development and application of wirelessly-powered sensor...
TRANSCRIPT
Development and Applicationof Wirelessly-Powered Sensor Nodes
Daniel James Yeager
A thesis submitted in partial fulfillmentof the requirements for the degree of
Master of Science
University of Washington
2009
Program Authorized to Offer Degree: Electrical Engineering
University of WashingtonGraduate School
This is to certify that I have examined this copy of a master’s thesis by
Daniel James Yeager
and have found that it is complete and satisfactory in all respects,and that any and all revisions required by the final
examining committee have been made.
Committee Members:
Brian Otis
Joshua Smith
Date:
In presenting this thesis in partial fulfillment of the requirements for a master’s degree atthe University of Washington, I agree that the Library shall make its copies freely availablefor inspection. I further agree that extensive copying of this thesis is allowable only forscholarly purposes, consistent with “fair use” as prescribed in the U.S. Copyright Law. Anyother reproduction for any purpose or by any means shall not be allowed without my writtenpermission.
Signature
Date
University of Washington
Abstract
Development and Applicationof Wirelessly-Powered Sensor Nodes
Daniel James Yeager
Chair of the Supervisory Committee:Professor Brian Otis
Electrical Engineering
This thesis presents work on three wirelessly-powered and wirelessly-interrogated compu-
tational devices (“tags”). First, the architecture and design of a software-defined passive
tag called WISP (Wireless Identification and Sensing Platform) is discussed in detail. Sev-
eral implemented applications including neural sensing and strain measurement are also
reviewed. Second, a passive data logger (“PDL”) is presented, which employs a novel
wirelessly-charged power model. Third, design and results of a fully-integrated system-on-
chip (“SoC”) sensor tag are presented. All of the work is compatible with EPC Class 1
Generation 2 protocol, allowing use with industry-standard UHF RFID readers.
TABLE OF CONTENTS
Page
List of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
List of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii
Chapter 1: Radio Frequency Identification (RFID) Technology . . . . . . . . . . . 1
1.1 A Brief History of Wireless Power . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Trends for Wirelessly-Powered Devices . . . . . . . . . . . . . . . . . . . . . . 2
1.3 An Overview of RFID Technology . . . . . . . . . . . . . . . . . . . . . . . . 4
1.4 A Review of Tag Classifications . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.4.1 Active Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4.2 Semi-Passive Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4.3 Passive Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.5 Thesis Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Chapter 2: RFID Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 RFID Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2.1 The link is asymmetric . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2.2 Tags cannot hear eachother . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2.3 Readers can hear eachother . . . . . . . . . . . . . . . . . . . . . . . . 13
2.2.4 Readers can talk on different channels . . . . . . . . . . . . . . . . . . 13
2.2.5 Tag backscatter occurs on the reader’s channel . . . . . . . . . . . . . 13
2.2.6 Tags cannot distinguish between readers . . . . . . . . . . . . . . . . . 13
2.2.7 All communication is reader-driven . . . . . . . . . . . . . . . . . . . . 13
2.2.8 Tag discovery is stochastic . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3 Gen2 Link Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.4 Physical Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
i
2.5 Power Available To A Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.6 Sending Sensor Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.6.1 Shoehorn Data into the ID . . . . . . . . . . . . . . . . . . . . . . . . 17
2.6.2 Access Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.6.3 The Select Command . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.7 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter 3: A Passive, Software-Defined Sensor Tag . . . . . . . . . . . . . . . . . 20
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.2 Theory of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.3 WISP Hardware Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.3.1 RF Front End . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.3.2 Power Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.3.3 Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.4 WISP Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.4.1 Power Management Firmware . . . . . . . . . . . . . . . . . . . . . . . 30
3.4.2 Communication Firmware . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.4.3 Application Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.5 WISP Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.7 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
3.8 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.8.1 Light and Temperature . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.8.2 Acceleration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.8.3 LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.8.4 Near Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
3.8.5 Other WISP Applications . . . . . . . . . . . . . . . . . . . . . . . . . 40
3.9 Conclusions and Impacts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Chapter 4: Maximalist Cryptography and Computation for UHF RFID Tags . . . 42
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.2 Background on WISP Architecture . . . . . . . . . . . . . . . . . . . . . . . . 43
4.3 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.4 Measurements and Estimates of Computation and Power Consumption . . . . 45
4.4.1 Measurements of Computation and Symmetric Cryptography . . . . . 45
ii
4.4.2 Estimates of Maximal Computation and Measurements of the Effectof Flash Writes on Computation . . . . . . . . . . . . . . . . . . . . . 49
4.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Chapter 5: A Wireless Strain Sensor for Embedded Material Health Monitoring . 525.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535.3 Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.3.1 Power Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555.3.2 Amplifier Gain and Bandwidth-Induced Attenuation . . . . . . . . . . 56
5.4 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585.5 Results/Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
5.5.1 Data Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595.5.2 Specimen Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
5.6 Conclusions and Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Chapter 6: NeuralWISP: A Wirelessly-Powered Brain Interface . . . . . . . . . . . 636.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636.2 System Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.2.1 Power and Communication . . . . . . . . . . . . . . . . . . . . . . . . 656.2.2 Analog Signal Path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676.2.3 Digital Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706.2.4 Application Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
6.3 Test Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726.3.1 Analog Front End . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726.3.2 Spike Detector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756.3.3 System Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776.3.4 In-vivo Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
6.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Chapter 7: Wirelessly-Charged UHF Tags for Sensor Data Collection . . . . . . . 857.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857.2 Background and Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . 877.3 Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
7.3.1 Run Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
iii
7.3.2 Charge Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 917.3.3 RFID Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
7.4 Hardware Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 937.4.1 High Level Description . . . . . . . . . . . . . . . . . . . . . . . . . . . 947.4.2 Demodulation and Power Management . . . . . . . . . . . . . . . . . . 957.4.3 Sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
7.5 Software Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 977.6 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 997.7 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027.8 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Chapter 8: A Graphical User Interface for RFID Applications . . . . . . . . . . . 1048.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048.2 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1058.3 WISP Demo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1068.4 Attenuation Tester . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Chapter 9: Design of an Integrated Gen2 Sensor Tag . . . . . . . . . . . . . . . . 1109.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109.2 Prior Work on Full Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109.3 Prior Work on Tag Components . . . . . . . . . . . . . . . . . . . . . . . . . . 112
9.3.1 Rectifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129.3.2 Oscillators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1139.3.3 Digital Core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
9.4 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1159.5 Analog Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
9.5.1 RF Rectifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1209.5.2 Bias Current Generator . . . . . . . . . . . . . . . . . . . . . . . . . . 1219.5.3 Bandgap Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1239.5.4 Regulators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1249.5.5 Demodulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259.5.6 Oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
9.6 Digital Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1319.6.1 Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1329.6.2 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
iv
9.6.3 Packet and Command Parsers . . . . . . . . . . . . . . . . . . . . . . . 134
9.6.4 Random Number Generation . . . . . . . . . . . . . . . . . . . . . . . 135
9.6.5 Transmitter Architecture . . . . . . . . . . . . . . . . . . . . . . . . . 136
9.6.6 Sequencer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
9.6.7 Encoder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
9.6.8 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
9.7 Chip Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
9.8 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
9.9 Design Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Chapter 10: socWISP Verification and Measurement Results . . . . . . . . . . . . . 147
10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
10.2 Pre-tapeout Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
10.3 Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
10.3.1 Analog core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
10.3.2 Digital core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
10.4 Measurement Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
10.4.1 Rectifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
10.4.2 Oscillator Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
10.4.3 Bandgap and Regulators . . . . . . . . . . . . . . . . . . . . . . . . . . 154
10.4.4 Bias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
10.4.5 Digital Core Performance . . . . . . . . . . . . . . . . . . . . . . . . . 155
10.4.6 UID Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
10.4.7 ADC Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
10.4.8 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Chapter 11: In-flight Insect Temperature Recording . . . . . . . . . . . . . . . . . . 160
11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
11.2 Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
11.3 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
11.4 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
11.4.1 Tethered Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
11.4.2 Untethered Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
11.5 Thermocouple Characterization Using a Low Power On-Chip Amplifier . . . . 165
11.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
v
Chapter 12: Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
vi
LIST OF FIGURES
Figure Number Page
1.1 Microprocessor efficiency timeline. . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Microprocessor efficiency and predicted range versus year . . . . . . . . . . 4
1.3 Voltage scaling versus year. . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.1 RFID communication diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.2 Gen2 downlink data encoding . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.3 Gen2 downlink encoding preamble . . . . . . . . . . . . . . . . . . . . . . . 16
2.4 Uplink data encoding format . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.1 Photograph of the WISP 4.1 hardware. . . . . . . . . . . . . . . . . . . . . . 21
3.2 WISP hardware block diagram. . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.3 WISP rectifier and modulator . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.4 Power management circuitry . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.5 Analog voltage sensor schematic . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.6 Demodulator input, reference and output voltage trace. . . . . . . . . . . . 28
3.7 ASK demodulator schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.8 Firmware block diagram including relevant hardware connections. . . . . . . 30
3.9 Basic power management state diagram for standard tasks. . . . . . . . . . 30
3.10 Advanced power management state diagram for power-hungry tasks. . . . . 31
3.11 WISP packet structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.12 Photograph of the WISP Monitor . . . . . . . . . . . . . . . . . . . . . . . . 34
3.13 Rectifier performance versus input power. . . . . . . . . . . . . . . . . . . . 35
3.14 WISP communication and error rates . . . . . . . . . . . . . . . . . . . . . . 36
3.15 Temperature measurements in response to artificial stimuli . . . . . . . . . . 37
3.16 Light sensor data plotted over 24 hours . . . . . . . . . . . . . . . . . . . . . 37
3.17 Acceleration vs. filter settling time . . . . . . . . . . . . . . . . . . . . . . . 38
3.18 Acceleration measurements as the WISP is rotated in orthogonal planes . . 39
3.19 WISP wirelessly powers an LED . . . . . . . . . . . . . . . . . . . . . . . . 40
3.20 Near-field WISP embedded in playing dice . . . . . . . . . . . . . . . . . . . 41
vii
4.1 WISP power cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474.2 Annotated scope trace of WISP execution and power consumption . . . . . 484.3 Computation available in one active cycle . . . . . . . . . . . . . . . . . . . 494.4 Number of cycles available after writing to flash . . . . . . . . . . . . . . . . 51
5.1 Strain gage measurement system diagram . . . . . . . . . . . . . . . . . . . 545.2 Circuit schematic of the Wheatstone bridge and strain gauge amplifier . . . 545.3 Effect of filter settling time on effective amplifier gain . . . . . . . . . . . . . 575.4 Experimental setup of the WISP(S/G) comparison with an extensometer. . 585.5 Strain recorded during the step loading of the specimen. . . . . . . . . . . 605.6 Correlation between the Wired and Wireless strain gauge measurements . . 61
6.1 Block diagram of NeuralWISP. . . . . . . . . . . . . . . . . . . . . . . . . . 646.2 Measured rectifier output power and efficiency versus input power. . . . . . 656.3 Schematic of the RF front end . . . . . . . . . . . . . . . . . . . . . . . . . . 666.4 Neural amplifier schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686.5 Analog front end circuitry . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716.6 Software state diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716.7 Graphical user interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736.8 NeuralWISP board and IC photograph . . . . . . . . . . . . . . . . . . . . . 756.9 Measured neural amplifier gain versus frequency . . . . . . . . . . . . . . . . 766.10 Measured noise spectra at the output of the LNA and the post-amp. . . . 766.11 Operation of the spike detector . . . . . . . . . . . . . . . . . . . . . . . . . 776.12 Accuracy of the spike detector . . . . . . . . . . . . . . . . . . . . . . . . . . 786.13 Time domain voltage trace of spike detector . . . . . . . . . . . . . . . . . . 786.14 Single spike digitized by the on-board ADC . . . . . . . . . . . . . . . . . . 796.15 Photograph of the in vivo experiment setup . . . . . . . . . . . . . . . . . . 806.16 Wirelessly-powered data from wing muscle tissue . . . . . . . . . . . . . . . 816.17 Primate neural spike data . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
7.1 Photograph of the WISP-PDL implemented using WISP version 4.1. . . . . 877.2 Maximum Iave for various run times and capacitor sizes. . . . . . . . . . . . 907.3 Predicted charge time versus range. . . . . . . . . . . . . . . . . . . . . . . . 937.4 Block diagram of the WISP-PDL. . . . . . . . . . . . . . . . . . . . . . . . . 947.5 Demodulation and power management circuitry. . . . . . . . . . . . . . . . . 957.6 WISP-PDL software state diagram. . . . . . . . . . . . . . . . . . . . . . . . 987.7 Reader antenna and control laptop outside of refrigerator. . . . . . . . . . . 100
viii
7.8 Control data set logged from milk carton. . . . . . . . . . . . . . . . . . . . 101
7.9 Real world data logged from milk carton over the course of a day. . . . . . . 101
8.1 LLRP-compatible abstraction layers for RFID application development. . . 106
8.2 Screen capture of the WISP GUI application . . . . . . . . . . . . . . . . . 107
8.3 Screen capture of the Attenuator Test program . . . . . . . . . . . . . . . . 109
9.1 socWISP system-level architecture . . . . . . . . . . . . . . . . . . . . . . . 116
9.2 Analog block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
9.3 Analog circuit schematic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
9.4 Rectifier cell schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
9.5 Bias current generator schematic. . . . . . . . . . . . . . . . . . . . . . . . . 122
9.6 Simulated bias current versus supply voltage. . . . . . . . . . . . . . . . . . 122
9.7 Simulated Monte Carlo bias current distribution (process and mismatch). . 122
9.8 Simulated bias current versus temperature. . . . . . . . . . . . . . . . . . . 123
9.9 Bandgap circuit schematic to generate 1.2 V reference. . . . . . . . . . . . . 124
9.10 Regulator schematic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
9.11 Analog demodulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
9.12 3 MHz ring oscillator schematic. . . . . . . . . . . . . . . . . . . . . . . . . . 127
9.13 Simulated oscillator performance versus process and temperature. . . . . . . 128
9.14 Simulated oscillator performance versus supply voltage and temperature. . . 130
9.15 EPC Gen2 digital core block diagram . . . . . . . . . . . . . . . . . . . . . . 131
9.16 Pulse-Interval-Encoding (PIE) demodulation logic schematic. . . . . . . . . 133
9.17 Edge detection logic state diagram. . . . . . . . . . . . . . . . . . . . . . . . 133
9.18 EPC physical layer packet digital decoder schematic. . . . . . . . . . . . . . 134
9.19 Schematic for command parsing logic. . . . . . . . . . . . . . . . . . . . . . 134
9.20 Schematic for packet parsing logic. . . . . . . . . . . . . . . . . . . . . . . . 135
9.21 EPC Gen2 uplink packet construction and modulation schematic. . . . . . . 136
9.22 Sequencer state diagram for constructing EPC Gen2 packets. . . . . . . . . 137
9.23 FM0 or Miller modulation encoder schematic. . . . . . . . . . . . . . . . . . 138
9.24 Divider residual for 15% allowable tolerance cases. . . . . . . . . . . . . . . 140
9.25 Divider residual for 10% allowable tolerance cases. . . . . . . . . . . . . . . 140
9.26 Divider residual for 7% allowable tolerance cases. . . . . . . . . . . . . . . . 141
9.27 Full chip layout with dimensions and high-level blocks annotated. . . . . . . 142
9.28 IC layout area breakdowns. . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
9.29 IC die micrograph. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
ix
10.1 Photograph of test setup for socWISP verification. . . . . . . . . . . . . . . 14910.2 Measured rectifier input impedance versus frequency . . . . . . . . . . . . . 15010.3 Measured rectifier return loss versus input frequency . . . . . . . . . . . . . 15110.4 Measured rectifier return loss versus input power . . . . . . . . . . . . . . . 15110.5 Measured rectifier output voltage with analog core (approx. 1.2 µA) load. . 15210.6 Measured rectifier power efficiency at various output voltages. . . . . . . . . 15310.7 Measured oscillator frequency distribution at 0.7 V supply voltage. . . . . . 15310.8 Measured ring oscillator frequency versus temperature. . . . . . . . . . . . . 15410.9 FM0-modulated communication voltage trace . . . . . . . . . . . . . . . . . 15610.10 Miller 4-modulated communication voltage trace . . . . . . . . . . . . . . . 15610.11 Digital core power versus supply voltage and clock frequency . . . . . . . . 15710.12 Sample IDs read from different tags. . . . . . . . . . . . . . . . . . . . . . . 15710.13 ADC samples reported through a COTS RFID reader . . . . . . . . . . . . 158
11.1 Off-chip thermocouple amplifier circuit schematic. . . . . . . . . . . . . . . . 16111.2 Photograph of the socWISP attached to a moth . . . . . . . . . . . . . . . . 16411.3 Temperature time series data from the socWISP on a tethered moth. . . . . 16411.4 Photograph of an untethered, instrumented moth hovering on a flower. . . . 16511.5 Temperature time series data from the socWISP on an untethered moth. . . 166
x
LIST OF TABLES
Table Number Page
1.1 Distinctions between RFID tag power models and uplink methods . . . . . . 8
3.1 Predicted available tag power versus range . . . . . . . . . . . . . . . . . . . . 22
4.1 Comparison of WISP with other RFID devices. . . . . . . . . . . . . . . . . 444.2 Execution time for operations in RC5 . . . . . . . . . . . . . . . . . . . . . . 48
6.1 Comparison of Neural Amplifiers . . . . . . . . . . . . . . . . . . . . . . . . . 746.2 Extended Comparison of Neural Amplifiers . . . . . . . . . . . . . . . . . . . 74
9.1 Comparison of published tag features. . . . . . . . . . . . . . . . . . . . . . . 1129.2 Review of oscillators presented in the literature. . . . . . . . . . . . . . . . . . 1149.3 Summary of Features vs. Design Version. . . . . . . . . . . . . . . . . . . . . 1189.4 IC layout area with and without pads. . . . . . . . . . . . . . . . . . . . . . . 1439.5 Power consumption breakdown for analog, digital, and peripheral cores. . . . 1449.6 Breakdown of simulated current consumption of analog blocks. . . . . . . . . 1449.7 Comparison of published (measured) tag performance. . . . . . . . . . . . . . 146
xi
GLOSSARY
RFID: Radio Frequency Identification.
TAG: the device to be interrogated remotely.
READER: the wireless interrogator.
IC: integrated circuit.
ASIC: application-specific integrated circuit.
PCB: printed circuit board.
COB: chip-on-board.
COTS: commercial off-the-shelf.
ADC: analog-to-digital converter.
SOC: system-on-chip.
xii
ACKNOWLEDGMENTS
I would like to thank Josh for his guidance and support, Brian for his patience and
constant optimism, and Alanson for mentoring my early research efforts.
xiii
DEDICATION
to my father, Tom
xiv
1
Chapter 1
RADIO FREQUENCY IDENTIFICATION (RFID) TECHNOLOGY
1.1 A Brief History of Wireless Power
Wireless delivery of power was first proposed by Nikola Tesla in the early 20th century to re-
motely power electric lights [1]. However, the electrical devices available during Tesla’s time,
primarily motors and electric lights, had high power consumption requirements (>10 W).
This led to large, and consequently dangerous, power densities. Similarly high-power ap-
plications were investigated in 1961 for operating aircraft [2] and in 1968 for delivering
power to earth from orbiting photovoltaic satellites [3]. Again, however, practical safety
considerations prevented adoption.
Modern implementations of wireless power systems generally fall under two categories:
inductive and radiative. Inductively-coupled systems use a magnetic field to transfer en-
ergy, and have been successfully used for powering and/or charging implantable medical
devices [4], charging consumer electronics such as the Sonicare electric toothbrush [5], and
clean room fabrication [6].
Radiative systems instead use RF propagation to transfer energy. This method is used
to send data (not power) in nearly every wireless communication system. The motivation
for using radiative energy transfer is simple: although inductive systems are generally much
more efficient than radiative systems, inductive systems are confined to centimeter ranges.
Radiative systems can extend to tens of meters with FCC-compliant transmitters, and these
systems will be discussed in great detail in this thesis.
Systems utilizing radiative energy transfer have only recently become feasible, and Sec-
tion 1.2 explains the enabling technological advances. Section 1.3 describes radio frequency
identification (RFID) technology, which is the most commercially-successful implementation
2
of such systems. Section 1.4 provides context for RFID tag design discussions by reviewing
commercial tag categorizations. Finally, Section 1.5 describes the organization of this thesis.
1.2 Trends for Wirelessly-Powered Devices
For the past 30 years, both consumer and military applications have fueled demand for
semiconductor electronics performance. In 1965, Gordon Moore foresaw this growth and
predicted that the number of components per integrated circuit will double every 2 years [7].
In order to achieve this growth, Moore’s Law has driven a reduction of transistor size by
roughly 13% per year [8]. Lateral scaling has reduced the area of the transistor, which
in turn reduces the device capacitance. Vertical scaling has reduced the oxide thickness,
which in turn reduces the device threshold voltage and consequently the supply voltage.
Equation (1.1), fundamental to digital integrated circuits, states that the power of each
transistor is proportional to its capacitance (transistor size), frequency of operation, and
square of its operating voltage.
P =12CfV 2 (1.1)
In sum, after increasing the frequency of operation and number of transistors (better perfor-
mance) but decreasing the operating voltage and device capacitance through device scaling
(better technology), power consumption has not changed dramatically through the years
for high performance integrated circuits.
An opportunity has arisen, however, for applications where the required integrated cir-
cuit performance has already been met through transistor count and clock speed. As technol-
ogy improvements continue to shrink devices, the power consumption of fixed performance
integrated circuits drops significantly [9]. Figure 1.1 shows a logarithmic plot of pico-joules
per instruction of current and historical sub-10 MHz microprocessors. For a given workload
(fixed number of instructions), modern microprocessors use orders of magnitude less energy
than those of previous years. Note that while the EM 6682 has remarkably low energy per
instruction, it is not yet available at speeds necessary for wireless communication.
So why have wirelessly-powered electronics just recently become feasible? Friis’ Trans-
mission Equation, shown in Equation (1.2), models the power available to a receiver at
3
Motorola HC08
Intel 4004 4bit
General
Instruments
PIC1650
Intel 8051 8bit
classic
Motorola HC05HC
TI MSP430F14x
TI MSP430F1232
EM6682
1
10
100
1000
10000
100000
1000000
10000000
1965 1970 1975 1980 1985 1990 1995 2000 2005 2010
Year
pJ per Instruction
Figure 1.1: Microprocessor efficiency timeline.
distance R. For modest antenna sizes in the UHF band, less than 1 mW is available at 1 m
range using transmit power at the FCC limit. Section 2 will discuss this topic in greater
detail, but let it suffice that not much power is available for performing computation.
Pr = PtGtGr
(λ
4πR
)2
(1.2)
Combining Moore’s Law with Friis’ Transmission Equation for historical microprocessor
data yields Figure 1.2. Microprocessor efficiency and predicted wireless range are plotted
together, with the square-loss of received power from Friis’ Equation reducing the scaling
by 12 on the log scale. The recent emergence of RFID technology is apparent: wirelessly
powering useful computational tasks at significant wireless distances only became feasible
recently!
Figure 1.2 predicts significantly longer wireless range as instruction efficiency improves.
However, as the cost per instruction becomes increasingly small, we must consider other con-
straints in these systems. One such constraint is voltage. As the available power decreases,
so does the voltage at which that power is delivered. Technology scaling has also driven a
4
0.01
0.1
1
10
100
1000
10000
100000
1000000
10000000
1970 1980 1990 2000 2010 2020
Year
Instructions per uJoule
0.01
0.1
1
10
100
1000
10000
100000
1000000
10000000
Meters
M icroprocessor Efficiency
Friis Distance (Power Limited)
Exponential Fit
Exponential Fit
Figure 1.2: Microprocessor efficiency and predicted range versus year. Note: inverse unitsof Instructions/pJ are used to show the trend with wireless range.
reduction in supply voltages in order to reduce power consumption. For example, the Inter-
national Technology Roadmap for Semiconductors (ITRS) predicts aggressive, near-linear
supply voltage scaling for cutting-edge processes (Figure 1.3(b)). However, historical mi-
croprocessor trends show less aggressive scaling with an exponential decay (Figure 1.3(a)).
At any rate, these trends will clearly benefit wirelessly powered devices.
In addition to supply scaling, advances in rectifier technology and power conversion will
also help overcome voltage-limitation challenges. For example, analog methods for tuning
transistor Vt enable the power conversion efficiency to be optimized for low input power
levels [10, 11]. Simultaneously, DC to DC power conversion technologies such as [12] are
able to convert tens of millivolts to volts. These advances will help to increase wireless
ranges even if voltage scaling becomes less aggressive in future years.
1.3 An Overview of RFID Technology
RFID systems typically consist of small, low-cost devices, called “tags”, which use the radio
signal from a specialized RFID reader for power and communication. When queried, each
5
y = 6E+33e-0.0384x
1
2
3
4
5
6
1975 1990 2005 2020
Year
Voltage
(a) Historical microcontroller data.
0.5
0.7
0.9
1.1
1.3
1.5
1995 2000 2005 2010 2015
Year
Voltage
(b) ITRS roadmap.
Figure 1.3: Voltage scaling versus year.
tag responds with a unique identification number by reflecting energy back to the reader
through backscatter modulation. Tags are affixed to objects of interest, and the location
of the object is inferred from the ability of readers to communicate with the tag. Typical
communication ranges are 10 cm to 50 cm for inductively-coupled devices and 3 m to 10 m
for UHF tags. These characteristics motivate use of RFID tags as a replacement for bar-
codes in such applications as supply chain monitoring and asset management. Additionally,
RFID tags are used as identification in building security and passports as well as electronic
payment in credit cards [13].
6
Industrial applications have spurred the development of RFID technology, producing a
robust physical layer capable of wirelessly powering and querying a tag. This solid foun-
dation, coupled with the widespread deployment of RFID readers, has inspired two general
categories of RFID research. The first is novel application spaces for conventional RFID
technology. The second is fundamental advances to RFID technology such as tag designs,
protocol efficiency, and reader architectures.
Various novel applications for conventional RFID technology have been proposed in
the literature. For example, the authors in [14] present network architectures for an RFID-
enhanced environment where objects are seamlessly tracked and monitored. A more specific
example discusses the implementation of an environment augmented with RFID to enhance
the quality of life and independence of elderly citizens [15]. Participants wear small RFID
reader bracelets that report interaction with tagged objects. Activities can be inferred from
this data and reported to caregivers.
Rudimentary sensor tags have been also constructed from commercial tags. To date,
there are several approaches to enhancing RFID tags with sensing capabilities. The α-WISP
multiplexes two commercial tag ICs onto one antenna, creating a 1-bit accelerometer [16].
The authors in [17] describe a humidity sensor for detecting moisture in walls of buildings
and houses by placing a sponge in front of a tag. Moisture in the sponge detunes the tag’s
antenna, allowing the approximation of humidity levels from the read range of the tag.
Another approach uses a custom tag with a built in fuse for sensing high temperatures in
food products. The fuse melts above a particular threshold, which permanently disables
the tag [18].
Fundamental advances in RFID technology have also been proposed in the literature,
and this will be an integral topic of this thesis. On the tag side, tradeoffs exist between
configurability, performance, size and cost - optimizations in this space are the subject of
ongoing research. Furthermore, enhancements such as sensing, computation, encryption and
data logging promise to enhance and unlock new applications for RFID. Examples include
infrastructure and object monitoring, automatic product tamper detection, identification
of harmful agents, and biomedical devices for noninvasive monitoring [19]. On the reader
side, opportunities exist for improvement on several fronts. Examples include physical and
7
link layer protocol improvement, cost reduction, security and privacy issues, and system
integration. Recent advances in software radio technology may aid in this research; a
software-defined reader can allow direct control over the wireless protocol [20]. One specific
issue that will arise in this thesis is that commercial readers are optimized for reading many
tags quickly. However, performance when streaming sensor data from one tag is suboptimal.
Flexibility is required on both the tag and reader sides in order to tackle these challenges.
The evolution of “augmented” RFID tags to include sensory, encryption and data pro-
cessing features has led researchers to re-examine the definition of a tag. For example, Kevin
Fu at the University of Massachusetts Amherst coined the term Computational RFIDs to
describe “battery-less computers that harvest all of their operating power from an interrogat-
ing reader.” Essentially, passive RFID technology has enabled micro-computing platforms
with wireless power and communication capabilities. This thesis will explore implications of
the additional flexibility, performance, and features afforded to wirelessly-powered devices
as enabled by Moore’s Law.
1.4 A Review of Tag Classifications
There are a number of different RFID technologies operating in frequency bands ranging
from 125 kHz to 5.8 GHz. Some systems use inductive coupling while others use radiative
coupling - some even use both forms of energy transfer! A subset of tags employ active trans-
mitters like conventional wireless sensor nodes, but the majority of commercial deployments
use passive (battery-free) tags. These technologies cause wide disparities in wireless range
from several centimeters to tens or hundreds of meters. This section aims to differentiate
between these various tag classes.
Two main distinctions between tags are the power source and the communication method.
RFID officially includes provisions for active (battery-powered) and semi-passive (battery-
assisted) tags in addition to passive (battery-free) tags. With respect to the uplink com-
munication method, active tags contain a low power radio like conventional wireless nodes,
while passive and semi-passive tags transmit data by modulating power reflected back to the
reader (backscatter). However, the main advantage of RFID tags versus traditional battery-
powered sensor nodes is freedom from battery-life constraints. Therefore the remainder of
8
Wirelessly Powered Battery Powered
Backscatter Passive Semi-Passive
Active TX Active
Table 1.1: Distinctions between RFID tag power models and uplink methods. The rowsdelineate the uplink method, and the columns delineate the power model. Wirelessly-powered active tags are not defined in the RFID specification; however, they are simplyactive tags plus energy harvesting such as solar, thermal, mechanical or ambient RF.
this thesis will focus on wirelessly-powered and wirelessly-charged tags, which do not have
fundamental lifespan limitations. Table 1.1 summarizes the distinctions between these tag
types.
1.4.1 Active Tags
Typical active tags include a microcontroller, battery, and low power radio. Commercial,
off-the-shelf (COTS) 2.4 GHz solutions such as Zigbee and Wifi (802.11) are popular. These
radios have wireless ranges greater than 100 m, which actually poses a problem for item
tracking. Short range tags only communicate in physical proximity to a reader (which
implies its location), but active tags are not necessarily in close proximity to the reader
when they communicate. To address this problem, time of flight, signal strength, and
triangulation are used to estimate the tag location. In theory, the tag could wirelessly
report its own location using an on-tag GPS receiver, although, the energy requirements
are currently prohibitive. In practice, the main drawback of active tags is not locating the
tags - it is replacing the batteries. The use of an active radio consumes significant amounts
of power and this limits the battery lifespan on the order of weeks to months.
1.4.2 Semi-Passive Tags
Semi-passive tags employ a battery for extending wireless range and enabling sensor mea-
surement/logging without reader proximity. Typically, passive tags are downlink limited
due to power constraints. A battery eliminates power constraints, and these systems then
9
become uplink limited due to finite reader sensitivity. Semi-passive tags have very low power
budgets because they communicate using backscatter modulation like passive tags. This
means that their lifespan can be several years despite reliance on a battery. Furthermore,
they can easily conform to passive tag protocol specifications, allowing use in existing RFID
infrastructure.
1.4.3 Passive Tags
Passive tags, unlike semi-passive and active tags, have no battery-life constraints. They are
powered by converting RF to DC power. Low frequency tags (125 kHz and 13.56 MHz) rely
on inductive coupling. The advantage of inductive coupling is that it operates in water, and
the disadvantage is that it limits wireless range to less than 1 m. Low frequency tags are
limited to inductive energy transfer because antenna sizes are too large at these frequencies.
High frequency tags (433 MHz, 915 MHz, 2.4 GHz, 5.8 GHz) typically employ radiative
energy transfer. Radiative tags have the opposite properties of inductively coupled tags;
they work poorly near water and have long wireless ranges of up to 20 m. High frequency
tags are not limited to radiative energy transfer, however. Companies such as Impinj offer
inductively-coupled UHF tags which trade the benefits of long wireless range for usability
near metal and water. Advantages of inductively-coupled UHF tags include protocol and
frequency compatibility with existing UHF infrastructure, unlike low frequency inductively-
coupled tags.
The industry has converged on UHF (915 MHz) tags for commercial deployment due to a
balance between cost (which increases with RF frequency), tag size (antenna scales inversely
with RF frequency) and operating distance (low frequency tags have insufficient operating
range). A link and physical layer standard called EPC (Electronic Product Code) Class
1, Generation 2 - or “Gen2” - has emerged as an industry standard. This specification
is described in detail in Chapter 2. Much of the work in this thesis will focus on tags
that conform to this specification, which allows operation with low-cost COTS readers and
existing infrastructure.
10
1.5 Thesis Overview
This thesis presents work on three wirelessly-powered and wirelessly-interrogated compu-
tational devices (“tags”). All 3 tags are compatible with the EPC Class 1 Generation 2
protocol, allowing use with industry-standard UHF RFID readers. Chapter 2 discusses
the implications of building on this specification. Chapter 3 presents the architecture and
design of a software-defined passive tag called WISP (Wireless Identification and Sensing
Platform) [21]. Implementation details of several WISP applications are presented in Chap-
ter 4 (encryption [22]), Chapter 5 (strain measurement [23]), and Chapter 6 (neural spike
sensing [24]). Chapter 7 presents a novel wirelessly-charged RFID tag power model and
a prototype implementation called the Passive Data Logger [25]. Chapters 9, 10, and 11
present the design, performance, and in vivo deployment of a fully-integrated system-on-chip
sensor tag called “socWISP” [26].
11
Chapter 2
RFID PROTOCOL
2.1 Introduction
Today, commercially-available, long-range, radiative tags and readers primarily use the Elec-
tronic Product Code (EPC) Class 1 Generation 2 UHF Air Interface Protocol Standard [27].
Formally known as ISO/IEC 18000-6 Type C, and informally referred to as “Gen2,” this
specification defines the link and protocol layers for RFID communication. Other specifica-
tions exist for the tag data format [28], and the interface for communicating with the reader
[29]. These specifications are meant to provide interoperability between manufactures and
uniformity for the user. For a overview of other RFID specifications, see [30].
Gen2 improves on its predecessor, Gen1, in several ways. First, it improves inventory
speed for large tag populations. Second, provisions are added for reading and writing of
arbitrary “user” memory. This is especially useful for sensor applications. Lastly, the spec-
ification is more flexible. In the author’s experience, Gen1 readers often operated outside of
specifications. For example, the physical layer timing parameters of the Alien Technologies
9RE-0001 violate the Gen1 specification. This was likely done to compensate for tag design
errors which are costly to redesign. Gen2 has more “wiggle room”, which makes it much
easier for tags and readers to fit into the specification. It also allows manufactures room to
optimize performance and gain a competitive edge. For example, academic findings indicate
significant performance tradeoffs in selection of protocol parameters [20, 31].
However, the purpose of this work is not to optimize tag throughput. Instead, we leverage
the core technologies of RFID in order to enable novel applications beyond item tracking.
To do this, we first review some of the basic principles of RFID systems in Section 2.2.
Next, the link and physical layers are described in Section 2.3 and Section 2.4, respectively.
Estimates of the power available to the tag are given in Section 2.5. Finally, methods for
sensor node communication are discussed in Sections 2.6.
12
2.2 RFID Basics
Passive, radiative RFID systems are dissimilar from traditional wireless networks. Several
distinctions are enumerated below:
2.2.1 The link is asymmetric
State of the art tags require greater than -20 dBm RF input power in order to generate
enough DC power to operate. In order to power a tag at several meters range, readers
typically transmit at the FCC limit of 1 W (30 dBm). This allows for 50 dB of path loss
given -20 dBm tag sensitivity. Assuming the tag perfectly backscatters the received signal
with no loss, the reader received signal is -70 dBm after the same path loss. The reader
thus requires sensitivity on the order of -80 dBm in order to guarantee that performance
is not limited by the reader. This link asymmetry is acceptable because the reader is
often stationary (ex, in a warehouse) and has a wired power supply. The tag performance
requirements must be low in order for the tag to operate with no battery.
2.2.2 Tags cannot hear eachother
Because tags require a relatively large input power to operate (-20 dBm), the reader signal
is trivial to demodulate. This is important because the tag cannot employ an active re-
ceiver due to its limited power budget. Tags typically employ a low power, low sensitivity
diode detector receiver. This low receive sensitivity, coupled with the low backscatter signal
strength from the tag (-20 dBm) and any tag-to-tag path loss, prevents communication
between tags. A workaround involves retransmission by the reader, but this involves signif-
icant overhead because the RFID protocol has no native support for this operation. Other
implications of limited tag receive sensitivity are that tags cannot employ listen-before-talk
channel slotting or perform multi-hop/peer-to-peer communication as in traditional sensor
networks.
13
2.2.3 Readers can hear eachother
Readers have powerful transmitters ( 30 dBm) and very sensitive receivers ( 80dBm). The
signal from another reader is easily stronger than the backscatter from a tag. This means
that a reader talking on the same channel can block another reader from hearing tags. The
interfering reader may or may not affect whether the tag can hear the intended reader.
2.2.4 Readers can talk on different channels
Readers are narrow-band communication systems. Allocated channel bandwidth is given
in [27], and readers are nominally insensitive to activity on other channels. Of course, this
requires sufficient linearity in the reader’s RF frontend.
2.2.5 Tag backscatter occurs on the reader’s channel
Tags reflect received signals back to the reader, and thus tag backscatter occurs on the
same channel (at the same frequency) as the reader. Consequently, readers (which are
narrowband systems) can only hear tags on their channel. The occupied bandwidth of the
tag’s backscatter depends on the backscatter link frequency, which is specified to the tag
by the reader.
2.2.6 Tags cannot distinguish between readers
Tags have a wideband RF front-end. Because rectifiers mix all received signals to DC, there
is no way for the tag to distinguish between received signals on different frequency channels.
Some provisions for tags to recognize different readers in close temporal proximity do exist.
For example, readers can use different “sessions,” which allows tags to distinguish between
one of four time-multiplexed channels.
2.2.7 All communication is reader-driven
The reader always talks before the tag, and compliant tags only talk when requested. This
is inefficient for sensor tags because it necessitates constant polling by the reader in order
to obtain information from tags.
14
Select
(Optional)Query Ack
Req_RN
(Handle)Read / Write
RN16 EPC IDRN16
(Handle)Data
Reader
Tag
Req_RN
(Cover code)
RN16
(Cover Code)
Figure 2.1: RFID communication diagram. The required packets are shown solid, whileoptional packets are dashed.
2.2.8 Tag discovery is stochastic
A reader can directly talk to a specific tag if the tag’s ID is already known (using the Select
command) or if the reader has an open communication session with that tag. However, the
discovery of new tags is a stochastic process. Much like the Slotted-Aloha algorithm, the
reader allocates a number of time slots in which the tags may respond. The tags then choose
a random slot in which to respond. Collisions must be detected and resolved by the reader
by increasing the number of slots or excluding already-detected tags from the next query
round. This process of tag discovery is often referred to as “singulation”. To singulate a
tag refers to the discovery of a tag’s ID through the above process.
2.3 Gen2 Link Layer
The RFID protocol, as it pertains to reading sensor data, is shown in Figure 2.1. First, one
or more Select commands may optionally be issued. This command is intended to allow
inclusion or exclusion of a subset of the tag population using a mask and a logic primitive
AND/OR/XOR as well as a pointer into tag memory.
Second, a inventory round occurs. The reader initializes tags with a Query command,
which specifies number of time slots (2Q) as well as communication parameters as the tag
backscatter link frequency and modulation type. Tags respond with a 16-bit random handle
in a randomly chosen time slot (the chosen slot is based on Q LSBs of the handle). Time
slots are delineated with a short reader command called Query Repeat (QueryRep). A
Query Adjust (QueryAdj) command may be used to change the number of available slots
if the reader detects that it has allocated too many or too few slots.
15
Figure 2.2: Gen2 downlink data encoding. Adapted from [27].
Third, the reader may ask for EPC tag IDs via the handle given by the tag using the
Acknowledge (Ack) command. Tags compare the handle in the Ack command to their own
to determine if they should reply.
Fourth, the reader may optionally perform an “Access” operation. This allows reading
(“Read”) and writing (“Write” and “Block Write”) of arbitrary memory, as well as opera-
tions such as locking the tag into read-only mode (“Lock”) and permanently disabling the
tag (“Kill”). The Read and Write commands are of particular interest for querying sensor
data and sending information to the tag.
2.4 Physical Layer
The Gen2 physical layer employs pulse interval encoding (PIE) for downlink communication
and phase modulation for uplink encoding. Examples of a downlink data-zero and data-one
are shown in Figure 2.2. The tag measures the pulse interval with a digital counter and
compares the measurement against the “pivot” to determine if the bit is a zero or one.
The pivot is specified by a parameter “RTcal”. RTcal is a pulse interval of duration
equal to the sum of a data-zero and data-one. Half of RTcal is the arithmetic average of a
data-zero and data-one, and this is used as the pivot. RTcal is specified at the beginning
of every reader packet in either a Preamble or Framesync. This is depicted in Figure 2.3.
The Query command is preceded by a Preamble, while all other commands have a
Framesync. The Preamble contains a pulse interval called TRcal, which specifies the tag
16
Figure 2.3: Gen2 downlink encoding preamble, which specifies how the tag should parse thebaseband waveform. Adapted from [27].
Figure 2.4: Uplink data encoding format. Adapted from [27].
17
backscatter link frequency (BLF). BLF is a square wave that the tag backscatters to com-
municate which has phase inversions added to encode data. Tags use one of 4 modulation
types: FM 0, Miller 2, Miller 4, or Miller 8. The modulation type is also specified in the
Query command by the reader. Examples of uplink modulation (two consecutive data-
zeros) are shown in Figure 2.4. Notice that each successive modulation has the same BLF
but half the data rate. The Gen2 spec has a number of example waveforms that offer a
good reference for the designer. Additionally, Section 9.6.8 and Section 9.6.7 present design
details for generation of these encodings.
2.5 Power Available To A Tag
Modulation parameters affect how much power is available to the tag. In the downlink
communication, reader amplitude modulation reduces average transmitted power. In the
uplink communication, tag backscatter reflects energy back to the reader instead of con-
verting it to DC power. Unfortunately, for all backscatter settings, the modulator is on
approximately half of the time. This results in 3 dB of power loss while the tag is commu-
nicating. For downlink communications, the settings are more flexible. The low-amplitude
duration, PW, becomes a smaller portion of the pulse interval as Tari increases (Tari is
the length of a data-0, shown in Figure 2.2). In the worst case, PW is 52.5% of Tari, and
the packet consists mostly of data-zeros. This results in roughly 3 dB power loss while the
reader is communicating. In the best case, PW is 26.5% of Tari and the packet consists
mostly of data-ones with PIE = 2. This results in 13.5% power loss, or 1.23 dB while the
reader is communicating.
2.6 Sending Sensor Data
There are a variety of methods to communicate data other than the EPC ID using Gen2
protocol. These are discussed below:
2.6.1 Shoehorn Data into the ID
The simplest method, which we also employed using the Gen1 protocol, is to embed data
into the ID. This causes minimal overhead aside from reducing the available ID space.
18
However, Gen2 allows for greater than 450-bit IDs - this easily accommodates a long ID in
addition to significant sensor data. Even standard 96-bit IDs provide adequate space for
many applications. The obvious drawback of this method is that it violates the protocol
and likely voids compatibility with middle-ware used in commercial deployments.
2.6.2 Access Commands
At the penalty of slightly increased tag complexity, dedicated Read and Write commands
are available. This enables bidirectional communication, although as previously mentioned,
it is reader-driven. Tags only respond to reader commands, which means that for the tag
to send data to the reader, the reader must issue a Read command. The reader would send
data to the tag using the Write command. Note that packet delivery is not guaranteed.
The user would need to build this functionality on top of the Gen2 protocol.
There is significant overhead for performing a single Read or Write operation because
the reader must first singulate the tag. At minimum, this includes the Query, Ack, and Req-
RN commands or approximately 50% increased overhead. If more than one tag is present,
a Select command can be added to reduce singulation time. Thus, performing one Read
command is much slower than sending data in the ID. However, if many Read commands
are performed in succession after the tag is singulated, the effective throughput is greatly
improved. Note that some commercial readers (ex, the Impinj Speedway reader) are not
capable of multiple successive access commands at this time.
2.6.3 The Select Command
The Select command presents an opportunity to communicate with tags with very little
overhead (no Query/Ack/ReqRN/Write). The reader may send a long data mask, a log-
ical operation, and a memory pointer. However, the tag has no opportunity to respond.
This could be used for selecting only tags with particular sensor values (ex, temperature too
warm), sending broadcast information to all tags, or instructing the tags to have some infor-
mation ready (encrypted data, sensor measurement, etc.) when a Read or Write command
is issued later.
19
2.7 Conclusions
The Gen2 specification is very flexible and feature-rich. The biggest hurdle is often not the
protocol itself but the way commercial readers implement it. For example, many readers
will only perform one access command and then reset. This forces significant overhead in
singulating tags repeatedly. However, as reader technology improves, so will the flexibility
they offer the user. Nevertheless, the remainder of this thesis presents work built around
commercial readers. This demonstrates the usability of the protocol for a wide variety of
sensor and security applications in spite of any limitations imposed by COTS readers.
20
Chapter 3
A PASSIVE, SOFTWARE-DEFINED SENSOR TAG
3.1 Introduction
The Wireless Identification and Sensing Platform (WISP) was born out of the question
”What novel applications can be enabled through RFID technology?” At the time, RFID
tags were mainly considered to be wireless identifiers for tracking objects. Indeed, many
initial experiments employed commercial tags to enable smarter living spaces, help provide
elder care through behavioral monitoring, and even localize robots. However, it quickly
became evident that visibility into the state of the tagged objects could be improved by
collecting richer, sensor-enhanced data.
Early prototypes encoded sensor information by multiplexing several commercial tag
ICs onto a single antenna. For example, mercury switch accelerometers connected one of
two tag ICs to an antenna. This provided 3 states of information: up, down or not present
[16]. Later, a RF-powered microcontroller multiplexed the commercial tag ICs using a GaAs
switch [32]. However, the use of commercial tag ICs severely constrained the communication
bandwidth because there was little control over what information the IC transmitted. This
lack of control motivated development of a tag design. In order to explore a variety of new
applications, a tag with software-defined behavior and easily-configurable hardware was
needed. This first WISP consisted of a low-power microcontroller, energy storage capacitor,
Schottky diode RF rectifier, modulator/demodulator, and low-quiescent-current regulator
on a custom PCB. Using this relatively simple design, light and temperature data were
wirelessly reported at a distance of approximately 1 m [33].
The WISP hardware and firmware have evolved to enable greater performance and a va-
riety of new features. Examples include extended wireless range of up to 3 m, compatibility
with the latest EPC RFID protocol, and integration of new sensors measuring everything
from mechanical strain to biomedical neural signals [34][21][24]. The latest hardware is
21
Figure 3.1: Photograph of the WISP 4.1 hardware.
shown in Figure 3.1, and extensive documentation is available online as part of the WISP
Challenge Giveaway.
The remainder of this chapter will discuss the WISP platform in detail. Section 3.2
presents the theory of operation including the wireless power model used by WISP. Sec-
tion 3.3 describes the hardware design, and Section 3.4 describes the firmware design. Fi-
nally, Sections 3.8 and 3.9 discuss the applications and impacts of this work including
educational outreach and research collaboration.
3.2 Theory of Operation
The WISP, like conventional RFID tags, is powered and interrogated wirelessly by commer-
cial RFID readers. Due to RF path loss, the power available to the tag can be very small
- on the order of microwatts - despite reader transmit power of 1 W. Consequently, WISP
shares some design constraints and operational principles with commercial tags. However,
due to the need for software programmability and hardware configurability, WISP requires
a more complex power model than conventional tags.
A first-order approximation of the received power, Pr, based on Friis’ Transmission
Equation is given in Equation (3.1).
Pr = PtGtGr
(λ
4πR
)2
ηLmLp (3.1)
Pr is the power received given a transmit power Pt = 1 W = 30 dBm, antenna gains
Gt = 6 dB and Gr = 2 dB, distance R, wavelength λ = cf = 3×108
915×106 = 0.33 m, RF to
DC conversion efficiency η = 25% = -6 dB, amplitude modulation losses Lm and antenna
22
Distance (m) Power (dBm) Power (µW)
1 -5.67 271
2 -11.7 67.6
3 -15.2 30.1
4 -17.7 17.0
5 -19.7 10.8
Table 3.1: Predicted available tag power versus range
polarization losses Lp. Section 2.5 discussed how amplitude modulation in the Gen2 protocol
physical layer affects the power available to the tag. For 50% duty cycle, the modulation
loss Lm = 12 = -3 dB. Finally, for a circularly-polarized reader patch antenna and linearly-
polarized tag dipole antenna, polarization loss Lp = 12 = -3 dB. Table 3.1 lists a few
examples of available power at increasing distances. For a fixed-function ASIC tag with
several microwatts power requirement, greater than 5 m range is clearly achievable even
with a modest rectifier efficiency of 25%.
A key feature of WISP is its programmability, which is enabled through a low-power
Texas Instruments (TI) MSP430 microcontroller. This microcontroller consumes approxi-
mately 2 mW while performing communication, which would limit operation to sub-meter
distances based on available power shown in Table 3.1. However, while the microcontroller
is in low power sleep mode it consumes less than 1 µW, and the WISP rectifier can gen-
erate sufficient operating voltage of 1.8 V at input power levels of approximately -10 dBm
(distance = ?). To enable operation when received power is less than active power, a new
tag power model is required where energy is accumulated until sufficient to complete a task.
This can be represented by the following equations, where energy is stored in a capacitor:
Ptask = VddItask (3.2)
if(Ptask > Pr), Estored ≥ Etask,net (3.3)
Etask,net = (Ptask − Pr)Ttask (3.4)
23
Estored =12C(V 2
s − V 2dd) (3.5)
Vs ≥√
2CEtask + V 2
dd (3.6)
Equation (3.2) defines the active power required to perform a task such as communica-
tion, computation or sensing. Equation (3.3) states that if the power required to perform a
task is greater than the power being received from the RFID reader, some power must be
supplied by the storage capacitor. Specifically, the energy required to perform the task must
be less than the usable energy stored in the capacitor plus the energy to be received while
performing the task (Equation (3.4)). The usable energy stored in the capacitor is given by
Equation (3.5), which counts voltage above the microcontroller operating voltage. Finally,
the required voltage on the storage capacitor can be derived from the previous equations,
and the result is shown in Equation (3.6).
The result is that the amount of energy storage required is a function of the largest
required contiguous task, and the amount of stored energy is determined by Vs and the
capacitor size. An example of a contiguous task is communication; an ID inventory requires,
at minimum, two consecutive reader-tag interactions while the Read command requires 4
consecutive reader-tag interactions. Sensing tasks can also demand significant Ttask as
analog filters settle out. Section 3.8 demonstrates that energy can be saved by sampling
before the filters settle and reducing error by modeling the filter time constant to predict the
final value. For computational tasks, checkpoint-based methods can allow long tasks such
as encryption to be broken into subtasks [35]. Because the tag may move out of range from
the reader at any time, computations stored in volatile memory may be lost. However, the
cost of writing to non-volatile memory can be significant. So, a balance is required between
aggressively performing computation and keeping stored progress updated.
Alternating between accumulating energy and performing tasks effectively reduces the
duty cycle of operation. At short distances no duty cycling is needed because Ptask < Pr.
For long distances where Ptask ≥ Pr, equations (3.7) and (3.8) compute the duty cycle, DC,
and expected task rate per second, ftask, in terms of Pr, the power received at distance R.
DC = min(Pr
Ptask, 1) (3.7)
24
ftask =DC
Ttask= min(
Pr
Etask,
1Ttask
) (3.8)
These equations assume the reader is continually sending modulated power. This is often not
the case, as the reader periodically stops to frequency hop, communicate with application
software, and check for interference with other nearby readers. Generally, Pr is now reduced
by the duty cycle of the reader. For communication tasks, Ttask ≈ Tquery where Tquery is
the amount of time the reader is on for a communication round. The duty cycle given
in Equation (3.7) now represents the fraction of queries that can be responded to. The
communication rate, fcomm, is now a function of the reader query rate, freader and is given
by Equation (3.9).
fcomm = DC × freader (3.9)
The reader rate depends significantly on the choice of Gen2 physical layer parameters, tag
population size, and amount of data retrieved from each tag as discussed in Section 2.5. On
the tag side, the duty cycle, DC, is maximized through energy-efficient firmware, minimal-
complexity protocol, signal processing to reduce sensor energy requirements, etc.
3.3 WISP Hardware Design
The hardware is tasked with converting RF energy into regulated DC power for the system,
facilitating RFID communication, and incorporating useful sensors onto a minimally-sized
PCB. The power model of the WISP is described in detail in Section 3.2, and the design
goals can be concisely stated here to motivate the design choices. In order to maximize
wireless range, the quiescent current consumption must be minimized. In order to maximize
operational duty cycle, the active current consumption must be minimized. Fortunately,
digital wristwatches share these design goals in order to maximize battery life, so COTS
parts are available to meet our specifications.
A high level diagram of the WISP design is shown in Figure 3.2. Power transmitted
by the reader is received by the antenna on the left. The RF envelope is recovered by a
rectifier and used to supply power to the tag. The communication block extracts amplitude-
modulated downlink communication and facilitates uplink backscatter communication. The
power management block enables the firmware to operate despite an extremely limited power
25
Matching
Network and
Power
Harvester
MSP430
µC
Ant
Communication
Sensors
Power
Management
Figure 3.2: WISP hardware block diagram.
Modulator
Input
915 MHz
Dipole Antenna
Rectifier
Output
Figure 3.3: WISP rectifier and modulator. Low-capacitance RF Schottky diodes are filledblack, while low-leakage DC Schottky diodes are filled white.
budget. Finally, sensors are powered and read by the MSP430 µC.
3.3.1 RF Front End
The RF front end is shown in detail in Figure 3.3. An L-match network transforms the tag
input impedance to match that of the antenna (72 Ω). The matching network capacitor Q is
not a concern; however, high-Q (Q = 30 to 40) inductors in the 1-20 nH range from Coilcraft
are used to minimize loss. The series and shunt capacitors in the voltage-multiplying rectifier
are 7 pF and 10 pF respectively, but their values are not critical. Conversely, the number
of voltage-doubling stages and the RF Schottky diode selection can affect performance
dramatically. This design uses Avago HSMS-285x diodes in a 5-stage configuration to
26
Regulated
Supply
Supervisor
Interrupt
Cstorage
SV
1.8 V
Reg.
Level
Shifter
Clamp
VS
Rectifier
Output
Figure 3.4: Power management circuitry. A regulator creates a stable supply voltage for themicrocontroller and sensors, and a voltage supervisor detects sufficient voltage for operation.The unregulated voltage is clamped to 5.5 V by a zener diode.
maximize input power sensitivity. Note that the rectifier may instead be optimized for
maximum power conversion efficiency. This would improve operational duty cycle at the
cost of maximum-achievable range.
3.3.2 Power Management
One particular challenge is that the WISP hardware and firmware design are closely in-
terrelated. Unlike battery-powered systems, the firmware may only remain in active mode
for milliseconds at a time before brownout occurs and the microcontroller resets due to
under-voltage. Several hardware mechanisms facilitate efficient firmware operation, and
energy-conscious firmware design helps maximize wireless range and operational duty cycle.
As mentioned, the rectifier recovers the RF envelope, which is amplitude-modulated to
encode downlink data. This envelope, which is essentially the baseband signal, is again
rectified and stored in Cstorage to provide an energy source for the tag (see Figure 3.4). The
stored energy is regulated to 1.8 V by a 1 µA quiescent current linear regulator (On-Semi
NCP583). Here a tradeoff is made between active duty cycle and wireless range: switching
regulators provide high efficiency at the cost of additional quiescent current. Finally, an
overvoltage protection diode (On-Semi ESD5Z3.3) clamps the unregulated voltage to 5.5 V.
Section 3.2 describes the WISP theory of operation: when received power is less than the
27
Figure 3.5: Analog voltage sensor schematic. The V oltageSense pin connects to a µC ADCinput, and the V oltageSenseEnable pin is driven by a µC digital output. Note that Cstorage
is repeated from 3.4 for clarity.
power to perform a task such as communication or sensing, the difference must be supplied
from the storage capacitor. The amount of energy required, represented as voltage on the
storage capacitor, is given by Equation 3.6. For many tasks, a standard storage voltage of
2.0 V (200 mV) is detected by a 300 nA quiescent current voltage supervisor (Seiko S-1000,
see Figure 3.4). The advantage of this mode of operation is that the microcontroller does
not need to periodically poll for sufficient voltage; the supervisor asyncronously provides a
hardware interrupt to the microcontroller when sufficient voltage is reached. The hardware
voltage supervisor is used for routine communication and sensing tasks.
Energy-intensive tasks such as encryption, measuring high-power sensors, and memory-
access communication require precise power management. For these tasks, an analog voltage
sensor enables the microcontroller to poll for a specific voltage. The schematic is shown in
Figure 3.5. Because the unregulated voltage can be much larger than the regulator supply
voltage, it must be scaled down by 13 using a voltage divider before reaching the ADC input.
There are conflicting requirements for the voltage divider: large resistors reduce quiescent
current draw, but small resistors allow for quick sampling due to their ability to drive the
ADC input capacitance. An enable circuit bypasses this tradeoff by allowing small resistors
to be disabled while not in use. An analog switch (TI TS5A3166) is needed to prevent
overvoltage to the µC when the resistors are disabled.
A low power level shifter (On-Semi NLSV1T244), is used to translate the supervisor and
demodulator signals (to be discussed in Section 3.3.3) to the logic level of the microcontroller.
28
0
0.5
1
1.5
2
2.5
0 20 40 60 80 100
Time (microseconds)
Voltage
Demodulator Output Reference Rectifier Output
Figure 3.6: Demodulator input, reference and output voltage trace.
Without the level shifters, the regulated supply is pulled up to the unregulated voltage
through the over-voltage protection diodes in the microcontroller. Under low input power
conditions (unregulated voltage < 2.8 V), the total supply current of each level shifter is
less than 500 nA. At high unregulated voltages up to 6 V, total supply current remains less
than 2 µA.
3.3.3 Communication
The RF envelope is the baseband modulated data, but signal conditioning is required to
provide a logic-level signal to the microcontroller. Figure 3.6 shows an oscilloscope trace of
the demodulator in action. The raw rectifier output has insufficient swing to function as a
logic level signal. The demodulator, shown in Figure 3.7 compares the instantaneous voltage
output of the rectifier, which represents the RF envelope, to the peak value (minus a diode
drop), which acts as a reference for comparison. This is effective for two reasons. First, the
internal capacitance and back-leakage in the rectifier cause the rectifier output voltage to
decay exponentially when the input RF envelope is low. Second, the low-amplitude envelope
durations are short in duration, which means that the rectifier output has little time to decay.
This conspires to create short dips below the peak rectifier output, which are conveniently
detected by placing the reference one Schottky diode drop below the peak output. The
29
Demodulator
Output
+
_
Demodulator
Enable
Level
Shifter
Regulated
SupplyRectifier
Output
1 µF
Figure 3.7: ASK demodulator schematic. A comparator uses the peak envelope minus a0.3 V diode drop as a reference. A footer transistor disables 10 µA of quiescent current.
comparator supply current is used to create the diode voltage drop without wasting power
through a resistor, and this also functions to provide power to the comparator only while
the reader is actually communicating to the WISP. A smaller, 1 µF cap simultaneously
stabilizes the reference voltage and comparator supply voltage.
3.4 WISP Firmware
The WISP firmware has several tasks. At the lowest level, it must provide power manage-
ment to keep the system due to undervoltage. In the middle is the communication code,
which implements the EPC Class 1 Generation 2 (Gen2) protocol and provides a means for
transmitting and receiving data. At the highest level is the application layer, which governs
the behavior of the WISP. The use of a programmable microcontroller allows WISP to be
easily configured for a wide variety of applications. Figure 3.8 shows these firmware blocks
along with their respective hardware connections. The latest WISP hardware (WISP 4.1)
employs a TI MSP430F2132 microcontroller. As TI has made improvements to the MSP430
product line, WISP has evolved to take advantage of new features, reduced power consump-
tion, faster clock speeds, and additional flash/RAM. As discussed in Section 1.2, Moore’s
Law is expected to drive down the cost per instruction as technology improves. This will
enable a richer feature set in wirelessly-powered devices. For now, however, fine-tuned
30
Power Management
Voltage
Detector
Voltage
Sense
Communication
Application
Mod &
DemodSensors Hardware
Firmware
Figure 3.8: Firmware block diagram including relevant hardware connections.
Charging
(LPM4)
Power On Contiguous
Task
SV High
SV High
SV Low
Figure 3.9: Basic power management state diagram for standard tasks.
assembly code is required to simply meet timing constraints while operating the micro-
controller at its lowest voltage - a seemingly small detail which has a significant effect on
wireless range and operational duty cycle.
3.4.1 Power Management Firmware
The amount of RF power available to WISP varies greatly with distance, and this necessi-
tates robust power management circuitry for reliable operation. The basic power manage-
ment algorithm of WISP is shown in Figure 3.9. The µC powers on into Active Mode at
approximately 1.5 V. This mode draws several hundred µA of current, and would quickly
brown out the system if left active. The power management scheme immediately puts the
µC into low power sleep mode with an interrupt enabled for the hardware supervisor. When
31
VS > VReq.Charging
(LPM4)
Power OnPoll VS
SV High
SV High
SV Low
Do Task
Task Complete
Figure 3.10: Advanced power management state diagram for power-hungry tasks.
the supervisor detects 2.0 V, an external input interrupt is triggered and a task may be
performed. The supervisor output can also be sampled directly, and more tasks may be
performed as long as the supervisor is high.
Not all tasks can be completed using the hardware supervisor. When the energy required
to perform the task requires Vs > 2.0V , a more advanced power management scheme is
employed. Figure 3.10 illustrates the state transitions. The bootup scheme is similar to
the basic power management scheme. When power is very low, the hardware supervisor is
used to wake the µC. However, when the voltage supervisor is high, the next state polls
the analog voltage sensor to determine the exact stored voltage. Polling requires a slightly
higher quiescent current because a clock source must be enabled in the µC. A fraction of
the very-low-frequency oscillator (”VLO”) or 32 kHz crystal oscillator can be used to set
the polling interval. These modes require approximately 1 µA instead of 0.1 µA quiescent
current from the µC. Voltage sampling is optimized for speed in order to reduce energy
expenditure (power times time). Sampling takes approximately 20 µs, and thus polling at
1 ms intervals or greater causes a very minimal impact on system power consumption. When
the voltage polling determines that sufficient voltage has been accumulated to perform the
task, the task is executed.
3.4.2 Communication Firmware
WISP performs EPC communication with minimum clock cycles via fine-tuned assembly
code. Both downlink and uplink communication rely heavily on the hardware timer module.
Downlink communication measures pulse intervals using the timer capture module, and
32
uplink communication creates the periodic output waveforms using the timer output and
compare modules. Uplink communication code is synchronized in instruction count to the
output timer. The firmware updates the compare-to value real-time in synchrony with the
timer to affect the output frequency, which in turn encodes ones and zeros.
The most significant protocol limitation of WISP is that it currently only supports
Miller-4 uplink encoding with Tari values between roughly 10 µs and 25 µs. WISP previ-
ously supported Miller-2 encoding; however, lack of reader support motivated conversion
to the Miller-4 protocol. Furthermore, previous microcontrollers lacked flash memory to
support multiple uplink encodings. The latest WISP has additional flash memory, so a
motivated researcher could expand WISP’s protocol capabilities. Unfortunately the fastest
communication rates are unachievable with 1.8 V supply voltage clock rates (up to 6 MHz).
We experimented with using a Coolrunner-II CPLD for protocol encoding/decoding and
MSP430 for application and power management. We found that two XC2C256 (256 macro-
cell) CPLDs (one for uplink, one for downlink), or perhaps one XC2C512 (512 macrocell),
could implement the full protocol. However, the macrocell to package size ratio is unattrac-
tive for WISP-form-factor applications.
3.4.3 Application Firmware
The RFID protocol is described in detail in Chapter 2. The minimum amount of commu-
nication necessary to gather WISP data is Query/Ack, although formal Read and Write
memory operations are also supported. WISP requires a high clock rate of approximately
3 MHz while communicating, which consumes substantial power. For comparison, the cost
of a programmable µC versus synthesized Verilog code is roughly 100 to 1 in power con-
sumption. However, by re-purposing part or all of the 96-bit EPC ID for sensor data,
significant energy savings are realized versus a complete memory read operation. Other
EPC bit lengths are available, but 96-bits is common for commercial tags. The data format
is shown in Figure 3.11.
WISP can also process Select, Request RN, Read and Write commands. The WISP
allows use of standard EPC Read commands, enabling sensor data retrieval from user mem-
33
Tag Type (1) Data (8) Version (1) Serial Number (2)
Figure 3.11: WISP packet structure. The information and number of bytes are shown ineach box. The tag type is often used to specify the sensor type. The data is typically sensordata. The WISP version allows marking of hardware or firmware revisions to be used forperformance evaluation or debugging. Finally, a tag-specific ID is given.
ory instead of re-purposing the EPC ID to encode the data. However, WISP populations
are typically less than 100 tags, and so ID space limitations have not been a major issue
in our experience. One reason that re-purposing the ID has not been a problem is due to
tag singulation changes between Gen1 and Gen2 RFID. Specifically, the use of a random
handle instead of ID tree-walking removes the effect of the ID on tag singulation. Various
sensor applications are described in detail in Section 3.8 which utilize this packet format.
3.5 WISP Troubleshooting
WISP requires non-conventional debugging methods due to its precarious power source. In
fact, many of the development challenges arise from power management issues. The WISP
Monitor [36] is a board consisting of a microcontroller and a UART-to-USB chip. The
Monitor allows a developer to monitor all pins (except the Voltage Regulator pin) on the
WISP 4.1 and stream debugging data to a PC via an FTDI FT232R UART-to-USB chip.
For simplicity, the Monitor uses the same µC model as the WISP. The WISP Monitor is
also powered by the USB cable, which allows it to not affect the WISP’s power budget. A
photo of the system is shown in Figure 3.12.
3.6 Discussion
Many applications require robust, high-bandwidth uplink (tag-to-reader) and/or downlink
(reader-to-tag) communication. Several realized examples will be presented in Section 3.8
including logged-data transfer, real-time sensor reading, actuation (ex, blink LED) in addi-
tion to standard Gen2 inventory activities. In many of these applications, achieving desired
34
Figure 3.12: Photograph of the WISP Monitor connected to a WISP [36]. Data is sent backover the USB port.
performance can be difficult or infeasible because the Gen2 protocol, and RFID in general,
were designed primarily for inventory applications. That is, the protocol was optimized to
robustly and completely identify large tag populations. Operations such as tag memory
access are supported but inefficient due to protocol overhead, computer-to-reader latencies,
security issues and even the uncertainty of tag power availability. Despite these drawbacks,
the commercial availability of Gen2 readers and widespread industrial deployments of Gen2
RFID systems (see Walmart, DoD) allow Gen2 applications to be leveraged and expanded
by others in academia and industry.
3.7 Performance
The received voltage and power versus input power are shown in Figure 3.13(a), and the
rectifier efficiency versus input power is shown in Figure 3.13(b). The sensitivity suffers
approximately 10 dB versus integrated designs due to parasitics in packaged components.
35
0
1
2
3
4
5
6
-20.0-15.0-10.0-5.00.05.0
Input Power (dBm)
Output Voltage
-270
-170
-70
30
130
230
330
430
530
630
Available Power (uw)
Low-to-High (V)
Turn On
Power (uW)
(a) Output voltage and power.
0.0%
5.0%
10.0%
15.0%
20.0%
25.0%
30.0%
35.0%
-10.0 -8.0 -6.0 -4.0 -2.0 0.0 2.0 4.0
Input Power (dBm)
Efficiency
(b) Power conversion efficiency.
Figure 3.13: Rectifier performance versus input power.
36
0
10
20
30
40
50
60
70
80
90
100
1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0
Calculated Distance (m)
Percent (%)
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
5.5
0 2 4 6 8 10 12 14
Attenuation (dB)
Voltage (V)
Successful Responses Per Query (%)
Uplink Packet Errors (%)
Output (V)
Figure 3.14: WISP communication and error rates as a function of RF attenuation andcalculated distance.
As shown in Figure 3.14, the read rate also drops with input power unlike IC tags due to
the need for duty cycling (see Section 3.2).
Figure 3.14 shows communication and error rates as a function of RF attenuation and
calculated distance. The WISP was placed at 1 m from the reader antenna and an adjustable
attenuator was connected in series between the reader and antenna. Equivalent distance
is calculated using Friis’ Transmission Equation. The error rate is measured by counting
dropped packets. Because the reader silently rejects packets with errors, the WISP is
configured to number each ID sequentially. This allows missing packets to be detected on
the application side.
3.8 Applications
3.8.1 Light and Temperature
The WISP has been used for measuring a variety of sensors. Temperature and light data
are shown in Figure 3.15 and Figure 3.16, respectively.
37
Figure 3.15: Temperature measurements in response to artificial stimuli [33].
Figure 3.16: Light sensor data plotted over a 24 hour period [33].
38
0
50
100
150
200
250
300
350
400
450
500
0 5 10 15 20
Time (ms)
ADC Sample Value
0
5
10
15
20
25
30
35
Peak to Peak Noise
Sample
Absolute Noise
Scaled Noise
Figure 3.17: Acceleration measurements in time as the sensor output filter settles out. Thepeak to peak “absolute” noise for 100 samples is also plotted for each sampling time. Thenoise, scaled to correct for the fact that the sensor has not settled, is plotted as ScaledNoise.
3.8.2 Acceleration
Acceleration data is useful for user input devices as well as determining the orientation of
an object relative to gravity. The accelerometer (Analog Devices ADXL330) is a relatively
high-power sensor, drawing 200 µA. Also, a long filter time constant is used to prevent
vibration artifacts (aliasing) due to the WISP’s slow sample rate of 1 Hz to 50 Hz. This
long RC settling, combined with the high sensor current consumption, causes a significant
performance penalty due to the high amount of energy required per sample. Samples plotted
as the sensor value settles are shown in Figure 3.17. Because the filter is a simple linear RC
low-pass filter, the attenuation caused by the filter at any point is time can be calculated.
For a given settling time, the filter attenuates by a constant fraction regardless of the final
value. This can be compensated by multiplying the measured value by a scaling factor. The
scaling factor is calculated based on the RC time constant and the allowed settling time.
There is a tradeoff between noise and settling time (energy expenditure) shown in Fig-
ure 3.17. The more time is given to settle, the lower the sampling noise (Absolute Noise)
becomes. However, the noise is also scaled by the same constant used to compute the final
39
Figure 3.18: Acceleration measurements as the WISP is rotated in orthogonal planes [34].
acceleration value. This is plotted as Scaled Noise. By approximately 5 ms, the noise has
reached its minimum and there is no benefit by waiting longer. Aggressive designs can use
2 ms or 3 ms settling time at the cost of higher noise.
Figure 3.18 shows acceleration data as the WISP is rotated in orthogonal planes. This
data can be streamed to a log file or used real time by the reader application. For example,
the WISP GUI (see Section 8) includes a demo where the user can orient a 3D object
by manipulating the orientation of WISP. The WISP accelerometer has also been used to
prototype a passive RFID security keycard or credit card activation mechanism [37]. The
user makes a motion gesture to activate the card, which prevents ghost-and-leech attacks.
3.8.3 LED
WISP can wirelessly power an LED. At short distances, the LED can be illuminated con-
tinuously. At long distances, the LED blinks at a duty cycle that is limited by the available
40
Figure 3.19: WISP wirelessly powers an LED when commanded by the reader. The lightedLED indicates the location of an item in a bin.
power. An example application is shown in Figure 3.19. Here, the user selects an item on
the computer. The computer instructs a particular tag to blink to indicate the location of
the item.
3.8.4 Near Field
UHF RFID tags can also work with in the inductively-coupled regime. Figure 3.20 shows an
example of WISPs embedded in playing dice. WISP’s accelerometer allows the dice states
to be wirelessly reported, where they are displayed to the user.
3.8.5 Other WISP Applications
Implementation details of several WISP sensor applications are presented in Chapter 4 [22]
(encryption), Chapter 5 [23] (strain measurement), and Chapter 6 [24] (neural spike sensing).
3.9 Conclusions and Impacts
WISP’s software programmability and hardware flexibility enable its application towards
a wide variety of applications. Collaborative efforts with researchers changing from aero-
41
Figure 3.20: Near-field WISP embedded in playing dice. WISP’s accelerometer allows thedice states to be wirelessly reported.
nautics engineers to neuroscientists has led to exciting technological advances. Perceiving
a continued interest in RFID research, the WISP developers launched a WISP Challenge.
After accepting proposals for WISP hardware grants, Intel donated over 150 WISPs to 23
research groups. Extensive documentation, tutorials and informational pages are available
online via a public wiki at http://wisp.wikispaces.com. As of July 2009, there were
over 70 unique visitors per day, over 50 members, and 51 wiki pages. It is our hope that
this donation will help spur exciting RFID research, especially in other disciplines such as
computer science, biology, and medicine.
42
Chapter 4
MAXIMALIST CRYPTOGRAPHY AND COMPUTATION FOR UHFRFID TAGS
4.1 Introduction
Because of computational constraints on many RFID tags, classical cryptographic primi-
tives such as block ciphers and asymmetric cryptography were thought to be unrealistic on
a low-resource tag [38]. To this end, many lightweight cryptographic protocols have been
proposed [39, 40, 41, 42, 43, 44, 45]. However, many such protocols have serious vulner-
abilities [46, 47, 48]. Moreover, the lack of a development platform makes it difficult to
determine the feasibility of proposed cryptographic schemes. Thus, a popular approach is
to minimize cryptographic operations to ensure feasibility on an RFID tag. This minimalist
approach [38] can leave spare computational resources unused. An open question is then
how to best maximize the security on an RFID tag to fully utilize available computational
resources.
Our approach to maximizing security relies on low-power microcontrollers. Continuous
improvements in the efficiency of microelectronics (i.e., required energy per instruction) now
enables wirelessly-powered, general-purpose microcontrollers — infeasible at any reasonable
range a few years ago. Such microcontrollers make traditional cryptographic methods more
feasible on RFID tags.
Using a maximalist approach to cryptography, our results show that an RF-powered UHF
tag can perform strong encryption. We provide preliminary experimental results of imple-
menting RC5-32/12/16 [49] on WISP (Wireless Identification and Sensing Platform) [50]
— a battery-free platform powered and read by a standards compliant UHF RFID reader
running the EPC Class 1 Gen 1 protocol. Our contributions include:
1. We provide preliminary experimental data on how much computation is available on
a microcontroller-based RFID tag.
43
2. We show that symmetric cryptography is feasible on an RF-powered, general-purpose
RFID tag. To the best of our knowledge, this is the first implementation of conven-
tional cryptography on an RF-powered UHF RFID tag.
4.2 Background on WISP Architecture
The WISP’s general-purpose computation capabilities are provided by an ultra low power
microcontroller, the TI MSP430F1232. This 16-bit device has just over 8 kBytes of flash
memory, 256 bytes of RAM and a 10-bit, 200 kilo-samples-per-second Analog to Digital
Converter (ADC). It can run at 8 MHz with a 3.3 V supply voltage, 6 MHz with a 3.0 V
supply, and 4 MHz with a 1.8 V supply. To erase and write to flash memory, a minimum
2.7 V supply is required. In this application, we used a 3.0 V supply because a suitable
ultra-low quiescent current 2.7 V regulator was not available. In active operation at 3.0 V,
the microcontroller consumes approximately 690 uA to 1.4 mA. Erasing and writing flash
both require approximately 3 mA. Reading from flash requires no additional power (above
ordinary active-mode operation). The flash in the MSP430’s information memory must
be erased in 128 byte blocks; its main memory is erased in 512 byte blocks. Bytes are
individually writable. Erasing the flash memory takes more time and therefore more energy
than writing or reading flash. Erasing a block requires 1.51 ms; writing a byte takes 32.7 us;
reading a byte from flash requires no more time than accessing RAM.
The MSP430 has various low power modes that are very useful for wirelessly powered
operation. Its lowest-power mode, “RAM-retention mode,” which stops all computation
but maintains state, requires only 0.5 uA at 1.5 V. The low power consumption of this
relatively new device is a critical factor in enabling use of a general-purpose microcontroller
in RF-powered RFID systems.
4.3 Related Work
Because of the resource-constrained nature of nodes in sensor networks, many of the design
criteria for security coincide with that for security of RFID tags. SPINS [51] and TinySec [52]
both present experimental data on implementation of security protocols in sensor networks.
Both works implemented RC5 for their block ciphers because of its small code size and high
44
Platform Power
Com
puting
Stor
age
Com
mun
icat
ion
Dista
nce
EPC Gen1 [53] UHF RF State
machine
64 bits UHF
backscatter
3-7.5 m [54]
EPC Gen2 [53] UHF RF State
machine
96/128 bits UHF
backscatter
3-7.5 m [54]
WISP [55] UHF RF 16-bit
8MHz
8KB+
256 bytes flash
256 bytes RAM
UHF
backscatter
< 4.5 m
DemoTag [56] Battery 8-bit
16MHz
4KB EEPROM
4KB SRAM
128KB flash
HF
backscatter
N/A
Mica2 Battery 8-bit
8MHz
128KB ROM
4KB RAM
512KB flash
UHF/
433MHz
40-50 m [57]
Microchip
MCRF202
Inductive 12-bit
400kHz
96/128 bits LF
backscatter
1.3-10.2 cm [58]
Proxmark3 [59] USB 32-bit
16MHz
256KB flash
64KB SRAM
LF and HF
backscatter
N/A
RFIDGuardian [60] Battery 32-bit
520MHz
16MB flash
64MB SRAM
HF
backscatter
.5 m
Table 4.1: Comparison of WISP with other RFID devices.
efficiency, and they show that RC5 provides a balance between security and performance
for sensor networks. Although sensor nodes have limited resources, general-purpose RFID
tags are even more limited in memory, power, and computing capabilities. Sensor nodes
like the Mica2 platform have their own power source onboard, and they have orders of
magnitude more storage. Table 4.3 provides side-by-side comparison of different devices
with RF interfaces. WISP is most comparable to general-purpose RFID tags such as EPC
Gen1 and Gen2.
45
There are many HF tags capable of cryptography because of their common usage in
building access control and authentication applications [61]. HF tags can afford to be more
expensive in terms of manufacture cost and therefore provide stronger cryptography because
the demand for tags with built-in security and privacy mechanisms, which is usually achieved
with a separate cryptographic engine. Israsena proposes the Tiny Encryption Algorithm
(TEA) as a suitable encryption engine for low-cost RFID applications [62]. Three different
architectures for the TEA encryption algorithm are presented that fit within the budget of a
5 cent per tag cost. Aigner and Feldhofer discuss their results on an implementation of Tiny
AES (TINA) as an ASIC [63]. Although both systems comply with stringent requirements
for low-cost RFID systems (average current consumption below 10 uA), they depend on
separate special-purpose circuitry. While ASICs are efficient in terms of power consumption
and cost, they are inflexible and limited to a narrow set of applications. Because of this
inflexibility, the cost for prototyping and development is relatively high — making it difficult
and time consuming to realize in actual applications. To the best of our knowledge, our
system provides the first UHF RFID tag using general-purpose microcontroller to provide
cryptographic capabilities under non-trivial computational constraints.
4.4 Measurements and Estimates of Computation and Power Consumption
In this section, we demonstrate that symmetric cryptography is feasible on microcontroller-
based RFID tags through an empirical study of RC5-32/12/16 on the WISP. Experimental
data shows how much computation is available on WISP with varying workloads. Although
WISP is relatively power-inefficient compared to ASIC designs, the logic gate count of WISP
is comparable to an EPC UHF tag — enabling a reasonable measurement of computational
capabilities and limitations of an RFID tag.
4.4.1 Measurements of Computation and Symmetric Cryptography
To show the feasibility of classical cryptography on a general-purpose RFID tag, we present
experimental results of implementing RC5 on WISP. We have chosen RC5 because of its
simplicity and relatively small memory requirements. RC5 is implemented with 32-bit word,
12 rounds, and 16 bytes of secret key. The 16-byte secret key is stored in flash. Even with
46
careful choices of block cipher parameters, there exist practical challenges in implementing
RC5 on such a resource-constrained platform. Because of the extremely limited RAM
memory (256 bytes), minimizing stack size is crucial. For instance, our first implementation
resulted in an immediate stack overflow upon running the key scheduler. Since RC5 requires
expanded key table of size 2(r+1) words, where r is the number of rounds, careful memory
planning is required to reduce any unnecessary memory writes. The current implementation
fully utilizes all of its RAM memory so that expanded key table (2(r+1)*4 bytes = 104
bytes) is kept in RAM along with just enough room for the stack. One of the approaches
to remedy possible stack overflow would be to use a precomputed expanded key table. It
can be precomputed and stored in ROM or flash as long as the secret key remains the same
without hurting the performance since reading from flash or ROM takes the same amount of
power and cycles as reading from RAM. In our implementation, we compute the extended
key table once in every hardware reset. In other words, the key table is computed during the
first active cycle and kept in RAM unless WISP reaches a brownout voltage. This decision
is based on the assumption that it is unlikely for the secret key to be changed while an
RFID reader is polling.
Although WISP can be running at 3MHz at 1.8 V, our data comes from running WISP
at 3MHz at 3.0 V at the cost of reduced operating range to ensure reliable flash writes. Since
many applications with security requirements assume a relatively short read range during
the reader-tag communication, we believe that this is a reasonable demonstration of present
capabilities, which may be enhanced for greater computation and range with newer, more
efficient microcontrollers. There is already a newly released MSP430 that allows internal
flash writes with only 2.2 V [64]. A more recent version of WISP not used in this paper
has an external serial flash that operates at 1.8 V, allowing flash writes at much longer
ranges. We expect the range to continue to increase as the energy-efficient performance of
microelectronics continues to improve. Here, we aim to show any patterns or characteristics
involved rather than providing exact figures.
All three major functions of RC5 — setupKey(), encrypt(), and decrypt() — have
been implemented and measured on WISP. setupKey() is executed once after hardware
reset, and the 64-bit ID value is encrypted or decrypted once every duty cycle (e.g., during
47
Power Save Mode (LP4)Power Save Mode (LP4)
Generate Packet(RC5, Calculate CRC) Generate Packet(RC5, Calculate CRC)
Receive and TransmitReceive and Transmit
Wait for Query (LP4)Wait for Query (LP4)
HardwareReset
Sufficient Voltage
SufficientVoltage
QueryInsufficient Voltage
Figure 4.1: WISP power cycle
“Generate Packet” stage in Fig. 4.1).
The duty cycling is enabled by a hardware voltage supervisor. This supervisor creates
software interrupts by toggling a microcontroller input high to indicate sufficient voltage for
operation. When the supervisor detects a voltage of 3.3V or greater, the microcontroller
is enabled and a computation is initiated. At the end of the computation, if the voltage
is between 2.7V and 3.3V the microcontroller enters very low power (RAM retention only)
mode. While in this low power mode, the harvester provides power to re-charge the supply
capacitor back to 3.3V for the next computation. Below 2.7V, a hardware reset is generated
by an insufficient voltage indicator output on the voltage regulator.
Fig. 4.2 depicts a typical lifecycle of WISP with RC5 encryption enabled and voltage
level patterns throughout the WISP duty cycle after a hardware reset, captured by an oscil-
loscope. The timeline shows that WISP spends most of its time in Power Save Mode(LP4),
approximately 90-95% of its duty cycle. WISP is in active mode only during “Generate
Packet” and “Transmit and Receive” stages.
Table 4.2 presents the execution time for three operations of RC5 on WISP tags operating
at a distance of 1 foot (0.3 m). The time measurements are the mean of ten separate trials of
execution after a hardware reset. The RFID reader constantly queries the WISP tag (about
15 polls per second) until the first response is received. Beyond the reader-tag distance of
48
Power Save Mode (LP4)
Generate Packet(RC5, Compute CRC)
Transmit & Receive
VOUT
LP4RESET
Wait for Query(LP4)Reader ON
Reader OFF
Figure 4.2: An annotated scope trace of WISP execution and power consumption. Thedotted line measures the supply voltage VOUT in 1 V increments on the y-axis. While theReader is ON (i.e., sending queries), the WISP’s voltage level stairs up. The ramp up from0 V is omitted on the left. The voltage supervisor wakes up the WISP from LP4 when thevoltage level exceeds 3.3 V, and WISP begins its computation (“Generate Packet”). Whenthe reader receives the WISP’s response, the reader stops sending queries, therefore cuttingoff RF-power to the WISP. This is observed as a gradual decline of voltage at the right sideof the figure. The WISP first enters LP4 and then resets as the voltage level falls belowthe minimum operating voltage. The total latency from 0 V until the end of RF responsetransmission in this case is approximately two seconds.
2 feet (0.6 m), WISP generally does not function except for a few sporadic reads. However,
within the range of 2 feet, we observed no major difference in execution time.
RC5-32/12/16 function Execution time (msec)
setupKey() 7.93
encrypt() 1.43
decrypt() 1.39
Table 4.2: Execution time for operations in RC5 with 32-bit words, 12 rounds, and a 16-bytesecret key on a WISP tag. The WISP received uninterrupted power. Encryption happenson 64-bit messages.
49
Figure 4.3: This estimate shows the computation available in one active cycle, where thepower harvester charges a 10 µF capacitor to its peak value and then the microcontrollerenters active mode, discharging the capacitor down to the minimum operating voltage. TheInstructions Available line ends abruptly at the distance where the harvester is no longerable to supply the microcontroller’s minimum operating voltage.
It is not apparent from the displayed data, but WISP with RC5 enabled does not greatly
affect the average tag response time. At a distance of 1 foot, the difference in the average
tag response time (e.g., time between when the first reader command is sent and the cor-
responding response is received) of WISP with and without RC5 is negligible (average of
462.6ms).
4.4.2 Estimates of Maximal Computation and Measurements of the Effect of Flash Writes
on Computation
Fig. 4.3 provides an estimate of available microcontroller instructions versus wireless dis-
tance. The model used to generate this plot is based on experimental data of WISP per-
formance, on the Friis transmission equation, and on published microcontroller power con-
sumption specifications.
In [55], experimental data of output voltage as a function of input power for the WISP
power harvester is given. Thus this data, together with the Friis equation, allows us to
predict the WISP’s output voltage Vrec as a function of distance d. This data captures
50
the finite efficiency of the WISP harvester. An ideal, lossless harvester could produce any
desired voltage if it were able to accumulate energy long enough. Actual WISP devices
reach a steady state voltage, at which point power lost and power harvested balance.
The TI-MSP430 data sheet specifies its current consumption for given voltage and op-
erating frequencies. This allows us to calculate its energy per instruction: 281 pJ per
instruction at Vdd = 1.8 V or 900 pJ per instruction at Vdd = 3.0 V.
Of the energy stored in the WISP’s storage capacitor, only the voltage above the mi-
crocontroller’s minimum operating voltage is usable. If the capacitor is initially charged to
Vrec and its minimum operating voltage is Vdd, then 12CVrec
2 − 12CVdd
2 Joules are available
to run the computation. Using the previously calculated dependence of Vrec on distance, we
find energy available as a function of distance. Dividing by energy per instruction provides
number of instructions as a function of distance.
Our actual measurements in Fig. 4.4 show the relationship between the reader-to-tag
distance and number of cycles available in one duty cycle with varying workloads of flash
writes to the MSP430 information memory. While Fig. 4.3 provides the estimated upper
bound on how much computation we can afford on WISP, Fig. 4.4 presents how many cycles
are available after flash writes of different sizes. For consistency, the experiment involves
two steps, initialization and measurement. During the initialization, WISP’s flash memory
is checked if its state is erased or not. The flash is wiped out (writing ’1’ in all bits) before
each measurement is taken. During the measurement phase, WISP consumes power writing
to flash then raises a bit in a loop until WISP completely runs out of power (brownout
voltage of 1.5 V). These bit raises appear as a pulse on the oscilloscope. Since raising a
bit requires 4 cycles, the number of bits are counted to compute available number of cycles
after writing different number of bytes to the flash. Note that a minimal set of operations
are done during the “Generate Packet” stage in this experiment (e.g., preloading the 64-bit
ID into an array), and there is no RC5 computation or CRC computation.
We observed that the number of cycles available does not deviate significantly from each
other at short read ranges. At the medium range of 0.5 m, the power consumption of a
flash write causes a significant decrease in available computation. Beyond the distance of
0.75 m, WISP is not able to reach the minimum operating voltage of 2.7 V for flash writes,
51
Figure 4.4: Preliminary measurements of the number of cycles available after writing toflash — computed after a minimal set of operations during the “Generate Packet” stageand without tag response over RF. Each data point represents a mean of ten samples.
therefore the plot lines for flash writes end abruptly. These measurements are preliminary,
and further research is necessary to determine a more precise relationship between flash
writes, erase segment sizes, and computation. However, one conclusion is that unnecessary
writes to flash at mid-range distances will significantly reduce available computation.
4.5 Conclusions
Our preliminary experimental data shows that UHF RFID tags with cryptographic capa-
bilities are no longer infeasible. Although our experimental platform exceeds the current
EPC UHF Class 1 tags in terms of computing power and storage, we believe that the de-
vice is comparable and a good representation of the future of UHF RFID tags. We believe
that the trend in microelectronics will continue to bring power-efficient and cost-effective
microcontrollers capable of more sophisticated computation. We hope that our work will
encourage further research to determine the feasibility of maximal-strength cryptography
with actual power measurements of RF-powered UHF RFID tags — an beyond algorithmic
estimates of space and running times.
52
Chapter 5
A WIRELESS STRAIN SENSOR FOR EMBEDDED MATERIALHEALTH MONITORING
5.1 Introduction
With the adoption of composite materials in the next generation of cutting edge mechanical
structures, the pursuit of technology that will allow the health of these structures to be
easily monitored is increasingly important for maximum safety and minimum maintenance
cost. In next-generation commercial aircraft composites make up 16% of the airframe weight
of the Airbus A380 [65] and 50% of the airframe weight of the Boeing 787 [66]. Composites
are also widely used in military aircraft and astronautics due to their high strength and low
weight, resulting in improved fuel economy and reduced maintenance [67]. Using a composite
monitoring system that is embedded in the structure could help reduce the amount of time
required to perform the inspection and even allow continuous, real-time monitoring of future
aircraft, vehicles and other composite structures.
The use of composites is also accompanied by the potential for structural failure due to
weakening from moisture absorption and/or heat, stress fractures, and delamination [68].
One method of monitoring the health of composite structures is to affix numerous strain
gauges to the structure and detect anomalous conditions by excessive strain [69]. However,
the weight, complexity and maintenance of wires to each strain gauge are often prohibitive,
especially during use of the structure (ex, in flight). These wires are also a weak point when
cycled in the dynamic load conditions many composite structures experience.
To address the disadvantages in wired strain gauges, the Wireless Identification and
Sensing Platform (WISP) can be leveraged to power and measure each strain gauge. Fur-
thermore, WISP communicates bi-directionally with a UHF RFID reader, allowing data
to be collected and analyzed wirelessly. Because each of these devices has a unique bi-
nary thumbprint, they can be queried in serial, reducing the number of data channels and
53
removing the need for heavy and weak wiring throughout the composite structure. The
following paper will discuss the WISP technology, its integration with a strain gauge and
the evaluation of its correlation with a traditional wired strain gauge.
5.2 Overview
The WISP is a wireless, battery-free sensing and computation device that communicates
with and is powered by a commercial UHF RFID reader. Much like conventional passive
RFID tags, WISP rectifies RF energy to power its onboard circuitry, and communicates
by reflecting power back to the reader through a technique called backscatter radiation.
However, unlike most RFID tags which backscatter a fixed identification number, WISP
encodes data into the tag ID using an ultra-low-power programmable microcontroller, the
Texas Instruments MSP430. Each ID sent from the WISP is reported by the reader to a
computer, which extracts the encoded data from the ID for plotting and/or logging. Using
the microcontrollers onboard ADC, WISP can power and measure attached sensors such as
temperature and ambient light. This sensor data is then reported to the computer through
each ID sent by the WISP. To measure a resistive strain gauge, an instrumentation amplifier
and Wheatstone bridge were designed to maximize strain sensitivity while keeping power
consumption to a minimum. The microcontroller takes a strain measurement by briefly
powering the bridge and amplifier and sampling the output with the ADC.
5.3 Design
Figure 5.1 shows a diagram of the WISP strain gauge measurement system. A computer
drives the RFID reader, which in turn queries the WISP. The WISP rectifier converts
incoming RF power to data and DC voltage. The harvested DC voltage is regulated to
1.8 V and used to power the microcontroller. When the voltage supervisor detects 1.9 V,
the microcontroller wakes from sleep mode via an external interrupt. The microcontroller
then makes a strain gauge measurement by powering the amplifier and Wheatstone bridge,
waiting for the amplifier output to stabilize, and converting the analog voltage to a digital
value. Next, the microcontroller embeds the sensor data in an EPC tag ID and computes
the required CRC for the ID. Finally, the microcontroller waits for a query from the RFID
54
Wheatstone
Bridge
Instrumentation
Amplifier
MSP430
Microcontroller
Voltage
Regulator
RF
Rectifier
Sensor Power
RFID
Reader
UHF
Wireless
Link
ComputerRS-232
Voltage
Supervisor
Figure 5.1: High-level system diagram showing the communication path between the straingauge (Wheatstone bridge), WISP, RFID reader and computer.
2k
R4Resistor
3k
R3Resistor
3k
R1Resistor
2.99k
R2Resistor 1 3
2
R6POT
8
1
4
3
21
U1A
MAX4242EUA
84
75
6
2
U1B
MAX4242EUA
84
75
62
U2BMAX4242EUA
8
1
4
3
2
1
U2AMAX4242EUA
300k
R5Resistor
300k
R5Resistor
GND
VCC
VCC
VCC
VCC
GND
GND
GND
GND
300k
R5
Resistor
300k
R5
Resistor300k
R5
Resistor
VCC
300k
R5
Resistor
6k
R7Resistor
6k
R7Resistor
VCC
GND
200 ohms
R6Resistor
13
2
R2,POT
Vin,1VOUT
12
RSG
Strain Gage
0.1uF
C4
0.1uFC3
GND
GND
20 ohm pot
100 ohm pot
Vin,2
Figure 5.2: Circuit schematic of the Wheatstone bridge and strain gauge amplifier. Thedifferential signal of the Wheatstone bridge is converted to the single-ended output, VOUT,which is measured by the WISP ADC.
reader and responds using the generated ID. This process repeats as long as the reader is
polled by the computer, and update rates of approximately 10 to 20 sensor measurements
per second are achieved over a range of 1 m. Measurement speed decreases with range
because available RF power decreases with the square of the range from the reader antenna.
55
The strain gauge instrumentation amplifier (IA) was built using discrete components
because an integrated IA chip that met both the low voltage (1.8 V) and low power (1 mW)
requirements of WISP is not available. A schematic of the design is shown in Figure 5.2.
The Wheatstone bridge, shown on the left of the schematic, has additional series resistance,
R4, added to the strain gauge in order to reduce current consumption of the bridge to
600 µA at 1.8 V. The resistance of the strain gauge, RSG, is
RSG = GF ∗Rg ∗ µStrain (5.1)
where GF, the gauge factor for the strain gauge, is 1.99 and Rg, the intrinsic strain gauge
resistance, is 1 kΩ. The differential output of the bridge, Vin,2 − Vin,1, is
Vin,2 − Vin,1 = Vdd
[R2 +R2,POT
R1 +R2 +R2,POT− R4 +RSG
R3 +R4 +RSG
](5.2)
where the resistor values are shown in Fig. 5.2, Vdd is 1.8 V and RSG is given by (1). The
output of the instrumentation amplifier, provided that the values of the resistances for R5
are equal, is
Vout = (Vin,2 − Vin,1)(1 +2R5
R6 +R6,POT) (5.3)
where Vin,2−Vin,1 is specified in (5.2) and resistor values are shown in Fig. 5.2. Finally, the
10-bit analog to digital converter output is
ADC =1024Vdd
Vdd(5.4)
where Vout is given by (5.3) and Vdd is the supply voltage, 1.8 V. R2,POT adjusts the zero-
strain output, and R6,POT adjusts the amplifier gain between 2000 and 3000. This allows
the full range of the ADC to be utilized by amplifying the strain gauge signal to the full
ADC input range of 0 V to 1.8 V. At a gain of 3000, a range of 2000 microstrain can be
measured, and at a gain of 2000, a range of 3000 microstrain can be measured.
5.3.1 Power Constraints
The power consumption of the strain gauge measurement circuit exceeds the power received
by WISP both due to the fact that the RFID reader transmits power less at less than 50%
56
duty cycle and also due to the RF transmission loss over wireless distance. Therefore power
to the strain gauge is partially supplied from a storage capacitor which must be charged
to the supervisor detection voltage before a strain measurement or RFID communication
takes place. A larger capacitor requires more time to charge and consequently affects the
query rate of the WISP. The allowable sensor settling time, given by Equation (5.6), is a
direct function of the storage capacitor size, C, the power consumption of the sensor and
microcontroller, I, and the difference, 4V , between the supervisor detection voltage, VSV ,
and the minimum operating voltage, Vdd.
I = C4V4t
(5.5)
For the WISP strain gauge measurement system, C = 47uF , VSV = 1.9V , Vdd = 1.8V ,
and I is approximately 600 µA. This allows 7.8 ms if no RF power is received. An actual
settling time of 8.6 ms is used to allow as much settling as possible. This is feasible because
some power is also received by the reader.
5.3.2 Amplifier Gain and Bandwidth-Induced Attenuation
The differential gain of the amplifier is 2700 when R6 + R6,POT = 222 ohms. Using a power
supply, this gain is achieved in steady state; however a lower gain of approximately 2100
was observed experimentally during wireless operation. Due to power constraints, the strain
gauge and amplifier were powered for only 8.6 ms before a sample was taken by the ADC.
The low gain-bandwidth product of the MAX4242 op-amps used in the instrumentation
amplifier causes a low-pass filter response by the amplifier on startup. This causes atten-
uation when an ADC sample is taken before the output has reached its final, steady-state
value.
Figure 5.3 shows the relationship between WISP ADC output and the resistance of the
strain gauge in the wired and wireless power cases. In this test, a potentiometer (pot)
was used instead of a strain gauge and an ohmmeter was used to measure the true value
of the pot for each sample. The amplifier was adjusted to center the ADC output at 500
for a pot value of approximately 1004 ohms, which results in the centering of the two
series in Figure 5.3. Neglecting this expected offset, the gain of the pulse-powered amplifier
57
0
200
400
600
800
1000
1200
1001 1002 1003 1004 1005 1006 1007
Strain Gauge Resistance (ohms)
ADC Value
Wireless Power (Duty Cycled)
Wired Power (Steady State)
Wireless Power Linear Fit
Wired Power Linear Fit
Figure 5.3: Comparison of instrumentation amplifier gain using an 8.6 ms pulse or contin-uous power to the amplifier.
configuration is 81% of the continuously-powered amplifier gain. This gain attenuation
is well modeled by a first-order low pass filter, which is created by the finite-bandwidth
op-amps of the instrumentation amplifier. The attenuation is given by
VADC
Vfinal= 1− exp(−2πtf−3dB) (5.6)
The gain-bandwidth-product(GBP) of the MAX4242 op-amps used is 90,000, and by
conservation of GBP, the bandwidth (f−3dB) is 90,000 / 2700, or 33.3 Hz. The strain gauge
was powered for t = 8.6 ms after which the ADC samples the amplifier output (VADC).
The attenuation of VADC with respect to the steady-state voltage, Vfinal, is predicted to
be 83.5% using (5), and this agrees with the experimental attenuation to within a factor of
1%. Offline compensation easily removes the linear filtering caused by the amplifier time
constant.
58
(a) WISP, Wheatstone Bridge, and Strain
gauge.
(b) WISP attached to sample under strain.
Figure 5.4: Experimental setup of the WISP(S/G) comparison with an extensometer.
5.4 Experimental Setup
Tests were conducted with a 1/4” and 1” wide specimen of S-glass composite. A 1 kohm
Omega strain gauge with a gauge factor of 1.99 was attached to the test specimen and then
evaluated with both a standard wired setup and an integrated setup with the Intel WISP.
Along with the wired strain gauge and WISP strain gauge combination [WISP(S/G)] an
extensometer was attached to the specimen and run in parallel with both the wired and
wireless strain tests of the specimen (Figure 5.4).
The specimen was loaded in steps from 0 to 6400 psi. First the wired strain gauge and
extensometer measured the strain of the specimen in parallel. Following the traditional ten-
sion test of the specimen the wireless WISP(S/G) and extensometer measured the specimen
in parallel. Data was logged through Labview for all the wired applications and through a
lab top integrated with the RFID reader for the WISP(S/G). Along with this discrete load-
ing test a positive ramp from 0 to 6800 psi at 25 lb/sec was used to test the time response
of the WISP(S/G) combination and a sine wave loading between -1000 and 1000 lbs. at
0.25 Hz. The following will detail a comparison of the WISP(S/G) data with a traditional
59
wired strain gauge to evaluate the proposed use of the WISP(S/G) for the construction of
a wireless intelligent composite for use in advanced composite structures.
5.5 Results/Discussion
Present the response of the WISP compared to other systems of measurement. Big conclu-
sion to draw seems to be that it is promising. Do you have any noise or integration results
you want to add? If we haven’t fixed the gain problem we may want to show something
that makes us think it matches up.
5.5.1 Data Analysis
To measure the strain from the 1 kohm strain gauge the WISP(S/G) has both a modified
quarter Wheatstone bridge and a 2070x gain amplifier before being converted to digital
in a 10-bit ADC. Data logged was the raw numbers form the ADC from 0 to 1024 which
represented a range from 1.8 to 0 V. To convert the rawADC data to a strain for comparison
with the extensometer the following formulas were used (Equation (5.7) and (5.8)). Equation
(5.7) converts the rawADC value logged from the WISP(S/G) to the voltage measured across
the Wheatstone bridge.
VADC =1024− rawADC
1024Vw
gain(5.7)
rawADC is the binary output of the ADC, 1024 is the full-scale value for the 10-bit
ADC, Vw = 1.8 V is the voltage across the Wheatstone bridge, and gain = 2070x is the
amount of amplification between the Wheatstone bridge and the ADC. Equation (5.8) then
converts the voltage measured across the Wheatstone bridge to the strain applied to the
strain gauge.
Vo ≈1124RR
Vw =112KsεVw (5.8)
The simplification in Equation (5.8) is warranted as long as the change in resistance is
much smaller than the resistance of the strain gauge. The resistors used in this configuration
are much greater than the change in resistance of the strain gauge.
60
Figure 5.5: Strain recorded during the step loading of the specimen.
5.5.2 Specimen Tests
Figure 5.5 shows the step loading of the specimen and the strain measured by the traditional
wired strain gauge, WISP(S/G), and the extensometer for both cases. The results of this
test show the low noise of the WISP(S/G) measurement and the corroboration of its results
by both the extensometer and the traditional strain measurement. A ramped force was
applied to the specimen at 25 lb/sec to evaluate the stability of the WISP(S/G) signal
under a changing force (Figure 5.5).
Using a linear ramp of applied pressure, measurements of strain were taken from both
the wired strain gauge, the WISP strain gauge and an extensometer for reference. Figure 5.6
demonstrates the highly linear correlation between the wired ADC measurements and the
WISP wireless measurements. The low noise and high correlation to traditional strain
measurements of the WISP(S/G) strain measurement support the use of the WISP(S/G)
as a technology that can be developed into a wireless health monitoring system embedded
into composite structures.
61
y = 1.0046x - 21.427
R2 = 0.9982
0
500
1000
1500
2000
2500
0 500 1000 1500 2000 2500
Wired Strain Measurement
WISP Strain Measurement
Figure 5.6: Correlation between the Wired and Wireless strain gauge measurements. WISPdata has been corrected to account for bandwidth-induced attenuation.
5.6 Conclusions and Future Work
The conclusion of these experiments is that the Intel WISP can be successfully integrated
with a strain gauge and used to monitor a specimen to create a useful stress v. strain plot.
The capability of wirelessly monitoring the strain in a composite structure can lead to the
creation a large, high resolution, network of WISP(S/G) that can monitor strain through
out a structure wirelessly. With discrete nodes of strain information, interpolation between
strain gauges will allow for the loading condition and health of a structure to be diagnosed
in pseudo real time. This not only makes the structures safer but promises to reduce the
cost of maintenance future commercial and military vehicles. The ability to embed these
components with a minimum of interference with the composite structure itself will allow
for the health monitoring system to last as long as the vehicle with a minimum of added
weight and complexity.
62
The WISP(S/G) is a PCB design, and could not currently be embedded in a composite.
However, it is feasible to make WISP into a small IC that is roughly the size of commercial
RFID chips (less than 1mm2). We have successfully embedded a functional, commercial
Alien Class 1, Generation 1 RFID tag in an epoxy laminate composite. Similarly, a WISP
IC and strain gauge could be embedded in a laminate.
One challenge that arises when embedding WISP(S/G) in a carbon-fiber composite
airplane wing is metal shielding from lightening-hardening. This would severely attenuate
the interrogator signal, and the system would not work. There are several other methods
of applying the system, however. One important example is flight testing. It takes several
weeks to instrument an airplane with the required equipment to perform these tests. Instead,
WISP(S/G) could be attached like a label to the outside of the wing, or inside the wing
box, and measurements could be wirelessly obtained in this manner. This setup would take
hours instead of weeks to install, and provide tremendous cost savings.
A second parameter of interest for flight testing is pressure data along the airplane
wing. Ethan Shih at the University of Washington recently integrated a BMP085 pressure
sensor with WISP. This would allow pressure measurements to be performed in much the
same manner. Furthermore, there are commercially available MEMS pressure sensors which
affirm the possibility of a fully-integrated solution.
Finally, there have been numerous other power scavenging sources proposed in the lit-
erature which could power a low power sensor solution like WISP. Examples include piezo-
electric, solar and thermoelectric power harvesting. Application-tailored solutions may help
overcome specific challenges in the deployment of these sensors.
63
Chapter 6
NEURALWISP: A WIRELESSLY-POWERED BRAIN INTERFACE
6.1 Introduction
Neural interfaces have made tremendous technology-driven advances in the recent past.
Cochlear implants are an early example of clinically relevant implantable devices [70], mod-
ern electronics are enabling previously impossible brain research experiments [71], and major
progress has been made toward neurally controlled prosthetics [72]. Because transcutaneous
wiring poses a significant infection risk, it is desirable that a neural interface communicate
and receive power wirelessly. Previous systems [73, 74] have achieved wireless operation by
using a near-field inductive link to transmit power and data. However, these systems require
that the external coil be located within a few centimeters of the internal coil. A wireless
neural interface with a range of 1 m or more will enable the removal of the interrogator
from the head and would allow wireless interfaces to be placed on small animals incapable
of carrying the interrogator hardware, such as mice.
We present a wireless neural interface which harvests power from the radio-frequency
(RF) energy provided by a standard commercial UHF RFID reader. The system operates
at a distance of up to 1 m from the reader. It records the spike count in a programmable
window (typically 1-10 s) and subsequently transmits the spike count to the reader as part
of the tag identification number that the reader is designed to acquire. This allows the
neuroscientist a wireless, battery-free method of recording spike density ( spikessecond) as various
tasks are performed or stimuli are presented.
6.2 System Design
The NeuralWISP builds upon our prior work on the Wireless Identification and Sensing Plat-
form (WISP) [34][21]. The WISP is a fully-passive UHF RFID tag that uses an ultra-low
power, general-purpose microcontroller (µC) for sensing, computation and RFID commu-
64
RF Match and
Power Harvester
MSP430
μC
Preamp
Modulation
Storage Cap
Spike Detection
Voltage Sense
Power Management
Demodulation
Neural LNA
Electrode
Figure 6.1: Block diagram of NeuralWISP.
nication. The use of a programmable µC allows WISP to be easily configured for different
applications including measurement of temperature, light level, strain, and acceleration.
These environmental sensor signals change slowly and thus permit periodic, low-frequency
(1 to 50 Hz) measurement. However, a much faster sampling rate (at least 8 kHz) is neces-
sary to detect neural spikes due to spectral content between 500 Hz and 2 kHz.
Achieving an 8 kHz sampling rate under the constraints of the limited power budget of
an RFID tag is not possible with general purpose microcontrollers available today. Instead,
a continuous-time analog spike detector was designed to wake the system when spikes occur
via a µC interrupt pin. This helps minimize average power consumption because the µC
can remain in a low-power sleep mode during periods of inactivity and wake only to process
spikes or communicate with the RFID reader. The µC counts spikes during a programmable
window and is reset after the spike count is transmitted to the reader.
The architecture of the NeuralWISP is shown in Fig. 6.1. Like a typical RFID tag,
power is received at the antenna, voltage-multiplied, rectified, and regulated to provide a
stable system power supply. The neural input signal is amplified and applied to an analog
spike detector in addition to an analog-to-digital converter (ADC) integrated in the µC.
The µC performs the control and timing tasks, and implements the RFID communication
protocol.
65
0%
5%
10%
15%
20%
25%
30%
35%
40%
-10.0-5.00.05.0
Input Power (dBm)
Eff
icie
ncy
(%
)
0
100
200
300
400
500
600
Po
wer
(u
w)
Rectif ier Eff iciencyAvailable Pow er (uW)
Figure 6.2: Measured rectifier output power and efficiency versus input power.
6.2.1 Power and Communication
NeuralWISP receives all of its power from the RFID reader. Commercial off-the-shelf
(COTS) UHF RFID readers operating in the U.S. Industrial, Scientific and Medical (ISM)
band (902 MHz to 928 MHz) are limited in transmit power to the FCC limit of 1 W
(+30 dBm). Readers often use an 8 dBi circularly-polarized patch antenna, which has an
approximately 60-degree beam width. Tags typically employ a 2 dBi dipole antenna. How-
ever, a number of factors decrease the power available to the tag. The most significant
effect is path loss; Friis’ Transmission Equation predicts that the amount of power received
decreases with the square of wireless range. The circularly-polarized reader antenna in
conjunction with a (linearly-polarized) dipole tag antenna also incurs 3 dB of polarization
loss. Additionally, amplitude modulation in the downlink (reader-to-tag) and backscatter
modulation in the uplink (tag-to-reader) communication causes up to 3 dB of loss. Finally,
tag rectifier efficiency, shown in Fig. 6.2, of about 25% causes 6 dB of loss. All included,
427 µW (-3.7 dBm) is available after the rectifier at 1 m. Implantation causes additional
losses due to dielectric constant mismatch at the air-tissue interface; however, experiments
have demonstrated the feasibility of radiative power transfer in this regime [75].
66
Modulator
Demodulator
Regulated
Supply
Supervisor
Interrupt
+
_
Demodulator
Enable
915 MHz
Dipole Antenna
Cstorage
Level
Shifter
SV
1.8 V
Reg.
Figure 6.3: Schematic of the RF front end including voltage-multiplying rectifier, modulator,demodulator with level shifter (LS), and voltage supervisor (SV). RF (low capacitance)Schottky diodes are filled black, and DC (low leakage) Schottky diodes are filled white.Also shown is the 1.8 V regulator, providing a stable supply for the rest of the system.
The power and communication circuitry, shown in Fig. 6.3, are similar to that of con-
ventional RFID tags, and [21] presents the design in detail. A 5-stage voltage-multiplying
rectifier converts the received RF signal from the reader into an unregulated voltage source
for the tag, which is stored on Cstorage. An L-match network transforms the tag impedance
to match that of the antenna. The harvested voltage is converted to 1.8 V by a low-drop-
out linear regulator with 1 µA quiescent current, which provides a stable supply voltage for
the system. The voltage supervisor provides a digital interrupt to wake the microcontroller
while waiting for sufficient energy to operate.
NeuralWISP communicates using the EPC Class 1 Generation 2 RFID protocol [27],
allowing compatibility with industry-standard COTS readers. Downlink (reader to tag)
communication is accomplished through reader amplitude modulation. The demodulator
employs a comparator to threshold the instantaneous received voltage against the average
(minus a diode drop). A footer transistor disables the comparator to save 10 µA of qui-
67
escent current while communication is not needed. Uplink (tag to reader) communication
is accomplished by modulation of the tag reflection coefficient. The modulator uses an RF
transistor to short the antenna terminals together, thereby producing a strong reflected
signal. In the worst case, approximately half of the nominal power is available to the tag
due to reader amplitude modulation and tag reflection modulation. Note that tag ID and
memory communication errors are minimized through use of a 16-bit CRC. Further details
on the protocol can be found in [27].
6.2.2 Analog Signal Path
The extremely low signal levels recorded from neural probes place severe constraints on the
analog front-end. Input-referred noise levels must be < 10µVRMS while providing good lin-
earity and high gain. These requirements frequently result in the low-noise neural amplifier
consuming a majority of the system power. In the NeuralWISP, the power dissipation limits
the wireless range, so power must be minimized. We designed a custom low-noise amplifier
(LNA) in a 0.5 µ m SOI BiCMOS process to meet these requirements. The amplifier is
designed to provide a gain of 40 dB. A schematic is shown in Fig. 6.4.
The amplifier is built using a two-stage op-amp with capacitive feedback, shown in
Fig. 6.4(b). The mid-band gain is set to 100 by the ratio of the C1 and C2, which are 20 pF
and 200 fF, respectively. Sizing the input capacitor C1 presents a tradeoff between noise
performance and chip area. Because large input transistors are used to minimize 1/f noise,
the op-amp input capacitance Copamp is on the order of 1 pF. The input signal is attenuated
by the capacitive divider formed by the C1 and the op-amp. Since any attenuation before the
op-amp will directly increase the input-referred noise, C1 should be much larger than Copamp
to minimize attenuation. However, overly large values for C1 would lead to unnecessarily
large chip area.
A closed-loop configuration was chosen for this system because open-loop amplifiers,
while demonstrating superior noise efficiency factors (NEF), typically suffer from inferior
power-supply rejection [76]. The LNA is AC-coupled to reject DC offsets resulting from
tissue-electrode interactions [77].
68
-
+
IN20pF
20pF
200fF
PR1
PR1
Out
Ref
800kΩ
.5μA
0.5μA
2μA
RST
RST
(a)
VOutVIn- VIn+IBias
(b)
Figure 6.4: (a) Schematic of custom 8 µA low noise neural amplifier fabricated in a 0.5µmSOI CMOS process (b) Schematic of the op-amp used in the low-noise amplifier.
MOS-bipolar pseudo-resistors [77] (PR) were used to set the DC bias point. The high-
pass pole frequency is set by C2 and the resistance of the PR. For small signals, the PRs
have an incremental resistance of about 1012 Ω, resulting in a low frequency pole below
1 Hz. The high-pass corner frequency set by the PRs is much lower than is necessary for
the extra-cellular recording task being demonstrated here. However, all other options have
significant drawbacks. A poly-silicon resistor would be prohibitively large, while transcon-
ductor implementations of high-valued resistors consume additional power and contribute
69
noise. Previous amplifiers have used a subthrehold MOS transistor as a resistive element,
but typically require a variable gate voltage to tune the resistance [78, 79]. Because the
amplifier described here was designed to operate without any programming or configuration
and to be suitable for a variety of neural recording tasks targeting both action potentials
and field potentials, the PR was deemed to be a simple, flexible, and reliable method for
setting the amplifier’s DC bias point.
To avoid long settling times on power up due to the PRs, a power-on-reset circuit is
included. When the reset signal is asserted, MOS switches temporarily short the PRs,
allowing the amplifier to reach its equilibrium bias point quickly.
A source-follower output stage was chosen for its flexibility with respect to load con-
ditions. A resistive load to ground will increase the current in the NMOS source follower
transistor, allowing the amplifier to automatically adapt to resistive loads without consum-
ing extra static bias current under lightly loaded conditions or using a complicated class AB
output stage. A PMOS source follower is used to shift the output level up into the input
range of the NMOS source follower, which drives the off-chip load. The LNA chip is com-
pletely self-contained, and includes a supply-independent bias current generator allowing
consistent operation over a range of 1-5 V.
An additional gain of 20 dB is provided by a second amplifier built from two OPA349
op-amps, shown in Fig. 6.5. The first op-amp is used to establish a 0.6 V reference for AC
coupling the amplifier stages. While the reference is derived from the supply, local regulation
(see Fig. 6.3) ensures low-frequency stability and the 100 pF capacitor shunts high-frequency
noise to ground. The second opamp is used in a non-inverting gain configuration. The gain
of the first stage allows relatively noisy micro-power op-amps to be used for the second gain
stage. Consequently, the second stage consumes only 1.9 µA from a 1.8 V supply, including
the reference.
The amplified signal is applied to an analog spike detector. Numerous algorithms for
spike detection have been developed, ranging from simple thresholding detectors to sophis-
ticated supervised learning classifiers such as support vector machines [80]. Even with many
other options available, the simple thresholding detector remains popular [73, 74]. An anal-
ysis of spike detection methods in the context of power constraints found thresholding on
70
the absolute value to provide the best tradeoff between accuracy and computational re-
quirements [81]. For this work, a single-ended thresholding detector was found to have the
appropriate combination of simplicity and efficacy.
The signal is low-pass filtered with a time constant of 0.1 s to generate the detection
threshold. Deriving the threshold from the amplified signal prevents any offsets in the
op-amps from corrupting the detection results. The signal is also shifted towards 0 V
and attenuated by up to 15% via a variable-ratio resistive divider. A digitally-controlled
resistor, variable from 0 Ω - 50 kΩ, determines the attenuation of the divider and thus the
sensitivity of the spike detector. The shifted signal is compared to the low-pass filtered
signal to generate the detection signal, which triggers an interrupt in the µC. The spike
detector’s programmable threshold is set by the µC to a level stored in flash memory. The
threshold level can be chosen by the user prior to deployment. Firmware control of the
threshold also allows for future implementation of real-time adjustments to the threshold.
Such adjustments could be made based on the observed input or by including adjustment
commands in the data sent from the reader to the NeuralWISP.
The output of the second amplifier is also connected to the ADC input of the MSP430
microcontroller to allow for direct digitization of the neural signal. The ADC has 10-bit
resolution and uses the supply as the reference. This provides a 1.76 mV LSB, or 1.76 µ V
input-referred.
6.2.3 Digital Control
An MSP430F2274 microcontroller (µC) is used to implement control, timing, and commu-
nication tasks. Fig. 6.6 shows the software architecture. On bootup, the µC configures the
adjustable resistor in the spike detector. During the primary mode of operation, the µC
will count spikes during a user-specified time interval (typically 1-10 s) and transmit the
number of spikes detected at the end of the interval. During the counting interval, the µC
is in a low-power sleep state for the majority of the time. The spike detector triggers an
interrupt, which causes the µC to wake up, increment the spike count, and return to sleep.
A timer drives another interrupt, which signals the end of the counting interval, causing
71
MCP4012
50k
40dB LNA
2M
OPA349
300k
TLV3491
4M
100pFOPA349
1M
0.1uF900k
100k
1M
0.1uF
Electrode
Digital Pot Control Spike
Interrupt
Figure 6.5: Analog front end circuitry, including custom 40 dB LNA, 20 dB post-amp,and spike detector with programmable threshold. The 600 mV reference is generated bya voltage divider from the regulated 1.8 V supply and an op-amp buffer. A non-invertingop-amp configuration provides the additional 20 dB gain. The spike detector compares theaverage (low-pass) signal to a programmable fraction of the instantaneous signal.
Comm State
(Sleep Mode)
Increment Counter
Construct Packet
Reset Counter
Send Packet
Spike State
(Sleep Mode)
Spike Interrupt
Timer Interrupt
Holdoff
RFID Query
Timer Interrupt
Figure 6.6: Software state diagram. The µC is in the low-power Spike State for the ma-jority of the time, awakening only to increment the spike counter after a detection or tocommunicate with the reader.
the µC to exit the spike-counting mode and await a communication session with the reader.
After communicating with the reader, the µC pauses for 3 s to allow the analog circuits
to recover from RF interference that occurred during the read, then returns to the spike
72
counting phase and repeats the cycle.
6.2.4 Application Layer
A graphical user interface was developed to read, graph and log spike density measurements
reported by the NeuralWISP to the RFID reader. The application communicates via Eth-
ernet using LLRP (Low Level Reader Protocol) [29]. A screen capture of the application in
action is shown in Fig. 6.7.
The state cycle for the application begins by polling the reader until the NeuralWISP
powers up and reports a spike count. Then the application turns off the reader for a
predetermined spike sampling period, which is set in the code of the NeuralWISP and in the
application. During this time, the NeuralWISP counts spikes. After the sampling period has
ended, the application again polls the reader. The NeuralWISP recharges and the reports
its spike count. The cycle then repeats. Note that the application stays synchronized with
the NeuralWISP’s charge-record-upload state cycle by waiting for the WISP to respond in
the upload state. This ensures that timing errors do not accumulate over several iterations
of the state cycle.
6.3 Test Results
The fabricated board is shown in Fig. 6.8. The populated board alone weighs 1.0 g, and
a 900 MHz wire dipole antenna (not shown) weighs approximately 0.6 g. During spike
counting, the system draws an average of about 20 µ A of current from its unregulated
supply, of which 8 µ A is consumed by the neural LNA. A commercial RFID reader with
+30 dBm transmitted power was used to wirelessly supply power and communicate with
the NeuralWISP.
6.3.1 Analog Front End
The amplifier’s noise was measured using an HP 35670A dynamic signal analyzer with the
input grounded. Fig. 6.10 shows the input-referred noise spectra at the output of both the
LNA and the post-amp, which was integrated from 0.5 Hz to 25 kHz and divided by the
73
Figure 6.7: A graphical user interface processes data from an Impinj Speedway RFID reader,displaying a graph of spike detections versus time.
measured gain to find the input-referred RMS noise voltage, which is 4.4 µVRMS for the low-
noise amplifier. Even with the use of the micro-power commercial op-amps, it can be seen
that the gain of the LNA suppresses the noise contribution of the post-amp. Additionally,
very low-frequency noise is filtered by the AC coupling between the LNA and post-amp.
The LNA can operate from a supply between 1 V and 5 V, and provides a measured
gain of 39 dB with a bandwidth spanning from 0.5 Hz to 5.9 kHz. Operating from the
NeuralWISP’s regulated 1.8 V supply, the amplifier consumes 8 µ A, including the bias
generator and output buffer. Fig. 6.9 shows the measured frequency response of the first
stage and the combined response of both gain stages. The LNA combined with the second
amplifier provides a mid-band gain of 56 dB with a bandwidth from 2 Hz to 4.9 kHz.
Table 6.1 and Table 6.2 show a comparison of the LNA used here to other published neural
amplifiers. The core amplifier has a current consumption of 3.3 µ A, corresponding to an
NEF of 4.0, which is comparable to other published amplifiers. Including buffering and bias
74
Table 6.1: Comparison of Neural Amplifiers
Gain IAmp NEF vni,RMS
This Work1 39dB 3.3µ A 4.0 4.4µ V
This Work2 39dB 8µ A 6.2 4.4µ V
Holleman [82] 36.1dB 805nA 1.8 3.6µ V
Rai [83] 38.3 12.5µ A 2.5 1.95µ V
Harrison [77] 39.5dB 16µ A 4.0 2.2µ V
Denison [84] 45.5dB 1.2µ A 4.9 .93µ V
Wu [85] 40.2dB 330nA 3.8 .94µ V
Wattanapanitch [86] 40.9dB 2.7µ A 2.7 3.1µ V
1Core amplifier only
2Complete amplifier chip, including buffers reference and biasgeneration
Table 6.2: Extended Comparison of Neural Amplifiers
THD (@ Input) PSRR Bandwidth Tech.
This Work1 0.2% @ 5mVpp 45dB .5Hz-5.9kHz .5µ m
This Work2 0.2% @ 5mVpp 45dB .5Hz-5.9kHz .5µ m
Holleman [82] 7.1% @ 1mVpp 5.5dB .3Hz-4.7kHz .5µ m
Rai [83] 1% @ 1mVpp 63dB .023Hz-11.5kHz .13µ m
Harrison [77] 1% @ 16.7mVpp ≥ 85dB .025Hz-7.2kHz 1.5µ m
Denison [84] — — .5Hz-250Hz 0.8µ m
Wu [85] .053% @ 5mVpp 62dB 3mHz-245Hz .35µ m
Wattanapanitch [86] 1% @ 7.3mVpp 75dB 45Hz-5.3kHz .5µ m
1Core amplifier only
2Complete amplifier chip, including buffers reference and bias generation
generation, the total current is 8 µ A, leading to an NEF of 6.2. It should also be noted
that some of the amplifiers in the table [84, 85] are designed with much lower bandwidth for
monitoring EEG signals or field potentials, and as a result have lower current consumption.
75
Figure 6.8: System photograph. Inset shows chip-on-board mounting of the custom low-noise amplifier IC.
The NEF accounts for different bandwidths and noise levels, allowing comparison between
amplifiers designed to different specifications.
6.3.2 Spike Detector
To characterize the spike detector, we applied a synthesized neural recording [80] to the
NeuralWISP input. This technique allowed us to vary the SNR and spike rate in the
recording and provided a reference against which to compare our measured spike detection
results in order to characterize the detector accuracy. Fig. 6.11 shows the operation of the
detector on a single spike, with an 85 µVP−P input signal. Software debouncing in the
interrupt handler prevents any glitches in the spike detection signal from causing errors in
the spike count.
Fig. 6.12 shows the spike detector accuracy. Spikes were detected using the hardware
analog spike detector (circle tick) and also using a PC-based threshold-crossing detector
76
10−1
100
101
102
103
104
20
30
40
50
60
Frequency (Hz)
Gain
(dB
)
LNA
LNA+2nd Amp
Figure 6.9: Measured gain versus frequency for both low-noise amplifier (LNA, bottom),and the combined gain of the LNA and 2nd amplifier.
100
101
102
103
104
10−9
10−8
10−7
10−6
Frequency (Hz)
Vn
i,rm
s (
V/√
Hz)
LNA
LNA+Post−Amp
Figure 6.10: Measured noise spectra at the output of the LNA and the post-amp.
(square tick) for comparison. Both detectors were run on synthetic recordings with an am-
plitude of approximately 400 µVP−P and SNR of 10 dB (left) and 6 dB (right). The results
were compared with the known spike times provided by the signal synthesis software. The
analog detector demonstrates comparable discriminative abilities to the software detector,
indicating that noise contributions from the analog front end do not limit spike detection
performance.
77
−40
−20
0
20
40
Post−
am
p O
utp
ut (m
v)
0 20 40 60 80 1000
1
2
Time (ms)
Dete
ct (V
)
Figure 6.11: Operation of the spike detector. The output of the post-amp is shown at thetop with an input signal containing a single spike with SNR of approximately 10 dB. Theamplitude at the input to the NeuralWISP is approximately 85 µ Vpp.
6.3.3 System Operation
Fig. 6.13 demonstrates the operation of the NeuralWISP. The middle trace is the unregu-
lated voltage stored on a 100 µ F capacitor Cstorage, which begins at 0 V, since the WISP
starts out with no stored energy. Initially, the reader is configured to transmit power in
continuous-wave (CW) mode, which charges the storage capacitor to 5.5 V where it is
clamped by a zener diode. As the stored voltage rises, the µC boots up (A). At point (B)
continuous-wave transmission stops and the RFID reader reads data from the WISP. The
first read following bootup will contain empty data. Following the read, the µC enters a 3 s
waiting state (C) in order to allow the analog circuits to recover from RF interference which
occurred during the read. After 3 s, the WISP begins counting spikes (D) for 5 s. After
the spike-counting phase, the reader again transmits CW power (E) to recharge the storage
capacitor, followed by another read, which retrieves data from the previous spike-counting
phase (D). This cycle is repeated indefinitely.
78
0 0.2 0.4 0.6 0.8 10
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
FNR
FP
R
Thresholding in SW
WISP HW Detector
0 0.2 0.4 0.6 0.8 10
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
FNRF
PR
Thresholding in SW
WISP HW Detector
Figure 6.12: Accuracy of the spike detector compared to a software spike detector for SNR= 10 dB (left) and SNR = 6 dB (right). The x-axis is the false negative rate (FNR =Number of missed spikes / Number of total true spikes). The y-axis is the false positiverate (FPR = Number of false detections / Number of total detections).
Figure 6.13: Two read cycles of wireless operation, showing the spike detector output (top),the unregulated stored voltage (middle), and a microcontroller output (bottom) pulsed toshow operation. The data was taken at a distance of approximately 1 m from the reader.
The NeuralWISP’s flexible hardware platform allows for many potential extensions to
the present functionality. For example, it could be configured to sample spike waveforms
after a spike is detected, and transmit the digitized data. An appropriate duty cycle would
79
0 0.5 1 1.5
0.65
0.7
0.75
0.8
0.85
0.9
0.95
1
Am
plif
ied S
ignal (V
)
time (ms)
Original Data
Digitized Data
Figure 6.14: A single spike digitized by the on-board ADC. The µC began sampling andconverting in response to an interrupt from the spike detector.
need to be chosen in order to meet the constraints imposed by the data rate allowed by the
tag/reader interface. Fig. 6.14 shows a spike captured and digitized by the NeuralWISP,
where the digitization was begun in response to a detected spike. The digitized spike
waveform is superimposed on the original waveform. This experiment was performed with
wireless power, but the data was retrieved through a wired interface. It demonstrates that
accurate reconstruction of a spike can be accomplished by waking the µC and ADC from low-
power sleep after spike detection, dramatically reducing average system power. Digitization
of detected events could also be used to implement secondary screening of spikes in software,
improving effective detection accuracy.
6.3.4 In-vivo Results
To validate the NeuralWISP’s ability to detect spikes in vivo, measurements of wing muscle
activity from a Manduca Sexta moth were taken. Note that while the prototype NeuralWISP
is too heavy to be carried by a moth, integration of NeuralWISP onto an IC could allow
in-flight measurements to be performed. Because the recording device is wirelessly powered,
no batteries or wires are required. Since the battery consumes a large fraction of the weight
budget of flying-insect-mounted electronics [87], a wirelessly-powered interface would permit
significant weight reduction compared to traditional sensing schemes. The setup is shown
80
Figure 6.15: In vivo experiment setup showing Manduca Sexta moth with tungsten wireelectrodes in wing muscle tissue. The electrodes are connected to the NeuralWISP via aresistive attenuator. Spike density measurements are wirelessly recorded and communicatedto the RFID reader.
in Fig. 6.15, and a wirelessly-powered recording captured by an oscilloscope is shown in
Fig. 6.16.
NeuralWISP relies on extremely low-power custom analog front end circuitry to allow
operation from a wireless power source. In order to test the compatibility of the analog
front end with extra-cellular neural recording, we performed in vivo measurements on a
macaque monkey (Macaca nemestrina). Fig. 6.17(a) shows spikes recorded with the Neu-
ralWISP LNA and post-amp, digitized with a standard rack-mounted acquisition system,
and high-pass filtered off-line. The clean grouping of the spikes demonstrates that the Neu-
ralWISP’s analog front end has compatible input impedance and sufficient linearity to allow
accurate recording of small neural signals in the presence of 60 Hz interference and local
field potentials.
Fig. 6.17(b) shows the same spikes without the high-pass filtering. A combination of
60 Hz interference and low-frequency field potentials cause the spikes to be superimposed
on a varying baseline level, complicating detection. For use in situations with significant
81
Figure 6.16: Wirelessly-powered data from wing muscle tissue captured over a 2 s timespanby an oscilloscope. The top trace shows the post-amplifier output, which corresponds toapproximately 2.4 mVpp at the input. The bottom trace shows the NeuralWISP spikedetector output.
0 0.2 0.4 0.6−40
−20
0
20
40
time (ms)
Input (µ
V)
(a)
0 0.2 0.4 0.6−200
−100
0
100
200
300
400
time (ms)
Input (µ
V)
(b)
Figure 6.17: Spikes recorded through the NeuralWISP’s amplifiers and digitized with stan-dard rack-mounted recording equipment. (a) High-pass filtered spikes line up well. (b)Unfiltered data indicates significant variation in the baseline.
low-frequency interference similar to that shown here, future systems should incorporate
additional high-pass filtering. Fortunately, such filtering (and additional gain, if desired)
can easily be implemented at a negligible cost in power using micro-power op-amps such as
the one used for the post-amp described above.
82
6.4 Discussion
There are a number of trade-offs in the design of wirelessly powered neural recording systems.
Some involve the use of the RFID protocol. RFID is a relatively mature technology, which
provides a robust communication layer and low cost (approx. $1000) interrogators. This
enables wide-scale deployment as well as collaboration with other researchers. Conversely,
RFID technology was designed for reading many nodes once. In sensing applications, the
goal is often to read one node repeatedly. This repurposing of the protocol constrains data
throughput due to increased overhead. For example, the query rate for 96-bit tag IDs is
limited to about 1 kHz. Reading other tag memory increases throughput but decreases the
tag access rate to about 360 Hz for multi-byte memory access. These estimates are based
on 160 kbps downlink and 640 kbps uplink with preamble overheads, even bit distributions,
and a single tag present (no singulation) [27].
Radiative energy transfer also has a number of trade-offs. Advantages include the abil-
ity to power many nodes with one reader and transfer power over many wavelengths of
distance (wavelength λ = cf = 0.33 m for UHF RFID). Limitations on the number of nodes
include shadowing (where one node blocks the reader signal from reaching a second node)
and detuning (nodes in close proximity may detune the frequency band they are sensitive
to). However, compared to other approaches such as inductive coupling, radiative energy
transfer enables operation at much greater range. Disadvantages include low power transfer
efficiency and the necessity of an antenna on the scale of the RF wavelength. Low power
transfer efficiency, in turn, limits the features of the nodes due to power constraints. How-
ever, reductions in power consumption due to technology scaling are enabling increased
functionality for the same power budget.
Lastly, while one reader may power many tags, multiple readers in close proximity must
time-multiplex. This is due to the tag demodulator design: simple peak detection lacks the
ability to perform channel selection. Therefore, tags cannot selectively listen to one reader
while other readers are transmitting simultaneously. This effectively means that tags in close
proximity must share the communication bandwidth of one reader. Spike sorting, binning,
and other forms of signal processing will allow maximum information to be gathered from
83
a collection of nodes under the limited bandwidth constrains of one reader.
Wireless neural sensing inherently places an RF transmitter in close proximity to the
signal to be detected. While pickup of 60 Hz noise can be greatly reduced due to the sensor
being wirelessly interrogated, the radio can introduce interference in the measurement. In
this work, we separated the sensing and communication temporally, which places time gaps
in the recording. In order to sense and communicate simultaneously, several techniques may
help eliminate RF interference. First, integration of the electrodes, amplifiers, and spike
detection circuitry to a size well below the RF wavelength helps prevent the electrodes from
acting as an antenna. Second, integration of RF-rejection filters in the signal path helps
eliminate noise picked up by the electrode. Finally, shielding of the low-noise amplifier and
filters helps reduce direct interference from the amplifier.
As the NeuralWISP is currently configured, it measures spike density in a time window
of a few seconds. While this is not the typical protocol for neuroscience experiments, it
provides an indication of the activity level of the neuron being observed. This can provide
useful information about sleep-wake state [88]. Simple measures of neural activity levels
can also be used to gauge recovery from brain insult, such as due to cardiac arrest. In [89]
EEG was used to measure activity, but spike density could serve as another indicator. With
additions to the firmware, even the modest data rate supported by the RFID protocol
would allow other information to be transmitted, such as histograms of inter-spike intervals
or spike amplitudes.
NeuralWISP enables a variety of interesting applications including monitoring of small
animals and insects in laboratory environments as well as implantable neural sensors pro-
vided the device size is reduced through ASIC integration. Similar applications for monitor-
ing heart rate, blood sugar, blood pressure, etc. could leverage this technology by applying
it to other biomedical sensors.
6.5 Conclusions
We have demonstrated a wirelessly powered neural interface with a range of 1 m. Using
harvested RF power, the NeuralWISP transmits spike counts to a commercial RFID reader
at user-programmable intervals. In addition to testing with simulation data, in vivo mea-
84
surements with Manduca Sexta moth and macaque monkey validated the feasibility of this
system in real-world conditions.
By operating from a wireless power source, the NeuralWISP allows indefinite operation
without the need to change batteries, a critical need for implanted neural interfaces. The
platform is also flexible and can be programmed to operate in different modes, such as spike
time-stamp recording, or continuous recording on a duty-cycled basis. Future work reducing
the size and weight of NeuralWISP will help lead to the practical deployment of wireless,
battery-free neural recording systems.
85
Chapter 7
WIRELESSLY-CHARGED UHF TAGS FOR SENSOR DATACOLLECTION
7.1 Introduction
RFID tags equipped with sensors are being developed because of their potential to add value
over identifier-only tags in a variety of settings. For example, perishable goods could be
monitored while they are in transit to check that they are not subject to unsafe temperatures,
and fragile goods could be monitored to detect unsafe accelerations that may cause breakage.
Other applications include the detection of harmful agents and non-invasive biomedical
monitoring.
To date, sensor-enhanced tags fall into two broad categories based on conventional mod-
els for powering RFID tags. There are several examples of application-specific, long-range
(UHF) passive tags with integrated temperature and light sensors, as well as an Analog to
Digital Converter (ADC) [1,2,3]. The benefits of passive tags are that they are inexpensive,
disposable and can potentially last for tens of years if not longer. Consequently they can
be embedded in objects for structural, medical, or product monitoring. The key limitation
of these sensor-enhanced passive tags is that their operation requires proximity to an RFID
reader. This greatly limits their use for capturing data through supply chains or other
applications in which there is only partial reader coverage.
In contrast, active, battery-powered tags with data logging capabilities have the advan-
tage that they can be used when tags are not in proximity to an RFID reader because
they carry their own power source. From a hardware standpoint, active tags range in com-
plexity from battery-assisted passive tags that communicate with RFID readers at the low
end to wireless sensor nodes at the high end. High end wireless sensor nodes can em-
ploy a reprogrammable microcontroller, large flash memory, numerous sensors, and wireless
communication over Wifi, Bluetooth, Zigbee or custom protocols [4,5]. Unfortunately, the
86
inclusion of batteries leads to several limitations. The first is finite lifespan, which ranges
from 1 to 5 years in the aforementioned examples. Rechargeable batteries (which also have
lifespan limits) require a charging infrastructure, usually a wired connection to a power
source, and also incur the overhead costs of connecting the battery to the charger. Second,
many batteries deteriorate or become hazardous at extreme temperatures. Third, batteries
add cost, both directly through purchase cost and indirectly through the cost of regula-
tory disposal procedures. Lastly, the inclusion of battery chemicals such as lithium may be
prohibitive for safety reasons.
This chapter presents a novel wirelessly-charged power model for sensor-enabled RFID
tags in the form of a passive data logger (PDL) tag. PDLs aim to combine the best features
of passive (battery-free) and active (battery-powered) tags. Like passive tags, PDLs use
only the energy that they acquire from wireless signals to perform tasks. Like active tags,
PDLs continue to operate when away from an RFID reader. To do so, PDLs store energy
harvested from RFID reader signals in a capacitor, and later operate using this energy. For
a similar physical size, the amount of energy PDLs can store is likely to be less than a semi-
active tag. However, many settings include occasional reader contacts, e.g., supply chains
feature relatively short intervals of data logging between manufacturers, distributors, and
retail stores. Thus, there are typically many opportunities for tags to wirelessly recharge
at the various locations where passive tags are normally interrogated. This allows PDLs to
be used repeatedly and to sustain their operation across occasional reader contacts despite
their lack of an internal, long-lived power source.
To demonstrate the feasibility of wireless-charging, we have built a prototype PDL,
called the WISP-PDL, and used it for a small data collection study that we report later
in this paper. A picture of the latest WISP-PDL is shown in Figure 7.1. Our prototype
builds upon and extends our prior work on WISP (Wireless Identification and Sensing
Platform) [1]. WISP is a fully-passive UHF RFID tag that uses an ultra-low power, 16-bit,
general-purpose microcontroller for sensing, computation and RFID communication. The
WISP-PDL inherits all the WISPs design requirements, but adds an additional one: it needs
to operate without proximity to an RFID reader. The WISP-PDL described in this paper
is a new generation of WISP, presented here for the first time, that implements the EPC
87
Figure 7.1: Photograph of the WISP-PDL implemented using WISP version 4.1.
Class 1 Generation 2 communication protocol.
Our prototype effort caused us to consider the problem of how to retrieve logged sensor
from PDL tags. Earlier sensor-enabled WISPs shoehorned sensor data into the low-order
bits of Gen 1 EPC IDs; the tag emulated different IDs as it was queried for data. However,
this strategy did not extend well to retrieving stored sensor data. Instead, our solution
for the PDL presented here is to upload sensor data using the EPC Gen 2 protocols tag
memory functionality. This has the advantages of compatibility with standard RFID tags
via EPC-compliant tag IDs, and it allows us to perform data collection from PDLs as
an application running on top of commercial RFID readers. The rest of this paper is
organized as follows. After describing related work (Section II) we discuss the main design
considerations in adding Passive Data Logging capabilities to WISP (Section III). We then
present the hardware and software architecture of the WISP-PDL (Sections IV and V). We
report on a short use study in which the WISP-PDL monitors the temperature of a milk
carton over the course of a day (Section VI). Finally, we discuss other applications (Section
VII) and conclude (Section VIII).
7.2 Background and Related Work
Typical UHF RFID systems are designed to increase the visibility of goods in supply chains.
A uniquely-numbered tag is attached to an item of interest, which is then wirelessly scanned
at checkpoints in the supply chain. RFID readers wirelessly power and communicate with
the tags at distances up to 10 m.
Standard commercial tags have also been used for detecting parameters other than loca-
88
tion. In our prior work, mercury tilt switches were used to toggle between two commercial
tag ICs, allowing one bit measurement of object orientation [6]. Others have made a hu-
midity sensor for detecting moisture in walls of buildings and houses by placing a sponge
in front of a tag [7]. Moisture in the sponge detunes the tags antenna, allowing approxi-
mation of humidity level from the read range of the tag. Finally, a custom tag for sensing
high temperatures in food products used a fuse that melts above a particular threshold to
enable or disable the tag [8]. These passive tags based on physical properties (e.g., a fuse
that melts above a particular temperature) can sense while away from a reader but most
are extremely limited in what they can report and are not reusable. PDLs aim to provide
general and reusable sensing when away from a reader.
Efforts have been made to retrieve richer, multi-bit sensor data from RFID tags for a
wide variety of applications. Possible examples include infrastructure and object monitor-
ing, automatic product tamper detection, identification of harmful agents, and biomedical
devices for noninvasive monitoring [9]. To enable these applications, two regimes appeared:
active battery-powered and passive battery-free tags.
Most active tags are essentially wireless sensor nodes [4,5], as noted previously, though
from a software standpoint they are mainly designed to communicate directly with a bases-
tation, rather than peer-to-peer like many wireless sensor nodes. An active tag with adaptive
analog sensor thresholds for triggering sensor measurements was proposed in [10]. By using
a quasi-active state where analog circuitry wakes a microcontroller when sensors exceed
defined thresholds, it can achieve better accuracy in capturing events than devices that rou-
tinely poll sensors on a time interval. Another class of battery-powered data-loggers used in
supply chains is semi-active tags. They are battery-assisted rather than battery-operated,
using backscatter modulation for communication rather than a radio. [15] illustrates the
use of 2.4 GHz semi-active tags in cold chain food monitoring for the army. However, semi-
active tags generally suffer the same disadvantages as active tags due to their dependence
on a battery.
Many passive sensor-enhanced RFID tags tend to be application specific. A commercially-
available, low-frequency RFID tag for detecting dangerous temperatures in food products
during transit is reported in [9], although its range is too small for use in many applications.
89
Other examples of application-specific, long-range (UHF) passive tags with integrated tem-
perature and light sensors, as well as an Analog to Digital Converter (ADC) are [2,3]. We
previously developed a general-purpose tag called WISP [1], which is a fully programmable
passively-powered UHF RFID sensor tag. While these devices provide the benefits of pas-
sive, battery-free operation, none can collect sensor data without proximity to an RFID
reader.
7.3 Design Considerations
The design constraints and challenges of passive sensor-enhanced UHF tags have been thor-
oughly discussed in our prior work [1]. Additionally, there are a number of considerations
we encountered while developing a PDL from our work on WISP. In general, these fall under
three categories: run time, charge time, and RFID compatibility.
7.3.1 Run Time
The primary design consideration for a PDL is the sensor measurement and logging run
time from a single capacitor charge. This run time is determined by the storage capacitor
size and the time-averaged current consumption, Iave, during both sleep and active periods.
As the maximum capacitor size is often fixed by size or cost, the maximum run time is then
determined by Iave. We designed for a 1 day run time using a 0.1 F capacitor. A significant
amount of effort was made reducing Iave to achieve the desired run time.
Fig. 7.2 plots the approximate maximum Iave for various run times and capacitor sizes
using the relationship I = C∆v∆t . This relationship allows accurate computation of the
runtime if the current consumption is constant over voltage, and this is a reasonable ap-
proximation when the quiescent current is larger than the average active current. When
the active current dominates and is drawn from a regulator, the amount of current drawn
from the capacitor by the regulator is a function of the voltage on the capacitor.
For applications with short-duration (100 µs to 10 ms) sensing / data logging and long
sampling interval (1 second or more between samples), the quiescent current can potentially
determine the minimum achievable Iave. A brief example illustrates this point. Assume a
sensor measurement and flash memory write occur every 10 seconds and each event consumes
90
1.E-08
1.E-07
1.E-06
1.E-05
1.E-04
1.E-03
1.E-02
1.E-01
1.E+00
1.E+01
1.E+02
1 10 100 1000 10000 100000
Capacitance (uF)
Average Current Budget (uA)
1 Hour1 Day1 Week1 Month1 Year
Figure 7.2: Maximum Iave for various run times and capacitor sizes.
500 µA for 1 ms. The average current consumption of this workload (sensing and logging)
is only 56 nA. However, the quiescent current of discrete component designs (not IC), can
require several microamps (as shown in our design).
The current consumption of the WISP-PDL, built with commercial off-the-shelf (COTS)
components, is roughly equal to that of the previous example. Excluding parasitic leakages,
the quiescent current budget includes a 1 µA ultra-low-power linear regulator, a 0.5 µA
interval wakeup timer and a 0.3 µA voltage supervisor. This corresponds to a sleep current
consumption of 1.8 µA. The active current is approximately 500 µA for 1 ms, but the sample
time can be adjusted between hundreds of milliseconds to tens of seconds.
As the quiescent current is the dominant consumer, a considerable improvement could
be made using an external wakeup circuit to power on the remaining circuitry at regular
intervals. For example, real-time clocks from Seiko [11] and Swatch [12] allow operation from
an unregulated power source at quiescent currents of approximately 350 nA. This RTC could
be used to enable the remaining circuitry. Although the reduced current consumption of a
RTC represents some improvement over the regulated design, it was not enough to justify
91
the added design complexity since we had met our run time design goal.
There is a point of diminishing returns in optimizing both the active or sleep currents.
When either current consumption is less than 10% of the other, little run-time is gained
from further reduction of the smaller current consumption. Also, some capacitors have
internal leakage resistances in the megaohm range, which also causes an upper bound on
maximum runtime. For example, ceramic capacitors have low-nanoamp to sub-nanoamp
leakages. Electrolytic and tantalum capacitors can have hundreds of nanoamps of leakage.
Double layer capacitors, which we employed for our design, have widely varying leakages
from low-nanoamps to low-microamps.
7.3.2 Charge Time
A second consideration is the wireless charge time, with acceptable charge times depending
on the intended PDL application. In general, it is important to characterize how fast the
PDL can charge at any particular distance. Conservation of energy requires that the energy
consumed during runtime first be charged into the storage capacitor, which is illustrated in
Equation (7.1).
Estored =12C(V 2
charged − V 2dd) = PchargeTcharge (7.1)
The usable energy, Estored, is stored in voltage above the minimum operating voltage,
Vdd. Energy stored in the capacitor at voltages below the PDLs minimum operating voltage,
Vdd, cannot be used. Thus the capacitor voltage must first charge up to Vdd after which
surplus (i.e. usable) energy begins to accumulate. Due to component ratings, a maximum
voltage, Vcharged, is enforced via overvoltage protection. The charge time is somewhat
longer than the recharge time, because the charge time includes voltage from 0 V to Vdd as
well as Vdd to Vcharged, while recharges only charge from Vdd to Vcharged.
Equation (7.1) allows prediction of the charge time if the power supplied by the harvester,
Pcharge, is known. Friis transmission equation allows prediction of the RF power available
to the PDL over distance, and empirical RF to DC rectifier efficiencies can then be used
to estimate Pcharge as a function of distance. Equation (7.2) is the linear form of Friis’
92
equation for path loss, with terms for polarization loss and rectifier efficiency included.
Pr = PtGtGr
(λ
4πR
)2
ηLmLp (7.2)
The transmit power of the reader Pt = 1 W = 30 dBm. Its center frequency is 915 MHz,
corresponding to wavelength λ = 0.33 m. The transmit antenna gain GT = 6 dBi (this
yields an effective isotropic radiated power of 4 WEIRP , the United States regulatory limit
for this ISM band). The receive antenna gain Gr = 2 dBi (the standard gain figure for
a dipole antenna), and the polarization loss Lp = 3 dB. Loss Lp occurs because only half
of the power transmitted from the circularly-polarized transmit antenna is received by the
linearly-polarized receive dipole antenna. Lastly, η = 30% is the rectifier efficiency, and this
is approximated from empirical data using the WISP. (Since η is a fraction between 0 and
1, its logarithm is negative, which is why it is added on the right hand side.)
Fig. 7.3 shows the predicted charge time versus range for the previously discussed effi-
ciency, antenna gains, transmit power and stored energy based on Friis equation, assuming
rectified power can be converted to Vcharged at a particular distance. WISP becomes
voltage limited at 4.5 m; however, integrated circuit designs are able to achieve high con-
version efficiencies up to 10 m [9]. Thus even at long distances from the reader, a PDL
can charge overnight or over the course of a day, which is not unreasonable for many ap-
plications. Finally, an integrated circuit design can potentially achieve much lower power
consumption and consequently much faster charge time for the same runtime as our discrete
implementation.
7.3.3 RFID Compatibility
Many supply chains have existing RFID infrastructure for use with standard commercial
tags. Creating secondary wireless networks for sensing in supply chains is generally imprac-
tical, so it is desirable for PDLs to integrate into the existing RFID network. WISPs already
harvest energy from standard reader signals. In addition, we needed to communicate sensor
data using only standard commands. Fortunately, the EPC Class 1, Generation 2 specifi-
cation provides a suitable interface for this task in the form of arbitrary, i.e., user-defined
93
0
5
10
15
20
25
30
35
0 2 4 6 8 10
Meters
Time (hours)
Recharge Time
Charge Time
Figure 7.3: Predicted charge time versus range.
memory. This memory can be read and written with standard commands. We log sensor
data into this memory and upload it by having the RFID reader perform a series of reads.
We can also use this memory scheme to signal associated metadata such as whether there
is more data to upload. This approach allows WISP-PDLs to operate on existing RFID
networks without interfering with standard ID-only tags. Adding EPC Gen 2 support re-
quired a significant change in our software-defined protocol from previous versions of WISP
as well as some modification to WISPs hardware demodulation circuitry.
7.4 Hardware Architecture
The WISP-PDL is a new generation of WISP hardware with modifications for long run time
data logging, EPC Gen 2 communication, and fluid level sensing. Previous WISPs were
fully-passive, sensor-enhanced EPC Gen 1 RFID tags. In the WISP-PDL as well as prior
WISPs, communication, sensing and computation are software defined in a general-purpose,
reprogrammable Texas Instruments MSP430 microcontroller. WISPs include circuitry for
RF power harvesting, modulation, demodulation, and voltage regulation that enable op-
eration as a passive RFID tag. A detailed design discussion of WISP is found in [1], and
therefore the bulk of this section will focus on areas specific to WSP-PDL. First, a high
94
Figure 7.4: Block diagram of the WISP-PDL.
level description of the WISP-PDL is presented. Second, WISP-PDL-specific components
are described in detail. Finally, a capacitive sensor is described.
7.4.1 High Level Description
The WISP-PDLs high-level implementation is similar to previous WISPs, and a block di-
agram of the WISP-PDL is shown in Fig. 7.4. The analog front end contains a power
harvester block that rectifies incoming RF energy into DC voltage to charge the storage
capacitor. The power management block stores energy and provides regulated voltage for
the system. The demodulator thresholds the enveloped RF carrier wave and converts the
downlink (reader to tag) logic level to the regulated logic level. The modulation circuitry
converts the uplink (tag to reader) waveform into a modulated tag reflection coefficient
to the antenna. Lastly, a MSP430 microcontroller facilitates communication and sensor
measurement.
There are a few significant hardware changes in the PDL-WISP from the previous
WISPs. First, the demodulator was revised to enable Gen 2 communication. Second,
the power management block was revised to reduce leakage and thereby lengthen run time.
Third, an external EEPROM allows low-voltage non-volatile data storage. Fourth, a capaci-
tive sensor was added to enable various sensing applications. Lastly, a newer microcontroller
(MSP430F2012) was used which allows 6 MHz operation at 1.8 V (versus 4 MHz at 1.8 V
with the MSP430F1232) for nearly the same power consumption. This was needed in order
to perform the more complex Gen 2 communication protocol.
95
Figure 7.5: Demodulation and power management circuitry.
7.4.2 Demodulation and Power Management
The demodulation and power management circuitry is shown in Fig. 7.5. Gen 2 reader-to-
tag physical layer modulation (PR-ASK) causes smaller amplitude modulation deviations
than Gen 1 ASK modulation. This required a new demodulator, which is similar to those
used in silicon tag designs. Two low threshold DC schottky diodes are used to rectify the
enveloped signal from the harvester. The current consumption of the comparator is used
as a constant-current source, and the voltage across D7 detects current (high amplitude
RF modulation) supplied by the harvester as a positive voltage, and lack of current (low
amplitude RF modulation) as negative voltage. The comparator is used to generate a rail-
to-rail logic level waveform, and the level shifter converts the unregulated logic level to
the regulated logic level. It is important to optimize current consumption and speed when
choosing a comparator; the Gen 2 protocol requires roughly 1 µs propagation time, and
minimal power consumption is desirable for maximizing the wireless range of the device.
Storage capacitor C1 accumulates energy, which is rectified by D6. Over-voltage pro-
tection (OVP) clamps high rectified voltages to 5.5 V, and a low dropout, ultra-low-power
96
linear regulator is used to provide 1.8 V regulated power for the system.
Fig. 7.4 shows external sensors and EEPROM attached. External sensors are described
shortly. An 8 Kbyte, 1.8 V EEPROM is used for logging data. Alternatively, the internal
flash memory of the microcontroller may be used for logging small amounts of data; however,
this necessitates a slightly higher regulated voltage of 2.2 V. Regardless of implementation,
the EEPROM or flash memory will hence be referred to generally as non-volatile memory
(NVM).
7.4.3 Sensors
A number of sensors can be integrated into the WISP-PDL, including those previously
implemented on WISP (rectified voltage, light level, temperature, and orientation). Other
interesting sensors that we have not yet integrated but have been explored for active and
semi-active tags include humidity, vibration, sound, bearing (via digital compass) and others
[10].
We implemented a capacitive sensor for fluid level sensing in our demonstration study.
Capacitive sensing is a popular method for sensing user input in devices such as the Ap-
ple iPod, human presence in automatic airbag enable/disable in automobiles, distance in
digital calipers, and displacement in MEMS accelerometers, as well as directly sensing gas
pressure, liquid level, and other parameters. It is also the case that capacitive sensing can
be accomplished with minimal components and low power consumption. In its simplest
incarnation, measurement of the discharge time of an RC circuit can be used to estimate
capacitance. More advanced designs provide enhanced noise immunity, directivity of sensing
and accuracy [13].
We achieved reasonable accuracy with a simple RC discharge measurement. A config-
urable microcontroller port I/O pin is used for sensing. The pin is first set as an output to
charge the sense capacitor to Vdd. Next, the pin is set as an input (output tri-state buffer
set to high-z) and the microcontrollers timer is used to measure the discharge time from Vdd
to the input buffer threshold of approximately Vdd / 2. In some microcontrollers, the pin
input leakage could be used as the parallel resistor, but the MSP430 has such low leakage
97
that a 10 MΩ resistor is necessary to create a discharge rate in the hundreds of microseconds
range.
%fill = 100Cmeasured − Cmin
Cmax − Cmin(7.3)
We characterized the sensor to understand the relationship between fluid level and ca-
pacitance. Table I shows experimental data versus linear steps for fill percentage. Fill
percentage was calculated using Equation (7.3). Note that the measurement was taken in-
side the physical range of the sensor (the bottom of the sense wires to the top of the sense
wires in Fig. 7.4).
7.5 Software Algorithms
The microcontroller firmware implements EPC Gen 2 communication, periodic sensor sam-
pling and data logging. Generally, the microcontroller spends most of its time in a low
power sleep mode. An internal timer wakes the microcontroller periodically to take sensor
measurements and potentially log the measurement. When the WISP-PDL is queried by
an RFID reader and there is new logged data, the four communication states on the right
side of Fig. 7.6 are executed. Note that portions of the Gen 2 specification not used for
retrieving the ID or sensor data are not yet implemented.
There are two primary challenges in the design of the software. The first is maximizing
time spent in the microcontrollers low-power sleep states. This minimizes the active current
consumption. Second, general purpose microcontrollers are not designed to efficiently per-
form RFID communication because they process software instructions while custom silicon
RFID tag state machines process many instructions in parallel. Custom, optimized com-
munication algorithms are necessary to achieve RFID data rates with a 6 MHz clock speed
and also to keep power consumption at a minimum.
Fig. 7.6 shows a state diagram of the WISP-PDL data logging and communication
cycles. The center box represents the sleep state, and a low-frequency, low-power oscillator
is used to periodically wake the device from this sleep. These timer interrupts trigger
the data logging cycle, shown on the left side of Fig. 7.6. First, sensors are powered on
98
Sleep Mode
(LPM 3+VLO)
Query Sensors
Compare
sensor data to
last logged
data → ∆
Write to EEPROM/Flash and
Enable RFID
Send RN
Send ID
Send RN
Send Data
VLO
WD
T
Interrupt
∆> V
t
∆ < Vt
RF
ID O
n +
Q
uery
Tim
eo
ut
Rea
d
Read
Request
RN
Ack
Figure 7.6: WISP-PDL software state diagram.
and sampled using the microcontrollers 10-bit ADC. To conserve NVM and power, not all
sensor measurements are stored. Current sensor measurements are compared against the
last stored sensor measurements, and if the difference ? exceeds a threshold Vt, the new
sample is logged to NVM. Also, each sample is time stamped using a count of the number
of timer interrupts. Finally, when a new sample is logged to NVM, the RFID interface is
enabled so that the new data may be retrieved by a nearby reader.
The implemented portion of the EPC Gen 2 communication cycle is illustrated on the
right half of Fig. 7.6. If the RFID interface is enabled, a Query command from the reader
begins the communication session. Several further commands precede the Read command,
which allows the reader to download logged data from NVM. A fully erased NVM Read data
packet is used to mark the end of valid NVM data. The reader then issues an additional read
command past the end marker, which signals the WISP-PDL to disable its RFID interface.
This last step is required because Gen 2 protocol does not provide an acknowledgment to
the tag that the read command was successful, and the tag must wait until the reader
successfully receives the last packet before disabling its RFID interface.
Depending on the usage scenario, it may be necessary to clear the NVM after a download
99
so that memory can be freed up for further logging. To reset the NVM address where sensor
data is stored, a write command or a read to a non-valid address can be used to trigger the
reset. For devices using flash memory, this also triggers an erase operation on the memory.
7.6 Results
We conducted two tests with the WISP-PDL, instrumenting a milk carton to measure
temperature and fill percent over the course of a day. This test was chosen for two reasons.
First, it is a controllable, convenient, small-scale setting. Second, it has two scenarios that
resemble a supply chain: (1) the refrigerator is temperature-controlled and RF-isolated like
a truck trailer or shipping crate and (2) there are random times in which the tagged object
is removed from the metal box and scanned by an RFID reader. In either case, the tag does
not know when it will be removed from the fridge for use or transferred from a shipping
crate or trailer. Fig. 7.7 shows the reader antenna (the reader is on top of the refrigerator)
and laptop which controls the reader and logs data retrieved from the WISP-PDL.
Two tests were performed with the instrumented milk carton, which is shown in Fig. 7.6.
The first is a controlled experiment where the milk carton is filled with water and dispensed
in fixed amounts. The second is an uncontrolled experiment where the milk carton is used
by various people in an office environment for tea and coffee drinks.
The results of the first experiment are shown in Fig. 7.8. In this test, a carton was
filled with water and poured out in regular increments much like the test in Table I. The
difference is that the carton is stored in the fridge between pours, and the water is poured
out instead of added. Similar to Table I, the carton is physically separated from other
cartons to prevent the sensor from detecting the milk in other cartons.
Each time the carton is poured, an upward spike in fill percentage occurs. This is caused
by the position of the sensor; when the carton is tilted to pour out liquid, the tilting causes
the fluid to cover the entire sensor. Positioning the sensor of the opposite side of the carton
would cause dips in the level during pouring.
Fig. 7.9 shows an uncontrolled experiment where a milk carton is instrumented the
same way as Fig. 7.8 and used over the course of a day. The high milk consumption is due
primarily to an espresso machine near the office refrigerator; one carton of milk makes 10
100
Figure 7.7: Reader antenna and control laptop outside of refrigerator.
(a) WISP-PDL attached to milk carton. (b) Fridge environment with other cartons nearby.
101
0
10
20
30
40
50
60
70
80
90
100
0 2 4 6 8
Time (hours)
Percent Full (%) / Temperature (C)
Temperature Celcius
Percent Fill
Figure 7.8: Control data set logged from milk carton.
0
10
20
30
40
50
60
70
80
90
100
0 5 10 15 20Time (hours)
Percent Full (%) / Temperature (C)
Temperature (°C)Percent Full
Figure 7.9: Real world data logged from milk carton over the course of a day.
to 15 lattes.
The data in the uncontrolled experiment (Fig. 7.9) shows two primary differences from
the controlled experiment (Fig. 7.8). First, the carton was not physically separated from
the other cartons in the uncontrolled experiment, which caused the level to increase at times
102
when the sensor was near other cartons. Second, the amount of milk removed each time was
not regulated in the uncontrolled experiment, so the level changed by varying amounts after
each use. By shielding the capacitive sensor, the interference effects of other milk cartons
could be eliminated.
7.7 Applications
There are a host of potential applications for PDLs. Monitoring sensitive parameters in sup-
ply chains is an obvious extension for current RFID networks. In particular, temperature-
controlled supply chains for food, chemicals, blood plasma, and pharmaceuticals are target
application areas. Shock, vibration, and humidity are other parameters than can be mea-
sured for sensitive goods.
In addition to logged parameters, PDLs can supplement their sensor data with infor-
mation provided by RFID readers. Examples include location, time, package contents, and
transport vehicle information. Further, this data could easily be provided using the stan-
dard Gen 2 RFID Write command. Note that storing reader-supplied information be done
with any RFID tag (passive, active or PDL) that has unused non-volatile memory, but
this information gains value when it supplements logged sensor data. This would allow for
detailed information at the destination without the complexity of requiring communication
between parties (such as manufacturing company, distributor and retailer). For example,
if the temperature exceeded a threshold during transit and the delivery truck license plate
number were supplied by the loading dock RFID reader, the problem could be discovered
and easily identified.
RFID has also been employed for non-conventional applications, which can benefit from
PDLs. For example, RFID has been explored for use in eldercare monitoring, allowing
caregivers to unobtrusively monitor daily living tasks such as cooking and cleaning [14].
However, data in these applications has typically been limited to the binary visibility model
(ie, is the tag near the reader?). Using PDLs, an RFID reader in the fridge and pantry
cabinets can recharge the tags, and the tags can sense and log data when out of range
of the reader. This allows continual data acquisition without the stringent requirement of
proximity to a reader.
103
Another application for PDLs is implantable medical sensors. Parameters such as blood
pressure, blood sugar, temperature, and heart rate could be monitored and logged through-
out the day. At night, a bedside reader would then download the days data and charge the
PDL. Finally, medical analysis software would allow the user to see the results and submit
data to a doctor for professional analysis.
7.8 Conclusions
The WISP-PDL demonstrates a new power model that differs from conventional passive
and active models for powering RFID tags. Like passive tags, PDLs use only the energy
that they acquire from wireless signals (via standard RFID readers) to perform tasks. Like
active tags, PDLs can continue to operate and collect sensor data when away from an RFID
reader. We have achieved this combination by having PDLs charge themselves by harvesting
energy from RFID reader signals and storing the energy in a capacitor for later use when
they are away from a reader. This model is intended for use in settings such as supply chain
monitoring, in which tags have occasional contact with readers.
Our prototype WISP-PDL extends our prior work on WISP (a passive, sensor-enabled
UHF tag) by adding energy storage and away-from-reader operation. WISP-PDLs run on
EPC Gen 2 infrastructure to upload collected sensor data via commercial readers and in
a manner that is compatible with standard EPC Gen 2 tags. The short demonstration
study we present demonstrates the feasibility of the novel power model. The WISP-PDL
successfully monitored the temperature and fullness of a milk carton during the course of
a day. The results are sufficiently promising that we are looking at larger and different
use cases, and we hope that wirelessly-charged tags prove to be a viable model for many
applications.
104
Chapter 8
A GRAPHICAL USER INTERFACE FOR RFID APPLICATIONS
8.1 Introduction
Many RFID readers include a basic tag display application that connects to the reader via
serial (RS232) or ethernet. However, these applications are primarily intended to demon-
strate the reader capabilities - not provide a useful service to the end user. For example,
there is often no method of manipulating tag data in real time or logging tag data to a
text file. For commercial reader deployment, the user typically hires a middleware company
who, in turn, writes software (middleware) to interface the reader with business manage-
ment software such as BizTalk [90]. Consequently, the default reader application is of little
use for RFID research.
Until recently, there was no standard interface for RFID readers. Each company imple-
mented its own protocol, and the middleware company wrote tailored interfaces for each
reader. For example, the author has written serial interfaces for both Alien and Thing-
Magic readers in Microsoft Visual Basic. These applications are similar in appearance and
architecture to the standards-compliant application that is presented in this chapter and
will thus be ignored. Clearly, writing unique software for each vendor (and sometimes each
reader from each vendor) is inefficient and slows commercial adoption. In 2007, the RFID
consortium EPCglobal ratified a standard reader interface called Low Level Reader Pro-
tocol (LLRP) which defines a standardized network interface for readers [29]. Just as a
standardized air protocol (Gen2) helped advance commercial RFID success through vendor
interoperability, LLRP is intended to further standardize protocols across vendors and thus
allow ease of commercial adoption.
This chapter discusses two LLRP-compatible reader applications. The first application,
described in Section 8.3, provides sensor data display, graphing and logging. The second
application, described in Section 8.4, varies the power available to the tag in order to
105
test tag performance across input power levels (input power is a proxy for multipath-free
wireless range). These applications are built on a common abstraction, which is described
in Section 8.2. This abstraction optionally hides much of the LLRP library complexity from
the application developer. The LLRP library provides low-level ethernet calls and XML
encoding/decoding of the reader communications.
8.2 Architecture
EPCglobal provides an LLRP library which facilitates ethernet communication with the
reader. Libraries are provided in Java, Perl, C, C++ and C#.NET. This work uses the
C# library in order to leverage the rapid GUI development tools available in Microsoft
Visual Studio. This choice of framework comes at the cost of operating system inflexibility.
However, a virtual machine could potentially sidestep this issue.
For the application developer, however, the library includes significant complexity that
is unnecessary for controlling the reader (connect / disconnect, start / stop) and receiving
tag data. The goal of this work is to abstract away much of the complexity of the LLRP
library to the application developer. To this end, the architecture shown in Figure 8.1 was
developed. The RFID Reader class acts as an interpreter, encoding basic function calls into
LLRP-compatible commands as well as decoding XML-encoded tag data and placing it into
convenient, typed data structures. The Reader Manager class stays synchronized with the
reader state (ex, connected or disconnected) and handles errors. This class also prevents the
user from sending errant commands to the reader, which improves application robustness.
The Settings module includes graphical forms and LLRP encoding/decoding code to
enable the user to manipulate the reader air protocol settings and link layer behavior. The
Logging module provides standard menus, file naming, and function calls for data logging
to text files. Minimal effort is required to add logging functionality to applications - the
developer need only define what information the user may select to log and define how their
data should be formatted in the log file. Graphing is provided through a GPL-licensed
library called ZedGraph [91]. This library is an incredibly simple turn-key solution. The
user need only add (x,y) points to a list and refresh the graph. The GUI elements are
provided through Microsoft Visual Studio, allowing extremely rapid and simple application
106
LLRP Library
RFID Reader
Reader Manager
Tags / Sensor Data Instructions
Parsed Data Control Signals
Raw Tag XML LLRP Commands
ApplicationSettings Logging
Graphing GUI
Figure 8.1: LLRP-compatible abstraction layers for RFID application development.
development. Finally, several interfaces are used to define the interactions between the
abstraction layer and the application. For example, the application must implement a
means for handling received tags and for displaying status and error messages.
8.3 WISP Demo
The first application is primarily used to display and log sensor data from WISPs. A screen
capture of the application is shown in Figure 8.2. On the right, a summary table shows
statistics about each tag in view of the reader. The read rate is shown in large text in
the upper right corner. Various tabs in the left panel show graphs of sensor data retrieved
from WISPs. Connecting and starting the reader are provided through panels along the
top of the window. Reader settings manipulation and text file logging are available through
buttons near the bottom of the window.
Starting the reader is simple due to the abstraction layers mentioned before. The GUI
/ application code simply calls the Reader Manager with the appropriate command. For
example, to connect to the reader, the application simply sends a connect command with the
reader address to the Reader Manager. This allows for simple, straightforward application
code which would not be the case if interacting directly with the LLRP library.
107
Figure 8.2: Screen capture of the WISP GUI application. A summary of tag statistics isshown on the right, and sensor details are available in various tabs on the left. Text filelogging and control of reader settings are available through buttons at the bottom of theapplication.
8.4 Attenuation Tester
As tag to reader distance increases, the power available to the tag decreases rapidly. WISP
maintains operation at low input power levels by lowering its duty cycle. That is, the read
rate gracefully declines with input power. However, firmware bugs can easily cause errant
behavior, resulting in a “cliff” effect. That is, for some input power where the WISP has
sufficient voltage to operate, it is unable to communicate. The Attenuation Tester allows
for repeatable testing without physically changing the tag to reader distance. It does this
by sweeping the transmit power of the reader through the reader settings.
A screen capture of the Attenuation Tester is shown in Figure 8.3. The features are
very similar to the WISP Demo application due to the required manipulation of the Reader
108
Manager in order to connect and start the reader. Read rate versus attenuation is auto-
matically plotted during the sweep, and it may also be logged to a text file. The logging
takes advantage of the Logging module, and requires only a few additional lines of code to
implement for this application.
8.5 Conclusions
A common reader interface represents an important step in the development of RFID.
Writing custom interfaces for each vendor is wasteful and inefficient. However, LLRP is
relatively new, and it disenfranchises readers that cannot talk over ethernet. In theory, the
data sent by ethernet could just as easily be sent by serial, and perhaps future versions of
LLRP will allow the user to select the physical layer in use. Regardless, there are good
reasons for using ethernet versus serial due to its ability to support many readers on one
network and the existence of LAN infrastructure in many environments. Wireless readers
are also compatible with LLRP via 802.11 (wifi) and standard network infrastructure. It
is likely that ethernet will become the standard interface of new readers in order to enable
LLRP compatibility.
109
Figure 8.3: Screen capture of the Attenuator Test program. Tag read rate versus attenuationlevel is plotted using ZedGraph. Text file logging and control of reader settings are availablethrough buttons in the center of the application.
110
Chapter 9
DESIGN OF AN INTEGRATED GEN2 SENSOR TAG
9.1 Introduction
The tremendous impact of WISP, both as a research platform and an educational tool,
demonstrated the usefulness of a Gen2-compatible, programmable RFID tag. WISP’s im-
plementation as a PCB design using COTS components has a number of drawbacks, how-
ever, compared to IC implementations. Chiefly, the WISP rectifier has poor sensitivity (-10
dBm vs. -20 dBm), and the microcontroller (µC) is clumsy and inefficient at performing
RFID communication (100x power consumption, limited protocol support). Work presented
in the literature - see Section 9.2 - has largely ignored Gen2 compatibility (for deployabil-
ity), programmability/configurability (for application development), and addressability (for
multi-tag environments). It is the aim of this work to address these oversights and apply
knowledge and experience from the WISP project to an IC implementation. The design of
this system-on-chip solution, or socWISP, is described in Sections 9.5 and 9.6. Verification
and measurement results are presented in Chapter 10, and Chapter 11 presents in-flight, in
vivo temperature recordings from a Manduca Sexta moth.
9.2 Prior Work on Full Tags
A plethora of RFID-related research has appeared in the literature, predominately since
Karthaus [92] influential and widely-cited paper in 2003. As described in Chapter 1, the
recent technological feasibility of RFID, coupled with numerous application spaces and
widespread commercial adoption, have galvanized academic research in this field. Literature
contributions on specific tag components (ex., rectifiers, oscillators) will be reviewed in
Section 9.3. However, a number of full tag implementations have also been presented, and
their features are summarized in Table 9.1.
Table 9.1 groups tags into four categories. The first category, including this work and
111
the WISP, represents fully-passive tags with sensors, addressability, and Gen2-compliant
protocol. The WISP, which is discussed in detail in Chapter 3, is incredibly feature-rich.
However, as stated in the introduction, performance is cramped by use of a µC. WISP has
proven most useful as a prototyping tool; its configurability and programmability facilitate
rapid application development. This work preserves some of the WISP’s flexibility while
dramatically improving performance, and design details will be presented in this chapter.
The second category, tags with sensors but no protocol/addressability, includes Shen,
Cho, Shenghua, and Paek. It is unclear how one would deploy this type of tag because
without an ID, the sensor data they report cannot be associated with the object to which
the tag is attached. The reported power consumption is remarkable: Paek claims a tag
power budget of only 95nW. Unfortunately the back-leakage of UHF rectifiers or the self-
leakage of most batteries will likely limit performance.
The third category, tags with addressability but no sensors, includes Nakamoto, Pillai,
Karthaus, and Barnett. These tags target conventional RFID applications and provide a
useful reference upon which a more feature-rich tag can be designed.
The fourth category, including Kim and Kocer, includes tags primarily designed for
battery-assisted operation. Kim [94] presents a Gen2 compatible tag with integrated tem-
perature sensor and addressability via FeRAM-stored ID. The tag has the capacity to op-
erate in passive mode without a battery; however, it appears that the tag functions as a
standard ID tag in this regime. Furthermore, their publication shows temperature data sent
in lieu of the ID. The authors are ambiguous about the exact functionality, but it appears
the tag can function as one of the two above types: a sensor tag or an addressable tag.
Finally, there is no ADC, so external sensors cannot be measured. The on-chip temper-
ature is measured with a ring oscillator, similar to temperature tags such as Shen, Cho,
etc. Kocer [95] presents a tag with 5-bit ADC and 3-bit programmable ID. The lack of a
commercially-compatible protocol and limited ID space makes deployment of this tag infea-
sible. Furthermore, the tag’s active current of 2 mW necessitates a battery or a WISP-like
power management scheme.
112
Table 9.1: Comparison of published tag features.
Protocol NVM Addressable Sensors Battery-Free
This Work G2 - Y1 8-Bit ADC Y
WISP G22 EEPROM+Flash Y 10-Bit ADC Y
Kim [94] G23 FeRAM Y Temp N
Kocer [95] N - 3-Bits 5-Bit ADC N
Nakamoto [96] ISO FeRAM Y - Y
Pillai [97] ISO EEPROM Y - Y
Karthaus [92] ISO4 EEPROM Y - Y
Barnett [98] G2 EEPROM Y - Y
Shen [99] N - N 8-Bit ADC + Temp Y
Cho [100] N - N Temp Y
Shenghua [101] N - N Temp Y
1Unique ID Generator provides addressability[93]
2Partial protocol support
3Sensor data not sent by Gen2 protocol
4Specific protocol not stated in publication
9.3 Prior Work on Tag Components
Remarkably few of the full tag implementations present implementation details or perfor-
mance metrics on the individual tag components. However, various subsections of the tag
have been published individually and in greater detail. [102] includes a literature review for
the regulator, bandgap reference and demodulator. Prior work on the rectifier, oscillator
and digital core are reviewed here.
9.3.1 Rectifier
There have been a number of in-depth analyses of UHF and microwave rectifier design.
This research has been spurred not only by RFID applications (where the power source is
intentionally “planted”), but also by the prospect of ambient RF harvesting. For example,
113
[103] wirelessly powers a consumer clock from television signals. This could enable a low
power, low duty cycle sensor node such as a Mote [104] to operate in environments where
solar power is infeasible and without battery-life constraints.
Much of the literature focuses on optimization of conventional topologies. For exam-
ple, Umeda [105], Vita [106], and Barnett [107] present design strategies for conventional
Dickson charge pumps (voltage-doubling ladders), and Yi [108, 109] includes an in-depth
mathematical analysis. Mandal [110, 111] discusses fundamental physical relationships that
link the operating bandwidth and range are related to technology dependent quantities like
threshold voltage and parasitic capacitances.
Several papers have investigated non-conventional topologies. For example, Nakamoto [10]
tunes transistor Vt to maximize rectifier power conversion, achieving 36.6% efficiency. Le [112,
11] replicates this work using floating gate PMOS transistors and optimizes for sensitivity
instead of efficiency. They achieve the best results to date: 1 V output voltage is reported
at -22.5 dBm input power. Unfortunately, however, Impinj patented “adaptive silicon”
technology using floating gate Vt tuning several years ago [113].
9.3.2 Oscillators
Gen2 RFID tags require a local oscillator to clock the digital core. In particular, the tag
backscatter specifications necessitate either a precise 1.28 MHz clock or a higher clock
rate with a programmable divider. Unfortunately many full-tag publications rarely provide
details on the oscillator; however, there have been several dedicated papers which are listed
in Table 9.2.
Most designs employ a current-starved ring oscillator, and efforts focus on reducing vari-
ation and power consumption. Ring oscillators suffer from high sensitivity to almost every
parameter including supply voltage, bias current, temperature, mismatch, parasitics, and
process variation. An alternative low-power oscillator topology is the relaxation oscilla-
tor. Achieving nanowatt power levels can be difficult with these designs; a 1 MΩ resistor
with 1 V supply draws 1 µW. Precision resistors consume significant area (especially for
megaohm values) and are not available in many processes. Additionally, a comparator with
114
Author Frequency Current (nA) Supply (V) Variation Tech.
This Work 3 380 0.5-0.9 20% max 130 nm
Cilek [114] 1.28 240 0.8-1.0 14% 130 nm
Song [115] 5.65 1200 0.6 - 130 nm
Klapf [116] 1.9 800 0.7-1.6 PLL 120 nm
Barnett [117] 1.52 400 0.8-1.5 - 130 nm
Lincoln [118] 3.5 14000 0.5-1 Inj. Lock 180 nm
Table 9.2: Review of oscillators presented in the literature.
sufficient bandwidth for oscillation must also be factored into the power budget. Due to
these tradeoffs, ring oscillators are more widely used than relaxation oscillators.
Cilek [114] presents a 1.28 MHz 3-stage current-starved ring oscillator in 0.14 µm CMOS.
Reported power is 191 nW minimum, and the supply voltage can range from 0.8 V to 1.0 V.
The authors claim 14% maximum and minimum frequency deviation, however, this includes
an impractical, manual adjustment of the bias current. In contrast to some older RFID
specifications, the Gen2 protocol provides no opportunity to phase-lock the oscillator to a
downlink preamble square wave. This means that the oscillator needs to meet specifications
without tuning. Lincoln [118] instead injection locks to the RF carrier. However, the
tradeoff in power consumption is unsuitable for a passive tag. The table cites the full clock
generator current of 14 µA. The relaxation oscillator core consumes 3 µA, but no results
are presented on the standalone operation of the oscillator.
Barnett [117] presents a 1.52 MHz relaxation oscillator. The advantage of this topology is
supply-independence; the frequency is stable from 0.8 V to 1.5 V. Low current consumption
of 400 nA is achieved by using a 14 MΩ resistor. However, they rely on wafer-trim or on-
chip calibration in order to correct for process variation. This is unrealistic for ultra-low-
cost RFID tag manufacture and as mentioned above, cannot be corrected using phase-lock
techniques.
There are various problems with the remaining designs. Klapf [116] presents an oscil-
lator with poor performance given the technology node - current consumption is an order
115
to magnitude higher than other results in the table. Finally, the 5.7 MHz oscillator from
Song [115] is more than twice the required frequency needed to meet Gen2 specifications.
They do not explain why such a frequency was chosen, and this high frequency will cause
unnecessarily high digital power consumption. Their implementation as a relaxation oscil-
lator provides low frequency variation over supply voltage. However, design sensitivities to
transistor Vt will undoubtedly affect both the bias current generator and oscillator core over
process and temperature variation, and no analysis or results are presented.
9.3.3 Digital Core
Relatively few publications discuss the design and optimization of the digital core. However,
the digital core can consume significant power if implemented poorly, and this would in
turn degrade performance of the tag as a whole. Two exceptions exist. First, Zalbide [119]
presents a Gen2 digital core architecture. Unfortunately they target just one allowable link
frequency and consequently may not work with commercial readers (which also only support
certain subsets of the protocol). They do, however, offer simulation results comparing
performance gains from various power reduction strategies. Second, Ricci [120] presents
simulation results for a 2 µW Gen2 digital core with cryptography, and some analysis
on clock frequency selection. A more detailed analysis is presented in Section 9.6.8. For
reference, Cilek [121] discusses the impact of clock frequency variation on the baseband
processing in the tag. Oddly, they focus on the downlink communication, which is not the
limiting constraint (see Section 9.6.2).
9.4 Architecture
The socWISP has an RF front end, nano-power analog circuitry, and digital architecture
similar to conventional ID-only RFID tags. In this manner, the socWISP is a standalone,
Gen2-compatible RFID tag. However, a number of features provide novel functionality for
an integrated tag solution as compared to the prior work shown in Table 9.1. Most notably,
this work functions simultaneously as an addressable, passive Gen2 tag and also as a sensor
tag. Figure 9.1 shows a block diagram of the system.
116
MSP430 µC
ADC
RegulatorsBandgap Ref.
RF Rectifier
Modulator & Demodulator
Packet Parse
Controller
Data Mux
Receiver
Transmitter
UID
On-Chip
Analog Core Digital Core Peripherals
Oscillator
Voltage Clamp, Supply DecouplingAntenna
Matching
Network
Figure 9.1: System-level architecture. On-chip components are shown in the tan area,including the analog (blue) and digital (green) cores as well as peripheral (red) circuitry.
There are 4 supply voltages used in the system. The analog circuitry can operate from
an unregulated rectifier output of 0.5 V to 3.6 V due to the use of thick-oxide (52A) devices.
The remainder of the on-chip circuitry uses standard (22A) devices and has a nominal supply
voltage of 1.2 V. Finally, a 1.8 V supply is provided for external devices such as an MSP430
µC and COTS opamps.
The digital core is functional with supply voltages ranging from 0.55 V to 1.2 V. To
reduce power consumption, a 0.7 V nominal supply is generated using two series diode-
connected transistors as a reference. This supply is intentionally CTAT (varies complemen-
tary to absolute temperature) in order to track the device Vt, and it is used to power both
the oscillator and digital core.
Many tags presented in the literature rely on precise clock frequencies to meet baseband
timing constraints. This work uses a programmable divider to output the correct baseband
waveform regardless of the local oscillator frequency. The divider is programmed on-the-fly
based on timing information provided by the Gen2 protocol. For clock frequencies ranging
from 1.7 MHz to 10 MHz, the digital core can output modulation that conforms to EPC
Gen2 specifications for frequency tolerance. This is discussed in detail in Section 9.6.8.
A nano-power current-starved 3 MHz ring oscillator clocks the digital core, and is de-
signed for a 0.6 V to 0.8 V supply. The 50% margin in clock frequency above the minimum of
1.7 MHz allows for supply, temperature, process and mismatch variation and also eliminates
need for costly post-manufacture trimming.
117
The peripheral circuitry, which includes an 8-bit ADC and a unique ID generator (UID),
operates from a 1.2 V supply. There are numerous examples in the literature of sub-1 V
(even down to 500 mV) ADCs in the literature; however, it was not the aim of this project to
optimize the ADC. This general-purpose ADC can be used in conjunction with an external
sensor to transmit sensor data in a fully-Gen2-compliant manner. Chapter 11 presents an
example of such.
The UID [93] exploits process variation in the start-up configuration of an SRAM to
achieve a randomly-distributed, but 96% stable, tag ID. This alleviates need for non-volatile
memory, which adds complexity through high-voltage flash memory charge pumps or spe-
cial FeRAM processes. This circuit is also optimized for 1.2 V operation. Again, however,
numerous publications in the literature have demonstrated low-voltage subthreshold opera-
tion of SRAM cells. Note that tag circuitry is naturally compatible with subthreshold clock
speeds; byte-wise ID readout at the maximum uplink rate requires less than 100 kHz clock
rate.
The breadth of applications to which WISP was applied reinforced the need for config-
urability. In addition to allowing an arbitrary analog signal to be measured by the ADC,
the socWISP facilitates bidirectional RFID communication with an off-chip device. This
is intended to provide an interface for a MSP430 µC, which can perform data logging,
advanced power management, duty cycling and measuring of high-power sensors, and actu-
ation/control of other devices such as a powered sensor node. These devices can be powered
by a 1.8 V on-chip linear regulator, and µC power management is aided by a 2.2 V voltage
detector as in the WISP design.
Two versions of this design were fabricated, and Table 9.3 summarizes the differences.
Version 1 includes all of the circuitry described above. This is meant to be a full-featured
extensible sensor tag. Version 2 does not include a microcontroller interface, 1.8 V regulator,
or voltage detector. Instead, a FIFO asynchronously buffers ADC sampling from irregular
RFID communication. This allows periodic sampling for time-sensitive applications, and
this version functions as a stand-alone tag.
118
Feature Version 1 Version 2
8-b ADC Yes Yes
ADC Access Un-Buffered FIFO-Buffered
ADC Sampling On Demand Periodic
1.2V, 0.7V Regulators Yes Yes
1.8V Regulator Yes No
2.2V Supervisor Yes No
Gen2 µC Interface Yes No
Table 9.3: Summary of Features vs. Design Version.
On-ChipRF RectifierMatching
Network
Analog Core
1.2 V Bandgap Reference
1.2 V Regulator 1.8 V Regulator
Bias Generator
0.7 V Regulator
Demodulator Ring Oscillator
Modulator
From Digital Core Digital
Supply
Analog
Supply
µC
Supply
Unregulated
Voltage
To Digital CoreAntenna
Figure 9.2: Analog block diagram. On-chip components are shown in the tan area.
9.5 Analog Design
Figure 9.2 shows a block diagram of the analog core components. [102] presents design
equations, layout diagrams, and simulation results for the bandgap, demodulator, regula-
tors and voltage detector. However, the schematics and underlying design methodology
will be repeated here for completeness. Additionally, measurement results are included in
Chapter 10. Lastly, design of the oscillator and bias generator will be described in detail.
Figure 9.3 shows a more detailed schematic of the analog core components. An off-chip
matching network, which could easily be absorbed into the antenna impedance, follows the
119
antenna. On chip, six voltage-doubling rectifier stages recover the baseband reader signal.
An off-chip Schottky diode and storage capacitor form the unregulated supply voltage for
the tag by rectifying DC from the recovered baseband waveform. The Schottky diode could
easily be replaced with a low- or zero-Vt diode-connected transistor. However, this design
simplified testing and added minimal cost/area to the final design. A zener diode clamps
the unregulated voltage to approximately 3 V. An off-chip clamp was used due to its low
cost, small size and simplicity. If necessary, one of several on-chip clamps presented in the
literature could be implemented.
A large 10 µF storage capacitor is used for two reasons. First, the sensor signal con-
ditioning hardware needs to stay powered even while the reader is off. Because commer-
cial readers often operate at less than 50% duty cycle, this necessitates an energy storage
mechanism. Using a reader with 100% duty cycle and/or a sensor which can be quickly en-
abled/disabled, much smaller supply capacitors could be used. Second, an optional off-chip
µC can be powered by the 1.8 V regulator. COTS µCs require high current (∼ 500µA) for
short periods of time (∼ 100µs). A large supply cap is necessary source this current at long
wireless distances.
All of the analog circuits shown on Figure 9.3 are powered by the unregulated voltage.
The use of thick-oxide devices allows operation up to 3.6 V. A unit 50 nA reference current
is used to bias the analog blocks, which comes from a VGSR current reference. Two reference
voltages are used to create the supply voltages. First, the bias generator creates a 0.7 V
reference using two diode-connected series transistors. Second, a bandgap creates a 1.2 V
reference voltage for the regulators. Two unity-gain-feedback linear regulators create the
0.7 V and 1.2 V supply directly from the reference voltages. Lastly, a 1.8 V supply is created
with resistive feedback using the 1.2 V reference.
The demodulator compares the instantaneous rectifier output to the same signal passed
through a low-pass filter. This output, the recovered baseband reader-to-tag communica-
tion, is level-shifted to the digital core voltage. Finally, uplink communication is achieved
by a single transistor which shorts the antenna terminals together. Each component of
Figure 9.3 is described in detail in the sections below.
120
Modulator
50
0.12
RF
IN
DC
OUT
6-Stage Rectifier
Clamp
Unreg
Rect
Out
Demod
Out
Un
reg
Dvd
d
Bia
s
Demodulator
Demodulator
µC Vdd
Avdd
Dvdd
Regulator
Unreg
FB
OUT
Bias
Ref
Regulator
Unreg
FB
OUT
Bias
Ref
Regulator
Unreg
FB
OUT
Bias
Ref
22nH
2pF
10µF
Antenna
2.5 MΩ
5.0 MΩUnreg
1.2VBandgap
Bias
50 nA
Bias Generator
Unreg 0.7V
Figure 9.3: Analog circuit schematic.
9.5.1 RF Rectifier
Figure 9.4 shows the voltage-doubling rectifier cell. A plethora of publications on rectifier
design have appeared in the literature as described in Section 9.3. Most focus on design for
sensitivity or efficiency. In reality, the most crucial feature is transistor Vt. This work was
fabricated in IBM 8RF 130 nm CMOS, which has standard-, low-, and zero-Vt transistors
in various oxide thicknesses. Back-leakage was tolerable with zero-Vt devices, and their low
forward drop provided good sensitivity and efficiency. As sensitivity and efficiency were
not dramatically affected by transistor size, the design was optimized for convenient input
impedance. After resonating the input capacitance with an inductor (which is often built
121
Figure 9.4: Rectifier cell schematic. Six cells are stacked to increase output voltage at lowinput power.
into the antenna as an inductive short), the tag presents a 50-ohm load. This eases testing
and allows easy integration with standard antennas.
It should be noted that the rectifier requires careful simulation for accurate modeling
due to its highly-nonlinear nature. Periodic steady state (PSS) and periodic s-parameter
analyses were performed in Cadence (Spectre) to measure the input impedance versus input
power and frequency as well as rectification efficiency.
9.5.2 Bias Current Generator
A conservative textbook design is used for the bias current generation, shown in Figure 9.5
[122]. Despite use of thick-oxide devices, the bias generator starts reliably at 0.6 V. The
high output impedance of the cascode devices, even in subthreshold operation, maintains
a remarkably constant output current of 50 nA from 0.6 V to 3.6 V as shown in Fig-
ure 9.6. Simulated Monte Carlo process and mismatch bias current distribution is shown
in Figure 9.7. Variation is minimized through use of relatively-large device sizes as well as
precision resistors. This achieves a standard deviation of just 2.8 nA without trimming.
Layout area could be reduced significantly with the use of less precise resistors, but at the
cost of post-fabrication calibration.
Temperature variation is shown in Figure 9.8. The temperature coefficient is PTAT with
0.21nAC slope. This results in a ±12% variation between 0C and 50C from nominal 25C.
122
vbn
vbp
vbnc
vbpc
1.6 MΩ
…..
50 nA Bias
Currents
vbpvbpc
Unreg
200 fFvbp
Startup Circuit Cascode Bias Voltage Bias Current Generator
vbnc
M1
M2
M27
M3
M4
M5
M6
M7
M8
M9
M10
M12
M14
M13
M15
M16
M17
M18
M19M11
M20
M22
M24M26
M21
M23
M25
Figure 9.5: Bias current generator schematic.
0
10
20
30
40
50
60
0 1 2 3 4
Input Voltage
Bias Current (nA)
Figure 9.6: Simulated bias current versus supply voltage.
0
10
20
30
40
50
60
70
80
90
100
39 40 42 43 44 45 47 48 49 50 52 53 54 55
Bias Current (nA)
Frequency
N=500,
Mean=46nA,
StDev=2.8nA
Figure 9.7: Simulated Monte Carlo bias current distribution (process and mismatch).
123
30
35
40
45
50
55
60
-50 0 50 100
Temperature (Celcius)
Bias Current (nA)
Figure 9.8: Simulated bias current versus temperature.
Most startup circuits consume substantial quiescent current. This design uses MOS
pseudoresistors to minimize static power to several nanoamps. A 200 fF capacitor ensures
that the startup circuitry time constant is much greater than the bias generator core, and
this in turn prevents any oscillations from developing.
A fountain design is used to distribute bias currents. This is necessary because of the
very small currents used: transients take a long time to settle out leaving bias voltages
vulnerable to capacitively-coupled interference. Additionally, hard-switching circuits such
as the demodulator and oscillator can create noise on the NMOS bias voltage. This in
turn can upset sensitive circuits such as the bandgap references. To combat this effect, the
demodulator and oscillator generate their own NMOS bias voltages at the cost of increased
bias current.
9.5.3 Bandgap Reference
Figure 9.9 shows the bandgap reference voltage generator. The nominal output voltage is
1.2 V, which allows easy generation of the 1.2 V supply using unity-gain feedback. Design
equations and simulation results are presented in [102].
Like the bias current generator, this circuit employs a textbook topology. The bandgap
reference does not suffer the same tradeoff between precision and layout area like the bias
generator despite use of significantly-higher-valued resistors. Instead, output voltage ac-
124
vbp
Unreg
8x1x
+
_
5 MΩ
1.2 V
5.5 MΩ
1x
M1 M2 M3
Figure 9.9: Bandgap circuit schematic to generate 1.2 V reference.
curacy is ensured through accurate matching between resistors. This is achieved using an
interleaved resistor layout. Parasitic junction diodes, which are characterized in IBM 8RF
130 nm, are used to form the bandgap.
9.5.4 Regulators
This design uses a linear regulator core to create various regulated voltages. By changing
the feedback and input reference voltage, various output voltages can be created. The core is
shown in Figure 9.10, and three incarnations that generate 0.7 V, 1.2 V, and 1.8 V supplies
are shown in Figure 9.3. The regulator core is biased with 100 nA quiescent current.
There are several design considerations. First, the PMOS pass transistor is 200 µm wide
to minimize VDS (I ·RON ) and thus provide low drop-out voltage. Second, a cascode stage
is used to increase opamp gain, which is low due to subthreshold biasing of transistors.
Addition of the cascode stage increases gain to approximately 67 dB. Third, a common-
centroid input transistor layout is employed to minimize input offset voltage which directly
impacts output voltage accuracy. Finally, feedback resistors for the 1.8 V regulator must be
quite large to keep quiescent current minimized. A resistive network of 5 MΩ and 2.5 MΩ
is used, which consumes about 250 µA. The 1.2 V and 0.7 V regulators use unity-gain
feedback, which does not consume quiescent current.
Many of the sensor tags reported in the literature employ shunt regulators. This is
125
Bias
10pF
Unreg
Ref
Out
FB
M1
M2
M3
M4
M5
M6
M9
M1 M4
vbp
Figure 9.10: Regulator schematic. The feedback and reference voltage determine the regu-lated output voltage. The PMOS bias voltage is reused from the bias current generator.
feasible because they have no ADC - the on-chip temperature sensor does not require dig-
itization of an analog signal. Instead, they employ an open-loop ring oscillator that has
a known temperature vs. frequency characteristic. However, these sensors suffer from low
absolute accuracy accuracy and errors from fluctuations in the supply voltage. For preci-
sion measurement of most sensor outputs, analog to digital conversion is required. For a
wireless system, a known reference voltage is required to interpret the code returned by
the ADC. This is because the ADC code represents the input voltage as a fraction of the
reference voltage. This design uses a precision reference to generate the supply voltage, and
the supply is also used as the ADC reference voltage.
9.5.5 Demodulator
Gen2 protocol is discussed in detail in Chapter 2, but downlink communication will be briefly
reviewed here for context. Reader to tag communication employs pulse-interval encoding
(PIE). Specifically, the duration of positive pulse width determines whether each bit is a zero
or one. The PIE ratio, or ratio between a data-zero length and a data-one length, is 1.5:1 at
126
minimum and 2:1 at maximum. The data-zero is called Tari, and can range from 6.25 µs to
25 µs. Obviously the positive pulse width cannot be determined without a negative pulse
to separate each bit. The negative pulse is denoted PW, and is the greater of either 26.5%
of Tari or 2 µs. The takeaway is that PW can be as small as 1.66 µs, which is greater than
600 kHz in bandwidth. This sets the lower limit on the demodulator bandwidth.
The digital core measures and converts the positive pulse durations into data and clock.
However, the received signal (the output of the rectifier) is not a suitable digital signal (ex,
see Figure 3.6). The purpose of the demodulator is to recover a logic-level (rail to rail)
signal from the rectifier output. The demodulator inputs are the rectifier output and a
low-pass-filtered version of the rectifier output. The RC filter has approximately 16 kHz
bandwidth and works to filter out the negative pulses. This is used as a reference voltage
to compare against.
The demodulator schematic is shown in Figure 9.11. It is essentially a 2-stage opamp;
the first stage provides differential to single-ended conversion with at least unity-gain am-
plification at the signal bandwidth. The second stage significantly boosts the signal swing
in order to achieve a logic level swing. Thick-oxide buffers with a low supply voltage (0.7 V)
prevent crowbar current due to the limited slew rate of the comparator. Phase margin is
not a concern; the comparator is an open-loop amplifier. The differential pair is biased with
75 nA, and the common-source stage is biased with 300 nA.
The second stage intentionally limits on the supply rails. The demodulator was designed
such that static current of cascaded second stage does not draw bias current while the
reader is off (which is more than 50% of the time). In order to maximize the differential
pair bandwidth, transistor sizes were minimized at the expense of mismatch. However, the
input drive is greater than 50 mV, so significant input offset voltage is tolerable.
9.5.6 Oscillator
A 3-stage current-starved ring oscillator is used to clock the digital core. Figure 9.12 shows
a schematic of the design. The oscillator is designed for a minimum frequency of 3 MHz,
which consumes a nominal 267 nA including the NMOS bias voltage generation. Large 1 µm
127
Bias
10pF
Unreg
DvddRect Out
21 pF
550
kΩ
Demod
Out
M1 M2
M3 M4
M5M6
M7
M8
M9
M10
M11
M12
Figure 9.11: Analog demodulator that is used to recover a logic-level baseband signal fromthe rectifier output.
Figure 9.12: 3 MHz ring oscillator schematic.
by 1 µm devices are used to reduce mismatch. It should be noted that parasitic extraction
is crucial for achieving useful simulation results. Without parasitics, simulation results vary
from 3.5 MHz to 6.8 MHz. With parasitics, simulation results vary from 3 MHz to 4.7 MHz.
Frequency control by use of current-starving naturally produces a poor slew rate. This
tends to cause large crowbar currents in the digital buffer following the oscillator. An
open-loop common-source amplifier significantly improves slew rate for the following digital
buffers, while consuming a fixed bias current itself.
Ring oscillators are essentially relaxation oscillators with an effective resistance defined
128
2.0
2.5
3.0
3.5
4.0
4.5
5.0
5.5
6.0
6.5
7.0
-50 0 50 100
Temperature (Celcius)
Oscillator Frequency (MHz)
FFF
FS
SF
SSF
(a) Simulated oscillator frequency versus process and temperature without compensation circuit.
2.5
3.0
3.5
4.0
4.5
5.0
-50 0 50 100
Temperature (Celcius)
Oscillator Frequency (MHz)
FFF
FS
SF
SSF
(b) Simulated oscillator frequency versus process and temperature with compensation circuit.
Figure 9.13: Simulated oscillator performance versus process and temperature.
129
by the current sources, capacitance set by CGS , and hysteretic up/down comparison voltages
defined by the NMOS and PMOS threshold voltages, respectively. Temperature changes
significantly affect the transistor Vt, which is a substantial fraction of the 0.6 V to 0.8 V
supply voltage. A relatively-simple, zero-power, open-loop compensation is created by M1
and the 1.3 MΩ resistor, R. The input bias current of 50 nA creates a voltage across R which
sets the VGS of M1. As the Vt of M1 decreases with increasing temperature, more current is
drawn away from M3 into dummy load M2. This reduces the bias current of current mirror
M3, which provides bias current compensation that tracks Vt. By choosing an appropriate R,
simulated variation is reduced from 40% to 10% for slow and normal PMOS corners between
-50C and 100C. Because PMOS process variation affects the Vt of M1, the compensation
also helps control the PMOS transistor variation. At room temperature, variation across
process corners is reduced from 67% to 30%. The worst case variation over process and
corners is reduced by a factor of two. Simulation results are shown in Figure 9.13(a) and
Figure 9.13(b).
Using PMOS transistors without current limiting (M4, M7, M10) causes the PMOS
transistor speed to affect the oscillation frequency. This is due to the effective “charging”
resistance being set only by the PMOS on-resistance. The disadvantage of this topology is
about 40% frequency variation over corners. However, the cost of adding PMOS current
sources is relatively high: increased supply voltage, and increased bias current. Stacking
another device necessitates a higher supply voltage, and also requires an extra current mirror
to generate the PMOS bias voltage. More importantly, however, the “free-running” PMOS
transistors greatly increase the oscillation frequency for a fixed bias current. A significantly
higher bias current would be required to achieve the same oscillation frequency with PMOS
current sources added.
Because the oscillation frequency is a function of Vt, which is referenced to the supply
rails, it is strongly affected by the supply voltage. Simulation results of frequency and supply
current versus voltage and temperature are shown in Figure 9.14(b) and Figure 9.14(a). This
is left uncompensated, relying on supply regulation for consistent performance.
130
3.0
3.5
4.0
4.5
5.0
0.5 0.6 0.7 0.8
Vdd
Oscillation Frequency (MHz)
-50˚C
0˚C
50˚C
(a) Simulated oscillator frequency versus temperature and supply voltage.
0.0
100.0
200.0
300.0
400.0
500.0
600.0
700.0
800.0
900.0
1000.0
0.5 0.6 0.7 0.8
Supply Voltage
Supply Current (nA)
-50˚C
0˚C
50˚C
100˚C
(b) Simulated oscillator current consumption versus temperature and voltage.
Figure 9.14: Simulated oscillator performance versus supply voltage and temperature.
131
Demodulator
Digital Core
Modulator
Oscillator Prescaler
Receiver
Encoder
Preamble
CRC 16
Sequencer
ControllerPacket Parse
RNG
UID
ADC
µC
MUX
Figure 9.15: EPC Gen2 digital core block diagram. The controller implements the Gen2RFID state machine, selecting the proper packets to send in response to received packets.
9.6 Digital Design
A high level block diagram of the digital core is shown in Figure 9.15. The Receive block
converts incoming downlink communication from pulse-interval-encoding (PIE) to clock and
data. A PacketParse block decodes EPC commands and stores relevant information for the
Controller and Prescaler. The Controller block decides what packet to send after receiving
a packet from the reader, and enables the transmitter if appropriate.
The transmit architecture is very modular. A standard 3-wire interface consisting of
clock, data and done is used for data sources, which are selected through a multiplexer
(MUX) by the Controller. The Sequencer aligns all of the pieces of a packet together: a
Preamble, data from the MUX, and CRC16 if appropriate (not all packets have a CRC).
Finally, the Encoder block converts the clocked data to FM0 or Miller encoding. The output
of the Encoder drives the uplink backscatter modulation transistor.
The Encoder requires a clock at twice the backscatter link frequency (BLF). This clock is
generated by scaling the input oscillator clock using a programmable divider. Section 9.6.8
describes how a minimum oscillator frequency is determined by residual divider error and
Section 9.6.7 presents the encoder design.
132
9.6.1 Controller
The Controller, shown in Figure 9.15, manages the EPC Gen2 state transitions, determines
if the tag should respond to received commands, and selects appropriate transmit data
packets. At a lower level, the Controller manages the transmit and receive states, providing
reset and enable signals to each block. The Controller also determines what data is sent in
response to the Read command. For version 1, the user memory address selects either the
µC or on-chip ADC as a data source. For version 2, the ADC is read through a FIFO and
the address determines whether the FIFO should advance the read pointer or keep it fixed.
This allows dropped packets to be repeated.
9.6.2 Receiver
A schematic of the receiver digital logic is shown in Figure 9.16. A 10-bit counter measures
incoming PIE symbols which are then compared against the pivot. Decoded data is clocked
out to the parsers. The LSB of the counter is used for random number generation, which is
discussed in Section 9.6.4.
The counter size determines the maximum clock frequency. A 10-bit counter allows
up to 10 MHz input clock frequencies without overflow for the longest symbol (TRcal) at
the slowest data rate. On the other extreme, the minimum clock frequency must be fast
enough for a digital counter to differentiate between zeros and ones. The minimum difference
between a data-zero and data-one is 3.1 µs. A clock rate greater than 323 kHz could detect
this change. However, this is irrelevant because the uplink specifications necessitate a much
higher clock frequency in the megahertz range (see Section 9.6.8).
Most information sent by the reader is digitally encoded. However, TRcal, which is used
to set the transmit frequency, is a temporally-encoded signal. In other words, the pulse
interval duration encodes information about the required uplink data rate. To store this
information, the counter value for the TRcal symbol is output directly to the Transmit (TX)
Settings module. TX Settings stores these values until the next Query.
Two state machines make up the receiver. The first is a low-level edge detector, shown
in Figure 9.17. After a low-high transition, the bit is evaluated and the physical layer state
133
clockOscillator
resetcount
Demodulator
LSBRNG
timeoutTRcal
Counter
rx clock
rx data
Logic Parser
TX Settings
PIE
data
Figure 9.16: Pulse-Interval-Encoding (PIE) demodulation logic schematic.
demod
high
always
demod
low
resetWait For
Demod
Low
Reset
Counter
Wait For
Demod
High
Evaluate
Bit
always
Figure 9.17: Edge detection logic state diagram.
transition is evaluated as shown in Figure 9.18. The states progress through the various
symbols in a packet. The TRcal state is selected if the measured count is greater than
RTcal, which is the only case in which this happens. For a review of the Gen2 packet
structure, see Chapter 2.
There are no error-handling states in the code. However, a timeout signal is generated in
the bits physical layer decoder state (see Figure 9.18) if the current counter value is greater
than RTcal. This timeout signal serves two purposes. Most obviously, if a timeout occurs
before the packet is complete, the controller resets the Receiver module. A more subtle
purpose, however, is to notify the Encoder that one RTcal period has transpired following
134
Data 0
always
RTcal
Bits
TRcalDelimiter
reset
else
always
count > RTcal
reset
always
* State transitions occur in the bit evaluation state
Figure 9.18: EPC physical layer packet digital decoder schematic.
rx clock
rx data
Receiver
MUX
8-Bit
Memory
Bit
Counter packet
complete
command
complete
M
DR
TRext
Logic
packet type9
2
Figure 9.19: Schematic for command parsing logic.
the last bit of the received packet. This is one of two conditions that the Encoder must wait
on before uplink transmission may occur.
9.6.3 Packet and Command Parsers
Two logic blocks are used to decode and parse the incoming data stream from the Receiver
module. The command parser, shown in Figure 9.19, detects which type of packet is being
received, and outputs signals to indicate when the command has been received and also
when the entire packet has been received. Additionally, the Query information relevant for
configuring the transmit block (TREXT, DR, M) is decoded.
135
rx clock
rx data
Receiver
Logic
+
MUX
Bit
Counter
read: words, pointer, bank
Q, up/dn
write data
Memory
Logic
handle
RN16
match
write clock
packet
type
Command
Parser
Figure 9.20: Schematic for packet parsing logic.
The packet parser, shown in Figure 9.20, is responsible for interpreting and storing
the payload of each different packet type. Depending on the packet type, as indicated by
the command parser, the incoming data is parsed differently. Signals related to the Write
command are passed directly through this module. Signals related to the Read command
are stored in memory, which remains set until the Controller resets this module. Finally,
signals pertaining to a reader-requested handle are compared against the tag’s handle, and
a match indicator flag is set appropriately.
9.6.4 Random Number Generation
A random number for tag singulation is generated by sampling the LSB of the baseband
bit-length counter, and passing these sampled bits through a linear-feedback shift-register
(LFSR). Barnett [98] takes a similar approach, sampling the RF carrier directly at the cost
of higher power consumption. Three mechanisms create randomness such that two tags
do not generate the same random number. First, the bit-length counter is clocked by the
on-chip current-starved ring oscillator, which is inherently noisy and uncorrelated to the
baseband signal. Second, the precise bit-length of the demodulator output varies based
on RF input signal strength, process variation in bias current, and mismatch of transistor
sizes. Each tag generates a slightly different baseband output, which is easily greater than
the period of the oscillator. Finally, the use of an LFSR creates history-dependency in the
random number generation. At minimum, changes in multipath due to reader frequency
136
do
CRC
Controller
start TX
done
CRC
16
Preamble
Generatorclock
preamble
data
done CRC data
clock out
done
data in
clock in
clock done data
ready stopclock done data
M
generate
violation
Receivertimeout
TREXT
DR TRcal
N
clock
Oscillator
Encoder
Logic ÷ N
TX
Settings TX
Settings
Data Source
MUX
Sequencer
modulator
out
Data
Sources
Figure 9.21: EPC Gen2 uplink packet construction and modulation schematic.
hopping will affect each tag’s demodulator output. This creates further uniqueness in the
random number generation.
9.6.5 Transmitter Architecture
The full transmitter logic schematic is shown in Figure 9.21. A Prescaler (Section 9.6.8) di-
vides down the clock to the appropriate backscatter link frequency (BLF). The Encoder (Sec-
tion 9.6.7) requests data from the Sequencer by clocking it. The Sequencer (Section 9.6.6)
orchestrates the construction of a packet by routing the clock to the each data source. The
data sources (Preamble, MUX, and CRC16) each provide a done indicator, which causes
the Sequencer to either move to the next data source in the packet, or tell the Encoder to
stop. Upon receiving a stop signal, the Encoder finishes up sending the current bit and then
sets a done flag. This flag from the Encoder tells the Controller that the transmission is
complete and that the transmitter can be reset.
137
done & CRC
done
done
resetPreamble
Mux
CRC16done &
!CRC
Done
Figure 9.22: Sequencer state diagram for constructing EPC Gen2 packets.
9.6.6 Sequencer
The Sequencer is responsible for creating a Gen2-compliant packet and passing it to the
Encoder for conversion to FM0 or Miller encoding. As the name suggests, it sequences data
streams from the Preamble generation module, a data source from the MUX selected by the
Controller, and finally the CRC16 if enabled by the Controller. A state diagram for these
transitions is shown in Figure 9.22.
A standard interface is used for all modules connected to the Sequencer: clock is sent
to the module, data is expected starting on the second positive clock edge, and the module
asserts a done signal when it is finished sourcing data. After each module is finished sending
data, the Sequencer clocks the next module. When all of the modules are complete and
the Encoder has finished sending the last bit, the Sequencer asserts a transmit complete
signal for the Controller. Note that the Sequencer does not generate a clock; the Encoder
generates the clock to pull in data at the correct timing.
9.6.7 Encoder
The Encoder’s task is to convert data into Gen2-compliant modulation. A schematic is
shown in Figure 9.23, with some of the details of Figure 9.21 omitted for simplicity. Both
FM0 and Miller modulations encode data through phase inversions (PI) of a square wave
138
2xBLF clockBLFPrescaler ÷ 2
PI 2xBLF
modulation out
data
÷ M
FF
XOR
Sequencer
FSM
ANDEnable
violation
Figure 9.23: FM0 or Miller modulation encoder schematic.
with frequency equal to the BLF. They differ in the timing of when the phase inversions
occur. The finite state machine (FSM) positions the phase inversion correctly in the outgoing
waveform depending on the data from the sequencer and on the selected modulation type
(FM0 or Miller). The Encoder is clocked at twice the BLF so that the finite state machine
(FSM) can manipulate each phase of the outgoing waveform.
The Miller modulation M sets the data rate relative to the backscatter link frequency
(BLF) via a divider. For FM0, the BLF is the data rate, and the divide ratio is 1. For
Miller 2, 4 and 8, the divide ratio is the Miller number. This clock drives the sequencer,
which returns data to the finite state machine (FSM). The finite state machine manipulates
the output waveform using an exclusive-or operation which is discussed below.
The FM0 preamble employs a violation of the encoding rules for signaling purposes.
To create this exception, the preamble sends a violation flag to the encoder, which over-
rides the standard encoding rules. Compliant modulation waveforms are found in the EPC
specification [27].
9.6.8 Prescaler
The EPC Gen2 specification defines the tag backscatter link frequency (BLF) as shown in
(9.1). TRcal is a length of time specified to the tag as a pulse interval, and DR is 8 or 643
depending on the Query settings.
BLF =DR
TRcal(9.1)
139
The tag measures TRcal with a digital counter clocked at the oscillator frequency f0. This
produces a measurement of TRcal called TRcount as given by Equation (9.2).
TRcount = TRcal · f0 (9.2)
In order to manipulate both positive and negative edges, the Prescaler provides a clock
fTX to the Encoder which is double the BLF. Combining (9.1) and (9.2), the input clock
f0 requires division by N to equal fTX as given by (9.3) where DR is 8 or 643 depending on
the Query settings.
N =TRcount
2DR(9.3)
Multiply and divide hardware consumes significant area and power. A more efficient
implementation is given by (9.4) and (9.5), where one of two divider values is chosen de-
pending on the required DR. Note that << and >> represent bit-wise shift operations
with the in-shifted bit (MSB or LSB) filled by a logic 0. Shifting to the left multiplies by
two, and shifting to the right divides by two. α = 4 and β = 13 are empirically chosen to
center the residual divide error about zero.
N8 = (α+ TRcount) >> 4 (9.4)
N 643
= (β + (TRcount << 1) + TRcount) >> 7 (9.5)
To illustrate this operation with an example, let the tag oscillator frequency f0 = 3 MHz
and the desired BLF = 256 kHz. The reader would send TRcal = 31.25 µs and DR = 8
(alternatively, it could send TRcal = 83.3 µs and DR = 643 ) using (9.1). The tag would
measure TRcount = 93 using (9.2). The tag would then compute the divide ratio N8 = 6
using (9.3). This would create a 500 kHz clock for the encoder and thus a 250 kHz fTX .
The error of 6 kHz, or 2.3%, is well within the Gen2 specified tolerance.
Residual errors versus input clock f0 are shown in figures 9.24, 9.25, and 9.26 for transmit
frequencies with the lowest divide ratios and most strict tolerances. The highest errors
occur for the fastest transmit frequencies because the divide ratio becomes coarse as it
approaches 1. A popular choice of clock frequency is 1.28 MHz [98]; however, this allows
a divide ratio of only 2. However, as shown in Figure 9.24, this requires clock frequency
140
-30%
-20%
-10%
0%
10%
20%
30%
40%
0.5 1 1.5 2 2.5 3 3.5
Frequency (MHz)
Residual Error
640 kHz, DR 64/3
Upper Limit
Lower Limit
Figure 9.24: Backscatter link frequency error due to divider residual for 15% allowabletolerance transmit frequencies.
-20.0%
-15.0%
-10.0%
-5.0%
0.0%
5.0%
10.0%
15.0%
20.0%
0.5 1 1.5 2 2.5 3 3.5
Frequency (MHz)
Residual Error
320 kHz, DR 64/3
256 kHz, DR 64/3
320 kHz, DR 8
256 kHz, DR 8
Upper Limit
Lower Limit
Figure 9.25: Backscatter link frequency error due to divider residual for 10% allowabletolerance transmit frequencies.
141
-15%
-10%
-5%
0%
5%
10%
15%
0.5 1 1.5 2 2.5 3 3.5
Frequency (MHz)
Residual Error
160 kHz, DR 8
Upper Limit
Lower Limit
Figure 9.26: Backscatter link frequency error due to divider residual for 7% allowable tol-erance transmit frequencies.
accuracy of ±15% for 640 kHz transmit frequencies because the next divider steps of 1
and 3 do not reduce the error to a tolerable level. This is notoriously difficult to achieve
without trimming for open-loop ring oscillators. In contrast, for clock frequencies above
approximately 1.7 MHz, the divider can reduce the error to a tolerable for any increase in
frequency.
Figure 9.25 shows residual error for transmit frequencies requiring 10% tolerance. Again,
above 1.7 MHz any frequency error can be corrected with an appropriate divider setting.
Note that it is important to center the residual error around 0, otherwise the error will start
at 0, increase to twice the absolute error shown currently, and then reset to 0.
9.7 Chip Layout
The layout for the chip is shown in Figure 9.27. Version 1 and 2 appear to be the same in
size; however, version 1 contains several pads for optional probe-test debugging. Figure 9.7
provides a comparison of the chip area used for each component. The capacitor array of the
ADC consumes a large portion of the area, and the digital cores also require significant real
142
Version 1 Version 2Chopper
AmpTest
Cells
2.5 mm
1.0 mm
Figure 9.27: Full chip layout with dimensions and high-level blocks annotated.
Digital Core
ADC
UID
Demodulator
Bandgap
Bias Gen.
Regulators
Rectifier
(a) Layout area for version 1.
Digital Core
FIFO
ADC
UID
Demodulator
Bandgap
Bias Gen.
Regulators
Rectifier
(b) Layout area for version 2.
Figure 9.28: IC layout area breakdowns.
estate. The complexity of the Gen2 protocol also causes significant area to be consumed by
the digital core. The FIFO size could be dramatically reduced by use of a buffered SRAM
cell. This increases chip complexity, however, due to the need for asynchronous read and
write access. The chopper amplifier area is dominated by MIM capacitors much like the
ADC. Finally, the area for each version is summarized in Table 9.4.
As mentioned, this work was designed and fabricated in IBM 8RF 130 nm CMOS tech-
nology. A die micrograph is shown in Figure 9.29. The chip was covered with a metal
plane, which was constructed in the top metal layer. The intention was to prevent RF
143
Component Without Pads With Pads
Version 1 0.29mm2 0.72mm2
Version 2 0.47mm2 0.68mm2
Table 9.4: IC layout area with and without pads.
Version 1 Version 2 Chopper
Amp
2.5 mm
1.0 mm
Figure 9.29: IC die micrograph.
interference from coupling onto MIM capacitor plates and other sensitive structures. For
example, the amplifier used in Chapter 6 is extremely sensitive to RF signals from sources
such as cellular phones and RFID readers. Copper foil helped shield the amplifier from this
interference, and so similar protections were applied here on chip. The low system noise
level while sampling a DC input, shown later in Chapter 10, demonstrates the effectiveness
of this shielding.
9.8 Performance
Idle and active system level current consumptions are shown in Table 9.5. Idle current
for the digital core is roughly 500 nA unclocked. Current consumption increases to 5 µA
at 3 MHz clock rate but with no communication activity. Active current is 6 µA total at
400 Hz tag rate. The current varies little with tag read rate. The peripheral core active
current varies with tag communication rate as well as ADC and UID utilization.
Table 9.6 further breaks down the current consumption for each block of the analog core.
An extra 50 nA is included in the bias generator current to account for a current mirror
144
Component Operating Voltage (V) Quiescent (µA) Active (µA)
Analog Core 0.5 to 3.6 1.4 1.7
Digital Core 0.55 to 0.9 0.5 6
Peripheral Core 1.2 0.1 1
Table 9.5: Power consumption breakdown for analog, digital, and peripheral cores. Notethat the analog core minimum operating voltage includes only the bias generator and de-modulator. Operation of all on-chip components requires 1.3 V, and optional off-chip com-ponents requires 1.9 V.
Table 9.6: Breakdown of simulated current consumption of analog blocks.
(a) Base Configuration
Component nA
Bias Gen. 250
Bandgap 220
0.7 V Reg. 100
1.2 V Reg. 100
Demod. 375
Oscillator 260
Sub-Total 1305
(b) Version 1 Extras
Component nA
2.2 V S.V. 100
1.8 V Reg. 350
(c) Totals
Version nA
V1 Total 1755
V2 Total 1305
which creates a bias voltage for the regulators and bandgap reference. The current shown
for the demodulator is worst case; when the reader is off, the 2nd stage shuts off and current
is reduced by 300 nA.
Table 9.7 compares the performance of this work to other tags presented in the literature.
For a comparison of tag features, refer back to Table 9.1. This work compares favorably to
other sensor tags without resorting to duty cycling (WISP, Kocer), loss of Gen2 compatibil-
ity (Shen), or elimination of the ADC (Kim). Drawing comparisons to tags lacking sensors
and/or addressability (all remaining tags) is less meaningful, but Karthaus and Barnett
clearly achieve the best RF sensitivity for a fully-passive tag. In part, the use of a linear
145
regulator, ADC and more complex state machine simply limit the achievable performance.
However, the power consumption of the digital core can clearly be reduced significantly.
Optimization of the digital core would add 3 to 5 dB of RF sensitivity.
A number of footnotes accompany Table 9.7. Unfortunately many authors fail to report
both the tag power consumption and RF sensitivity. When omitted, the RF sensitivity
is calculated from tag power consumption based on two assumptions: a conservative 20%
rectifier efficiency and a 50% loss due to downlink and uplink modulation. Conversely, if RF
sensitivity is presented, the inverse calculation is performed using the same assumptions. In
the case of Nakamoto [96], RF input power is calculated using Friis’ Transmission Equation
with no multipath or polarization losses (which matches results shown in Figure 17.2.4 of
[96]). Again, 50% modulation losses are assumed, but rectifier efficiency is specified as
36.6%.
9.9 Design Summary
Design methodology and simulation results were presented for two tag versions. The first is
a full-featured sensor tag with optional µC interface. This enables flexibility in application
development via µC programmability (ie, system-on-chip WISP) while leveraging ASIC
performance gains (low power Gen2 state machine, and analog components). The second
version enables periodic sampling for time-sensitive applications via a FIFO buffer. Such
an application is presented in Chapter 11.
Several features enable high performance for a feature-rich tag. Addressability is pro-
vided by a unique ID generator [93] which eliminates the need for high voltage charge pumps
(EEPROM / Flash) or special processes (FeRAM). An ultra-low-power ring oscillator with
analog and digital compensation helps minimize system power consumption. Similarly,
ultra-low-power analog components provide a stable system supply for accurate ADC con-
version. Finally, the digital core provides interfaces for reading the ADC and communicating
with an off-chip microcontroller while remaining fully-Gen2 compliant.
146
Table 9.7: Comparison of published (measured) tag performance.
Sensitivity Active Sleep Vdd Area Tech. Clock
This Work -12dBm 9µA 6µA 1.5V1 1.0mm2 0.13µ 3MHz
WISP -9dBm2 800µA 2µA 1.8V 1.5cm2 PCB 3MHz
Kim [94] -5.3dBm3 15µA 0.5µA 2.0V 1.0mm2 0.25µ4 -
Kocer [95] -12.3dBm2 660µA 0.9µA 3V 1.0mm2 0.25µ -
Nakamoto [96] -6.2dBm5 87.8µW - - 1.8mm2 0.25µ -
Pillai [97] 19dBm2 12µA 0.66µA 1.5V 5mm2 1.0µ -
Karthaus [92] -17.8dBm 1.5µA - 1.5V - 0.5µ4 300kHz
Barnett [98] -14dBm 2.75µA3 - 1.45V 0.55mm2 0.13µ4 1.28MHz
Shen [99] -8.2dBm3 10.2µA6 - >1.5V 0.8mm27 0.35µ4 -
Cho [100] -12.9dBm3 3.4µA - 1.5V 0.42mm27 0.25µ 330kHz
Shenghua [101] -20.5dBm3 0.9µW8 - - 0.2mm2 0.18µ -
1Optional 1.8 V regulator requires Vdd > 1.8 V. On-chip components employ 0.7 V and 1.2 V regulators.
2Duty cycling required at this input power.
3Calculated based on 20% rectifier efficiency and 50% modulation losses.
4Process includes Schottky diodes.
5No power numbers reported, but authors claim 36.6% rectifier efficiency and 4.3m range given 4W EIRP.
6Simulation result, no measurements reported.
7Excludes pad area.
8Supply voltage not specified.
147
Chapter 10
SOCWISP VERIFICATION AND MEASUREMENT RESULTS
10.1 Introduction
This chapter will discuss the socWISP performance and functionality verification. Sec-
tion 10.2 discusses efforts to ensure correct functionality pre-tapeout. Section 10.3 presents
experimental methods. Section 10.4 includes measurement results, and Section 10.4.8 con-
cludes.
10.2 Pre-tapeout Verification
Analog behavior was simulated exclusively using Cadence/Spectre. With the exception of
the peripheral circuitry (UID, ADC), the demodulator and modulator interfaces to digital
core were designed to specification but not simulated together. Regulator behavior was also
designed to specification, with load regulation behavior guaranteed through maximum Iload
and minimum Cload [102].
Verifying the digital core design using simulated test cases is relatively easy for normal,
successful operation. A Verilog RFID reader was designed to stimulate the tag by generating
and sending the downlink baseband signal and interpreting the tag uplink signal. In the tag
implementation, these signals ordinarily connect to the demodulator input and modulator
output of the tag digital core. Using this setup, Gen2 physical and link layer behavior were
verified using ModelSim. Additionally, mixed-signal simulations were performed in Cadence
to verify the digital core interaction with the ADC and UID.
Note that this test reader only tests tag behavior with logic-level digital signals; that is,
the analog and RF signals signal paths are not included in this simulation. A full reader
implementation would include signal processing to recover and threshold noisy, sampled tag
backscatter from an ADC. Examples of FPGA-based RFID readers have been presented
in the literature; however, they are beyond the scope of this discussion. The reason we
148
will not consider the reader implementation is because a COTS reader was used to verify
functionality. This is discussed below.
In contrast to nominal operation which is easy to verify, a wide variety of error conditions
can cause failure with first silicon and require revision. To ensure robust operation in
realistic conditions, the digital core was implemented on an Altera Cyclone II FPGA (via
the DE2 development board). An Impinj Speedway reader was used to test the system,
and a WISP analog front end (rectifier, modulator, demodulator) enabled the FPGA to
communicate with the reader. This was valuable for ensuring robust demodulation as well
as verifying the uplink encoder, prescaler, and CRC16. Although the commercial reader
does not delineate specific errors (with the exception of a bad CRC), tag read errors indicate
need for debugging. Real-time outputs such as the packet complete, packet type, and handle
match flags were monitored on an oscilloscope to debug errors in real time. These conditions
were replicated in simulation to troubleshoot and resolve issues.
10.3 Methods
A fully-instrumented test board is shown in Figure 10.1. The reader RF signal is not
transmitted by antenna; a variable attenuator is inserted in line with a coax cable between
the reader and tag. This eliminates multipath effects and simplifies testing. Specific testing
on the analog and digital cores is described below.
10.3.1 Analog core
Various tests were performed to verify functionality and yield of the design. Transient step
and DC loading tests were performed for the regulators. Demodulator functionality was
verified with an COTS RFID reader by monitoring signals on an oscilloscope and later
through full-system tests. The bandgap, bias generator and oscillator yield were measured
across 10 boards, with two versions for each board. Rectifier performance input impedance
was measured with a VNA, and output voltage/power versus input power was measured
with an RF signal generator. Results are presented in Section 10.4.
149
Figure 10.1: Photograph of test setup for socWISP verification.
10.3.2 Digital core
As with pre-fabrication verification, the post-fabrication verification was aided greatly by use
of a COTS Impinj Speedway reader. Initial tests employed a WISP front end as before. After
the analog core functionality was verified, the full-chip tests were performed. Information
from tags was parsed, displayed and logged to a text file using a C# application (see
Section 8). Several Gen2 modulation parameters are available from the Speedway reader,
and functionality is demonstrated in Section 10.4.5.
10.4 Measurement Results
10.4.1 Rectifier
The rectifier input impedance versus frequency, after an on-board matching network, is
shown in Figure 10.2. Note that UHF RFID in the United States operates between 902 MHz
and 928 MHz. Figure 10.3 shows input match with the modulator turned on and off. This
demonstrates that the uplink transistor is effective in modulating a large change in power
150
Figure 10.2: Measured rectifier input impedance versus frequency at -15 dBm input power,plotted on a smith chart from 850 MHz to 950 MHz.
reflected to the reader. This in turn provides the maximum backscatter signal for the
reader. Lastly, rectifiers are highly nonlinear - this causes varying input impedance with
input power. Figure 10.4 shows return loss versus input power. The match is optimized for
low input power levels where the tag requires the most efficiency in order to operate. At
high input power levels, efficiency is not important because there is an abundance of input
power.
Output voltage versus input power for a 1.2 µA load is shown in Figure 10.5, and
Figure 10.6 shows rectifier efficiency at varying output voltages. This data was taken by
connecting the rectifier output to a power supply at the desired output voltage. An ammeter
was connected in series to measure current delivered from the rectifier into the power supply.
In the efficiency calculation, rectifier back leakage was counted as loss, while power delivered
to the power supply and to the analog core was counted as delivered power. Lastly, the data
151
-25
-20
-15
-10
-5
0
850 900 950 1000
Frequency (MHz)
| S11 (dB)|
Modulator Off
Modulator On
Figure 10.3: Measured rectifier return loss versus input frequency with modulation transistoron and off. Measurements were taken at -15 dBm input power with frequency ranging from850 MHz to 1 GHz.
-25
-20
-15
-10
-5
0
-15 -10 -5 0
Input Power (dBm)
| S11 (dB)|
Figure 10.4: Measured rectifier return loss versus input power at 915 MHz.
152
0.50
0.70
0.90
1.10
1.30
1.50
1.70
1.90
2.10
2.30
-23 -21 -19 -17 -15
Input Power (dBm)
Output Voltage (V)
Figure 10.5: Measured rectifier output voltage with analog core (approx. 1.2 µA) load.
was taken at room temperature. Increases in temperature reduce the transistor Vt, which
increases the efficiency but also increases the rectifier back-leakage.
10.4.2 Oscillator Performance
The oscillator frequency distribution at 0.7 V supply voltage is plotted in Figure 10.7. The
mean is 2.96 MHz and the standard deviation is 387 kHz. Greater than 3 standard deviations
of measured oscillator variation is tolerable for the tag to meet timing specifications.
Oscillator frequency variation over temperature is shown in Figure 10.8. Note that the
oscillation frequency increases with both supply voltage and bias current. However, the bias
is PTAT while the supply is CTAT. This data includes the PTAT bias generator variation
but not the CTAT supply voltage variation because it was powered from a power supply.
Regardless, the temperature coefficient of the oscillator is tolerable. Without the oscillator
temperature compensation circuit, the variation would be much higher. With additional
compensation from the CTAT supply, temperature variation will reduce further.
153
0%
5%
10%
15%
20%
25%
30%
35%
40%
-25 -20 -15 -10 -5 0
Input Power (dBm)
Rectifier Efficiency
0.5 V
1.0 V
1.5 V
2.0 V
WISP 1.8 V
Figure 10.6: Measured rectifier power efficiency at various output voltages.
2
2.2
2.4
2.6
2.8
3
3.2
3.4
3.6
3.8
4
1 2 3 4 5 6 7 8 9 10
Board #
Oscillation Frequency (MHz)
Figure 10.7: Measured oscillator frequency distribution at 0.7 V supply voltage.
154
3
3.1
3.2
3.3
3.4
3.5
0 25 50 75 100
Temp. (C)
Freq. (M
Hz)
Measured Data
Simulated Slow-Slow Corner
Simulated Fast-Slow Corner
Figure 10.8: Measured ring oscillator frequency versus temperature.
10.4.3 Bandgap and Regulators
The bandgap voltage is well-represented by the unloaded output voltage of the 1.2 V regula-
tor due to its unity-gain feedback. Both versions have identical circuitry, so their measure-
ments can be combined into one statistic. Mean output voltage is 1.20 V, with a standard
deviation of 1.05%. The mean of both versions are identical, but version 2 has a higher
standard deviation; this is expected given the small sample size of 10. The 1.8 V regulator
only exists on version 1 and shares the bandgap reference. Mean output voltage is 1.78 V,
and the standard deviation is 0.64%. The 1.8 V regulator standard deviation is identical
to that of 1.2 V regulator samples from version 1. This suggests that the resistor ratio
accuracy is very good, and variation is originating from the bandgap reference.
155
10.4.4 Bias
The bias current generator cannot be measured directly due to pin constraints. However,
the total analog core quiescent current can be used as a rough proxy (the total current
should be a multiple of the unit-reference current). The mean current for version 1 is
1.23 µA with 3.07% standard deviation. The mean current for version 2 is 0.92 µA with
3.66% standard deviation. Referring to Table 9.6 and excluding oscillator current, simulated
current consumptions for version 1 and version 2 are 1.195 µA and 745 nA, respectively.
Measured mean current consumption for version 1 is in line with expectations from simula-
tion; however, the high measured current consumption compared to simulation for version
2 is unexpected.
10.4.5 Digital Core Performance
A limited set of test conditions are available from COTS readers because settings may not
be manipulated individually. Instead, preset groups of settings are available which optimize
for speed or read range. For example, Figure 10.9 demonstrates communication using FM0
uplink modulation and Tari = 12.5 µs. Bit-level traces are inset. Figure 10.10 shows Miller
4 uplink modulation and Tari = 25 µs. These traces were captured by an oscilloscope
with RF power delivered through a coax cable in order to reduce RF-induced noise in the
captured waveform.
Figure 10.11 shows power consumption versus supply voltage and clock rate for the
digital core with no communication occuring. Active power increases by approximately
400 nA at 80 Hz tag read rate, and by approximately 500 nA at 400 Hz read rate. This
indicates that the logic design does an effective job at reducing clock rates, especially in the
transmit logic, to the minimum possible. However, the rise in current with clock rate when
communication is idle indicates that additional clock gating could significantly reduce power
consumption below present levels. Ideally, current consumption would not increase with
clock rate but with useful activity (communication) performed by the logic. Nevertheless,
performance is competitive with other designs reported in the literature (see Table 9.7).
156
Reader Command: QueryRep Tag Response: RN16
Figure 10.9: FM0-modulated communication voltage trace, with the QueryRep commandenlarged to show modulation details.
0 5 10 15-0.2
0
0.2
0.4
0.6
0.8
1
1.2
Time (ms)
Voltage (V)
Reader
Tag
ReadAckQueryRep ReqRN
Figure 10.10: Oscilloscope trace full communication sequence (QueryRep-Ack-ReqRN-Read) to retrieve sensor data using M4-modulated communication.
157
0
2
4
6
8
10
12
14
0.5 0.6 0.7 0.8 0.9 1 1.1 1.2
Supply Voltage
Po
we
r C
on
su
mp
tio
n (
µW
)
Leakage
1 MHz
2 MHz
3 MHz
4 MHz
5 MHz
Figure 10.11: Measured digital core power consumption versus supply voltage and clockfrequency. The typical operating point is 3 MHz at 0.7 V, which consumes 3 µW
Bit Number
Chip Number
5 10 15 20 25 30 35 40 45
1
2
3
4
5
6
Figure 10.12: Sample IDs read from different tags.
10.4.6 UID Performance
The UID has been extensively characterized in [93] including analysis of the bit distributions.
However, to demonstrate system functionality, sample tag IDs generated by the UID and
read through the COTS reader are shown in Figure 10.12. Due to an interface error between
the digital core and the UID readout circuitry, the ID space was reduced by a factor of two.
However, all chips are uniquely addressable, and this bug is easily fixed.
158
204.5
205
205.5
206
206.5
207
207.5
208
208.5
209
209.5
1 101 201 301 401 501 601
Sample Number
ADC Code
Figure 10.13: Fully-wirelessly-powered ADC samples reported through a COTS RFIDreader. The DC input shows a low peak noise level of ± 1.5 bits peak to peak.
10.4.7 ADC Performance
Figure 10.13 shows an ADC time series captured through a COTS RFID reader using a
DC input. This test was performed on the moth deployment board, which is described in
Chapter 11. The board was approximately 1 m from the reader and fully wirelessly powered.
This demonstrates the low system noise floor of ± 1.5 bits peak to peak.
10.4.8 Conclusions
Full system functionality was achieved in a single tapeout through the use of several impor-
tant design verification techniques. For example, testing of the digital core with a COTS
RFID reader through synthesis and implementation on an FPGA proved crucial to design
success. In particular, the author’s experience with WISP firmware design indicated that ro-
bustness against communication errors is near impossible to achieve without bench testing.
In fact, the WISP analog front end was used to interface the COTS reader to the FPGA.
Other non-obvious verification that helped ensure success included mixed-signal cosimula-
tion of the analog components (UID, ADC) and digital core as well as transient analysis of
159
the startup current draw of the analog components. Specifically, all components must start
up and shut down gracefully without any large current consumption spikes. Components
must also be robust to both slow and fast power supply ramp ups. One are of verification
that was overlooked was the power consumption of the digital core. Industry standard tools
can provide insight into the power consumption of the digital core and thus allow estimation
and optimization of the power consumption during the design stage.
160
Chapter 11
IN-FLIGHT INSECT TEMPERATURE RECORDING
11.1 Introduction
This chapter presents the deployment of socWISP for muscle temperature recording of a
Manduca Sexta moth. We are studying the biomechanics and temperature dependence of
Manduca flight muscle with Professor Tom Daniels and Nicole George at the University of
Washington. This work enables untethered, in-flight recording with a minimum of weight
and unlimited sensor lifespan.
Temperature is sensed via an implanted thermocouple and wirelessly reported by the
socWISP, described in Chapter 9. A minimum number of off-chip components are used for
thermocouple signal amplification before digitization by the on-chip ADC and transmission
to the RFID reader. The entire system is wirelessly-powered by a COTS UHF RFID
reader, consumes less than 1 cm2 in PCB area, and weighs only 0.35 g including antenna,
thermocouple and assembled PCB.
The design of this system is discussed in Section 11.2. Experimental setup and methods
are given in Section 11.3. Results are presented in Section 11.4.1 and Section 11.4.2. Finally,
Section 11.6 concludes.
11.2 Design
The socWISP provides much of the circuitry necessary for the design. However, the ther-
mocouple signal is too small for direct digitization by the ADC. A DC-coupled differential
amplifier with adjustable virtual ground provides 1000x gain. The schematic for the ampli-
fier is shown in Figure 11.1. Two micropower precision opamps (OPA369) are used in the
design. The first is used to create a low impedance virtual ground via unity-gain feedback
and a voltage-divider reference. The second is used to amplify the thermocouple signal via
non-inverting resistive feedback. The non-inverting gain configuration and CMOS input
161
Figure 11.1: Off-chip thermocouple amplifier circuit schematic.
stage provide high input impedance for the thermocouple, which cannot drive a load.
The CMOS input stage of the OPA369 has a maximum 0.75 mV input offset voltage,
which is small for micropower opamps. However, this maximum offset is on the scale of the
input signal (2 mV swing for zero to 40C). Input offset has a random distribution as it
comes from transistor mismatch; most designs will have tolerable offsets. Those that are
not tolerable can be adjusted by trimming the reference voltage for the virtual ground. A
fully-integrated design could easily adjust the reference voltage wirelessly; CMOS switches
can short out resistor segments to trim the resistor values. The Gen2 Write command could
be used to write the appropriate switch states to the tag. Flash, EEPROM or e-fuse could
be used to store the value once programmed, or the application could remember the settings
for each tag and program them appropriately.
The PCB is shown in Figure 11.2. Unlike the test board used in Chapter 10, the PCB
weight and size must be minimal in order to not affect the moth’s flight. To minimize
size, small 0402 surface mount components are used and routing is performed on internal
162
(a) socWISP photo (front). (b) socWISP photo (back).
layers of a 4-layer board. Blind vias are not used because they increase the manufacturing
cost and do not significantly affect the board size. The PCB weight is also reduced by
minimizing board thickness to 25 mils. Further reduction may compromise board stiffness,
which would in turn endanger the COB bonding during deployment. The IC and bondwires
are encapsulated with epoxy to protect against physical damage (not shown in Figure 11.2
to illustrate COB features). The board, components and IC weigh 0.25 g, and the board
measures 0.91 cm by 0.73 cm. The board size does not provide sufficient ground plane
area for use of a monopole antenna; a dipole antenna made of 30 AWG wrapping wire
is used instead. The type-T thermocouple is made from copper and constantan, and the
thermocouple junction is formed by twisting the bare wire together. The fully-assembled
board, including thermocouple and antenna weighs 0.35 g.
11.3 Experimental Setup
The thermocouple’s linearity was verified using the on-chip chopper amplifier. A two-
point calibration using a mineral oil bath was performed to scale the measurements. It is
important to take the mineral oil bath measurements quickly and keep the board away from
the hot air which rises from the oil bath. The hot air warms the board and thus affects
the cold-junction temperature. This rise in cold-junction temperature causes a small but
noticeable error in the measurement.
163
Attaching the board to the moth, without permanently affecting the board, is a non-
trivial exercise. The moth’s scales render tape useless, but any form of glue is difficult to
remove from the board. Instead, electrical tape was cut to the size of the board and affixed
to the board. Then, the electrical tape (with board attached) was glued to the moth. This
allows removal of the board after testing.
The thermocouple is implanted in the moth’s wing muscle tissue. Preparations are well
documented in the literature [123]. First, a small hole is punctured in the exoskeleton above
the dorsal longitudinal muscle using a fine needle. The hole should be placed to one side
of the midline to avoid damaging the heart. This does not disturb the moth and may be
performed without sedation. Then, the thermocouple is inserted into the hole to 3 mm to
4 mm depth. Optionally, the thermocouple may be glued in place to avoid displacement
during moth flight.
11.4 Results
Two in vivo experiments were performed using a Manduca Sexta moth. In the first test,
the moth was tethered to a metal rod. In the second test, the moth was free to fly in a
plexiglass box of approximately 1 m per side.
11.4.1 Tethered Test
Figure 11.2 shows the setup for the tethered experiment. The exoskeleton hole is visible to
the right of the midline; the thermocouple is not yet implanted. The reader antenna (not
shown) is placed 2 m to 3 m away from the experiment. A COTS Impinj Speedway reader
is used with custom the application software (described in Chapter 8).
Time series data is shown in Figure 11.3. At 15 minutes, the moth begins flying. By 20
minutes, the moth has reached steady-state temperature. At 25 minutes, the moth stops
flying and gradually cools off.
164
Figure 11.2: Photograph of the socWISP attached to a moth, with thermocouple implantedin muscle tissue.
Figure 11.3: Temperature time series data from the socWISP on a tethered moth.
165
Figure 11.4: Photograph of an untethered, instrumented moth hovering on a flower.
11.4.2 Untethered Test
The value of this work is enabling untethered, in-flight recording. Figure 11.4 shows an
untethered moth wearing the socWISP measurement system. The moth is placed in a 1-m
per side plexiglass enclosure with various flowers for stimulation. One reader antenna was
used in this test, which was nearly sufficient for good coverage of the enclosure. Future tests
will use two antennas to avoid the null due to dipole antenna directionality.
Time series data from a test is shown in Figure 11.5. The temperature begins warming
at 70 minutes when the moth begins flying. From 83 minutes to 87 minutes, the moth is
resting and the temperature cools off. The moth then flies for 4 minutes before resting
again. These trends are annotated in the figure. Two segments of several minutes duration
are lost (“No Data”) due to the moth being out of the antenna’s field of view.
11.5 Thermocouple Characterization Using a Low Power On-Chip Amplifier
Figure 11.6(a) shows thermocouple characterization time series using a mineral oil bath,
hotplate, and ground truth sensor. Measurements were performed using a chopper amplifier
designed by Fan Zhang at the University of Washington. Figure 11.6(b) shows a linear fit,
and Figure 11.6(c) shows the residual error of the linear fit.
166
Figure 11.5: Temperature time series data from the socWISP on an untethered moth.
11.6 Conclusion
These experiments demonstrate the feasibility of in vivo, untethered, in-flight temperature
recording of insects. Future work on antenna size reduction will enable deployment on
smaller insects. Experiments measuring neural or muscle signals are feasible as described
in Chapter 6 provided a FIFO can by successfully synthesized on-chip or if a custom RFID
reader with less overhead (however, still Gen2 compliant) is employed. Specifically, the
reader must not resingulate tags for each read operation; the tag handle can be used to
read the ADC value repeatedly. Using this method and the 640 kbps uplink rate, neural
and muscle signals could be easily sampled for a small insect population. If there is 100%
overhead due to downlink communications and uplink packets are 48 bits in length (16-bit
handle + 16-bit word + 16-bit CRC), 1 insect could be sampled at 6.6 kHz or 2 insects
could be sampled at 3.3 kHz. If ADC samples are queued in a FIFO, overhead can be
significantly reduced. For example, reading four 8-bit samples require only 64 bits versus
48 bits for one sample in the un-queued mode. Furthermore, downlink overhead does not
increase with uplink packet size. This would triple or quadruple the number of insects for a
given sample rate. Still, it is desirable to instrument much larger population sizes. For these
applications, the tags would need to compress and/or filter the data to reduce transmission
167
(a) Thermocouple characterization time series.
(b) Thermocouple linear fit.
(c) Thermocouple linear fit residual.
168
of redundant data. The WISP is an ideal platform to prototype these protocol and tag
behavior changes due to its software programmability; testing with silicon designs require
several months design iteration time.
169
Chapter 12
CONCLUSIONS
For many wirelessly-deployed sensors, periodic battery replacement is costly at best and
infeasible at worst. Two key features of RFID make it attractive for wireless sensor deploy-
ment: power is wirelessly and deliberately supplied to the tag, and backscatter modulation
allows for near-zero-power communication by the tag. These features do not preclude the
use of (a) additional power sources such as thermal, solar, and mechanical power harvesting,
(b) application-specific timescale energy storage ranging from a capacitor (milliseconds to
hours) to a rechargeable battery (days to years), and (c) additional long range radios to
augment the communication capabilities. Applications that require sensing while the tag is
out of range of the reader will require at least some non-conventional features in order to
operate. However, the core features of RFID will continue to enable tag lifespans which are
unachievable for conventional radio-based sensor nodes.
As demonstrated throughout this thesis, RFID is an exciting technology for both ultra-
low-power communication as well as wireless power delivery. Coupling this technology
with recent advances in brain-machine interfaces and biomedical research has enabled sig-
nificant progress towards practical application and deployment. For example, Chapter 6
discussed the design of a wirelessly-powered neural spike recorder. As neuroscientists better
learn to interface with neural signals, exciting advances in prosthetic control can leverage
this technology to make the neural interface both seamless and unobtrusive. Additionally,
Chapter 9 presented a fully integrated tag for more general biomedical sensing. Results of
in vivo deployment on a live, untethered moth are shown in Chapter 11. The key novelty is
that long-term wireless recording was previously unattainable due to the size, weight, and
lifespan of conventional sensors.
Collaboration has also produced exciting results in other, relatively unrelated fields.
For example, next generation aerospace sensors are discussed in Chapter 5, and wirelessly
170
charged tags for shipment tracking are presented in Chapter 7. Lastly, Chapter 4 discusses
the implementation of strong cryptography on a tag. As RFID is employed in passports
and credit cards, this research is imperative for consumer privacy and security.
It is clear that while a wide variety of applications are explored in this thesis, there are
a great deal of topics yet to be explored. As discussed in Chapter 3, the configurability
and programmability of the WISP platform make it a valuable research tool across many
disciplines. Through a generous donation by Intel Corporation, over 150 WISPs have been
donated to 23 academic research groups. It will be exciting to see what innovative research
can be enabled through this technology.
171
BIBLIOGRAPHY
[1] Nikola Tesla. The Tesla Papers: Nikola Tesla on Free Energy & Wireless Transmissionof Power. Adventures Unlimited Press, 2000.
[2] WC Brown. A Survey of the Elements of Power Transmission by Microwave Beam.In IRE International Convention Record, pages 93–106, 1961.
[3] P.E. Glaser. Power from the sun: Its future. Science, 162(3856):857–861, 1968.
[4] J.C. Schuder. Powering an artificial heart: Birth of the inductively coupled-radiofrequency system in 1960. Artif Organs, 26(11):909–915, 2002.
[5] B.P. Wells. Series resonant inductive charging circuit, 6 2005. US Patent 6,972,543.
[6] S. Salimian, C.M. Heller, L. Li, et al. Dual-frequency capacitively-coupled plasmareactor for materials processing, 12 1997. US Patent 5,656,123.
[7] Gordon E. Moore. Cramming more components onto integrated circuits. Electronics,38(8), April 1965.
[8] C. Patel. Lecture 11: Scaling. Technical report, UMBC, October 2005.
[9] Joshua R. Smith and Daniel J. Yeager. Range scaling of far field wireless powertransfer. Technical report, Intel Labs Seattle, 2008.
[10] H. Nakamoto, D. Yamazaki, T. Yamamoto, H. Kurata, S. Yamada, K. Mukaida,T. Ninomiya, T. Ohkawa, S. Masui, and K. Gotoh. A passive UHF RFID tag LSIwith 36.6% efficiency CMOS-only rectifier and current-mode demodulator in 0.35 µmFeRAM technology. In Solid-State Circuits Conference, 2006. ISSCC 2006. Digest ofTechnical Papers. IEEE International, pages 1201–1210, Feb. 2006.
[11] Triet T. Le. Efficient power conversion interface circuits for energy harvesting appli-cations. PhD thesis, Oregon State University, 2008.
[12] E. Carlson, K. Strunz, and B. Otis. 20 mV input boost converter for thermoelectricenergy harvesting. In 22nd International Converence on VLSI Design, 2009.
[13] R. Weinstein. RFID: a technical overview and its application to the enterprise. ITProfessional, 7(3):27–33, May-June 2005.
172
[14] D.C. Ranasinghe, K.S. Leong, M.L. Ng, D.W. Engels, and P.H. Cole. A distributedarchitecture for a ubiquitous RFID sensing network. In Intelligent Sensors, SensorNetworks and Information Processing Conference, 2005. Proceedings of the 2005 In-ternational Conference on, pages 7–12, Dec. 2005.
[15] M. Philipose, K.P. Fishkin, M. Perkowitz, D.J. Patterson, D. Fox, H. Kautz, andD. Hahnel. Inferring activities from interactions with objects. Pervasive Computing,IEEE, 3(4):50–57, Oct.-Dec. 2004.
[16] M. Philipose, J.R. Smith, B. Jiang, A. Mamishev, Sumit Roy, and K. Sundara-Rajan.Battery-free wireless identification and sensing. Pervasive Computing, IEEE, 4(1):37–45, Jan.-March 2005.
[17] S. Johan, Xuezhi Zeng, T. Unander, A. Koptyug, and H.-E. Nilsson. Remote moisturesensing utilizing ordinary RFID tags. In Sensors, 2007 IEEE, pages 308–311, Oct.2007.
[18] D. G. Watters, P. Jayaweera, A. J. Bahr, and D. L. Huestis. Design and performanceof wireless sensors for structural health monitoring. In D. O. Thompson and D. E.Chimenti, editors, Quantitative Nondestructive Evaluation, volume 615 of AmericanInstitute of Physics Conference Series, pages 969–976, may 2002.
[19] R. Want. Enabling ubiquitous sensing with RFID. Computer, 37(4):84–86, April 2004.
[20] Michael Buettner and David Wetherall. An empirical study of UHF RFID perfor-mance. In MobiCom ’08: Proceedings of the 14th ACM international conference onMobile computing and networking, pages 223–234, New York, NY, USA, 2008. ACM.
[21] Alanson P. Sample, Daniel J. Yeager, Pauline S. Powledge, Alexander V. Mamishev,and Joshua R. Smith. Design of an RFID-based battery-free programmable sensingplatform. In IEEE Transactions on Instrumentation and Measurement, 2008.
[22] Hee-Jin Chae, Daniel J. Yeager, Joshua R. Smith, and Kevin Fu. Maximalist cryptog-raphy and computation on the WISP UHF RFID tag. In Proceedings of the Conferenceon RFID Security, July 2007.
[23] D.J. Yeager, G.R. Quetin, S.H. Kim, J.Duncan, M. Miller, J.R. Smith, and P. Feraboli.Development of a wirelessly-powered strain gage for aerospace applications. Technicalreport, Intel Research Seattle, 2007.
[24] Jeremy Holleman, Daniel J. Yeager, Richa Prasad, Joshua R. Smith, and Brian Otis.NeuralWISP: An energy-harvesting wireless neural interface with 1-m range. In Pro-ceedings of Biological Circuits and Systems Conference (BioCAS), November 2008.
173
[25] Daniel J. Yeager, Pauline S. Powledge, Richa Prasad, David Wetherall, and Joshua R.Smith. Wirelessly-charged UHF tags for sensor data collection. In RFID, IEEEInternational Conference on, pages 320–327, April 2008.
[26] Daniel J Yeager, Fan Zhang, Azin Zarrasvond, and Brian Otis. A 9.2µA Gen 2compatible UHF RFID sensing tag with -12dBm sensitivity and 1.25µVrms input-referred noise floor. In IEEE International Solid-State Circuits Conference (ISSCC)Technical Digest, Feb. 2010.
[27] EPCglobal. Class 1 Generation 2 UHF Air Interface Protocol Standard, 2009.
[28] EPCglobal. EPC Tag Data Standard (TDS), 2009.
[29] EPCglobal. Low Level Reader Protocol (LLRP), 2007.
[30] R. Glidden and J. Schroeter. Bringing long-range UHF RFID tags into mainstreamsupply chain applications. RF DESIGN, 28(7):24, 2005.
[31] You-Chang Ko, S. Roy, J.R. Smith, Hyong-Woo Lee, and Choong-Ho Cho. RFIDMAC performance evaluation based on ISO/IEC 18000-6 Type C. CommunicationsLetters, IEEE, 12(6):426–428, June 2008.
[32] Joshua R. Smith, Bing Jiang, Sumit Roy, Matthai Philipose, Kishore Sundara-Rajan,and Alexander Mamishev. ID modulation: Embedding sensor data in an RFID time-series. In Information Hiding, pages 234–246, 2005.
[33] Joshua R. Smith, Alanson P. Sample, Pauline S. Powledge, Sumit Roy, and AlexanderMamishev. A wirelessly-powered platform for sensing and computation. In Ubicomp,pages 495–506, 2006.
[34] Daniel J. Yeager, Alanson P. Sample, and Joshua R. Smith. WISP: A passively pow-ered UHF RFID tag with sensing and computation. RFID Handbook: Applications,Technology, Security, and Privacy, 2008.
[35] Benjamin Ransford, Shane Clark, Mastooreh Salajegheh, and Kevin Fu. Gettingthings done on computational RFIDs with energy-aware checkpointing and voltage-aware scheduling. In Proceedings of USENIX Workshop on Power Aware Computingand Systems (HotPower), December 2008. to appear.
[36] Richa Prasad. Energy debugging for RFID sensor networks. UW CSE Masters Project,2009.
174
[37] Alexei Czeskis, Karl Koscher, Joshua R. Smith, and Tadayoshi Kohno. RFIDs andsecret handshakes: defending against ghost-and-leech attacks and unauthorized readswith context-aware communications. In ACM Conference on Computer and Commu-nications Security, pages 479–490, 2008.
[38] Ari Juels. Minimalist cryptography for low-cost RFID tags. In C. Blundo andS. Cimato, editors, The Fourth International Conference on Security in Communi-cation Networks – SCN 2004, volume 3352 of LNCS, pages 149–164. Springer-Verlag,2004.
[39] Benoit Calmels, Se’bastien Canard, Marc Girault, and Herve’ Sibert. Low-cost cryp-tography for privacy in RFID systems. In Josep Domingo-Ferrer, Joachim Posegga,and Daniel Schreckling, editors, International Conference on Smart Card Researchand Advanced Applications – CARDIS, LNCS, Tarragona, Spain, April 2006. IFIP,Springer-Verlag.
[40] Yang Cui, Kazukuni Kobara, Kanta Matsuura, and Hideki Imai. Lightweight asym-metric privacy-preserving authentication protocols secure against active attack. In In-ternational Workshop on Pervasive Computing and Communication Security – PerSec2007, pages 223–228, New York, USA, March 2007. IEEE.
[41] Pedro Peris-Lopez, Julio Cesar Hernandez-Castro, Juan Estevez-Tapiador, and ArturoRibagorda. LMAP: A real lightweight mutual authentication protocol for low-costRFID tags. In Workshop on RFID Security 2006(RFIDSec 06), Graz, Austria, July2006. Ecrypt.
[42] Pedro Peris-Lopez, Julio Cesar Hernandez-Castro, Juan Estevez-Tapiador, and ArturoRibagorda. M2AP: A minimalist mutual-authentication protocol for low-cost RFIDtags. In International Conference on Ubiquitous Intelligence and Computing – UIC06,volume 4159 of LNCS, pages 912–923. Springer-Verlag, September 2006.
[43] Pedro Peris-Lopez, Julio Cesar Hernandez-Castro, Juan M. Estevez-Tapiador, andArturo Ribagorda. EMAP: An efficient mutual authentication protocol for low-costRFID tags. In OTM Federated Conferences and Workshop: IS Workshop – IS’06,volume 4277 of LNCS, pages 352–361. Springer-Verlag, November 2006.
[44] Selwyn Piramuthu. HB and related lightweight authentication protocols for secureRFID tag/reader authentication. In Collaborative Electronic Commerce Technologyand Research – CollECTeR 2006, Basel, Switzerland, June 2006.
[45] Axel Poschmann, Gregor Leander, Kai Schramm, and Christof Paar. DESL: Anefficient block cipher for lightweight cryptosystems. In Workshop on RFID Security2006(RFIDSec 06), Graz, Austria, July 2006. Ecrypt.
175
[46] Benessa Defend, Kevin Fu, and Ari Juels. Cryptanalysis of two lightweight RFIDauthentication schemes. In International Workshop on Pervasive Computing andCommunication Security – PerSec 2007, pages 211–216, New York, USA, March 2007.IEEE.
[47] Daesung Kwon, Daewan Han, Jooyoung Lee, and Yongjin Yeom. Vulnerability of anRFID authentication protocol proposed at SecUbiq 2005. In International Workshopon Security in Ubiquitous Computing Systems – Secubiq 2006, LNCS, Seoul, Korea,August 2006. Springer-Verlag.
[48] Tieyan Li and Guilin Wang. Security analysis of two ultra-lightweight RFID authen-tication protocols. In IFIP SEC 2007, Sandton, Gauteng, South Africa, May 2007.IFIP.
[49] Ron Rivest. The RC5 encryption algorithm. In Fast Software Encryption, pages86–96, 1994. http://theory.lcs.mit.edu/ rivest/Rivest-rc5rev.pdf.
[50] Joshua R. Smith, Alason P. Sample, Pauline S. Powledge, Sumit Roy, and Alexan-der Mamishev. A wirelessly-powered platform for sensing and computation. In 8thInternational Conference on Ubiquitous Computing (Ubicomp 2006), pages 495–506,Orange Country, CA, USA, September 2006.
[51] Adrian Perrig, Robert Szewczyk, Victor Wen, David E. Culler, and J. D. Tygar.SPINS: security protocols for sensor networks. In Mobile Computing and Networking,pages 189–199, 2001.
[52] Chris Karlof, Naveen Sastry, and David Wagner. TinySec: A link layer securityarchitecture for wireless sensor networks. In Second ACM Conference on EmbeddedNetworked Sensor Systems (SenSys 2004), pages 162–175, November 2004.
[53] Damith C. Ranasinghe, Daihyun Lim, Peter H Cole, and Srinivas Devadas. Whitepaper: A low cost solution to authentication in passive RFID systems. TechnicalReport WP-HARDWARE-029, Auto-ID Labs, The University of Adelaide, Adelaide,Australia, September 2006.
[54] ThomasNet. Short range UHF EPC tag is designed for item-level tagging. http://news.thomasnet.com/fullstory/482149, May 2007. Last viewed May 12, 2007.
[55] Alanson P. Sample, Daniel J. Yeager, Pauline S. Powledge, and Joshua R. Smith.Design of a passively-powered, programmable platform for UHF RFID systems. InIEEE International Conference on RFID 2007, March 2007.
[56] Manfred Aigner. DemoTag, 2006. Last viewed May 16, 2007.
176
[57] Crossbow. MICA2 data sheet. http://www.xbow.com, 2009.
[58] RFID Spotlight. 5 things must know for RFID starters. http://www.innovez-one.com/blogs/, August 2006. Blog entry, Last viewed May 15, 2007.
[59] Jonathan Westhues. Proxmark3. http://cq.cx/proxmark3.pl, 2007. Last viewedMay 16, 2007.
[60] Melanie Rieback, Georgi Gaydadjiev, Bruno Crispo, Rutger Hofman, and An-drew Tanenbaum. A platform for RFID security and privacy administration. InUSENIX/SAGE Large Installation System Administration conference – LISA’06,Washington DC, USA, December 2006.
[61] EM Microelectronic. EM 4035 datasheet. http://www.emmicroelectronic.com/webfiles/product/RFID/ds/EM4035_FS.pdf, 2006.
[62] Pasin Israsena. Securing ubiquitous and low-cost RFID using tiny encryption al-gorithm. In International Symposium on Wireless Pervasive Computing, Phuket,Thailand, January 2006. IEEE.
[63] Manfred Aigner and Martin Feldhofer. Secure symmetric authentication for RFIDtags. In Telecommunication and Mobile Computing – TCMC 2005, Graz, Austria,March 2005.
[64] Mark Buccini. New MSP430 family from Texas Instruments runs at 12 RISC MIPSand standby of 1uA. http://www.microcotroller.com/news/ti_msp4302xx.asp,October 2004. Last viewed May 14, 2007.
[65] Sara Black. Composite rib structure for Airbus A380 vertical tail. High PerformanceComposites, 2004.
[66] Jeff Hawk. The Boeing 787 Dreamliner: More Than an Airplane. Presentation toAIAA/AAAF aircraft noise and emissions reduction symposium, American Instituteof Aeronautics and Astronautics, 2005.
[67] Eric Greene. Marine Composites. Davis Consulting Group, second edition, 1997.
[68] Steven J. Hooper, editor. Composite Materials: Testing & Design (ASTM SpecialTechnical Publication). ASTM International, 1997.
[69] W. H. Craig and T. H. Courtney. On the tension test as a means of characterizingfibre composite failure mode. Journal of Materials Science, 10:1119–1126, 1975.
177
[70] R. P. Michelson, M. M. Merzenich, C. R. Pettit, and R. A. Schindler. A cochlearprosthesis: Further clinical observations; preliminary results of physiological studies.Laryngoscope, 83(7):1116–1122, 1973.
[71] A. Jackson, J. Mavoori, and E. E. Fetz. Long-term motor cortex plasticity inducedby an electronic neural implant. Nature, 444:56–60, 2006.
[72] D. M. Taylor, S. I. Helms Tillery, and A. B. Schwartz. Direct cortical control of 3Dneuroprosthetic devices. Science, 296:1829–1832, 2002.
[73] R. R. Harrison, P. T. Watkins, R. J. Kier, R. O. Lovejoy, D. J. Black, B. Greger,and F. Solzbacher. A low-power integrated circuit for a wireless 100-electrode neuralrecording system. Solid-State Circuits, IEEE Journal of, 42(1):123–133, 2007.
[74] R. H. Olsson and K. D. Wise. A three-dimensional neural recording microsystemwith implantable data compression circuitry. Solid-State Circuits, IEEE Journal of,40(12):2796–2804, 2005.
[75] Daniel Halperin, Thomas S. Heydt-Benjamin, Benjamin Ransford, Shane S. Clark,Benessa Defend, Will Morgan, Kevin Fu, Tadayoshi Kohno, and William H. Maisel.Pacemakers and implantable cardiac defibrillators: Software radio attacks and zero-power defenses. In Proceedings of the 29th Annual IEEE Symposium on Security andPrivacy, May 2008.
[76] J. Holleman and B. Otis. A sub-microwatt low-noise amplifier for neural recording.Engineering in Medicine and Biology Society, 2007. EMBS 2007. 29th Annual Inter-national Conference of the IEEE, pages 3930–3933, 2007.
[77] R. R. Harrison and C. Charles. A low-power low-noise CMOS amplifier for neuralrecording applications. Solid-State Circuits, IEEE Journal of, 38(6):958–965, 2003.
[78] T. Horiuchi, T. Swindell, D. Sander, and P. Abshier. A low-power CMOS neuralamplifier with amplitude measurements for spike sorting. In Circuits and Systems,2004. ISCAS’04. Proceedings of the 2004 International Symposium on, volume 4, 2004.
[79] P. Mohseni and K. Najafi. A fully integrated neural recording amplifier with DC inputstabilization. IEEE Transactions on Biomedical Engineering, 51(5):832–837, 2004.
[80] R. J. Vogelstein et al. Spike sorting with support vector machines. Engineeringin Medicine and Biology Society, 2004. EMBC 2004. Conference Proceedings. 26thAnnual International Conference of the, 1:546–549, 2004.
[81] I. Obeid and P.D. Wolf. Evaluation of spike-detection algorithms for a brain-machineinterface application. Biomedical Engineering, IEEE Transactions on, 51(6):905–911,2004.
178
[82] J. Holleman and B. Otis. A sub-microwatt low-noise amplifier for neural recording.Engineering in Medicine and Biology Society, 2007. EMBS 2007. 29th Annual Inter-national Conference of the IEEE, pages 3930–3933, 2007.
[83] S. Rai, J. Holleman, J.N. Pandey, F. Zhang, and B. Otis. A 500 µW neural tag with2µvrms AFE and frequency multiplying MICS/ISM FSK transmitter. In Solid-StateCircuits Conference, 2009. Digest of Technical Papers. ISSCC. 2009 IEEE, 2009.
[84] T Denison, K Consoer, A Kelly, A Hachenburg, and W Santa. A 2.2 µW 94 nV/√Hzchopper-stabilized instrumentation amplifier for EEG detection in chronic implants.In International Solid-State Circuits Conference Digest of Technical Papers, 2007.
[85] H. Wu and Y.P. Xu. A 1V 2.3 µW biomedical signal acquisition IC. Solid-StateCircuits, 2006 IEEE International Conference Digest of Technical Papers, pages 119–128, 2006.
[86] Woradorn Wattanapanitch, Michale Fee, and Rahul Sarpeshkar. An energy-efficientmicropower neural recording amplifier. IEEE Transactions on Biomedical Circuitsand Systems, 1(2):136–147, June 2007.
[87] D. C. Daly, P. P. Mercier, M. Bhardwaj, A. L. Stone, J. Voldman, R. B. Levine, J. G.Hildebrand, and A. P. Chandrakasan. A pulsed UWB receiver SoC for insect motioncontrol. In IEEE International Solid-State Circuits Conference (ISSCC) TechnicalDigest, pages 200–201, Feb 2009.
[88] O.Y. Dergacheva, I.E. Khachikova, and A.A. Burikov. Dynamics of neuron spike activ-ity in the oral nucleus of the pons during the sleep-waking cycle in cats. Neuroscienceand Behavioral Physiology, 34(5):485–489, 2004.
[89] X. Jia, M.A. Koenig, R. Nickl, G. Zhen, N.V. Thakor, and R.G. Geocadin. Earlyelectrophysiologic markers predict functional outcome associated with temperaturemanipulation after cardiac arrest in rats. Critical Care Medicine, 36(6):1909, 2008.
[90] M. Beckner, M. Simms, and R. Venkatesh. Pro RFID in BizTalk Server 2009. ApressBerkely, CA, USA, 2009.
[91] J. Champion. Zedgraph, 2007.
[92] U. Karthaus and M. Fischer. Fully integrated passive UHF RFID transponder ICwith 16.7-W minimum RF input power. Solid-State Circuits, IEEE Journal of,38(10):1602–1608, Oct. 2003.
[93] Ying Su, J. Holleman, and B.P. Otis. A digital 1.6 pJ/bit chip identification circuitusing process variations. Solid-State Circuits, IEEE Journal of, 43(1):69–77, Jan.2008.
179
[94] Shiho Kim, Jung-Hyun Cho, Hyun-Sik Kim, Haksoo Kim, Hee-Bok Kang, and Suk-Kyung Hong. An EPC Gen 2 compatible passive/semi-active UHF RFID transponderwith embedded FeRAM and temperature sensor. In Solid-State Circuits Conference,2007. ASSCC ’07. IEEE Asian, pages 135–138, Nov. 2007.
[95] F. Kocer and M.P. Flynn. A new transponder architecture with on-chip ADC for long-range telemetry applications. Solid-State Circuits, IEEE Journal of, 41(5):1142–1148,May 2006.
[96] H. Nakamoto, D. Yamazaki, T. Yamamoto, H. Kurata, S. Yamada, K. Mukaida,T. Ninomiya, T. Ohkawa, S. Masui, and K. Gotoh. A passive UHF RF identificationCMOS tag IC using ferroelectric RAM in 0.35-µm technology. Solid-State Circuits,IEEE Journal of, 42(1):101–110, Jan. 2007.
[97] V. Pillai, H. Heinrich, D. Dieska, P.V. Nikitin, R. Martinez, and K.V.S. Rao. Anultra-low-power long range battery/passive RFID tag for UHF and microwave bandswith a current consumption of 700 nA at 1.5 V. Circuits and Systems I: RegularPapers, IEEE Transactions on, 54(7):1500–1512, July 2007.
[98] R. Barnett, G. Balachandran, S. Lazar, B. Kramer, G. Konnail, S. Rajasekhar, andV. Drobny. A passive UHF RFID transponder for EPC Gen 2 with -14dBm sensitivityin 0.13µm CMOS. In Solid-State Circuits Conference, 2007. ISSCC 2007. Digest ofTechnical Papers. IEEE International, pages 582–623, Feb. 2007.
[99] Hongwei Shen, Lilan Li, and Yumei Zhou. Fully integrated passive UHF RFID tagwith temperature sensor for environment monitoring. In ASIC, 2007. ASICON ’07.7th International Conference on, pages 360–363, Oct. 2007.
[100] Namjun Cho, Seong-Jun Song, Sunyoung Kim, Shiho Kim, and Hoi-Jun Yoo. A5.1-µW UHF RFID tag chip integrated with sensors for wireless environmental mon-itoring. In Solid-State Circuits Conference, 2005. ESSCIRC 2005. Proceedings of the31st European, pages 279–282, Sept. 2005.
[101] Zhou Shenghua and Wu Nanjian. A novel ultra low power temperature sensor forUHF RFID tag chip. In Solid-State Circuits Conference, 2007. ASSCC ’07. IEEEAsian, pages 464–467, Nov. 2007.
[102] Azin Zarrasvand. Ultra-Low Power Circuit Design for Wireless Systems and Sensors.Master’s thesis, University of Washington, 2009.
[103] Alanson Sample and Joshua Smith. Wireless power from ambient RF signals. IntelTechnical Report, 2008.
180
[104] Joseph Polastre, Robert Szewczyk, and David Culler. Telos: enabling ultra-low powerwireless research. In Fourth International Symposium Information Processing in Sen-sor Networks, Piscataway, NJ, USA, 2005. IEEE Press.
[105] T. Umeda, H. Yoshida, S. Sekine, Y. Fujita, T. Suzuki, and S. Otaka. A 950 MHzrectifier circuit for sensor networks with 10 m-distance. In Solid-State Circuits Con-ference, 2005. Digest of Technical Papers. ISSCC. 2005 IEEE International, pages256–597 Vol. 1, Feb. 2005.
[106] G. De Vita and G. Iannaccone. Design criteria for the RF section of UHF and mi-crowave passive RFID transponders. Microwave Theory and Techniques, IEEE Trans-actions on, 53(9):2978–2990, Sept. 2005.
[107] R. Barnett, S. Lazar, and Jin Liu. Design of multistage rectifiers with low-costimpedance matching for passive RFID tags. In Radio Frequency Integrated Circuits(RFIC) Symposium, 2006 IEEE, pages 4 pp.–, June 2006.
[108] Jun Yi, Wing-Hung Ki, and Chi-Ying Tsui. Analysis and design strategy of UHFmicro-power CMOS rectifiers for micro-sensor and RFID applications. Circuits andSystems I: Regular Papers, IEEE Transactions on, 54(1):153–166, Jan. 2007.
[109] J. Yi, W.-H. Ki, and C.-Y. Tsui. Corrections to analysis and design strategy of UHFmicro-power CMOS rectifiers for micro-sensor and RFID applications [jan 07 153-166].Circuits and Systems I: Regular Papers, IEEE Transactions on, 54(6):1406–1406, June2007.
[110] S. Mandal and R. Sarpeshkar. Low-power CMOS rectifier design for RFID applica-tions. Circuits and Systems I: Regular Papers, IEEE Transactions on, 54(6):1177–1188, June 2007.
[111] Soumyajit Mandal. Far field RF power extraction circuits and systems. Master’sthesis, Massachusetts Institute of Technology, 2004.
[112] T. Le, K. Mayaram, and T. Fiez. Efficient far-field radio frequency energy harvest-ing for passively powered sensor networks. Solid-State Circuits, IEEE Journal of,43(5):1287–1302, May 2008.
[113] R. Glidden, C. Bockorick, S. Cooper, C. Diorio, D. Dressler, V. Gutnik, C. Hagen,D. Hara, T. Hass, T. Humes, J. Hyde, R. Oliver, O. Onen, A. Pesavento, K. Sund-strom, and M. Thomas. Design of ultra-low-cost UHF RFID tags for supply chainapplications. Communications Magazine, IEEE, 42(8):140–151, Aug. 2004.
[114] F. Cilek, K. Seemann, D. Brenk, J. Essel, J. Heidrich, R. Weigel, and G. Holweg. Ultralow power oscillator for UHF RFID transponder. In Frequency Control Symposium,2008 IEEE International, pages 418–421, May 2008.
181
[115] F. Song, J. Yin, H.L. Liao, and R. Huang. Ultra-low-power clock generation circuitfor EPC standard UHF RFID transponders. Electronics Letters, 44(3):199–201, 312008.
[116] C. Klapf, A. Missoni, W. Pribyl, G. Holweg, and G. Hofer. Analyses and designof low power clock generators for RFID TAGs. In Research in Microelectronics andElectronics, 2008. PRIME 2008. Ph.D., pages 181–184, 22 2008-April 25 2008.
[117] R. Barnett and Jin Liu. A 0.8V 1.52MHz MSVC relaxation oscillator with invertedmirror feedback reference for UHF RFID. In Custom Integrated Circuits Conference,2006. CICC ’06. IEEE, pages 769–772, Sept. 2006.
[118] L. Lincoln, K. Leung, and H.C. Luong. A 7-µW clock generator in 0.18-µm CMOS forpassive UHF RFID EPC G2 tags. In Solid State Circuits Conference, 2007. ESSCIRC2007. 33rd European, pages 412–415, Sept. 2007.
[119] I. Zalbide, J. Vicario, and I. Velez. Power and energy optimization of the digital coreof a Gen2 long range full passive RFID sensor tag. In RFID, 2008 IEEE InternationalConference on, pages 125–133, April 2008.
[120] A. Ricci, M. Grisanti, I. De Munari, and P. Ciampolini. Design of a 2 µW RFIDbaseband processor featuring an AES cryptography primitive. In Electronics, Circuitsand Systems, 2008. ICECS 2008. 15th IEEE International Conference on, pages 376–379, 31 2008-Sept. 3 2008.
[121] F. Cilek, K. Seemann, G. Holweg, and R. Weigel. Impact of the local oscillator onbaseband processing in RFID transponder. In Signals, Systems and Electronics, 2007.ISSSE ’07. International Symposium on, pages 231–234, 30 2007-Aug. 2 2007.
[122] David Johns and Ken Martin. Analog Integrated Circuit Design. Wiley, 1996.
[123] DA Dorsett. Preparation for flight by hawk-moths. Journal of Experimental Biology,39(4):579–588, 1962.