Activating Wireless Voice for E-Toll Collection Systems with Zero Start-up Cost Zhenlin An*,Qiongzheng Lin*,Lei Yang*and Lei Xiet *Department of Computing,The Hong Kong Polytechnic University,Hong Kong fState Key Laboratory for Novel Software Technology,Nanjing University,China Email:*fan,lin,young}@tagsys.org,TIxie@nju.edu.cn Abstract-This work enhances the machine-to-human commu- nication between electronic toll collection (ETC)systems and drivers by providing an AM broadcast service to deployed ETC systems.This study is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver.Such a phenomenon allows the development of a previously infeasible cross-technology and cross-frequency communication,called Tagcaster,which converts an ETC reader to an AM station for broadcasting short messages (e.g.,charged- fees and traffic forecast)to drivers at tollbooths.The key innovation in this work is the engineering of Tagcaster over 2Rp》 ④isening off-the-shelf ETC systems using shadow carrier and baseband Fig.1:Tagcaster-enhanced wireless voice service for ETC system. whitening without the need for hardware nor firmware changes This feature allows zero-cost rapid deployment in existing ETC 1 The ETC reader queries the transponder attached on the vehicle.2 infrastructure.Two prototypes of Tagcaster are designed,imple- The transponder is identified through its reply.Tagcaster broadcasts mented and evaluated over four general and five vehicle-mounted the wireless voice to the identified vehicle.The driver can listen AM receivers (e.g.,Toyota,Audi,and Jetta).Experiments reveal to the AM radio through the vehicle-mounted radio receiver. that Tagcaster can provide good-quality (PESQ>2)and stable AM broadcasting service with a 30 m coverage range.Tagcaster credit balance,real-time traffic and road condition).Achiev- remarkably improves user experience at ETC stations and two- ing direct machine-to-human (M2H)communication between thirds volunteer drivers rate it with a score of 4+out of 5. drivers and ETC systems requires extra peripherals and efforts. For example,drivers must slow down their cars to view an I.INTRODUCTION LED screen installed at the tollbooth for charge details.The Electronic toll collection(ETC)is a system enabling elec- information acquired by drivers is usually quite limited due to tronic collection of toll payments,thus allowing for near- the small screen size.Slowing down also worsens the conges- nonstop toll collection and traffic monitoring.ETC (e.g., tion during rush hours.Facing this practical issue,we ask "Is Z-Pass and I-PASS)has become the most successful and there any convenient and user-friendly M2H communication widespread application of Radio Frequency IDentification way to provide informative interaction fast?" (RFID).Approximately,70%to 89%of cars are equipped with In this study.we introduce a novel ETC service,called ETC transponders (or tags)in the US.In particular,over 80% Tagcaster,which supplements the function of an AM radio of Illinois'1.4 million daily drivers currently use I-PASS [11. to the existing ETC infrastructure with zero start-up cost. ETC can eliminate delay on toll roads,HOV lanes,and toll Tagcaster can activate a deployed ETC tollbooth to provide the bridge by collecting tolls without requiring cars to stop.Owing wireless voice service for direct M2H communication.Fig.I to this wide adoption,the industry and academia are looking illustrates our service scenario.When a driver passes through a into delivering new services via the currently deployed ETC tollbooth,the ETC reader automatically identifies the vehicle's infrastructure.Examples include paying for food at drive- ID and retrieves its related data from backend servers.Then, through restaurants or parking lots with an e-toll transponder, the reader broadcasts the data in the form of an AM radio.The tracking the number of cars at every road intersection for traffic driver can listen to the broadcast using the vehicle-mounted control,and detecting and ticketing over-speeding cars without radio receiver or smart-phone inside. the need for car-mounted radars and hidden police officers. "Wireless voice"is more user-friendly and spontaneous ETC offers an opportunity for using ETC systems to enable than current interactive medias(e.g.,LED screens or external smart cities in the future [2]. speakers).It provides a new means to deal with the issue As a typical technology of the Internet of Things,ETC of poor visibility in bad weather conditions,such as stormy, systems are designed for machine-to-machine communication foggy or smoggy,when viewing feedback from ETC screens only (e.g.,identifying cars or monitoring traffic).Drivers is difficult for drivers.Such functionality is also useful in cannot directly obtain related information (e.g.,charge amount, a wide range of application scenarios.Apart from charging
Activating Wireless Voice for E-Toll Collection Systems with Zero Start-up Cost Zhenlin An∗ , Qiongzheng Lin∗ , Lei Yang∗ and Lei Xie† ∗Department of Computing,The Hong Kong Polytechnic University, Hong Kong †State Key Laboratory for Novel Software Technology, Nanjing University, China Email: ∗{an, lin, young}@tagsys.org, † lxie@nju.edu.cn Abstract—This work enhances the machine-to-human communication between electronic toll collection (ETC) systems and drivers by providing an AM broadcast service to deployed ETC systems. This study is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver. Such a phenomenon allows the development of a previously infeasible cross-technology and cross-frequency communication, called Tagcaster, which converts an ETC reader to an AM station for broadcasting short messages (e.g., chargedfees and traffic forecast) to drivers at tollbooths. The key innovation in this work is the engineering of Tagcaster over off-the-shelf ETC systems using shadow carrier and baseband whitening without the need for hardware nor firmware changes. This feature allows zero-cost rapid deployment in existing ETC infrastructure. Two prototypes of Tagcaster are designed, implemented and evaluated over four general and five vehicle-mounted AM receivers (e.g., Toyota, Audi, and Jetta). Experiments reveal that Tagcaster can provide good-quality (PESQ> 2) and stable AM broadcasting service with a 30 m coverage range. Tagcaster remarkably improves user experience at ETC stations and twothirds volunteer drivers rate it with a score of 4+ out of 5. I. INTRODUCTION Electronic toll collection (ETC) is a system enabling electronic collection of toll payments, thus allowing for nearnonstop toll collection and traffic monitoring. ETC (e.g., Z-Pass and I-PASS) has become the most successful and widespread application of Radio Frequency IDentification (RFID). Approximately, 70% to 89% of cars are equipped with ETC transponders (or tags) in the US. In particular, over 80% of Illinois’ 1.4 million daily drivers currently use I-PASS [1]. ETC can eliminate delay on toll roads, HOV lanes, and toll bridge by collecting tolls without requiring cars to stop. Owing to this wide adoption, the industry and academia are looking into delivering new services via the currently deployed ETC infrastructure. Examples include paying for food at drivethrough restaurants or parking lots with an e-toll transponder, tracking the number of cars at every road intersection for traffic control, and detecting and ticketing over-speeding cars without the need for car-mounted radars and hidden police officers. ETC offers an opportunity for using ETC systems to enable smart cities in the future [2]. As a typical technology of the Internet of Things, ETC systems are designed for machine-to-machine communication only (e.g., identifying cars or monitoring traffic). Drivers cannot directly obtain related information (e.g., charge amount, !"#$%&$'()*+,-./( 1 3 2 ETC READER ETC READER Vehicle-mounted AM Radio Good morning, sir. Charging fee is 5$. Notice the road ahead is under maintenance. Have a nice day! 4 Reply 1 Query Broadcasting 2 3 4 Listening Fig. 1: Tagcaster-enhanced wireless voice service for ETC system. ❶ The ETC reader queries the transponder attached on the vehicle. ❷ The transponder is identified through its reply. ❸ Tagcaster broadcasts the wireless voice to the identified vehicle. ❹ The driver can listen to the AM radio through the vehicle-mounted radio receiver. credit balance, real-time traffic and road condition). Achieving direct machine-to-human (M2H) communication between drivers and ETC systems requires extra peripherals and efforts. For example, drivers must slow down their cars to view an LED screen installed at the tollbooth for charge details. The information acquired by drivers is usually quite limited due to the small screen size. Slowing down also worsens the congestion during rush hours. Facing this practical issue, we ask “Is there any convenient and user-friendly M2H communication way to provide informative interaction fast?” In this study, we introduce a novel ETC service, called Tagcaster, which supplements the function of an AM radio to the existing ETC infrastructure with zero start-up cost. Tagcaster can activate a deployed ETC tollbooth to provide the wireless voice service for direct M2H communication. Fig. 1 illustrates our service scenario. When a driver passes through a tollbooth, the ETC reader automatically identifies the vehicle’s ID and retrieves its related data from backend servers. Then, the reader broadcasts the data in the form of an AM radio. The driver can listen to the broadcast using the vehicle-mounted radio receiver or smart-phone inside. “Wireless voice” is more user-friendly and spontaneous than current interactive medias (e.g., LED screens or external speakers). It provides a new means to deal with the issue of poor visibility in bad weather conditions, such as stormy, foggy or smoggy, when viewing feedback from ETC screens is difficult for drivers. Such functionality is also useful in a wide range of application scenarios. Apart from charging
information,Tagcaster can also broadcast greetings,real-time (i.e.,OOK).On the contrary,AM stations and receivers are traffic conditions,account balance,and advertisements.More- analog systems in which the quantized analog audio data are over,drivers do not need to slow down to acquire information represented using multiple level voltages.Therefore,analog from an ETC system as they are pushed actively.Additional radio receivers cannot decode the digital binary signals trans- scenarios that motivate our design and the reason why not mitted from the reader.To deal with this issue,Tagcaster lever- choose other technologies are displayed in section II ages the controllability of RF power to adjust the transmitting The fundamental challenge in Tagcaster is in the seemingly power dynamically for the required amplitude modulation. impossible cross-technology communication between ETC Specifically,Tagcaster initially quantizes the analog audio data RFID and AM radio due to the large frequency gap.ETC RFID into four-bit discrete values.then manipulates the transmitting systems operate at ultra-high frequency (UHF)(e.g..800-900 power among 16 levels correspondingly.In such a way,the MHz),whereas an AM radio works at radio frequency (e.g., audio data can be carried onto the desired frequencies. 500-1700 kHz).A real AM station is usually equipped with a We implement two prototypes of Tagcaster using an R2000 60 m long antenna because the length of transmitting antenna chip from ImpinJ [3]and USRP N210 respectively.Nine off- must be close to half of the carrier wavelength.Clearly,a 16 the-shelf radio receivers including five vehicle-mounted and cm long directional antenna for ETC reader fails to propagate five general-purpose radio receivers are tested.Our results AM radio signals into the air.Our insight is that non-linearity demonstrate that Tagcaster can fully provide AM radio service effect in the circuits of radio receivers can receive and pull and enhance the ETC user experience on these devices.The the UHF signal down to the low-frequency band if the signals perceptual evaluation of speech quality(PESQ)of the received are transmitted via two UHF carriers.Specifically,on the voice is around 2,which is equal to that of the current transmitter side,the RFID reader broadcasts two signals at telephone communication system.The coverage range is 30 f1 and f2 (e.g.,f1 =820.5 MHz and f2 =820 MHz) m with two-way antennas.Demo audios are uploaded in [4]. simultaneously.Given that both signals are at UHF,they can Contributions:This work presents Tagcaster,the first be propagated successfully by the existing UHF antenna.On system utilizing the non-linearization phenomenon in radio the radio receiver side,a new signal is created at |fi-f2 (e.g., receivers to provide high-quality radio service for ETC readers. 500 kHz)due to the nonlinearity effect of the pre-amplifier at The design of Tagcaster provides three key contributions. the radio receiver.The process is equivalent to performing an First,it proves the engineering possibility of down-converting additional downconversion called the zeroth downconversion communication with hardware non-linearity.Second,it intro- before the radio signal is further downconverted and decoded duces a new amplitude modulation scheme by controlling RF to an audio signal.Unlike traditional wisdom that regards non- power.Finally,Tagcaster presents a practical prototype and a linearity as detrimental,we use it as a natural downconverter. comprehensive evaluation. Engineering a Tagcaster must address two practical issues that stem from the pursuit of zero start-up cost(i.e.,without II.BACKGROUND AND MOTIVATION requiring modification in the hardware of the ETC system). In this section,we introduce system background,typical How to generate two carriers?The zeroth downconver- application scenarios and potential alternative solutions. sion requires two signals from an ETC reader to operate at fe A.System Background and Scope and fe+fr so that their difference of fe+fr-fel is exactly equal to the fr that the radio receiver can process.Here,fe ETC systems are a combination of techniques and tech- and fr are operating frequencies of the ETC reader and the nologies that allow vehicles to pass through a toll facility AM radio,respectively.Therefore,we must enable the ETC without requiring any action from drivers.The core of ETC reader to modulate signals at two carriers (fe and fe+f). is a typical RFID system where an active or passive e-toll Although total 52 frequency channels are available for an transponder(RFID tag)responds to a query command trans- RFID reader,only a single channel can be used at any moment mitted by the reader.The readers are installed in tollbooths, for the reading.Our transparent design views the reader as whereas transponders are attached to vehicle's windshields. a "black box",whose input is limited to predefined reader ETC systems are typical closed-loop systems that only work commands.Finally,Tagcaster whitens the baseband to a square within particular regions.Therefore,no agreement on the ETC signal by inputting a long sequence of RFID commands. standard has been achieved so far.For example,dozens of ETC Given that the reader uses pulse interval encoding (PIE) networks exist in the US [5]and these include E-ZPass,I-Pass, for modulation.multiple harmonics can be observed on the SunPass,TxTAG and Fastrack.Even so,these ETC networks receiving side.Inspired by this physical-layer characteristic, have three common factors as follows: we set the parameter of length of bit tactically to "frame" Readers work at the UHF band (i.e.,860-960 MHz)to the first-order (i.e.,fundamental)and fifth-order harmonics to achieve good penetration because transponders are located appear at frequencies of fe and fe+fr,respectively. inside vehicles.For example,E-ZPass works at 915MHz. How to modulate audio signals?An ETC reader is a.The simplicity of the transponders results in a cheap typical digital communication system whose baseband signal and low-power device.The forward link from readers to contains two different level voltages (i.e.,high and low)only. transponders uses PIE-like encoding to facilitate the decod- The envelop of its modulated signals changes at two levels ing at powerless transponders
information, Tagcaster can also broadcast greetings, real-time traffic conditions, account balance, and advertisements. Moreover, drivers do not need to slow down to acquire information from an ETC system as they are pushed actively. Additional scenarios that motivate our design and the reason why not choose other technologies are displayed in section II. The fundamental challenge in Tagcaster is in the seemingly impossible cross-technology communication between ETC RFID and AM radio due to the large frequency gap. ETC RFID systems operate at ultra-high frequency (UHF)(e.g., 800-900 MHz), whereas an AM radio works at radio frequency (e.g., 500-1700 kHz). A real AM station is usually equipped with a 60 m long antenna because the length of transmitting antenna must be close to half of the carrier wavelength. Clearly, a 16 cm long directional antenna for ETC reader fails to propagate AM radio signals into the air. Our insight is that non-linearity effect in the circuits of radio receivers can receive and pull the UHF signal down to the low-frequency band if the signals are transmitted via two UHF carriers. Specifically, on the transmitter side, the RFID reader broadcasts two signals at f1 and f2 (e.g., f1 = 820.5 MHz and f2 = 820 MHz) simultaneously. Given that both signals are at UHF, they can be propagated successfully by the existing UHF antenna. On the radio receiver side, a new signal is created at |f1−f2| (e.g., 500 kHz) due to the nonlinearity effect of the pre-amplifier at the radio receiver. The process is equivalent to performing an additional downconversion called the zeroth downconversion before the radio signal is further downconverted and decoded to an audio signal. Unlike traditional wisdom that regards nonlinearity as detrimental, we use it as a natural downconverter. Engineering a Tagcaster must address two practical issues that stem from the pursuit of zero start-up cost (i.e., without requiring modification in the hardware of the ETC system). • How to generate two carriers? The zeroth downconversion requires two signals from an ETC reader to operate at fe and fe +fr so that their difference of |!fe +fr −!fe| is exactly equal to the fr that the radio receiver can process. Here, fe and fr are operating frequencies of the ETC reader and the AM radio, respectively. Therefore, we must enable the ETC reader to modulate signals at two carriers (fe and fe + fr). Although total 52 frequency channels are available for an RFID reader, only a single channel can be used at any moment for the reading. Our transparent design views the reader as a “black box”, whose input is limited to predefined reader commands. Finally, Tagcaster whitens the baseband to a square signal by inputting a long sequence of RFID commands. Given that the reader uses pulse interval encoding (PIE) for modulation, multiple harmonics can be observed on the receiving side. Inspired by this physical-layer characteristic, we set the parameter of length of bit tactically to “frame” the first-order (i.e., fundamental) and fifth-order harmonics to appear at frequencies of fe and fe + fr, respectively. • How to modulate audio signals? An ETC reader is a typical digital communication system whose baseband signal contains two different level voltages (i.e., high and low) only. The envelop of its modulated signals changes at two levels (i.e., OOK). On the contrary, AM stations and receivers are analog systems in which the quantized analog audio data are represented using multiple level voltages. Therefore, analog radio receivers cannot decode the digital binary signals transmitted from the reader. To deal with this issue, Tagcaster leverages the controllability of RF power to adjust the transmitting power dynamically for the required amplitude modulation. Specifically, Tagcaster initially quantizes the analog audio data into four-bit discrete values, then manipulates the transmitting power among 16 levels correspondingly. In such a way, the audio data can be carried onto the desired frequencies. We implement two prototypes of Tagcaster using an R2000 chip from ImpinJ [3] and USRP N210 respectively. Nine offthe-shelf radio receivers including five vehicle-mounted and five general-purpose radio receivers are tested. Our results demonstrate that Tagcaster can fully provide AM radio service and enhance the ETC user experience on these devices. The perceptual evaluation of speech quality (PESQ) of the received voice is around 2, which is equal to that of the current telephone communication system. The coverage range is 30 m with two-way antennas. Demo audios are uploaded in [4]. Contributions: This work presents Tagcaster, the first system utilizing the non-linearization phenomenon in radio receivers to provide high-quality radio service for ETC readers. The design of Tagcaster provides three key contributions. First, it proves the engineering possibility of down-converting communication with hardware non-linearity. Second, it introduces a new amplitude modulation scheme by controlling RF power. Finally, Tagcaster presents a practical prototype and a comprehensive evaluation. II. BACKGROUND AND MOTIVATION In this section, we introduce system background, typical application scenarios and potential alternative solutions. A. System Background and Scope ETC systems are a combination of techniques and technologies that allow vehicles to pass through a toll facility without requiring any action from drivers. The core of ETC is a typical RFID system where an active or passive e-toll transponder (RFID tag) responds to a query command transmitted by the reader. The readers are installed in tollbooths, whereas transponders are attached to vehicle’s windshields. ETC systems are typical closed-loop systems that only work within particular regions. Therefore, no agreement on the ETC standard has been achieved so far. For example, dozens of ETC networks exist in the US [5] and these include E-ZPass, I-Pass, SunPass, TxTAG and Fastrack. Even so, these ETC networks have three common factors as follows: • Readers work at the UHF band (i.e., 860-960 MHz) to achieve good penetration because transponders are located inside vehicles. For example, E-ZPass works at 915MHz. • The simplicity of the transponders results in a cheap and low-power device. The forward link from readers to transponders uses PIE-like encoding to facilitate the decoding at powerless transponders
Readers maintain continuous wave (CW)to supply energy to passive transponders or to awaken active transponders. In view of diversity,our design concentrates on two main- stream standards,namely ISO18000-6 and EPCglobal Gen2 Deteeto which have been widely adopted in the world.ISO18000- Antenn 6 defines one model (i.e.,Interrogator-Talks-First)with four utomatie Gain Control ist dow AM/FM types:A.B.C,and D.EPCglobal Gen2 is considered the de Radio Reciver facto standard instance of ISO18000-6 at 860-960 MHz for Fig.2:Internal structure of an AM Radio receiver.Input radio types B and C.We use type C as an example to introduce signals are processed through three downconversions where the zeroth our design and implementation.Nevertheless,extending the downconversion is explicitly performed by the amplifier. design to other types is similar. B.Application Scenarios A.Exploiting the Nonlinearity Effect Tagcaster enables a spontaneous setup of a radio broadcast service for vehicle-mounted radio receivers.Such a service is Primer on AM Radio.All AM radio systems work from useful in a wide range of application scenarios.We provide 520 to 1700 kHz without a license from FCC.Radio receivers a few examples.(1)Charging notification.This scenario is a usually adopt the superheterodyne design,as displayed in fundamental service of ETC systems for drivers,who should Fig.2.The RF signal (fr)is amplified by the pre-amplifier be precisely informed of how they are charged when passing to improve the signal-to-noise ratio (SNR).Then,the amplified through an ETC tollbooth.The traditional means is to watch RF signal enters a superheterodyne mixer along with the an LED indicator installed at the tollbooth.With Tagcaster, output of the local oscillator,which is tuned to a frequency drivers are informed by listening to the radio.(2)Overspeed (fr)that is higher or lower than the intended reception warning.An increasing number of states or regions have frequency.As a result,the mixer output includes two signals, begun adopting an average speed (i.e.,total distance traveled that operate at fr+fr and fr-fr.The sum signal at fr+fr divided by the time interval)for overspeeding surveillance. is immediately filtered out by the following IF filter.This ETC systems deployed at adjacent critical junctions can now difference can always be at a fixed value of the frequency warn drivers of potential violences of local traffic regulations. offset and is called the intermediate frequency (IF).This (3)Road traffic broadcast.Drivers can listen to special traffic stage is called the first downconversion or superheterodyning. news and the latest traffic conditions around the ETC station. Superheterodyning exhibits good performance because radio components can be optimized to work at a single intermediate C.Comparison against Alternatives frequency.The desired baseband signal is then extracted by the Why not install an AM station at the tollbooth?ETC detector (e.g.,an envelope detector of Foster-Seeley discrimi- service is private for each driver but AM station is designed nator),which performs the second downconversion by tuning for large-scale public radio service.The radio signal can be the center frequency to the expected.The downconverted audio received kilometres away.Installing an AM station to each are transmitted to the speaker. tollbooth for ETC broadcasting will leak user's privacy and Nonlinearity Effect.In RF system,circuits are designed to disturb the surrounding radio.Instead,RFID is a short-range work linearly.If an RF amplifier receives an input signal S. communication and many existing RFID systems with beam- then output signal,denoted by Sout,is given as forming technology [6]-[8]or directional antenna can provide desired directional communication.Therefore,an RFID sys- Sout =AS (1) tem can only cover the desired area (ETC lane)so that to where A is the amplification factor.The amplifier is supposed protect user's privacy..Why not use Bluetooth or Wi-Fi?Cars to scale the signal magnitude and introduce a constant phase equipped with Bluetooth chip have their Bluetooth antennas distortion.Unfortunately,the non-linearity effect of the ampli- inside to communicate with smart devices or wearables [9].An fier can generate many harmonics.Consequently,the practical antenna inside a car can be shielded from signals from an ETC output signal is given by: station by the car's metal body.By contrast,radio antennas are already outside the car where FM or AM signals are the Linear Nonlinear strongest.Finally,we stress that the primary merit of Tagcaster Sout=】 AkS*=A1S+A282+A3S3+.. (2) 1 is that it does not require the firmware or physical layer of ETC transceivers to be modified.Therefore,Tagcaster can where A are the gains of the various harmonics introduced by fully co-exist with the given alternatives for complementarity the circuit.These components are called fundamental,second- even when they are already deployed in several stations. order,third-order and so on.The third-order and higher-order harmonics attenuate fast and become undetectable.Therefore, III.TAGCASTER DESIGN our focus is on the first-and second-order terms only.If the In this section,we first exploit the nonlinearity effect and input signal S is a superimposition of two sine waves with zeroth downconversion in radio receivers and describe how different frequencies fi and f2,that is,S(t)=sin(2fit)+ Tagcaster can utilize the zeroth downconversion for its design. sin(2f2t),where t is time,then the equation can be expanded
• Readers maintain continuous wave (CW) to supply energy to passive transponders or to awaken active transponders. In view of diversity, our design concentrates on two mainstream standards, namely ISO18000-6 and EPCglobal Gen2, which have been widely adopted in the world. ISO18000- 6 defines one model (i.e., Interrogator-Talks-First) with four types: A, B, C, and D. EPCglobal Gen2 is considered the de facto standard instance of ISO18000-6 at 860-960 MHz for types B and C. We use type C as an example to introduce our design and implementation. Nevertheless, extending the design to other types is similar. B. Application Scenarios Tagcaster enables a spontaneous setup of a radio broadcast service for vehicle-mounted radio receivers. Such a service is useful in a wide range of application scenarios. We provide a few examples. (1) Charging notification. This scenario is a fundamental service of ETC systems for drivers, who should be precisely informed of how they are charged when passing through an ETC tollbooth. The traditional means is to watch an LED indicator installed at the tollbooth. With Tagcaster, drivers are informed by listening to the radio. (2) Overspeed warning. An increasing number of states or regions have begun adopting an average speed (i.e., total distance traveled divided by the time interval) for overspeeding surveillance. ETC systems deployed at adjacent critical junctions can now warn drivers of potential violences of local traffic regulations. (3) Road traffic broadcast. Drivers can listen to special traffic news and the latest traffic conditions around the ETC station. C. Comparison against Alternatives • Why not install an AM station at the tollbooth? ETC service is private for each driver but AM station is designed for large-scale public radio service. The radio signal can be received kilometres away. Installing an AM station to each tollbooth for ETC broadcasting will leak user’s privacy and disturb the surrounding radio. Instead, RFID is a short-range communication and many existing RFID systems with beamforming technology [6]–[8] or directional antenna can provide desired directional communication. Therefore, an RFID system can only cover the desired area (ETC lane) so that to protect user’s privacy. • Why not use Bluetooth or Wi-Fi? Cars equipped with Bluetooth chip have their Bluetooth antennas inside to communicate with smart devices or wearables [9]. An antenna inside a car can be shielded from signals from an ETC station by the car’s metal body. By contrast, radio antennas are already outside the car where FM or AM signals are the strongest. Finally, we stress that the primary merit of Tagcaster is that it does not require the firmware or physical layer of ETC transceivers to be modified. Therefore, Tagcaster can fully co-exist with the given alternatives for complementarity even when they are already deployed in several stations. III. TAGCASTER DESIGN In this section, we first exploit the nonlinearity effect and zeroth downconversion in radio receivers and describe how Tagcaster can utilize the zeroth downconversion for its design. PreAMP Mixer Local Oscillator IF AMP IF Filter AM/FM Detector AM/FM Radio Reciver Antenna Automatic Gain Control 1st downconversion 2nd downconversion 0th downconversion Fig. 2: Internal structure of an AM Radio receiver. Input radio signals are processed through three downconversions where the zeroth downconversion is explicitly performed by the amplifier. A. Exploiting the Nonlinearity Effect Primer on AM Radio. All AM radio systems work from 520 to 1700 kHz without a license from FCC. Radio receivers usually adopt the superheterodyne design, as displayed in Fig. 2. The RF signal (@ fr) is amplified by the pre-amplifier to improve the signal-to-noise ratio (SNR). Then, the amplified RF signal enters a superheterodyne mixer along with the output of the local oscillator, which is tuned to a frequency (@ f ′ r ) that is higher or lower than the intended reception frequency. As a result, the mixer output includes two signals, that operate at fr + f ′ r and fr − f ′ r . The sum signal at fr + f ′ r is immediately filtered out by the following IF filter. This difference can always be at a fixed value of the frequency offset and is called the intermediate frequency (IF). This stage is called the first downconversion or superheterodyning. Superheterodyning exhibits good performance because radio components can be optimized to work at a single intermediate frequency. The desired baseband signal is then extracted by the detector (e.g., an envelope detector of Foster-Seeley discriminator), which performs the second downconversion by tuning the center frequency to the expected. The downconverted audio are transmitted to the speaker. Nonlinearity Effect. In RF system, circuits are designed to work linearly. If an RF amplifier receives an input signal S, then output signal, denoted by Sout, is given as Sout = AS (1) where A is the amplification factor. The amplifier is supposed to scale the signal magnitude and introduce a constant phase distortion. Unfortunately, the non-linearity effect of the ampli- fier can generate many harmonics. Consequently, the practical output signal is given by: Sout = X∞ k=1 AkS k = Linear z }| { A1S + Nonlinear z }| { A2S 2 + A3S 3 + · · · (2) where Ak are the gains of the various harmonics introduced by the circuit. These components are called fundamental, secondorder, third-order and so on. The third-order and higher-order harmonics attenuate fast and become undetectable. Therefore, our focus is on the first- and second-order terms only. If the input signal S is a superimposition of two sine waves with different frequencies f1 and f2, that is, S(t) = sin(2πf1t) + sin(2πf2t), where t is time, then the equation can be expanded
nd d Fig.3:Illustration of Tagcaster design.At the reader side,the audio data are modulated onto two carriers:the real reader carrier at f and the shadow carrier at fe+fr.After receiving the RF signal,the receiver pulls down the signal by the zeroth,the first,and the second downconversion in turn.The zeroth downconversion is conducted due to the nonlinearity of the pre-amplifier. using a trigonometric formula as follows: fe+fr the shadow carrier.The left part of Fig.3 illustrates Sou =S(t)+S2(t) an example where fr =550 kHz and fe 920 MHz.The audio data are modulated onto the 920 MHz original carrier =sin(2 fit)+sin(2 f2t)+(sin(2f1t)+sin(2 f2t))2 (3) and 920.55 MHz shadow carrier.Formally,v(t)denotes the =sin(2mfh)+sin(2mf20+（《2-cos(2m2fht0- audio signal,which is a low-frequency signal below 20 kHz. cos(2π2f2t)-cos(2π(f1+f2)t)+cos(2r(f万-f2)t)) Then,the output upconverted RF signal from the reader is Four new frequencies (i.e.,2f1,2f2,f1+f2 and f1-f2) given as are created after the first-stage magnification.Translating into S+(t)=v(t)(cos(2πfet)+cos(2π(fe+fr)t) (5) actual numbers,when f =920 MHz and f2 =920.7 MHz,the amplified signals appear at 920 MHz,920.7 MHz, One might wonder why a single-tone signal is not generated at 2×920=1840.7MHz,2×920.7=1841.4MHz, the shadow carrier for the downconversion only.The hardware 920+920.7=1840.7MHz,and(920.7-920)MHz=700 limits the current commercial ETC reader to work at a single kHz.The first five frequencies are filtered out by the IF filter. channel for each reading.Further details are discussed in V. However,700 kHz remains.The net effect is that the UHF Downconversion at the receiver.After receiving the mixed signal appears at a low frequency of 700 kHz,which radio signal transmitted from the ETC reader,the pre-amplifier in receivers can process.The nonlinearity effect was considered a the radio receiver automatically performs the zeroth downcon- type of "pollution"in previous work.Nevertheless,we explore version.Substituting the given signal into Eqn.4,a new signal this underlying physical property as an opportunity to achieve is produced as follows. cross-technology communication between ETC system and AM radio receivers.Since difference frequency is our interest, s国=20cos2UK+r-A0=2国cos(2fr)o this item is extracted from Eqn.3 and expressed as follows: S(t)is the result of the zeroth downconversion.It operates at 1 the radio frequency f.which the receiver can process.That S,(因=2os(2m(h-2)0 (4) is,the zeroth downconversion can pull the mixed signal at where S(t)is the downconverted signal due to the nonlinear- fe and fe+fr down to radio frequency fr.The right side ity effect. of Fig.3 presents the entire workflow at the receiver.S(t) can be further downconverted twice by the mixer and the B.Activating the Zeroth Downconversion decoder to extract v2(t).which is finally played by the speaker. Notably,the side effect of our design is that the audio signal The previous discussion inspires us to leverage nonlinearity is distorted due to the squaring,i.e.,v2(t).We can eliminate to pull down UHF signals to the radio band.Specifically,Tag- this distortion by taking a square root of the raw audio signal caster enables an ETC reader to transmit at two carriers,whose (i.e.,Vu(t))before it is modulated onto the carriers,such that frequencies are denoted by fi and f2.When the two signals the downconverted signal S(t)=(vv(t))2 cos(2frt)= pass through the pre-amplifier simultaneously,a low-frequency v(t)cos(2πfrt). signal appears at fi-f2 in the amplifier.This process is equivalent to conducting an additional downconversion before IV.ENGINEERING TAGCASTER the first and the second downconversions at the mixer and detector.To distinguish them,we refer to the downconversion The core of Tagcaster is the engineering of dual-carrier caused by the nonlinearity effect at the pre-amplifier as the upconversion at the ETC reader (i.e.,modulating the audio zeroth downconversion.Fig.2 shows their stages and process data onto two carriers)because only such an upconversion order.The next discussion is about the leveraging of the zeroth can activate the zeroth downconversion at the radio receiver downconversion for Tagcaster's radio service. However,achieving this task is challenging because Tagcaster Upconversion at the reader side.Suppose that an ETC is required to be a transparent service.The only way to change reader and a radio receiver work at frequencies of fe and fr.the behaviors of ETC readers is to feed data in the application respectively.To activate the zeroth downconversion,our ETC layer in accordance with corresponding standards.Given such reader modulates the audio data onto two carries at fr and a strict constraint,two engineering challenges are discussed in fe+fr simultaneously.For clarity,we call the new carrier at this section
0 Hz 20 kHz 919.11 MHz 920 MHz 920.55 MHz Upconversion ETC Channel Audio data ETC Reader @ 920MHz / Upconversion 919.11 MHz 920 MHz 920.55 MHz 920.89 MHz zeroth downconversion (Non-linearity) ETC Channel 550 kHz 0 Hz 20 Hz 1st down-conversion (Mixer) Radio Receiver @ 550kHz / Downconversion fe fe + fr fe fe + fr fr 920.89 MHz 100 Hz 2nd down-conversion (Decoder) RF signal in Air Shadow carrier ETC carrier Fig. 3: Illustration of Tagcaster design. At the reader side, the audio data are modulated onto two carriers: the real reader carrier at fe and the shadow carrier at fe + fr. After receiving the RF signal, the receiver pulls down the signal by the zeroth, the first, and the second downconversion in turn. The zeroth downconversion is conducted due to the nonlinearity of the pre-amplifier. using a trigonometric formula as follows: Sout =S(t) + S 2 (t) = sin(2πf1t) + sin(2πf2t) + (sin(2πf1t) + sin(2πf2t))2 = sin(2πf1t) + sin(2πf2t) + 1 2 ((2 − cos(2π2f1t)− cos(2π2f2t) − cos(2π(f1 + f2)t) + cos(2π(f1 − f2)t)) (3) Four new frequencies (i.e., 2f1, 2f2, f1 + f2 and f1 − f2) are created after the first-stage magnification. Translating into actual numbers, when f1 = 920 MHz and f2 = 920.7 MHz, the amplified signals appear at 920 MHz, 920.7 MHz, 2 × 920 = 1840.7 MHz, 2 × 920.7 = 1841.4 MHz, 920 + 920.7 = 1840.7 MHz, and (920.7 − 920) MHz = 700 kHz. The first five frequencies are filtered out by the IF filter. However, 700 kHz remains. The net effect is that the UHF signal appears at a low frequency of 700 kHz, which radio receivers can process. The nonlinearity effect was considered a type of “pollution” in previous work. Nevertheless, we explore this underlying physical property as an opportunity to achieve cross-technology communication between ETC system and AM radio receivers. Since difference frequency is our interest, this item is extracted from Eqn. 3 and expressed as follows: S↓(t) = 1 2 cos(2π(f1 − f2)t) (4) where S↓(t) is the downconverted signal due to the nonlinearity effect. B. Activating the Zeroth Downconversion The previous discussion inspires us to leverage nonlinearity to pull down UHF signals to the radio band. Specifically, Tagcaster enables an ETC reader to transmit at two carriers, whose frequencies are denoted by f1 and f2. When the two signals pass through the pre-amplifier simultaneously, a low-frequency signal appears at |f1 − f2| in the amplifier. This process is equivalent to conducting an additional downconversion before the first and the second downconversions at the mixer and detector. To distinguish them, we refer to the downconversion caused by the nonlinearity effect at the pre-amplifier as the zeroth downconversion. Fig. 2 shows their stages and process order. The next discussion is about the leveraging of the zeroth downconversion for Tagcaster’s radio service. Upconversion at the reader side. Suppose that an ETC reader and a radio receiver work at frequencies of fe and fr, respectively. To activate the zeroth downconversion, our ETC reader modulates the audio data onto two carries at fr and fe + fr simultaneously. For clarity, we call the new carrier at fe + fr the shadow carrier. The left part of Fig. 3 illustrates an example where fr = 550 kHz and fe = 920 MHz. The audio data are modulated onto the 920 MHz original carrier and 920.55 MHz shadow carrier. Formally, v(t) denotes the audio signal, which is a low-frequency signal below 20 kHz. Then, the output upconverted RF signal from the reader is given as S↑(t) = v(t)(cos(2πfet) + cos(2π(fe + fr)t)) (5) One might wonder why a single-tone signal is not generated at the shadow carrier for the downconversion only. The hardware limits the current commercial ETC reader to work at a single channel for each reading. Further details are discussed in §V. Downconversion at the receiver. After receiving the mixed signal transmitted from the ETC reader, the pre-amplifier in the radio receiver automatically performs the zeroth downconversion. Substituting the given signal into Eqn. 4, a new signal is produced as follows. S↓(t) = 1 2 v 2 (t) cos(2π(!fe + fr −!fe)t) = 1 2 v 2 (t) cos(2πfrt) (6) S↓(t) is the result of the zeroth downconversion. It operates at the radio frequency fr, which the receiver can process. That is, the zeroth downconversion can pull the mixed signal at fe and fe + fr down to radio frequency fr. The right side of Fig. 3 presents the entire workflow at the receiver. S↓(t) can be further downconverted twice by the mixer and the decoder to extract v 2 (t), which is finally played by the speaker. Notably, the side effect of our design is that the audio signal is distorted due to the squaring, i.e., v 2 (t). We can eliminate this distortion by taking a square root of the raw audio signal (i.e., p v(t)) before it is modulated onto the carriers, such that the downconverted signal S↓(t) = 1 2 ( p v(t))2 cos(2πfrt) = 1 2 v(t) cos(2πfrt). IV. ENGINEERING TAGCASTER The core of Tagcaster is the engineering of dual-carrier upconversion at the ETC reader (i.e., modulating the audio data onto two carriers) because only such an upconversion can activate the zeroth downconversion at the radio receiver. However, achieving this task is challenging because Tagcaster is required to be a transparent service. The only way to change the behaviors of ETC readers is to feed data in the application layer in accordance with corresponding standards. Given such a strict constraint, two engineering challenges are discussed in this section
PIE Tari 0.5Tan <X<Tan 00000 F signal at± 00000 bit zero 10!00!010 bit one w RF Signal (a)The schematic of reader transmitter (b)Pulse-Interval Encoding (PIE) (c)Amplitude Modulation (AM) Fig.4:The RFID transmission.(a)The incoming bitstream from computer is firstly encoded through the PIE.Then The PIE-coded baseband signal is moved to the ultra-high frequency (e.g.,820 MHz)by multiplying the carrier generated from the local oscillator.Finally, RF signal is propagated into the air through the antenna;(b)shows the adjustable parameters of PIE used in RFID;(c)shows the amplitude modulation where the reader is transmitting a continuous stream of zero bits. Generating the Shadow Carrier.The shadow carrier is Tagcaster's radio band used to pull RF signals from UHF down to the radio frequency at radio receivers.The first challenge is how to generate an undefined shadow carrier by complying with 200 kHz ETC regulations. kHz 160kH 500 kHz 800 kHz 1700 kHz Modulating the Audio Signal.An AM radio conveys the 5f (the sth-order) the analog audio data by changing the amplitude of the Fig.5:Spectrum comparison.The fundamental frequency of the carrier,whereas the reader baseband only accepts the digital baseband signal fo in the ETC reader is from 40 to 160 kHz bitstream from the upper layer.The second challenge is how Correspondingly,its fifth order harmonic 5f varies from 200~800 to carry the analog data through a digital wireless system. kHz.A commercial AM radio works from 500 to 1700 kHz.The overlapping spectrum from 500 to 800 kHz is the band at which A.Primer on RFID Transmission Tagcaster's radio operates. To explain Tagcaster,how an ETC reader works must first be introduced.Readers are required to generate high- FCC 15.247 authorizes RFID readers to operate in the ISM power CW,which persistently supplies energy to passive band from 902-928 MHz with 52 channels.each of which transponders in the field.Two data links are involved.The first has a maximum bandwidth of 500 kHz. link is data transmission from readers to tags,called downlink B.Generating the Shadow Carrier transmission.The second link is the opposite,which is called uplink transmission.Given that Tagcaster broadcasts audio in The shadow carrier is the key for activating the receiver's a single way,we only introduce the downlink here.Fig.4(a) zeroth downconversion.We must generate the shadow carrier illustrates a schematic of a reader transmitter that contains in accordance with RFID regulations. four main components:PIE encoder,local oscillator,mixer, 1)Rationale behind the Shadow Carrier:Modulation and antenna.The entire workflow is sketched. translates the entire spectrum of a baseband signal to a high Baseband Encoding.A reader encodes the data (e.g.. band centering at the carrier frequency.Formally,Se(t)= commands)coming from the host using PlE in baseband. cos(2mfet)denotes the carrier.If the baseband signal is a Fig.4(b)illustrates the coding scheme.PIE coding uses simple sinusoidal signal denoted by S(t)=Adc+cos(27fot), different durations to represent bit zero and bit one.Bit zero then the modulated signal propagated into the air is given by has the duration of a single Tari,whereas that of bit one Sair =S(t)Se(t)=(Adc +cos(2nfut))cos(2nfet) equals to Tari+x.Tari is the unit duration for the signaling reference.It can be set as from 6.25 to 25us.The duration of -Aaco(2J)+cos(2f+) (7) bit one is always X-us longer than that of bit zero and must be between 1.5 and 2 Tari.Both bits start with a high voltage +2os(2x(.-f) and end with a low voltage.The durations of low voltage for where Adc is the direct constant.The equation implies that the two bits are the same and equal to the pulse width (PW). the output signal in the air appears at fe and fe+fo.Inspired Tari,PW and X can be set by users to suit their scenarios. by this fundamental,we can generate a shadow carrier by Modulation.The PIE-coded baseband signal is then multi- inputting a well-designed baseband signal.Specifically,if we plied by the UHF carrier generated from a local oscillator to transmit a continuous stream of constant zeros,then the PlE- produce the output RF signal.Fig.4(c)shows this procedure.coded baseband signal of the reader becomes a square signal Given that the multiplication only changes the amplitude of with the fundamental frequency offo=1/Tari.The duration the carrier to carry the baseband signal,it is called as AM.In of the bit zero that is equal to Tari and PW is set to Tari/2 terms of carrier frequency,the ISO/IEC 18000-6 standard only (see Fig.4(b)).Therefore,readers are effectively"framed"to specifies a broad spectrum (i.e.,820-920 MHz)and allows transmit continuous signals at fe (i.e..direct constant)and local agencies to regulate the channel division.For example,fe+f(upconversion)
Reader Transmitter Local Oscillator PIE Encoder Baseband Binary data Antenna RF Signal 00000 Computer Mixer Low Level Reader Protocol (LLRP) 920 MHz 0 0 0 0 0 0 0 0 0 0 (a) The schematic of reader transmitter Tari 0.5Tari <X < Tari PW PW bit zero bit one PIE (b) Pulse-Interval Encoding (PIE) 0 0 0 0 0 0 0 0 0 0 Baseband signal at Carrier signal at RF signal at fb fe AM fe ± fb (c) Amplitude Modulation (AM) Fig. 4: The RFID transmission. (a) The incoming bitstream from computer is firstly encoded through the PIE. Then The PIE-coded baseband signal is moved to the ultra-high frequency (e.g., 820 MHz) by multiplying the carrier generated from the local oscillator. Finally, RF signal is propagated into the air through the antenna; (b) shows the adjustable parameters of PIE used in RFID; (c) shows the amplitude modulation where the reader is transmitting a continuous stream of zero bits. • Generating the Shadow Carrier. The shadow carrier is used to pull RF signals from UHF down to the radio frequency at radio receivers. The first challenge is how to generate an undefined shadow carrier by complying with ETC regulations. • Modulating the Audio Signal. An AM radio conveys the the analog audio data by changing the amplitude of the carrier, whereas the reader baseband only accepts the digital bitstream from the upper layer. The second challenge is how to carry the analog data through a digital wireless system. A. Primer on RFID Transmission To explain Tagcaster, how an ETC reader works must first be introduced. Readers are required to generate highpower CW, which persistently supplies energy to passive transponders in the field. Two data links are involved. The first link is data transmission from readers to tags, called downlink transmission. The second link is the opposite, which is called uplink transmission. Given that Tagcaster broadcasts audio in a single way, we only introduce the downlink here. Fig. 4(a) illustrates a schematic of a reader transmitter that contains four main components: PIE encoder, local oscillator, mixer, and antenna. The entire workflow is sketched. Baseband Encoding. A reader encodes the data (e.g., commands) coming from the host using PIE in baseband. Fig. 4(b) illustrates the coding scheme. PIE coding uses different durations to represent bit zero and bit one. Bit zero has the duration of a single Tari, whereas that of bit one equals to Tari+X. Tari is the unit duration for the signaling reference. It can be set as from 6.25 to 25µs. The duration of bit one is always X-us longer than that of bit zero and must be between 1.5 and 2 Tari. Both bits start with a high voltage and end with a low voltage. The durations of low voltage for the two bits are the same and equal to the pulse width (PW). Tari, PW and X can be set by users to suit their scenarios. Modulation. The PIE-coded baseband signal is then multiplied by the UHF carrier generated from a local oscillator to produce the output RF signal. Fig. 4(c) shows this procedure. Given that the multiplication only changes the amplitude of the carrier to carry the baseband signal, it is called as AM. In terms of carrier frequency, the ISO/IEC 18000-6 standard only specifies a broad spectrum (i.e., 820-920 MHz) and allows local agencies to regulate the channel division. For example, 40 kHz 160 kHz fb 500 kHz fr 800 kHz 200 kHz 5fb (the 5th-order) 1700 kHz Tagcaster’s radio band Fig. 5: Spectrum comparison. The fundamental frequency of the baseband signal fb in the ETC reader is from 40 to 160 kHz. Correspondingly, its fifth order harmonic 5fb varies from 200 ∼ 800 kHz. A commercial AM radio works from 500 to 1700 kHz. The overlapping spectrum from 500 to 800 kHz is the band at which Tagcaster’s radio operates. FCC 15.247 authorizes RFID readers to operate in the ISM band from 902 - 928 MHz with 52 channels, each of which has a maximum bandwidth of 500 kHz. B. Generating the Shadow Carrier The shadow carrier is the key for activating the receiver’s zeroth downconversion. We must generate the shadow carrier in accordance with RFID regulations. 1) Rationale behind the Shadow Carrier: Modulation translates the entire spectrum of a baseband signal to a high band centering at the carrier frequency. Formally, Se(t) = cos(2πfet) denotes the carrier. If the baseband signal is a simple sinusoidal signal denoted by Sb(t) = Adc+cos(2πfbt), then the modulated signal propagated into the air is given by Sair =Sb(t)Se(t) = (Adc + cos(2πfbt)) cos(2πfet) =Adc cos(2πfet) + 1 2 cos(2π(fe + fb)t) + 1 2 cos(2π(fe − fb)t) (7) where Adc is the direct constant. The equation implies that the output signal in the air appears at fe and fe ±fb. Inspired by this fundamental, we can generate a shadow carrier by inputting a well-designed baseband signal. Specifically, if we transmit a continuous stream of constant zeros, then the PIEcoded baseband signal of the reader becomes a square signal with the fundamental frequency of fb = 1/Tari. The duration of the bit zero that is equal to Tari and PW is set to Tari/2 (see Fig. 4(b)). Therefore, readers are effectively “framed” to transmit continuous signals at fe (i.e., direct constant) and fe + fb (upconversion)
By changing the value of Tari,the fundamental frequency NAK NAK 。。 NAK of the square signal at the baseband can be varied within 40~160 kHz (i.e.,f E [40,160]kHz).However,we desire a frequency shift of fr E 5001700 kHz (i.e.,AM radio Preamable CMD Code 11000000 frequency).Even the upper limit of fo(i.e.,160 kHz)cannot reach the lower limit of fr(i.e..500 kHz)because FCC Fig.6:Whitening the baseband of the ETC reader.The reader is regulation only allocates 500 kHz bandwidth to RFID reader forced to keep transmitting NAK command,which contains an eight- bit constant code with six zeros. for each channel (see Fig.5). The time consumed for one NAK transmission is given as The fundamental of signal processing indicates that the square wave is composed of infinite sinusoidal harmonics. (3+2×1.5+6)×Tari=12×Tari (11) Thus,S(t)can be expanded as follows by using the Fourier where 3 Taris are for the preamble,1.5 Taris are for the series. two ones (i.e..X=0.5 x Tari),and 6 Taris are for the Sb(t)=A山+ sin(2 xnfit)】 six zeros.NAK command is selected for us in two reasons. 1=1,3,5,.- First,the payload of the command is fixed to the bitstream of (8) 1100000 where 75%of the bits are zeros.Second.NAK is a sin(2πft)+ 3sin(2x3f6t)+ si(2m5ft)+. mandatory command that all commercial readers must support. 3rd-ooder Sch-order In practice,we can command the reader to keep transmitting Instead of a single-tone signal,S is composed of infinite odd NAKs to achieve long-sequences of bit zeros approximately. sinusoidal signals at frequencies of fo,3fb,5f,,which are The transmission of the remaining 25%bit ones almost does called first-order,third-order,fifth-order harmonics,and so on. not affect the broadcast because their presence lasts for a short respectively.By substituting Enq.8 into Eqn.7,the modulated time(a few microseconds)in each cycle.Therefore,the instant signal in the air is updated as follows: pause in voice is hardly noticed by humans. To verify this idea.we uses an ETC reader (refer to SV =As+g∑ 上in(2rnft cos(2xfet) for details)to transmit a sequence of NAKs by setting fr= 500 kHz.Then,we set the parameter of Tari to 10 us (see =Adc cos(2mfet) (9) Egn.10).We also employ USRP to receive the RF signal. +2∑月 Fig.7 illustrates the baseband signal of the received signal 云a.n6in2x+6川+n2xe-n in time and frequency domains.As desired,the signal spikes Eqn.9 indicates that the output RF signal actually appears at exactly at 100 kHz (i.e.,first order),300 kHz(third order). fe,fe±fb,fe±3f,fe±5fb,·.Given thatfo∈40 500 kHz (fifth-order),and so on.This results verify that we 160 kHz,the fifth-order harmonic 5f falls into the range of can whiten the reader's baseband using the NAKs. 200~800 kHz.It has 300 kHz overlapping (i.e.,from 500~ 800 kHz)with the allowable AM radio spectrum.To visually understand the spectrum,we illustrate various bands and their relation in Fig.5.Therefore,the frequency of Tagcaster's radio service can be fixed at any frequency between 500 and 800 kHz(highlighted in red).Conversely,if radio frequency frE 500,800 kHz,then we should set the duration of the bit zero at the baseband to. (a)Time domain (b)Frequency domain Tari=1/fo=5/fr (10) Fig.7:Illustration of the shadow carrier.The reader is forced to transmit a long sequence of NAKs.(a)shows the received signal in where fr =5f.For example,if we choose fr=500 kHz, the time domain and (b)shows the spectrum of the signal. then Tari =1/fo =1/100 kHz 10 us. C.Modulating Audio Signal 2)Whitening the Baseband with Zeros:Our basic idea of Both AM radio and ETC reader adopt amplitude modulation generating a shadow carrier is to force the reader to transmit to carry baseband signals.At first glance,Tagcaster can a long sequence of bit zeros.This procedure is called as directly use the modulation component in an RFID reader for baseband whitening.However,commercial ETC readers only the AM modulation.Unfortunately,this naive approach fails accept the predefined commands from hosts.A long sequence to work in practice for two reasons.First,AM radios stations of zeros is unacceptable.About 30 commands defined in and receivers are designed for processing analog audio signals, the ISO18000-6 or EPCglobal Gen2,among which we select but readers can only process digital signals.Specifically,the the NAK command to whiten the baseband.Fig.6 shows envelope of the reader's carrier only has two levels(Fig.7(a)), the structure of this command,which starts with a three-bit whereas an AM radio uses different amplitude levels to unmodified preamble and contains eight-bit command code.represent quantized analog audio data(Fig.8).Second,this
By changing the value of Tari, the fundamental frequency of the square signal at the baseband can be varied within 40 ∼ 160 kHz (i.e., fb ∈ [40, 160] kHz). However, we desire a frequency shift of fr ∈ 500 ∼ 1700 kHz (i.e., AM radio frequency). Even the upper limit of fb (i.e., 160 kHz) cannot reach the lower limit of fr (i.e., 500 kHz) because FCC regulation only allocates 500 kHz bandwidth to RFID reader for each channel (see Fig. 5). The fundamental of signal processing indicates that the square wave is composed of infinite sinusoidal harmonics. Thus, Sb(t) can be expanded as follows by using the Fourier series. Sb(t) = Adc + 4 π X n=1,3,5,... 1 n sin(2πnfbt) = Adc + 4 π sin(2πfbt) | {z } 1st-order + 1 3 sin(2π3fbt) | {z } 3rd-order + 1 5 sin(2π5fbt) | {z } 5th-order + · · · (8) Instead of a single-tone signal, Sb is composed of infinite odd sinusoidal signals at frequencies of fb, 3fb, 5fb, · · · , which are called first-order, third-order, fifth-order harmonics, and so on, respectively. By substituting Enq. 8 into Eqn. 7, the modulated signal in the air is updated as follows: Sair = Adc + 4 π X n=1,3,5,... 1 n sin(2πnfbt) cos(2πfet) =Adc cos(2πfet) + 2 π X n=1,3,5,... 1 n (sin(2π(fe + nfb)t) + sin(2π(fe − nfb)t)) (9) Eqn. 9 indicates that the output RF signal actually appears at fe, fe ± fb, fe ± 3fb, fe ± 5fb, · · · . Given that fb ∈ 40 ∼ 160 kHz, the fifth-order harmonic 5fb falls into the range of 200 ∼ 800 kHz. It has 300 kHz overlapping (i.e., from 500 ∼ 800 kHz) with the allowable AM radio spectrum. To visually understand the spectrum, we illustrate various bands and their relation in Fig. 5. Therefore, the frequency of Tagcaster’s radio service can be fixed at any frequency between 500 and 800 kHz (highlighted in red). Conversely, if radio frequency fr ∈ [500, 800] kHz, then we should set the duration of the bit zero at the baseband to. Tari = 1/fb = 5/fr (10) where fr = 5fb. For example, if we choose fr = 500 kHz, then Tari = 1/fb = 1/100 kHz = 10 µs. 2) Whitening the Baseband with Zeros: Our basic idea of generating a shadow carrier is to force the reader to transmit a long sequence of bit zeros. This procedure is called as baseband whitening. However, commercial ETC readers only accept the predefined commands from hosts. A long sequence of zeros is unacceptable. About 30 commands defined in the ISO18000-6 or EPCglobal Gen2, among which we select the NAK command to whiten the baseband. Fig. 6 shows the structure of this command, which starts with a three-bit unmodified preamble and contains eight-bit command code. NAK NAK NAK Preamable CMD Code 11000000 · · · · · · Fig. 6: Whitening the baseband of the ETC reader. The reader is forced to keep transmitting NAK command, which contains an eightbit constant code with six zeros. The time consumed for one NAK transmission is given as (3 + 2 × 1.5 + 6) × Tari = 12 × Tari (11) where 3 Taris are for the preamble, 1.5 Taris are for the two ones (i.e., X= 0.5 × Tari), and 6 Taris are for the six zeros. NAK command is selected for us in two reasons. First, the payload of the command is fixed to the bitstream of 1100000 where 75% of the bits are zeros. Second, NAK is a mandatory command that all commercial readers must support. In practice, we can command the reader to keep transmitting NAKs to achieve long-sequences of bit zeros approximately. The transmission of the remaining 25% bit ones almost does not affect the broadcast because their presence lasts for a short time (a few microseconds) in each cycle. Therefore, the instant pause in voice is hardly noticed by humans. To verify this idea, we uses an ETC reader (refer to §V for details) to transmit a sequence of NAKs by setting fr = 500 kHz. Then, we set the parameter of Tari to 10 µs (see Eqn. 10). We also employ USRP to receive the RF signal. Fig. 7 illustrates the baseband signal of the received signal in time and frequency domains. As desired, the signal spikes exactly at 100 kHz (i.e., first order), 300 kHz (third order), 500 kHz (fifth-order), and so on. This results verify that we can whiten the reader’s baseband using the NAKs. 200 400 600 800 1000 1200 Time(us) 0 0.2 0.4 0.6 0.8 1 1.2 Amplitude NAK NAK NAK NAK NAK (a) Time domain 0 1 2 3 4 5 6 7 8 9 Frequency (100kHz) -102 -101 Strength(dB) 1st-order 3rd-order 5th-order (b) Frequency domain Fig. 7: Illustration of the shadow carrier. The reader is forced to transmit a long sequence of NAKs. (a) shows the received signal in the time domain and (b) shows the spectrum of the signal. C. Modulating Audio Signal Both AM radio and ETC reader adopt amplitude modulation to carry baseband signals. At first glance, Tagcaster can directly use the modulation component in an RFID reader for the AM modulation. Unfortunately, this naive approach fails to work in practice for two reasons. First, AM radios stations and receivers are designed for processing analog audio signals, but readers can only process digital signals. Specifically, the envelope of the reader’s carrier only has two levels (Fig. 7(a)), whereas an AM radio uses different amplitude levels to represent quantized analog audio data (Fig. 8). Second, this
■Audio siona 0.4 Raw Audic ved Aud 29 7531 02 19 2242526%24232323242522820 0,2928,27,232222,222325,2626,22524232221 -0.4 0.1 0.2 03 0.4 0.5 06 Time(s) Fig.8:Modulation of audio data.Audio data are sampled every 12 Fig.9:Raw audio vs.received audio Taris on the time line and quantized into 16 levels on the amplitude line.Each box corresponds to a sample. so the audio data is actually modulated onto both carriers (fe and fe+fr).This reason explains why we move v(t) approach requires the modification of reader hardware and outside the sum of the two carriers in Egn.5.To validate the firmware,which violats our design principle of transparency. effectiveness of Tagcaster,Fig.9 illustrates a comparison of The essence of amplitude modulation is to carry data by the raw and received audio signals,both of which represent changing the amplitude of the output RF signal.Commercial the sentence "Good morning,Mr.Bob!".The raw audio is RFID readers can dynamically set the transmitting power in generated by a text-to-speech software,while the received a real-time.For example,ImpinJ R2000 [10]has 31 power audio is recorded through a commercial radio receiver. levels that the user can set.This functionality inspires us to modulate audio signal by adjusting the power of the output V.IMPLEMENTATION RF signal directly instead of modulating the multiplication. Tagcaster Reader.We implement the prototype of the ETC In doing so,we can skip the baseband processing to achieve reader for Tagcaster with an USRP-N210 SDR.It is equipped amplitude modulation equivalently.The whole procedure is with an SBX daughterboard.An RF power amplifier [12]is sketched as follows: used to magnify the max transmitting power to 31 dBm.The .[Step 1]Sampling:First,Tagcaster resamples audio data prototype fully supports Gen2 PHY [13].Notably,the USRP every 12 Taris.The sampling period is exactly equal to the emulated reader is used for evaluation purposes to measure duration of a NAK command (see Eqn.11)because NAK is low-level PHY information,such as harmonics and signal the minimum unit before which the transmitting power can be strength,which are inaccessible by commodity devices updated.Correspondingly,the sample rate is equal to 1/(12x Radio Receiver.We test nine commercial radio receivers. Tari)=fr/60 Hz (see Eqn.10).Given that fr =500~800 including (1)five vehicle-mounted receivers (VMRs)at Toyota kHz,the sampling rate is equal to 8.3313.33 kHz.An 8 kHz Sienna.Audi Q7.Audi Q5,Jetta Avant,and Jetta Sedan: sampling rate is regarded as adequate for human speech.For and (2)four general-purpose receivers (GPRs),which are example,the telephone system usually uses 8 kHz ADC [11]. TECSUN ICR-110,Sony ICF-P36 [14].PANDA T-16,and Thus,our sampling rate can fully address the common quality AMHA 010.The main difference among them is sensitivity. demand of radio broadcasting.Fig.8 provides an example VMRs are sensitive to work with low SNR. where each box represents one sampling. AM Radio Channels.Seven radio channels (e.g.,fr)are .[Step 2]Quantization:Second,Tagcaster quantifies listed in Table.I.These channels are not uniformly distributed the amplitude of audio data into 16 levels,namely,four-bit within 500~800 kHz because the sampling rate is 2 MS/s in quantization.Each quantified result corresponds to an output the reader so the adjustable step of Tari is 0.5 us.Moreover. RF power level.A normal audio ADC adopts 8-bit or 16-bit an AM radio receiver allows users to tune the frequency quantization.However,we can only set the RF power to one with a step of 5 kHz.However,only five channels are tested of the 32 predefined levels in the reader.Moreover,we must in our experiments because C5 and C7 are in conflict with ensure that the signal can propagate into air with sufficient commercial AM stations in our city. energy.Only 16 levels(from 15th to 31s)are available for us TABLE I:Radio Channel in Tagcaster (four-bit quantization).In Fig.8,the audio signal is quantified to 16 levels indicated by horizontal gray lines.Our evaluation Channel(#)C1 C2 C3 C4 e5 C6 e7 Tari(us) 9.5 9 8.58 7.576.5 reveals that four-bit quantization is acceptable. f(kHz) 530 555590625665715770 [Step 3]Broadcasting:Finally,Tagcaster broadcasts the audio samples in such way:for each sample,it initiates a VI.EVALUATION power adjustment and a subsequent NAK transmission.In In this section,we evaluate the Tagcaster through series of Fig.8,the green and red boxes indicate the RF power and NAK outdoor experiments. commands,respectively.The time cost for power adjustment is almost negligible because it does not require signal processing A.Communication Performance and is executed quickly (i.e.,<1 us). We begin with a group of benchmark experiments to present In summary,NAK transmission holds the shadow carrier,the performance of the communication from the ETC reader to whereas the power adjustment modulates audio data.The the AM radio receiver in terms of different parameter settings. adjustment affects all RF signals coming out from the reader, The zeroth downconversion only occurs in radio receivers
Power adjustment NAK command Audio signal Transmitting Power (#) 15 19 17 21 23 25 27 29 Time 31 20,22,24,25,26,25,24,23,23,23,24,25,26,28,29,29,29,28,27,23,22,22,22,23,25,26,26,26,25,24,23,22,21 Fig. 8: Modulation of audio data. Audio data are sampled every 12 Taris on the time line and quantized into 16 levels on the amplitude line. Each box corresponds to a sample. approach requires the modification of reader hardware and firmware, which violats our design principle of transparency. The essence of amplitude modulation is to carry data by changing the amplitude of the output RF signal. Commercial RFID readers can dynamically set the transmitting power in a real-time. For example, ImpinJ R2000 [10] has 31 power levels that the user can set. This functionality inspires us to modulate audio signal by adjusting the power of the output RF signal directly instead of modulating the multiplication. In doing so, we can skip the baseband processing to achieve amplitude modulation equivalently. The whole procedure is sketched as follows: • [Step 1] Sampling: First, Tagcaster resamples audio data every 12 Taris. The sampling period is exactly equal to the duration of a NAK command (see Eqn. 11) because NAK is the minimum unit before which the transmitting power can be updated. Correspondingly, the sample rate is equal to 1/(12× Tari) = fr/60 Hz (see Eqn. 10). Given that fr = 500 ∼ 800 kHz, the sampling rate is equal to 8.33 ∼ 13.33 kHz. An 8 kHz sampling rate is regarded as adequate for human speech. For example, the telephone system usually uses 8 kHz ADC [11]. Thus, our sampling rate can fully address the common quality demand of radio broadcasting. Fig. 8 provides an example where each box represents one sampling. • [Step 2] Quantization: Second, Tagcaster quantifies the amplitude of audio data into 16 levels, namely, four-bit quantization. Each quantified result corresponds to an output RF power level. A normal audio ADC adopts 8-bit or 16-bit quantization. However, we can only set the RF power to one of the 32 predefined levels in the reader. Moreover, we must ensure that the signal can propagate into air with sufficient energy. Only 16 levels (from 15th to 31st) are available for us (four-bit quantization). In Fig. 8, the audio signal is quantified to 16 levels indicated by horizontal gray lines. Our evaluation reveals that four-bit quantization is acceptable. • [Step 3] Broadcasting: Finally, Tagcaster broadcasts the audio samples in such way: for each sample, it initiates a power adjustment and a subsequent NAK transmission. In Fig. 8, the green and red boxes indicate the RF power and NAK commands, respectively. The time cost for power adjustment is almost negligible because it does not require signal processing and is executed quickly (i.e., < 1 µs). In summary, NAK transmission holds the shadow carrier, whereas the power adjustment modulates audio data. The adjustment affects all RF signals coming out from the reader, 0 0.1 0.2 0.3 0.4 0.5 0.6 Time (s) -0.4 -0.2 0 0.2 0.4 Amplitude Raw Audio Received Audio Fig. 9: Raw audio vs. received audio so the audio data is actually modulated onto both carriers (fe and fe + fr). This reason explains why we move v(t) outside the sum of the two carriers in Eqn. 5. To validate the effectiveness of Tagcaster, Fig. 9 illustrates a comparison of the raw and received audio signals, both of which represent the sentence “Good morning, Mr. Bob!”. The raw audio is generated by a text-to-speech software, while the received audio is recorded through a commercial radio receiver. V. IMPLEMENTATION Tagcaster Reader. We implement the prototype of the ETC reader for Tagcaster with an USRP-N210 SDR. It is equipped with an SBX daughterboard. An RF power amplifier [12] is used to magnify the max transmitting power to 31 dBm. The prototype fully supports Gen2 PHY [13]. Notably, the USRP emulated reader is used for evaluation purposes to measure low-level PHY information, such as harmonics and signal strength, which are inaccessible by commodity devices. Radio Receiver. We test nine commercial radio receivers, including (1) five vehicle-mounted receivers (VMRs) at Toyota Sienna, Audi Q7, Audi Q5, Jetta Avant, and Jetta Sedan; and (2) four general-purpose receivers (GPRs), which are TECSUN ICR-110, Sony ICF-P36 [14], PANDA T-16, and AMHA 010. The main difference among them is sensitivity. VMRs are sensitive to work with low SNR. AM Radio Channels. Seven radio channels (e.g., fr) are listed in Table. I. These channels are not uniformly distributed within 500 ∼ 800 kHz because the sampling rate is 2 MS/s in the reader so the adjustable step of Tari is 0.5 µs. Moreover, an AM radio receiver allows users to tune the frequency with a step of 5 kHz. However, only five channels are tested in our experiments because C5 and C7 are in conflict with commercial AM stations in our city. TABLE I: Radio Channel in Tagcaster Channel(#) C1 C2 C3 C4 ✟C5 C6 ✟C7 Tari(µs) 9.5 9 8.5 8 7.5 7 6.5 fr(kHz) 530 555 590 625 665 715 770 VI. EVALUATION In this section, we evaluate the Tagcaster through series of outdoor experiments. A. Communication Performance We begin with a group of benchmark experiments to present the performance of the communication from the ETC reader to the AM radio receiver in terms of different parameter settings. The zeroth downconversion only occurs in radio receivers
which are composed of highly integrated circuits.We have no Moreover,the broadcasting should only be received by the direct means to acquire downconverted low-level radio signals target for privacy protection.Thus,a long-range broadcasting from these receivers.Recalling that our ultimate goal is to is unprofitable for Tagcaster.Given these considerations,we provide audio service,we use the audio data played from only present the audio strength in the range of 12 m.The receivers to evaluate the link performance indirectly.The audio results are shown in Fig.11.When the distance increases is recorded by a microphone in the format of WAv with a to 10 m,the strength is approximately 20 dB which is sampling rate of 48 kHz. sufficient to provide a good quality for the audio decoding.In addition,current ETC stations are usually equipped with two General-purpose Recelver (GPR) independent antennas in the heading and leaving directions. 0 60 SONYDESUN-PANDA-AMHA Thus,the real coverage range for good-quality broadcasting is 40 up to about 30 m in practice. 20 B.Audio Performance In this section,we evaluate the quality of the resulting audio Vehicled-mounted Receiver (VMR) signals in terms of PESQ.PESQ is a common metric used Audi Q7 -Audio Q5..Jetta Avant-=Jetta Sedan -Toyota to measure the quality of telephony systems [15].It outputs a 40 perception score between 0 and 5,where a high score indicates 20 good quality.Generally,the audio is good enough to be under- 2 stood when the score is over 1.2.We manipulate the Tagcaster Frequency (kHz) reader to broadcast the PESQ benchmark dataset [16]and Fig.10:In-band frequency response use the official PESQ tool [16]to score the recorded audio 1)Characterizing the In-band Response:We determine data.Given that the PESQ tool only works for the audio data whether the nonlinearity effect works across diverse radio sampled with 16 or 8 kHz,we need to reduce the 48 kHz- receivers or not.In our experiments,we use a reader to recorded audio to 16 kHz.All experiments are conducted in transmit a chirp-based audio signal at 530 kHz for every our campus and in nearby noisy and busy streets(10 m away) single receiver.The chip signal sweeps from 0 to 5.5 kHz. where many vehicles run at every moment. Fig.10 shows the receiving power in the unit of dB at General-purpose Receiver (GPR) the receivers with respect to the two types of receivers.All 109 receivers can output the chirp signals as desired in the entire SONY spectrum,and the tendency is similar regardless of the types. 0 This finding fully validates that the nonlinearity-enabled zeroth AHAM downconversion is a general physical characteristic of radio 25 Vehicle-mounted Receiver (VMR) receivers.The average strength of GPRs is approximately 40 dB.whereas that of VMRs is around 30 dB.Therefore.GPRs Toyota etta Avan performs better than VMRs.The additional 10 dB attenuation Jetta Sedan at VMRs is mainly caused by the car's metal body instead of -Audi Q7 -Audi Q5 the receiver's hardware. 1.4 1.6 1.8 2 2.2 24 26 80 Fig.12:Audio quality in diverse receivers Toyota letta Avant 1)Audio Quality in Diverse Receivers:First,we evaluate audio quality with respect to different receivers.Fig.12 0 displays quality comparisons for GPRs and VMRs.At a high level,the audio quality received by GPRs is better than that received by VMRs,because the radio signal is acquired by GPRs in a free space without the influence of the metal body. Distance (m) In addition,GPRs are analog systems that maintain higher Fig.11:Impact of distance fidelity qualification than digital VMRs.Particularly,the mean 2)Characterizing the Broadcasting Range:We also eval- scores of Audi Q7 and Q5 are 1.6 and 1.5,respectively, uate audio strength as a function of the distance between the whereas those of Jetta Avant and Sedan are 1.59 and 1.40, radio receiver and ETC reader.We notice that the reading respectively.Usually,high-end vehicles are equipped with range of an ETC reader for transponders is controlled under better audio systems. 10 m to ensure that a single vehicle closest to the station 2)Audio Quality in Different Channels:Second,we eval- is identified.Tagcaster aims to broadcast related information uate the audio quality in different channels.The results are about the vehicle.Thus,the broadcasting should be initiated presented in Fig.13.The average PESQ value of five channels exactly after when the vehicle is identified by the ETC system is around 2,which is good enough for broadcasting service. (i.e.,when its distance to the reader is less than 10 m). The worst cases occur in the channels of 590 and 625 kHz
which are composed of highly integrated circuits. We have no direct means to acquire downconverted low-level radio signals from these receivers. Recalling that our ultimate goal is to provide audio service, we use the audio data played from receivers to evaluate the link performance indirectly. The audio is recorded by a microphone in the format of WAV with a sampling rate of 48 kHz. 1 2 3 4 5 0 20 40 60 80 Strength(dB) General-purpose Receiver (GPR) SONY DESUN PANDA AMHA 0 1 2 3 4 5 5.5 Frequency (kHz) 0 20 40 60 80 Strength(dB) Vehicled-mounted Receiver (VMR) Audi Q7 Audio Q5 Jetta Avant Jetta Sedan Toyota Fig. 10: In-band frequency response 1) Characterizing the In-band Response: We determine whether the nonlinearity effect works across diverse radio receivers or not. In our experiments, we use a reader to transmit a chirp-based audio signal at 530 kHz for every single receiver. The chip signal sweeps from 0 to 5.5 kHz. Fig. 10 shows the receiving power in the unit of dB at the receivers with respect to the two types of receivers. All receivers can output the chirp signals as desired in the entire spectrum, and the tendency is similar regardless of the types. This finding fully validates that the nonlinearity-enabled zeroth downconversion is a general physical characteristic of radio receivers. The average strength of GPRs is approximately 40 dB, whereas that of VMRs is around 30 dB. Therefore, GPRs performs better than VMRs. The additional 10 dB attenuation at VMRs is mainly caused by the car’s metal body instead of the receiver’s hardware. 1 2 3 4 5 6 7 8 9 10 11 12 Distance (m) 0 20 40 60 80 Strength (dB) Toyota Jetta Avant Audio Q7 SONY AHAM Fig. 11: Impact of distance 2) Characterizing the Broadcasting Range: We also evaluate audio strength as a function of the distance between the radio receiver and ETC reader. We notice that the reading range of an ETC reader for transponders is controlled under 10 m to ensure that a single vehicle closest to the station is identified. Tagcaster aims to broadcast related information about the vehicle. Thus, the broadcasting should be initiated exactly after when the vehicle is identified by the ETC system (i.e., when its distance to the reader is less than 10 m). Moreover, the broadcasting should only be received by the target for privacy protection. Thus, a long-range broadcasting is unprofitable for Tagcaster. Given these considerations, we only present the audio strength in the range of 12 m. The results are shown in Fig. 11. When the distance increases to 10 m, the strength is approximately 20 dB which is sufficient to provide a good quality for the audio decoding. In addition, current ETC stations are usually equipped with two independent antennas in the heading and leaving directions. Thus, the real coverage range for good-quality broadcasting is up to about 30 m in practice. B. Audio Performance In this section, we evaluate the quality of the resulting audio signals in terms of PESQ. PESQ is a common metric used to measure the quality of telephony systems [15]. It outputs a perception score between 0 and 5, where a high score indicates good quality. Generally, the audio is good enough to be understood when the score is over 1.2. We manipulate the Tagcaster reader to broadcast the PESQ benchmark dataset [16] and use the official PESQ tool [16] to score the recorded audio data. Given that the PESQ tool only works for the audio data sampled with 16 or 8 kHz, we need to reduce the 48 kHzrecorded audio to 16 kHz. All experiments are conducted in our campus and in nearby noisy and busy streets (10 m away) where many vehicles run at every moment. 1 1.5 2 2.5 3 10-2 100 CDF General-purpose Receiver (GPR) TECSUN SONY PANDA AHAM 1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 10-2 10-1 100 CDF Vehicle-mounted Receiver (VMR) Toyota Jetta Avant Jetta Sedan Audi Q7 Audi Q5 Fig. 12: Audio quality in diverse receivers 1) Audio Quality in Diverse Receivers: First, we evaluate audio quality with respect to different receivers. Fig. 12 displays quality comparisons for GPRs and VMRs. At a high level, the audio quality received by GPRs is better than that received by VMRs, because the radio signal is acquired by GPRs in a free space without the influence of the metal body. In addition, GPRs are analog systems that maintain higher fidelity qualification than digital VMRs. Particularly, the mean scores of Audi Q7 and Q5 are 1.6 and 1.5, respectively, whereas those of Jetta Avant and Sedan are 1.59 and 1.40, respectively. Usually, high-end vehicles are equipped with better audio systems. 2) Audio Quality in Different Channels: Second, we evaluate the audio quality in different channels. The results are presented in Fig. 13. The average PESQ value of five channels is around 2, which is good enough for broadcasting service. The worst cases occur in the channels of 590 and 625 kHz
22 our service with a score of 4+whereas only 30%have given scores to existing ETCs. VII.RELATED WORK 1.6 We review related work in three fields. (1)Nonlinearity effect.Although the study and exploitation 530Khz 555Khz 590Khz 625Khz 715Khz of the utilization of nonlinearity in diode based devices are Channel not new,the harmonics in the RFID system have only elicited Fig.13:Audio quality in different channels attention in recent years.The harmonic phenomenon in RFIDs was reported in [17]-[23].which focused on eliminating the where the lowest scores are equal to 1.4.A commercial negative impact of RF amplifier nonlinearity [24].The work AM radio operates at 665 kHz in our city,and its leakage of [25]characterized the harmonic signals in UHF RFID via may interfere with these two channels.However,we can still extensive experiments.The study of [26]used harmonics to understand the audio marked with a score of 1.4 even in a achieve multi-frequency continuous wave ranging and further noisy situation. localize tags in 3D space.The work also explored harmonics as a secondary communication channel [18].Deepak et al.[27] introduced a new backscatter device for deep issue detection 88 through the nonlinearity effect.However,unlike previous work that focused on tag's uplink communication,our work is the first to bridge the communication from ETC readers to AM radio receivers. 50 40 -30-20-100102030 50 (2)Cross-technology communication (CTC).Many re- Speed(km/h) cent studies on CTC introduced deep cooperation between Fig.14:Impact of driving speed heterogeneous wireless devices.Most of them focused on the technologies in the same ISM band,such as Wi-Fi and Zig- 3)Audio Quality at Different Driving Speeds:We also bee [28]-[32].Specifically,WeBee [32]introduced a physical- evaluate audio quality by considering the impact of driving level emulation technique to provide a high-throughput con- speed.The Doppler effect can be an issue for UHF carriers,as nection.The work of [33]utilized the harmonic backscatter indicated in SIII.Fig.14 illustates audio quality as a function technique to connect the UHF RFID and Wi-Fi.This work of driving speed.In the figure,the positive and negative speeds suggested a new type of CTC,that has never been used before. indicate that the vehicle is heading to and leaving from the (3)Backscatter and RFID.Similar to RFID tags,backscat- ETC station,respectively.The audio quality fluctuates only ters are battery-free devices that modulate data by reflecting within the score of +0.2 compared with the stationary case the source signals.Dozens of backscatters have been proposed where the speed is zero.When the vehicle is driving at 50 in the past years [9].[34]-[39].Our work is inspired by km/h,the 920 MHz carrier shifts to 42.6 Hz,but the radio the FM backscatter [9],which reflects FM radio signals for receiver only detects a 0.01 Hz shift. broadcasting.Previous studies embedded the RFID reader into a bulb to make it easily deployable indoors [40].ETC 12 transponders have been used to localize and count vehicles for building smart cities [2].By contrast,our work aims 08 to enhance RFID application in outdoor ETC service with 0.6 powerful human to machine interaction. 0.4 0.2 VIII.CONCLUSION 0 This work presents Tagcaster,a system that enables com- Local AM Our AM Local ETC Our ETC mercial UHF ETC systems to provide additional broadcasting Fig.15:User feedback on Tagcaster service service with only a software update.Tagcaster is the first C.Human Experience system to offer down-converting cross-technology commu- nication.Our extensive experiments indicate that Tagcaster We finally investigate the user experience of Tagcaster. can provide good-quality radio service with only a software We invite 20 drivers to experience Tagcaster service and updated ETC reader. ask them to rate the service.The rating score is from 0 to 5,where 5 is excellent.Fig.15 illustrates a comparison of ACKNOWLEDGMENTS AM radio and ETC service.The subjective opinions of the The research is supported by NSFC General Program(NO 20 drivers are strongly positive.They appreciate the in-time 61972331),NSFC General Program (NO.61902331)and wireless voice notification of charging fee using the AM radio, NSFC Key Program (NO.61932017).The research of Lei which is described as"extremely convenient and interesting". Xie is supported by National Natural Science Foundation of Specifically,approximately 60%of the volunteers have rated China (N0.61872174,61832008)
530Khz 555Khz 590Khz 625Khz 715Khz Channel 1.4 1.6 1.8 2 2.2 PESQ Fig. 13: Audio quality in different channels where the lowest scores are equal to 1.4. A commercial AM radio operates at 665 kHz in our city, and its leakage may interfere with these two channels. However, we can still understand the audio marked with a score of 1.4 even in a noisy situation. -50 -40 -30 -20 -10 0 10 20 30 40 50 Speed(km/h) 1.6 1.8 2 PESQ Fig. 14: Impact of driving speed 3) Audio Quality at Different Driving Speeds: We also evaluate audio quality by considering the impact of driving speed. The Doppler effect can be an issue for UHF carriers, as indicated in §III. Fig. 14 illustates audio quality as a function of driving speed. In the figure, the positive and negative speeds indicate that the vehicle is heading to and leaving from the ETC station, respectively. The audio quality fluctuates only within the score of ±0.2 compared with the stationary case where the speed is zero. When the vehicle is driving at 50 km/h, the 920 MHz carrier shifts to 42.6 Hz, but the radio receiver only detects a 0.01 Hz shift. Local AM Our AM Local ETC Our ETC 0 0.2 0.4 0.6 0.8 1 1.2 Score 1 2 3 4 5 Fig. 15: User feedback on Tagcaster service C. Human Experience We finally investigate the user experience of Tagcaster. We invite 20 drivers to experience Tagcaster service and ask them to rate the service. The rating score is from 0 to 5, where 5 is excellent. Fig. 15 illustrates a comparison of AM radio and ETC service. The subjective opinions of the 20 drivers are strongly positive. They appreciate the in-time wireless voice notification of charging fee using the AM radio, which is described as “extremely convenient and interesting”. Specifically, approximately 60% of the volunteers have rated our service with a score of 4+ whereas only 30% have given scores to existing ETCs. VII. RELATED WORK We review related work in three fields. (1) Nonlinearity effect. Although the study and exploitation of the utilization of nonlinearity in diode based devices are not new, the harmonics in the RFID system have only elicited attention in recent years. The harmonic phenomenon in RFIDs was reported in [17]–[23], which focused on eliminating the negative impact of RF amplifier nonlinearity [24]. The work of [25] characterized the harmonic signals in UHF RFID via extensive experiments. The study of [26] used harmonics to achieve multi-frequency continuous wave ranging and further localize tags in 3D space. The work also explored harmonics as a secondary communication channel [18]. Deepak et al. [27] introduced a new backscatter device for deep issue detection through the nonlinearity effect. However, unlike previous work that focused on tag’s uplink communication, our work is the first to bridge the communication from ETC readers to AM radio receivers. (2) Cross-technology communication (CTC). Many recent studies on CTC introduced deep cooperation between heterogeneous wireless devices. Most of them focused on the technologies in the same ISM band, such as Wi-Fi and Zigbee [28]–[32]. Specifically, WeBee [32] introduced a physicallevel emulation technique to provide a high-throughput connection. The work of [33] utilized the harmonic backscatter technique to connect the UHF RFID and Wi-Fi. This work suggested a new type of CTC, that has never been used before. (3) Backscatter and RFID. Similar to RFID tags, backscatters are battery-free devices that modulate data by reflecting the source signals. Dozens of backscatters have been proposed in the past years [9], [34]–[39]. Our work is inspired by the FM backscatter [9], which reflects FM radio signals for broadcasting. Previous studies embedded the RFID reader into a bulb to make it easily deployable indoors [40]. ETC transponders have been used to localize and count vehicles for building smart cities [2]. By contrast, our work aims to enhance RFID application in outdoor ETC service with powerful human to machine interaction. VIII. CONCLUSION This work presents Tagcaster, a system that enables commercial UHF ETC systems to provide additional broadcasting service with only a software update. Tagcaster is the first system to offer down-converting cross-technology communication. Our extensive experiments indicate that Tagcaster can provide good-quality radio service with only a software updated ETC reader. ACKNOWLEDGMENTS The research is supported by NSFC General Program (NO. 61972331), NSFC General Program (NO. 61902331) and NSFC Key Program (NO. 61932017). The research of Lei Xie is supported by National Natural Science Foundation of China (NO. 61872174, 61832008)
REFERENCES [22]N.B.Carvalho.A.Georgiadis.A.Costanzo.H.Rogier.A.Collado. J.A.Garcia,S.Lucyszyn,P.Mezzanotte,J.Kracek,D.Masotti et al.. [1]"Electronic toll collection,"https://en.wikipedia.org/wiki/Electronic_ "Wireless power transmission:R&d activities within europe"IEEE toll collection. Transactions on Microwave Theory and Techniques,vol.62.no.4,pp [2]O.Abari.D.Vasisht,D.Katabi.and A.Chandrakasan."Caraoke:An e- 1031-1045.2014. toll transponder network for smart cities,"in ACM SIGCOMM Computer (23]Z.Li,Y.Xie,M.Li,and K.Jamieson,"Recitation:Rehearsing wireless Communication Review,vol.45,no.4.ACM,2015.pp.297-310. packet reception in software,"in in Proc.of ACM MobiCom,2015,pp [3]"ImpinJ,Inc,"http://www.impinj.com/,2019. 291-303. 4 "Demo Audio,"https://www.youtube.com/watch?v=-0w0sdJIThM. [24]S.Merchan,A.G.Armada,and J.Garcia,"Ofdm performance in [5]"List of electronic toll collection systems,"https://en.wikipedia.org/wiki/ amplifier nonlinearity,"IEEE Transactions on Broadcasting,vol.44. List_of_electronic_toll_collection_systems [6]Q.Yang.Y.Zhang.H.-M.Wang,and Z.Han,"Transmit optimization for no.1,Pp.106-114.1998. secure mimo rfid wireless communication,"in 2016 IEEE Internationa [25]G.A.Vera,Y.Duroc,and S.Tedjini,"Analysis and exploitation of harmonics in wireless power transfer (h-wpt):passive uhf rfid case," Conference on Communications (ICC).IEEE,2016,pp.1-6. [7]J.Li,X.Han,H.Zhang.and W.Shi,"Suppressing multipath inter- Wireless Power Transfer,vol.1,no.2,pp.65-74,2014. ference by using smart antenna for passive uhf rfid system,"DEStech 126]Y.Ma,X.Hui,and E.C.Kan,"3d real-time indoor localization via Transactions on Engineering and Technology Research,no.iect,2016. broadband nonlinear backscatter in passive devices with centimeter [8]S.Chen,S.Zhong.S.Yang,and X.Wang."A multiantenna rfid reader precision,"in in Proc.of ACM MobiCom.2016,pp.216-229. with blind adaptive beamforming,"IEEE Internet of Things Journal, [27]D.Vasisht,G.Zhang,O.Abari,H.-M.Lu,J.Flanz,and D.Katabi, vol.3,no.6,Pp.986-996,2016. "In-body backscatter communication and localization,"in Proc.of ACM [9]A.Wang,V.Iyer.V.Talla,J.R.Smith.and S.Gollakota,"Fm SIGCOMM.2018. backscatter:Enabling connected cities and smart fabrics,"in Proc.of [29]S.M.Kim and T.He,"Freebee:Cross-technology communication via ACM NSD1,2017,pp.243-258 free side-channel."in Proc.of ACM MobiCom.2015. [10]"ImpinJ R2000 RFID reader chip."https://support.impinj.com/hc/en-us/ [30]X.Zhang and K.G.Shin,"Gap sense:Lightweight coordination of articles/202755828-Indy-R2000-Datasheet. heterogeneous wireless devices,"in Proc.of IEEE INFOCOM,2013. [11]"Audio Sampling."https://en.wikipedia.org/wiki/Sampling (signal [31]Y.Zhang and Q.Li,"Howies:A holistic approach to zigbee assisted processing#Audio sampling. wifi energy savings in mobile devices,"in Proc.of IEEE INFOCOM [12]R.Zitouni,S.Ataman.M.Mathian,and L.George,"Radio frequency 2013 measurements on a sbx daughter board using gnu radio and usrp n- [32]Z.Li and T.He,"Webee:Physical-layer cross-technology communica 210,"in Measurements Networking (M&N).2015 IEEE International tion via emulation,"in Proc.of ACM MobiCom.2017. Workshop on. IEEE,2015,pp.1-5. [33]Z.An,Q.Lin,and L.Yang,"Cross-frequency communication:Near- [13]"EPCglobal Gen2 Specification,"www.gs1.org/epcglobal.2004 field identification of uhf rfids with wifi!"in Proc.of ACM MobiCom. [14]"SONY Radio,"https://www.sony.co.th/en/electronics/radios/icf-p36. ACM,2018,pp.623-638 [15]Y.Hu and P.C.Loizou,"Evaluation of objective quality measures [34]B.Kellogg.V.Talla,S.Gollakota,and J.R.Smith,"Passive wi-fi: for speech enhancement,"IEEE Transactions on audio speech.and Bringing low power to wi-fi transmissions."in Proc.of ACM NSDI. language processing,vol.16,no.1,pp.229-238,2008. vol.16,2016,pp.151-164 [16]"Official PESQ TooL,"https://www.itu.int/rec/T-REC-P.862-200102-I/ [35]V.Liu,A.Parks,V.Talla,S.Gollakota,D.Wetherall,and J.R.Smith en. "Ambient backscatter:wireless communication out of thin air,"in Proc [17]D.M.Dobkin,The rf in RFID:uhf RFID in practice. Newnes,2012 of ACM S/GCOMM,vol.43.no.4.ACM,2013.pp.39-50. [18]G.A.Vera.Y.Duroc.and S.Tedjini."Third harmonic exploitation [36]V.Talla,M.Hessar,B.Kellogg,A.Najafi,J.R.Smith,and S.Gollakota, in passive uhf rfid,"IEEE Transactions on Microwave Theory and "Lora backscatter:Enabling the vision of ubiquitous connectivity,"Proc Technigues,vol.63.no.9,pp.2991-3004,2015. of ACM IMWUT,vol.1,no.3,p.105,2017. [19]M.S.Trotter,J.D.Griffin,and G.D.Durgin,"Power-optimized 37]P.Zhang,D.Bharadia,K.Joshi,and S.Katti."Hitchhike:Practical waveforms for improving the range and reliability of rfid systems,"in backscatter using commodity wifi,"in Proc.of ACM SenSys,2016. RFID.2009 IEEE International Conference on.IEEE,2009.pp.80-87. (38]D.Bharadia,K.R.Joshi,M.Kotaru,and S.Katti,"Backfi:High [20]A.Collado and A.Georgiadis,"Optimal waveforms for efficient wire- throughput wifi backscatter,"Proc.of ACM S/GCOMM.vol.45,no.4. less power transmission,"IEEE Microwave and Wireless Components pp.283-296.2015. Letters,vol.24,no.5,pp.354-356,2014. 39]V.Iyer,V.Talla,B.Kellogg,S.Gollakota,and J.Smith,"Inter- [21]A.Boaventura,A.Collado,N.B.Carvalho,and A.Georgiadis,"Op- technology backscatter:Towards internet connectivity for implanted timum behavior:Wireless power transmission system design through devices,"in Proc.of ACM SIGCOMM.ACM,2016. behavioral models and efficient synthesis techniques,"IEEE Microwave [40]J.Gummeson,J.Mccann,C.J.Yang,D.Ranasinghe,S.Hudson, Magazine,vol.14,no.2,pp.26-35,2013. and A.Sample,"Rfid light bulb:Enabling ubiquitous deployment of [28]K.Chebrolu and A.Dhekne,"Esense:Communication through energy interactive rfid systems,"Proc.of ACM IMWUT,vol.1,no.2,p.12, sensing,"in Proc.of ACM MobiCom.2009. 2017
REFERENCES [1] “Electronic toll collection,” https://en.wikipedia.org/wiki/Electronic toll collection. [2] O. Abari, D. Vasisht, D. Katabi, and A. Chandrakasan, “Caraoke: An etoll transponder network for smart cities,” in ACM SIGCOMM Computer Communication Review, vol. 45, no. 4. ACM, 2015, pp. 297–310. [3] “ImpinJ, Inc,” http://www.impinj.com/, 2019. [4] “Demo Audio,” https://www.youtube.com/watch?v=-0w0sdJlThM. [5] “List of electronic toll collection systems,” https://en.wikipedia.org/wiki/ List of electronic toll collection systems. [6] Q. Yang, Y. Zhang, H.-M. Wang, and Z. Han, “Transmit optimization for secure mimo rfid wireless communication,” in 2016 IEEE International Conference on Communications (ICC). IEEE, 2016, pp. 1–6. [7] J. Li, X. Han, H. Zhang, and W. Shi, “Suppressing multipath interference by using smart antenna for passive uhf rfid system,” DEStech Transactions on Engineering and Technology Research, no. iect, 2016. [8] S. Chen, S. Zhong, S. Yang, and X. Wang, “A multiantenna rfid reader with blind adaptive beamforming,” IEEE Internet of Things Journal, vol. 3, no. 6, pp. 986–996, 2016. [9] A. Wang, V. Iyer, V. Talla, J. R. Smith, and S. Gollakota, “Fm backscatter: Enabling connected cities and smart fabrics,” in Proc. of ACM NSDI, 2017, pp. 243–258. [10] “ImpinJ R2000 RFID reader chip,” https://support.impinj.com/hc/en-us/ articles/202755828-Indy-R2000-Datasheet. [11] “Audio Sampling,” https://en.wikipedia.org/wiki/Sampling (signal processing)#Audio sampling. [12] R. Zitouni, S. Ataman, M. Mathian, and L. George, “Radio frequency measurements on a sbx daughter board using gnu radio and usrp n- 210,” in Measurements & Networking (M&N), 2015 IEEE International Workshop on. IEEE, 2015, pp. 1–5. [13] “EPCglobal Gen2 Specification,” www.gs1.org/epcglobal, 2004. [14] “SONY Radio,” https://www.sony.co.th/en/electronics/radios/icf-p36. [15] Y. Hu and P. C. Loizou, “Evaluation of objective quality measures for speech enhancement,” IEEE Transactions on audio, speech, and language processing, vol. 16, no. 1, pp. 229–238, 2008. [16] “Official PESQ Tool,” https://www.itu.int/rec/T-REC-P.862-200102-I/ en. [17] D. M. Dobkin, The rf in RFID: uhf RFID in practice. Newnes, 2012. [18] G. A. Vera, Y. Duroc, and S. Tedjini, “Third harmonic exploitation in passive uhf rfid,” IEEE Transactions on Microwave Theory and Techniques, vol. 63, no. 9, pp. 2991–3004, 2015. [19] M. S. Trotter, J. D. Griffin, and G. D. Durgin, “Power-optimized waveforms for improving the range and reliability of rfid systems,” in RFID, 2009 IEEE International Conference on. IEEE, 2009, pp. 80–87. [20] A. Collado and A. Georgiadis, “Optimal waveforms for efficient wireless power transmission,” IEEE Microwave and Wireless Components Letters, vol. 24, no. 5, pp. 354–356, 2014. [21] A. Boaventura, A. Collado, N. B. Carvalho, and A. Georgiadis, “Optimum behavior: Wireless power transmission system design through behavioral models and efficient synthesis techniques,” IEEE Microwave Magazine, vol. 14, no. 2, pp. 26–35, 2013. [28] K. Chebrolu and A. Dhekne, “Esense: Communication through energy sensing,” in Proc. of ACM MobiCom, 2009. [22] N. B. Carvalho, A. Georgiadis, A. Costanzo, H. Rogier, A. Collado, J. A. Garc´ıa, S. Lucyszyn, P. Mezzanotte, J. Kracek, D. Masotti et al., “Wireless power transmission: R&d activities within europe,” IEEE Transactions on Microwave Theory and Techniques, vol. 62, no. 4, pp. 1031–1045, 2014. [23] Z. Li, Y. Xie, M. Li, and K. Jamieson, “Recitation: Rehearsing wireless packet reception in software,” in in Proc. of ACM MobiCom, 2015, pp. 291–303. [24] S. Merchan, A. G. Armada, and J. Garcia, “Ofdm performance in amplifier nonlinearity,” IEEE Transactions on Broadcasting, vol. 44, no. 1, pp. 106–114, 1998. [25] G. A. Vera, Y. Duroc, and S. Tedjini, “Analysis and exploitation of harmonics in wireless power transfer (h-wpt): passive uhf rfid case,” Wireless Power Transfer, vol. 1, no. 2, pp. 65–74, 2014. [26] Y. Ma, X. Hui, and E. C. Kan, “3d real-time indoor localization via broadband nonlinear backscatter in passive devices with centimeter precision,” in in Proc. of ACM MobiCom, 2016, pp. 216–229. [27] D. Vasisht, G. Zhang, O. Abari, H.-M. Lu, J. Flanz, and D. Katabi, “In-body backscatter communication and localization,” in Proc. of ACM SIGCOMM, 2018. [29] S. M. Kim and T. He, “Freebee: Cross-technology communication via free side-channel,” in Proc. of ACM MobiCom, 2015. [30] X. Zhang and K. G. Shin, “Gap sense: Lightweight coordination of heterogeneous wireless devices,” in Proc. of IEEE INFOCOM, 2013. [31] Y. Zhang and Q. Li, “Howies: A holistic approach to zigbee assisted wifi energy savings in mobile devices,” in Proc. of IEEE INFOCOM, 2013. [32] Z. Li and T. He, “Webee: Physical-layer cross-technology communication via emulation,” in Proc. of ACM MobiCom, 2017. [33] Z. An, Q. Lin, and L. Yang, “Cross-frequency communication: Near- field identification of uhf rfids with wifi!” in Proc. of ACM MobiCom. ACM, 2018, pp. 623–638. [34] B. Kellogg, V. Talla, S. Gollakota, and J. R. Smith, “Passive wi-fi: Bringing low power to wi-fi transmissions.” in Proc. of ACM NSDI, vol. 16, 2016, pp. 151–164. [35] V. Liu, A. Parks, V. Talla, S. Gollakota, D. Wetherall, and J. R. Smith, “Ambient backscatter: wireless communication out of thin air,” in Proc. of ACM SIGCOMM, vol. 43, no. 4. ACM, 2013, pp. 39–50. [36] V. Talla, M. Hessar, B. Kellogg, A. Najafi, J. R. Smith, and S. Gollakota, “Lora backscatter: Enabling the vision of ubiquitous connectivity,” Proc. of ACM IMWUT, vol. 1, no. 3, p. 105, 2017. [37] P. Zhang, D. Bharadia, K. Joshi, and S. Katti, “Hitchhike: Practical backscatter using commodity wifi,” in Proc. of ACM SenSys, 2016. [38] D. Bharadia, K. R. Joshi, M. Kotaru, and S. Katti, “Backfi: High throughput wifi backscatter,” Proc. of ACM SIGCOMM, vol. 45, no. 4, pp. 283–296, 2015. [39] V. Iyer, V. Talla, B. Kellogg, S. Gollakota, and J. Smith, “Intertechnology backscatter: Towards internet connectivity for implanted devices,” in Proc. of ACM SIGCOMM. ACM, 2016. [40] J. Gummeson, J. Mccann, C. J. Yang, D. Ranasinghe, S. Hudson, and A. Sample, “Rfid light bulb: Enabling ubiquitous deployment of interactive rfid systems,” Proc. of ACM IMWUT, vol. 1, no. 2, p. 12, 2017