A Semi-Passive UHF RFID Tag Chip Applied for Electronic Vehicle Identification (EVI)

A Semi-Passive UHF RFID Tag Chip Applied for Electronic Vehicle Identification (EVI) Egas Henes Neto, Eduardo Conrad Junior, Daniel Barcelos, Rafael Soares, Antonio Souza, Josias Mainardi, Rafael Cantalice, Davi Leonel, Janaina Costa and Murugappan Ramaswami Centro Nacional de Tecnologia Eletrônica Avançada CEITEC-S.A. Porto Alegre - RS - Brazil {egas.neto, rafael.soares, murugappan.ramaswami}@ceitec-sa.com ABSTRACT The paper presents a semi-passive UHF RFID tag chip developed to meet the restrictive requirements for Electronic Vehicle Identification application. The use of an external power supply allows the tag to achieve longer communication ranges even though additional features such as communication data encryption have been added. The system exploits backscattering mechanism like a passive tag to achieve long battery life. The combination of longer communication ranges with backscattering mechanism required innovative and efficient design solutions to increase power sensitivity. A low-power PMU featuring several wake-up modes was implemented to meet the required battery duration. The semi-passive tag chip was manufactured in 0.18µm standard CMOS technology and is compliant with SINIAV standard. The provided silicon measurements showed a sensitivity of -23dBm RF input power. 1. INTRODUCTION Radio Frequency Identification (RFID) technology is a widely investigated topic and there are innumerous applications for this technology including supply chain management, access control, department stores, baggage tracing and tracking at the airports, etc. [1] [2]. A variety of RFID systems have been deployed to many applications according to their distinctive bands [3]. There are three most important band categories: Low-Frequency (LF) band, High-Frequency (HF) band and Ultra-High Frequency (UHF) band, that operate at 125KHz to 134KHz, 13.56MHz and 860MHz to 960MHz, respectively. LF and HF bands have been widely used in a large number of applications. These systems are based on inductive coupling and they are very attractive in many applications such as animal identification, access control and contactless smart cards. However, LF and HF systems present a short communication range and limited data rate, becoming inadequate for some applications where these requirements are mandatory. UHF RFID technology uses far field coupling and has a long read range combined with high data rate capability, which makes this technology more suitable for identification applications such as container tracking, department stores and vehicle identification. Passive tags implementing the EPC class 1 generation 2 protocol [4] are the most used solution for RFID at UHF today. EPC C1G2 is an open protocol that creates an interoperable environment, internationally regulated, that improves tag performance significantly [5]. A passive tag does not have a battery, i.e, the tag harvests power from an incident radio wave to energize its circuits. If the tag harvests power from a radio wave in an efficient way and the current consumption of the circuits in the tag is low, the tag will operate in a long distance range. These characteristics added to the cost concern, make passive tags extensively used in diverse applications. Although passive tags are adequate for many applications, there are applications that require greater distance range and additional features not mandatory with EPC C1G2, such as cryptography to ensure safe data communication. These features usually demand more power, decreasing the range of operation of the passive tag. In this case, a semi-passive (also called battery-assisted passive) tag is required. This class of RFID tag uses a battery to supply the tag in an active way, but exploits backscattering mechanism to perform tag-to-reader communication like a passive tag. Thus, semi-passive tag enables some tag features without affecting the range of operation of the tag and becomes an attractive solution for systems that demand these requirements [6]. The Brazilian National Automated Vehicle Identification System (SINIAV) standard for tag design is one example of this type of requirement. SINIAV standard is based on ISO 180006-6 [7] and ISO 18000-6/Amd.1 standards [8], with some additional features and constraints. The most important requirements are listed below: Power sensitivity of -21dBm; Cryptography algorithm; 128kb/s data rate for reader-to-tag communication; 320kb/s and 640kb/s data rates for tag-to-reader communication; Physical security. In this paper, a semi-passive UHF RFID tag is presented that is compliant with the SINIAV protocol. Section two presents the architecture of the proposed design. Section three presents the chip building blocks and discusses the design considerations and tradeoffs associated with the system. Section four shows the silicon measurements and results of this design. Finally, conclusions are provided in section five. 2. ARCHITECTURE OF THE SEMI- PASSIVE UHF TAG Figure 1 shows the simplified block diagram of the semi-passive tag architecture. The chip is composed of an RF front-end, a power management unit (PMU) and a digital section. The RF front-end section includes an RF detector, a demodulator and a modulator. The RF detector block acts as a wake-up circuit, detecting the incoming RF signal at the antenna and generating the RFON signal to activate the chip for communication. The

demodulator recovers the envelope data of the RF signal, sending the recovered data to the digital circuit. The modulator changes the tag impedance in order to perform tag-to-reader communication through the backscattering mechanism. An RF limiter structure at the antenna pad is used to limit the RF signal voltage amplitude to protect internal circuitry. The PMU section is composed of a power-on-reset (POR), a bias circuit, a ring oscillator, a voltage regulator and a battery monitor. After the RF field detection turns-on RFON signal, the power-on-reset generates the ENREG signal to turn-on the voltage regulator. By comparing the VDD voltage with a reference level (VREF), the POR detects the stabilization of the voltage regulator and initializes the ring oscillator and the digital section. Other feature of the POR block is the tamper flag signal that indicates when a tampering attempt is detected. The battery monitor block indicates if the chip is connected to a battery (BATTON) and if the battery is charged (BATTOK). In this case, the POR signal will activate the chip for communication only if both BATTON and BATTOK are true. In this design, the battery monitoring is permanently on during the entire life time of the tag. Thus, the bias circuit is continuously on to provide current and voltage references to the battery monitor block. The digital block interprets the reader commands from DATAIN and replies back to the reader an appropriate response through DATAOUT, according to the SINIAV protocol. The non-volatile memory (NVM) block is used to store the necessary data for the protocol. 3. CIRCUIT IMPLEMENTATION This section presents the building blocks of the proposed architecture. A discussion about design considerations and performance issues in terms of the standard specifications is done for each block. 3.1 RF Section 3.1.1 RF Detector This block detects the incoming RF signal, activating other parts of the chip for communication. Considering the power sensitivity specification of -21dBm, the RF Detector becomes one of the most important building blocks of this design. In [6][9], solutions based on voltage multiplication are proposed. In this case, a rectifier (also called charge-pump) must be used to perform the voltage multiplication from an RF signal at the antenna to a DC signal at the rectifier output. One possible limitation of this topology is the power efficiency of voltage multiplication, where a considerable amount of energy could be lost in the process, limiting the sensitivity of the RF detection. In this work a very efficient approach was developed to detect the RF signal. This approach is not based on voltage multiplication and presents high sensitivity, very low power consumption from the battery and antenna, and low silicon area. This innovative solution is currently applied for patent to the Brazilian Intellectual Property National Institute (INPI) patent office [10]. 3.1.2 Demodulator This block converts the ASK (amplitude shifting keying) modulated signal received by the tag into a digital format. The demodulator circuit consists of an envelope detector, a low pass filter and a voltage comparator. The detected envelope signal is averaged through the low pass filter generating an average signal. The comparator retrieves the digital pulse-interval encoding (PIE) format by comparing the detected envelope and the average signals. The demodulator must present high sensitivity since the minimum power specification of -21dBm would represent an RF signal with 200mV of amplitude or less. Other constraints are in terms of linearity and power consumption from the antenna and battery. In this design, an innovative solution is implemented that offers high sensitivity, high linearity, low power BATTERY RF SECTION PMU SECTION DIGITAL SECTION BATT ON BATT Battery Monitor V OK DD Modulator DATA OUT BIAS Voltage Regulator ANTENNA RF RF Detector RF ON BATT ON BATT OK POR EN REG Tamper Flag POR Signal Digital + NVM Oscillator CLK Demodulator DATA IN Figure 1. Block diagram of the semi-passive RFID tag

consumption and low silicon area. This solution has also been currently applied for patent to the Brazilian Intellectual Property National Institute (INPI) patent office [10]. 3.1.3 Modulator Tag-to-reader communication is made by the backscattering mechanism. The modulator changes the chip input impedance, generating two different impedances. These two impedances will give two different reflection coefficients, indicating to the reader how much power is reflected by differential radar cross section formula [11]. In the first case, the chip impedance is matched with the antenna to guarantee the data sent by the reader is received by the tag. The second case is when the modulator changes the chip impedance to reflect more power than the first case. This produced power signal needs to be higher than the reader sensitivity, which is around -70 dbm. Since semi-passive tags do not need to harvest power from the reader signal to supply its circuitry like passive tags do, thus the reader distance increases and the power level at the chip decreases. In this scenario, the modulator becomes a key point in the communication range because its performance in terms of modulation indicates the differential reflected power level that arrives at the reader. In the design proposed in this paper a well deployed NMOS switch is used as a modulator. 3.2 PMU Section 3.2.1 Power-On-Reset The main purpose of the power-on-reset block is to initialize the digital section. This block receives some inputs, such as the battery flags and the RF field detection flag. Each of these flags will take the digital logic to a different operational condition, so the block must generate signals to control that operation. The block is composed of three sub-blocks: a comparator to signalize the correct value of the regulated supply VDD, a level detector circuit to generate the tamper flag signal, and a digital logic to generate the POR signal. 3.2.2 Voltage Regulator In this work a low-dropout (LDO) voltage regulator is implemented using a common source as basic architecture. The regulator operates with supply voltages from 1.8V to 3.6V and a reference voltage of 1.2V, providing 1.8V regulated voltage with a 98% current efficiency. The regulator's output capacitor is integrated to the chip. 3.2.3 Oscillator The oscillator block generates all the required clock signals to the digital logic. The block has two ring oscillators that generate two independent clock signals for random number generation which is needed for the tag's collision-arbitration algorithm. Other clocks are generated using frequency dividers. These ring oscillators are based on the current-starved topology, with bits of calibration to compensate process variations. The main clock frequency is 2.56 MHz, with a variation of 5% after calibration. 3.2.4 Bias The bias references are required to supply several blocks in the analog section of the chip. The voltage reference generates a quasi-fixed voltage level, considering load, temperature and power supply variation. This design was made to deal with a wide battery voltage supply range, from 1.8V to 3.6V. It is based on a band-gap topology, by adding positive temperature coefficient of thermal voltage to nominal negative temperature coefficient. It supplies a voltage reference to the power-on-reset and battery monitor blocks. A voltage to current converter (V/I) block is used to generate, using the band-gap voltage reference, an accurate 50nA reference current. Because this reference current is distributed through several blocks, a low spread around 15% is required over process, supply voltage and temperature variations. 3.2.5 Battery Monitor This block detects the battery level, informing the status to the power-on-reset block. Considering the necessity of an independent operation and a continuous charge measurement during the battery life, the battery monitor becomes an important building block for the SINIAV application. In our design, a very efficient approach is used to detect the battery charge level, where a very low power timer is used to periodically turn on the measurement control block, which drastically reduces the average power consumption of the monitoring activity. The operation average consumption is 130nA. 3.3 Digital Section The digital section of the chip is responsible for implementing the SINIAV protocol, which provides a unique secure method to identify vehicles. This protocol is an extension of the standards ISO18000-6 [9] and ISO18000-6/Amd1 [8]. The reader issues commands by modulating an RF carrier using DSB-ASK or PR-ASK using a pulse-interval encoding (PIE) format. The digital section of the chip decodes the received data, identifies the reader commands, executes and replies them accordingly. The tag encodes its response as FM0 baseband at either 320KHz or 640KHz [12]. SINIAV tags have privacy and fraud protection requirements [13]. The digital block is responsible for encrypting the data during SINIAV transactions and for controlling the actions taken when a tampering attempt is detected. 3.3.1 Non-Volatile Memory SINIAV tags have a multiple time programmable (MTP) nonvolatile memory (NVM) [12], whose logical division is similar to the specified in ISO18000-6. The tag's memory stores the keys used by the encryption algorithm needed during SINIAV transactions. Besides that, the memory stores information about the tag and about the vehicle to which the tag is attached. 4. MEASUREMENTS RESULTS The semi-passive tag was manufactured in 0.18mm standard CMOS process. The die size is 1.3x1.3mm2, where roughly half is occupied by the non-volatile memory block. The measured tag sensitivity is -23dBm at 915MHz, measured with a 50Ω source impedance. The current consumptions of the tag are 28mA and 1.5mA, for active and stand-by modes at VDDBAT=3.3V. Table 1 summarizes the measured performance of this work. Figure 2 shows the RF start-up sequence of the tag. At T1 an RF field is detected and at this time the voltage regulator is turnedon through ENREG signal (see figure 2). At T2, the power-onreset detects the correct value of the regulated supply VDD, and activates the oscillator and the digital circuit. The measured switch point of the power-on-reset block is 1.4V. The voltage regulator generates an 1.88V VDD supply from a 3.3V battery supply and its measured stabilization time (T2-T1) is 56ms. The measured frequency is about 2.56MHz. Figure 3 shows a readerto-tag communication at 128kb/s data rate. This waveform is measured at the demodulator output. Measurements show that the tag is able to communicate with the reader about 80ms after of the RF signal is detected.

Figure 4 shows the simulation of the same RF start-up sequence and a demodulation of a test signal. To simulate the Analog Front-End (AFE) of the chip, mixed-signal modeling and various levels of abstraction are used, according to the complexity required by each test. In this case, the entire RF front-end, which is composed by the RF Detector, Demodulator's Envelope Extractor and Modulator, is abstracted to its baseband behavior through the usage of simplified models, while the baseband section of the chip is simulated using schematics. These simulation techniques allow a detailed evaluation of the functionality for the entire top-level circuit without having prohibitive computational times. According to the results of the simulation presented in this figure, T1 and T2 times are consistent to silicon measurements. Table 1. Measured performance summary. Parameter Stand-by current Measurement 1.5µA Current consumption 28µA Tag Sensitivity -23dBm Regulated Supply Voltage 1.88V Oscillator Frequency Wake-up time for communication ready* Area *after RF signal detection 5. CONCLUSIONS 2.56MHz 80µs 1.3mm x 1.3mm In this work, a semi-passive UHF RFID tag compliant with Brazilian National Automated Vehicle Identification System (SINIAV) protocol is presented. The design implements the required privacy and fraud protection features. Innovative and efficient solutions are deployed which leads the chip to operate in a competitive power sensitivity of -23dBm. A low-power PMU is implemented targeting long battery life time and to meet SINIAV standard requirements. The measured tag consumption for the active mode is 28µA, with a regulated supply voltage of 1.88V. The semi-passive tag is manufactured using 0.18µm standard CMOS technology. 6. ACKNOWLEDGMENTS The authors would like to acknowledge the contributions of all CEITEC-S.A. team involved in this work. 7. REFERENCES [1] Finkenzeller, K. 2003. RFID Handbook. John Wiley & Sons Ltd., Chichester, England. [2] Khannur, P. B., et al. An 860 to 960MHz RFID Reader IC in CMOS. IEEE Radio Frequency Integrated Circuits Symposium, 2007, pp: 269-272. [3] Pillai, V., Heinrich, H., Dieska, D., Nikitin, P.V., Martinez, R., Rao, K.V.S. An Ultra-Low-Power Long Range Battery/Passive RFID Tag for UHF and Microwave Bands With a Current Consumption of 700nA at 1.5V. IEEE Transactions on Circuits and Systems I: Regular Papers. 2007, pp: 1500-1512. [4] EPC Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for Communications at 860MHz to 960MHz for Communications Version 1.1.0, Electronic Product Code (EPC) Standard, 2006. [5] Kotani, K., Sasaki, A.,Ito, T. High-Efficiency Differential- Drive CMOS Rectifier for UHF RFIDs. IEEE Journal of Solid-State Circuits. 2009, pp: 3011 3018. RF signal RF signal VDD T 1 POR T 2 DATAOUT CLK Figure 2. Start-up measurement Figure 3. Reader-to-tag communication measurement from the demodulator output

[6] Wenyi, C., et al. A Semi-Passive UHF RFID Tag With On- Chip Temperature Sensor. IEEE Custom Integrated Circuits Conference (CICC). 2010, pp: 1 4. [7] ISO 18000-6, Information technology Radio frequency identification for item management Part 6: Parameters for air interface communications at 860 MHz to 960 MHz. [8] ISO 18000-6/Amd.1, Information technology Radio frequency identification for item management Part 6: Parameters for air interface communications at 860 MHz to 960 MHz Extension with Type C and update of Types A and B. [9] Najafi, V., Jenabi, M., Mohammadi, S., Fotowat-Ahmady, A., Marvasti, M.B. A Dual Mode EPC Gen 2 UHF RFID Transponder in 0.18μm CMOS. 15th IEEE International Conference on Electronics, Circuits and Systems ICECS 2008, pp: 1135 1138. [10] Brazilian Intellectual Property National Institute (INPI). www.inpi.gov.br. [11] Nikitin, P.V., Roa, K.V.S. Antennas and Propagation in UHF RFID Systems. IEEE International Conference on RFID, 2008, pp: 277 288. [12] DENATRAN; Portaria DENATRAN no. 570/11, Anexo IV Especificação da Tecnologia SINIAV - Especificações Técnicas de Equipamentos SINIAV da geração Zero (G0). June 27th, 2011. [13] DENATRAN; Portaria DENATRAN no. 570/11, Anexo VI Especificação da Tecnologia SINIAV Requisitos de Segurança Física de Equipamentos SINIAV da geração Zero (G0). June 27th, 2011. Figure 4. Simulation of RF start-up and test signal demodulation.