier receives an input signal S, then output signal, denoted by Sout, is given as Sout = AS (1) where A is the amplification factor. The amplifier is supposed to scale the signal magnitude and introduce a constant phase distortion. Unfortunately, the non-linearity effect of the ampli- fier can generate many harmonics. Consequently, the practical output signal is given by: Sout = X∞ k=1 AkS k = Linear z }| { A1S + Nonlinear z }| { A2S 2 + A3S 3 + · · · (2) where Ak are the gains of the various harmonics introduced by the circuit. These components are called fundamental, secondorder, third-order and so on. The third-order and higher-order harmonics attenuate fast and become undetectable. Therefore, our focus is on the first- and second-order terms only. If the input signal S is a superimposition of two sine waves with different frequencies f1 and f2, that is, S(t) = sin(2πf1t) + sin(2πf2t), where t is time, then the equation can be expanded
nd d Fig.3:Illustration of Tagcaster design.At the reader side,the audio data are modulated onto two carriers:the real reader carrier at f and the shadow carrier at fe+fr.After receiving the RF signal,the receiver pulls down the signal by the zeroth,the first,and the second downconversion in turn.The zeroth downconversion is conducted due to the nonlinearity of the pre-amplifier. using a trigonometric formula as follows: fe+fr the shadow carrier.The left part of Fig.3 illustrates Sou =S(t)+S2(t) an example where fr =550 kHz and fe 920 MHz.The audio data are modulated onto the 920 MHz original carrier =sin(2 fit)+sin(2 f2t)+(sin(2f1t)+sin(2 f2t))2 (3) and 920.55 MHz shadow carrier.Formally,v(t)denotes the =sin(2mfh)+sin(2mf20+（《2-cos(2m2fht0- audio signal,which is a low-frequency signal below 20 kHz. cos(2π2f2t)-cos(2π(f1+f2)t)+cos(2r(f万-f2)t)) Then,the output upconverted RF signal from the reader is Four new frequencies (i.e.,2f1,2f2,f1+f2 and f1-f2) given as are created after the first-stage magnification.Translating into S+(t)=v(t)(cos(2πfet)+cos(2π(fe+fr)t) (5) actual numbers,when f =920 MHz and f2 =920.7 MHz,the amplified signals appear at 920 MHz,920.7 MHz, One might wonder why a single-tone signal is not generated at 2×920=1840.7MHz,2×920.7=1841.4MHz, the shadow carrier for the downconversion only.The hardware 920+920.7=1840.7MHz,and(920.7-920)MHz=700 limits the current commercial ETC reader to work at a single kHz.The first five frequencies are filtered out by the IF filter. channel for each reading.Further details are discussed in V. However,700 kHz remains.The net effect is that the UHF Downconversion at the receiver.After receiving the mixed signal appears at a low frequency of 700 kHz,which radio signal transmitted from the ETC reader,the pre-amplifier in receivers can process.The nonlinearity effect was considered a the radio receiver automatically performs the zeroth downcon- type of "pollution"in previous work.Nevertheless,we explore version.Substituting the given signal into Eqn.4,a new signal this underlying physical property as an opportunity to achieve is produced as follows. cross-technology communication between ETC system and AM radio receivers.Since difference frequency is our interest, s国=20cos2UK+r-A0=2国cos(2fr)o this item is extracted from Eqn.3 and expressed as follows: S(t)is the result of the zeroth downconversion.It operates at 1 the radio frequency f.which the receiver can process.That S,(因=2os(2m(h-2)0 (4) is,the zeroth downconversion can pull the mixed signal at where S(t)is the downconverted signal due to the nonlinear- fe and fe+fr down to radio frequency fr.The right side ity effect. of Fig.3 presents the entire workflow at the receiver.S(t) can be further downconverted twice by the mixer and the B.Activating the Zeroth Downconversion decoder to extract v2(t).which is finally played by the speaker. Notably,the side effect of our design is that the audio signal The previous discussion inspires us to leverage nonlinearity is distorted due to the squaring,i.e.,v2(t).We can eliminate to pull down UHF signals to the radio band.Specifically,Tag- this distortion by taking a square root of the raw audio signal caster enables an ETC reader to transmit at two carriers,whose (i.e.,Vu(t))before it is modulated onto the carriers,such that frequencies are denoted by fi and f2.When the two signals the downconverted signal S(t)=(vv(t))2 cos(2frt)= pass through the pre-amplifier simultaneously,a low-frequency v(t)cos(2πfrt). signal appears at fi-f2 in the amplifier.This process is equivalent to conducting an additional downconversion before IV.ENGINEERING TAGCASTER the first and the second downconversions at the mixer and detector.To distinguish them,we refer to the downconversion The core of Tagcaster is the engineering of dual-carrier caused by the nonlinearity effect at the pre-amplifier as the upconversion at the ETC reader (i.e.,modulating the audio zeroth downconversion.Fig.2 shows their stages and process data onto two carriers)because only such an upconversion order.The next discussion is about the leveraging of the zeroth can activate the zeroth downconversion at the radio receiver downconversion for Tagcaster's radio service. However,achieving this task is challenging because Tagcaster Upconversion at the reader side.Suppose that an ETC is required to be a transparent service.The only way to change reader and a radio receiver work at frequencies of fe and fr.the behaviors of ETC readers is to feed data in the application respectively.To activate the zeroth downconversion,our ETC layer in accordance with corresponding standards.Given such reader modulates the audio data onto two carries at fr and a strict constraint,two engineering challenges are discussed in fe+fr simultaneously.For clarity,we call the new carrier at this section
0 Hz 20 kHz 919.11 MHz 920 MHz 920.55 MHz Upconversion ETC Channel Audio data ETC Reader @ 920MHz / Upconversion 919.11 MHz 920 MHz 920.55 MHz 920.89 MHz zeroth downconversion (Non-linearity) ETC Channel 550 kHz 0 Hz 20 Hz 1st down-conversion (Mixer) Radio Receiver @ 550kHz / Downconversion fe fe + fr fe fe + fr fr 920.89 MHz 100 Hz 2nd down-conversion (Decoder) RF signal in Air Shadow carrier ETC carrier Fig. 3: Illustration of Tagcaster design. At the reader side, the audio data are modulated onto two carriers: the real reader carrier at fe and the shadow carrier at fe + fr. After receiving the RF signal, the receiver pulls down the signal by the zeroth, the first, and the second downconversion in turn. The zeroth downconversion is conducted due to the nonlinearity of the pre-amplifier. using a trigonometric formula as follows: Sout =S(t) + S 2 (t) = sin(2πf1t) + sin(2πf2t) + (sin(2πf1t) + sin(2πf2t))2 = sin(2πf1t) + sin(2πf2t) + 1 2 ((2 − cos(2π2f1t)− cos(2π2f2t) − cos(2π(f1 + f2)t) + cos(2π(f1 − f2)t)) (3) Four new frequencies (i.e., 2f1, 2f2, f1 + f2 and f1 − f2) are created after the first-stage magnification. Translating into actual numbers, when f1 = 920 MHz and f2 = 920.7 MHz, the amplified signals appear at 920 MHz, 920.7 MHz, 2 × 920 = 1840.7 MHz, 2 × 920.7 = 1841.4 MHz, 920 + 920.7 = 1840.7 MHz, and (920.7 − 920) MHz = 700 kHz. The first five frequencies are filtered out by the IF filter. However, 700 kHz remains. The net effect is that the UHF signal appears at a low frequency of 700 kHz, which radio receivers can process. The nonlinearity effect was considered a type of “pollution” in previous work. Nevertheless, we explore this underlying physical property as an opportunity to achieve cross-technology communication between ETC system and AM radio receivers. Since difference frequency is our interest, this item is extracted from Eqn. 3 and expressed as follows: S↓(t) = 1 2 cos(2π(f1 − f2)t) (4) where S↓(t) is the downconverted signal due to the nonlinearity effect. B. Activating the Zeroth Downconversion The previous discussion inspires us to leverage nonlinearity to pull down UHF signals to the radio band. Specifically, Tagcaster enables an ETC reader to transmit at two carriers, whose frequencies are denoted by f1 and f2. When the two signals pass through the pre-amplifier simultaneously, a low-frequency signal appears at |f1 − f2| in the amplifier. This process is equivalent to conducting an additional downconversion before the first and the second downconversions at the mixer and detector. To distinguish them, we refer to the downconversion caused by the nonlinearity effect at the pre-amplifier as the zeroth downconversion. Fig. 2 shows their stages and process order. The next discussion is about the leveraging of the zeroth downconversion for Tagcaster’s radio service. Upconversion at the reader side. Suppose that an ETC reader and a radio receiver work at frequencies of fe and fr, respectively. To activate the zeroth downconversion, our ETC reader modulates the audio data onto two carries at fr and fe + fr simultaneously. For clarity, we call the new carrier at fe + fr the shadow carrier. The left part of Fig. 3 illustrates an example where fr = 550 kHz and fe = 920 MHz. The audio data are modulated onto the 920 MHz original carrier and 920.55 MHz shadow carrier. Formally, v(t) denotes the audio signal, which is a low-frequency signal below 20 kHz. Then, the output upconverted RF signal from the reader is given as S↑(t) = v(t)(cos(2πfet) + cos(2π(fe + fr)t)) (5) One might wonder why a single-tone signal is not generated at the shadow carrier for the downconversion only. The hardware limits the current commercial ETC reader to work at a single channel for each reading. Further details are discussed in §V. Downconversion at the receiver. After receiving the mixed signal transmitted from the ETC reader, the pre-amplifier in the radio receiver automatically performs the zeroth downconversion. Substituting the given signal into Eqn. 4, a new signal is produced as follows. S↓(t) = 1 2 v 2 (t) cos(2π(!fe + fr −!fe)t) = 1 2 v 2 (t) cos(2πfrt) (6) S↓(t) is the result of the zeroth downconversion. It operates at the radio frequency fr, which the receiver can process. That is, the zeroth downconversion can pull the mixed signal at fe and fe + fr down to radio frequency fr. The right side of Fig. 3 presents the entire workflow at the receiver. S↓(t) can be further downconverted twice by the mixer and the decoder to extract v 2 (t), which is finally played by the speaker. Notably, the side effect of our design is that the audio signal is distorted due to the squaring, i.e., v 2 (t). We can eliminate this distortion by taking a square root of the raw audio signal (i.e., p v(t)) before it is modulated onto the carriers, such that the downconverted signal S↓(t) = 1 2 ( p v(t))2 cos(2πfrt) = 1 2 v(t) cos(2πfrt). IV. ENGINEERING TAGCASTER The core of Tagcaster is the engineering of dual-carrier upconversion at the ETC reader (i.e., modulating the audio data onto two carriers) because only such an upconversion can activate the zeroth downconversion at the radio receiver. However, achieving this task is challenging because Tagcaster is required to be a transparent service. The only way to change the behaviors of ETC readers is to feed data in the application layer in accordance with corresponding standards. Given such a strict constraint, two engineering challenges are discussed in this section
PIE Tari 0.5Tan <X<Tan 00000 F signal at± 00000 bit zero 10!00!010 bit one w RF Signal (a)The schematic of reader transmitter (b)Pulse-Interval Encoding (PIE) (c)Amplitude Modulation (AM) Fig.4:The RFID transmission.(a)The incoming bitstream from computer is firstly encoded through the PIE.Then The PIE-coded baseband signal is moved to the ultra-high frequency (e.g.,820 MHz)by multiplying the carrier generated from the local oscillator.Finally, RF signal is propagated into the air through the antenna;(b)shows the adjustable parameters of PIE used in RFID;(c)shows the amplitude modulation where the reader is transmitting a continuous stream of zero bits. Generating the Shadow Carrier.The shadow carrier is Tagcaster's radio band used to pull RF signals from UHF down to the radio frequency at radio receivers.The first challenge is how to generate an undefined shadow carrier by complying with 200 kHz ETC regulations. kHz 160kH 500 kHz 800 kHz 1700 kHz Modulating the Audio Signal.An AM radio conveys the 5f (the sth-order) the analog audio data by changing the amplitude of the Fig.5:Spectrum comparison.The fundamental frequency of the carrier,whereas the reader baseband only accepts the digital baseband signal fo in the ETC reader is from 40 to 160 kHz bitstream from the upper layer.The second challenge is how Correspondingly,its fifth order harmonic 5f varies from 200~800 to carry the analog data through a digital wireless system. kHz.A commercial AM radio works from 500 to 1700 kHz.The overlapping spectrum from 500 to 800 kHz is the band at which A.Primer on RFID Transmission Tagcaster's radio operates. To explain Tagcaster,how an ETC reader works must first be introduced.Readers are required to generate high- FCC 15.247 authorizes RFID readers to operate in the ISM power CW,which persistently supplies energy to passive band from 902-928 MHz with 52 channels.each of which transponders in the field.Two data links are involved.The first has a maximum bandwidth of 500 kHz. link is data transmission from readers to tags,called downlink B.Generating the Shadow Carrier transmission.The second link is the opposite,which is called uplink transmission.Given that Tagcaster broadcasts audio in The shadow carrier is the key for activating the receiver's a single way,we only introduce the downlink here.Fig.4(a) zeroth downconversion.We must generate the shadow carrier illustrates a schematic of a reader transmitter that contains in accordance with RFID regulations. four main components:PIE encoder,local oscillator,mixer, 1)Rationale behind the Shadow Carrier:Modulation and antenna.The entire workflow is sketched. translates the entire spectrum of a baseband signal to a high Baseband Encoding.A reader encodes the data (e.g.. band centering at the carrier frequency.Formally,Se(t)= commands)coming from the host using PlE in baseband. cos(2mfet)denotes the carrier.If the baseband signal is a Fig.4(b)illustrates the coding scheme.PIE coding uses simple sinusoidal signal denoted by S(t)=Adc+cos(27fot), different durations to represent bit zero and bit one.Bit zero then the modulated signal propagated into the air is given by has the duration of a single Tari,whereas that of bit one Sair =S(t)Se(t)=(Adc +cos(2nfut))cos(2nfet) equals to Tari+x.Tari is the unit duration for the signaling reference.It can be set as from 6.25 to 25us.The duration of -Aaco(2J)+cos(2f+) (7) bit one is always X-us longer than that of bit zero and must be between 1.5 and 2 Tari.Both bits start with a high voltage +2os(2x(.-f) and end with a low voltage.The durations of low voltage for where Adc is the direct constant.The equation implies that the two bits are the same and equal to the pulse width (PW). the output signal in the air appears at fe and fe+fo.Inspired Tari,PW and X can be set by users to suit their scenarios. by this fundamental,we can generate a shadow carrier by Modulation.The PIE-coded baseband signal is then multi- inputting a well-designed baseband signal.Specifically,if we plied by the UHF carrier generated from a local oscillator to transmit a continuous stream of constant zeros,then the PlE- produce the output RF signal.Fig.4(c)shows this procedure.coded baseband signal of the reader becomes a square signal Given that the multiplication only changes the amplitude of with the fundamental frequency offo=1/Tari.The duration the carrier to carry the baseband signal,it is called as AM.In of the bit zero that is equal to Tari and PW is set to Tari/2 terms of carrier frequency,the ISO/IEC 18000-6 standard only (see Fig.4(b)).Therefore,readers are effectively"framed"to specifies a broad spectrum (i.e.,820-920 MHz)and allows transmit continuous signals at fe (i.e..direct constant)and local agencies to regulate the channel division.For example,fe+f(upconversion)
Reader Transmitter Local Oscillator PIE Encoder Baseband Binary data Antenna RF Signal 00000 Computer Mixer Low Level Reader Protocol (LLRP) 920 MHz 0 0 0 0 0 0 0 0 0 0 (a) The schematic of reader transmitter Tari 0.5Tari <X < Tari PW PW bit zero bit one PIE (b) Pulse-Interval Encoding (PIE) 0 0 0 0 0 0 0 0 0 0 Baseband signal at Carrier signal at RF signal at fb fe AM fe ± fb (c) Amplitude Modulation (AM) Fig. 4: The RFID transmission. (a) The incoming bitstream from computer is firstly encoded through the PIE. Then The PIE-coded baseband signal is moved to the ultra-high frequency (e.g., 820 MHz) by multiplying the carrier generated from the local oscillator. Finally, RF signal is propagated into the air through the antenna; (b) shows the adjustable parameters of PIE used in RFID; (c) shows the amplitude modulation where the reader is transmitting a continuous stream of zero bits. • Generating the Shadow Carrier. The shadow carrier is used to pull RF signals from UHF down to the radio frequency at radio receivers. The first challenge is how to generate an undefined shadow carrier by complying with ETC regulations. • Modulating the Audio Signal. An AM radio conveys the the analog audio data by changing the amplitude of the carrier, whereas the reader baseband only accepts the digital bitstream from the upper layer. The second challenge is how to carry the analog data through a digital wireless system. A. Primer on RFID Transmission To explain Tagcaster, how an ETC reader works must first be introduced. Readers are required to generate highpower CW, which persistently supplies energy to passive transponders in the field. Two data links are involved. The first link is data transmission from readers to tags, called downlink transmission. The second link is the opposite, which is called uplink transmission. Given that Tagcaster broadcasts audio in a single way, we only introduce the downlink here. Fig. 4(a) illustrates a schematic of a reader transmitter that contains four main components: PIE encoder, local oscillator, mixer, and antenna. The entire workflow is sketched. Baseband Encoding. A reader encodes the data (e.g., commands) coming from the host using PIE in baseband. Fig. 4(b) illustrates the coding scheme. PIE coding uses different durations to represent bit zero and bit one. Bit zero has the duration of a single Tari, whereas that of bit one equals to Tari+X. Tari is the unit duration for the signaling reference. It can be set as from 6.25 to 25µs. The duration of bit one is always X-us longer than that of bit zero and must be between 1.5 and 2 Tari. Both bits start with a high voltage and end with a low voltage. The durations of low voltage for the two bits are the same and equal to the pulse width (PW). Tari, PW and X can be set by users to suit their scenarios. Modulation. The PIE-coded baseband signal is then multiplied by the UHF carrier generated from a local oscillator to produce the output RF signal. Fig. 4(c) shows this procedure. Given that the multiplication only changes the amplitude of the carrier to carry the baseband signal, it is called as AM. In terms of carrier frequency, the ISO/IEC 18000-6 standard only specifies a broad spectrum (i.e., 820-920 MHz) and allows local agencies to regulate the channel division. For example, 40 kHz 160 kHz fb 500 kHz fr 800 kHz 200 kHz 5fb (the 5th-order) 1700 kHz Tagcaster’s radio band Fig. 5: Spectrum comparison. The fundamental frequency of the baseband signal fb in the ETC reader is from 40 to 160 kHz. Correspondingly, its fifth order harmonic 5fb varies from 200 ∼ 800 kHz. A commercial AM radio works from 500 to 1700 kHz. The overlapping spectrum from 500 to 800 kHz is the band at which Tagcaster’s radio operates. FCC 15.247 authorizes RFID readers to operate in the ISM band from 902 - 928 MHz with 52 channels, each of which has a maximum bandwidth of 500 kHz. B. Generating the Shadow Carrier The shadow carrier is the key for activating the receiver’s zeroth downconversion. We must generate the shadow carrier in accordance with RFID regulations. 1) Rationale behind the Shadow Carrier: Modulation translates the entire spectrum of a baseband signal to a high band centering at the carrier frequency. Formally, Se(t) = cos(2πfet) denotes the carrier. If the baseband signal is a simple sinusoidal signal denoted by Sb(t) = Adc+cos(2πfbt), then the modulated signal propagated into the air is given by Sair =Sb(t)Se(t) = (Adc + cos(2πfbt)) cos(2πfet) =Adc cos(2πfet) + 1 2 cos(2π(fe + fb)t) + 1 2 cos(2π(fe − fb)t) (7) where Adc is the direct constant. The equation implies that the output signal in the air appears at fe and fe ±fb. Inspired by this fundamental, we can generate a shadow carrier by inputting a well-designed baseband signal. Specifically, if we transmit a continuous stream of constant zeros, then the PIEcoded baseband signal of the reader becomes a square signal with the fundamental frequency of fb = 1/Tari. The duration of the bit zero that is equal to Tari and PW is set to Tari/2 (see Fig. 4(b)). Therefore, readers are effectively “framed” to transmit continuous signals at fe (i.e., direct constant) and fe + fb (upconversion)