Professional Documents
Culture Documents
RFID
Self-Interference
Reader
(a) Classical Antenna Arrays (b) Relay-based Antenna Array
Figure 1: RFly overview and the self-interference Figure 2: Challenge of phase entanglement. (a) In traditional antenna arrays,
challenge. The packets forwarded by the relay on the phase measurements correspond to a direct link between the RF source and
the uplink and downlink feed back into its antenna, the antenna. (b) When the reader obtains the phase through the relay, the phase
causing self-interference. is an entanglement of two half-links: one between the relay and the drone and
another between the relay and the RFID.
accurate localization hinges on phase measurements [24, 45, We built a prototype of RFly. To implement the relay, we built
46, 48]. RFlys hardware design into a custom PCB circuit and mounted it
Finally, it must be compact to be mounted on a drone. on a Parrot Bebop2 drone [23]. We implemented an RFID reader
on USRP N210 software radios [6] and used the Alien Squiggle
To realize these properties, RFlys relay adopts a mirrored archi- passive RFID tags [12] for evaluation. Our experimental evaluation
tecture that has two main components. The first component performs demonstrates the following results:
self-interference cancellation to enable bidirectionally full-duplex
communication. In contrast to past full-duplex relay proposals [15], Read Range: RFlys relay significantly extends the range over
the cancellation is done entirely in the analog domain in order to which a reader can communicate with off-the-shelf passive
preserve the timing characteristics of the forwarded packets. Un- RFIDs. Our stress-test experiments demonstrate that a reader
fortunately, the cancellation inadvertently introduces random phase can achieve 100% read rate when an RFID is over 50 m away
and frequency offsets that can preclude localization. The second even in non-line-of-sight environments and through walls;
component compensates for these offsets by exploiting the fact that this represents over 10 range improvement over scenarios
it can control both the uplink and downlink forwarding hardware where the relay is absent.2
(since they are co-located on the drone). Hence, it subtracts on the Localization Accuracy: RFlys median localization error is
uplink the exact (phase and frequency) offsets that it inadvertently 19 cm and 90t h percentile error is 53 cm. The localization
adds on the downlink. This mirrored architecture enables the reader accuracy decreases with distance due to SNR reduction but
to capture the phase of the RFIDs response through the relay and is remains sub-meter even when the localized RFID is over 50 m
described in detail in 4. from the reader.
Now that we can capture the phase of the RFIDs response, we RFlys relay has few additional desirable features that make the
may proceed to localization. In particular, as the drone flies, the relay system amenable to immediate deployment. First, it is transparent to
captures RFID responses at different points along its trajectory, emu- the RFID protocol. This enables it to naturally scale already deployed
lating an antenna array as shown in Fig. 2(a). However, relay-based infrastructures of RFID readers in warehouses, stores, or factories
localization exhibits a fundamental difference from all past work without requiring any modification. Second, it is lightweight and
on antenna arrays. Since the reader obtains phase measurements can be miniatured further into a single integrated circuit. This allows
through the relay, the measured phase does not consist of a single us to mount the entire relay on a small drone, which is safe to fly
link (direction) as in typical antenna array scenarios. Rather, the indoors in warehouses and factories. In contrast, none of todays
phase is an entanglement of two half-links: one between the reader commercially available readers can be mounted on small drones
and the relay and another between the relay and the RFID tag, as and would instead require larger drones that are only safe to fly in
shown in Fig. 2(b). outdoor environments or away from humans [19, 41]. Finally, RFlys
RFlys solution to this challenge consists of embedding an RFID design incorporates a mechanism that enables it to automatically
into the relay itself. This enables it to isolate each of the two half- manage interference from multiple readers within its radio range.
links and process each of them independently. At a high level, RFlys
Contributions: We make the following contributions:
disentanglement protocol queries both the on-board RFID and other
We present the first system that leverages drones as relays for
RFIDs in the environment to capture their phases. This effectively
battery-free networks. The system enables drones to detect
provides it with two equations and two unknowns. It can then solve
and localize objects in non-line-of-sight settings and over a
these equations to recover the two half-links. Having isolated the
wide area.
phases for each of the half-links, RFly may proceed to applying
standard antenna array equations on each of the half-links for local-
2 The distance gain comes from the reader-relay half-link (which is similar to a standard
ization. In 5, we elaborate on this idea and describe how RFlys
algorithm can deal with additional challenges due to multi-path WiFi link) because the relay is powered-up by the drones battery. In contrast, the
distance between the RFID and the relay remains limited to few meters since the relay
reflections in the environment. must power up the tag and deliver sufficient modulation depth for communication.
Drone Relays for Battery-Free Networks SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA
We design and build the first phase-preserving and bidirec- predetermined flight plan. The drone has an on-board RFID relay,
tionally full-duplex relay. which acts as a transparent intermediary between RFID readers and
We introduce a new localization algorithm that operates on RFID tags in the environment, as shown in Fig. 1. As the drone flies,
RF signals obtained through a mobile relay. the relay continuously forwards uplink and downlink traffic between
We present a prototype implementation of our system demon- the readers and the RFIDs. In 4, we describe how RFlys relay
strating its accuracy and range of operation. forwards the packets in the analog domain to preserve localization-
RFly has a few limitations that are worth noting. First, the drone sensitive characteristics of the signal.
still relies on vision-based systems for navigation, obstacle avoid- The RFID reader collects the responses obtained through the relay,
ance, and stability. While this does not prevent RFly from localizing and decodes the responses to identify the RFIDs unique IDs. In 5,
RFIDs in non-line-of-sight, it requires optical markers that can guide we describe how a reader can localize RFIDs in the environment by
the drones navigation. Second, the localization range is still lim- synthesizing the measurements collected along the drones trajectory.
ited to few tens of meters. We believe that these limitation can Finally, to identify the localized objects, the system leverages a local
be addressed as the research evolves and hope that RFlys design database that maps each RFIDs unique ID to the object it is attached
motivates new systems that synergize drone technologies with RF to. Such databases are typically provided by a manufacturer and map
capabilities and battery-free networks. each object to its RFIDs unique identifier [1].
Before describing the details of RFlys design, it is worth consid-
2 PRIMER ering a simple alternative: Why not mount an entire RFID reader on
Passive RFIDs are battery-free tags which communicate with a de- a drone and use it for localization in battery-free networks? RFly is
vice called a reader. A reader bootstraps communication by sending superior to such a design for three main reasons:
a query on the downlink channel. The query serves both as a mecha- Ability to use indoor drones: Todays commercially available
nism to power up the tag and a means to communicate messages to indoor drones, such as the Parrot Bebop, can only carry a
it. A powered up tag responds with its unique identifier through ON- very limited payload between few to tens of grams [22,
OFF keying modulation. To do so, it switches its internal impedance 23]. Because RFlys relay weighs only 35 grams, RFly can
between two states: reflective and non-reflective. leverage these drones; hence, it is safe to operate indoors
State-of-the-art localization techniques [32, 45, 46] operate on and near humans. In contrast, the lightest-weight standalone
the phase of the received tag response, which encodes distance UHF RFID readers available on the market today weigh over
information. Specifically: 0.5 kg [8]. Sustaining such a payload would require relatively
On the downlink, after transmitting a query, the reader trans- larger drones which are restricted to outdoor environments
mits a continuous wave at some frequency f , which can be and are unsafe to fly near humans [19, 41].
expressed as: Interference management: Many of todays factories and
x (t ) = e j2 f t (1) warehouses are already outfitted with an infrastructure of
On the uplink, the RFID modulates the wave with some sig- RFID readers. RFly can extend such an infrastructure and
nal s (t ), and the signal received at the reader can be expressed incorporates mechanisms that allow us to manage interfer-
as: ence, while remaining transparent to the RFID communica-
y(t ) = s (t )e j2 f (t 2d /c ) (2) tion protocol. In contrast, a flying indoor RFID reader would
where 2d corresponds to the round-trip distance from the introduce additional interference and result in more collisions
reader to the tag and c is the speed of light. with an already deployed infrastructure. Addressing such in-
terference would require changing the RFID protocol.
Upon demodulation, a reader can recover the phase of the received
Generality of the proposed techniques: Finally, it is impor-
signal as = 4d/c and use it for localization.
tant to note that RFlys contributions extend beyond the spe-
Finally, we note that the communication range between the reader
cific problem of drone-based localization in battery-free net-
and the tag is limited on the downlink channel. This is because the
works. In particular, the bidirectionally full-duplex capability
reader must deliver sufficient power to the RFID (around -15 dBm
can extend the coverage of battery-free networks even if in
for off-the-shelf tags [12]) and modulation depth so that it may
static settings. Moreover, the phase-preserving design and the
power up and decode. This limits the reliable range of passive RFID
through-relay localization algorithm extend beyond battery-
communication to 3-6 m [12, 42].
free networks to various types of wireless networks.
3 RFLY OVERVIEW The following sections describe RFlys relay design and drone-
based localization algorithm.
RFly is a system that leverages drones as relays for UHF RFID
networks. The system can detect and localize RFIDs that are sep-
arated by tens of meters from an RFID reader, i.e., much larger
4 RELAY DESIGN FOR BACKSCATTER
than the read range of a typical reader. RFly works in both line-of- COMMUNICATIONS
sight and non-line-of-sight environments, enabling us to localize Recall from 1 that RFlys relay must be bidirectionally full-duplex,
occluded RFID-tagged objects in highly cluttered environments such and it must preserve the phase and timing characteristics of the
as warehouses, stores, and factories. forwarded packets to enable localization. In this section, we de-
In order to localize objects in the environment, RFly dispatches scribe RFlys relay design; then, in 5 we describe how it performs
a drone that navigates throughout the area of interest following a localization through the relay.
SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA Yunfei Ma, Nicholas Selby, Fadel Adib
4.1 The Challenge of Self-Interference results in a range of 0.75 m, while an isolation of 80dB results in a
The key challenge in designing RFlys relay is self-interference. To range of 238 m.
understand this challenge, let us consider the simplest relay design, Next, we describe how RFly addresses the two types of self-
shown in Fig. 3. In order to preserve the phase and timing character- interference.
istics of the forwarded packets, the relay may simply amplify and
forward the received packets without performing digital manipula- 4.2 Addressing Inter-Link Self-Interference
tion. However, such an approach results in self-interference, whereby
We start by addressing the self-interference between the uplink and
the forwarded packets feed back into the relays receive antennas.
the downlink relay paths. Recall that an RFID responds by reflecting
Based on fundamental principles in control theory, this amplified
the signal transmitted by the reader. Hence, both uplink and down-
feedback drives the relay into an unstable state whereby it rings as
link are at the same frequency. This results in leakage Interdu and
its output feeds back into its input [15]. This problem is exacerbated
Interud in Fig. 3.
by the fact that RFID communication is full-duplex in nature since
RFlys solution to this challenge exploits the signal structure of
RFID tags communicate by reflecting the readers signal. As a result,
RFID communications in the frequency domain. Specifically, it ex-
the relay simultaneously suffers from self-interference on both the
ploits the fact that the readers query (on the downlink channel) and
uplink and the downlink as can be seen in Fig. 3.
the RFIDs response (on the uplink channel) occupy different sub-
To overcome this challenge, RFly must address two types of
bands around the center frequency used for communication. Fig. 4
self-interference:
illustrates this property by overlaying the frequency response of the
(1) Inter-link self-interference, which refers to the interference readers query and the RFIDs response. The figure demonstrates a
between the uplink and downlink forwarding paths Interud gap, which is called the guard-band, in the signal spectrum between
and Interdu in Fig. 3. uplink tag response and downlink query from the reader to the RFID.
(2) Intra-link self-interference, which refers to the interference For example, the EPC Gen2 protocol allows an RFID tag backscat-
between the transmit and receive antennas on each of the ter link frequency (BLF) as high as 640kHz while the spectrum of
uplink and downlink processing paths separately, denoted by reader to tag query command is constrained within 125kHz.
Intrau and Intrad respectively in Fig. 3. RFlys design takes advantage of the guard-band by implementing
Isolation vs. Communication Range. Before delving into how filters on the uplink and downlink relays. Note, however, that since
RFly addresses these two types of self-interference, it is worth noting the frequency difference between the uplink and downlink is very
that the amount of achieved isolation (i.e., self-interference cancella- small (tens of kHz) in comparison to the center frequency (around
tion) directly impacts the communication range between the relay 900MHz), implementing such filtering in passband (i.e., around
and the RFID reader. Specifically, to ensure that the relay does not the center frequency) would require extremely high quality-factor
oscillate, the signal arriving from the reader must be greater than the filters, which are unavailable on the market. Instead, we adopt a
leakage from the relays transmit antennas. Hence, the path loss L downconvert-upconvert approach and filter in baseband.
between the reader and the relay must be smaller than the isolation I For simplicity, let us start with the downlink channel (from the
between the transmit and receive antennas. Mathematically, since reader to the tag). This channel occupies a small bandwidth around
path loss can be expressed as a function of the range R and the the center frequency, as shown in Fig. 4. RFly downconverts the
wavelength , the following inequality must be satisfied: received signal to baseband, low-pass filters, then upconverts before
transmitting it to the tag. Through this filtering, it prevents the re-
I > L = 20 log (4R/) (3) layed responses self-interference, which is denoted as Interud in
I /20 Fig. 3 from leaking into the downlink relay channel. Similarly, on the
R/ < 10 /(4 ) (4)
uplink channel (from tag to reader), RFly downconverts to baseband,
The inequality demonstrates that in order to achieve larger range, we then bandpass filters around the tags response, then upconverts
need to achieve higher isolation. Numerically, an isolation of 30dB back.
Drone Relays for Battery-Free Networks SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA
A natural question is: how can the relay discover the readers on the downlink relay. This induces a phase shift (t ), which
center frequency? Specifically, a reader may send a query at any cancels the effect of the oscillator discrepancies between the relay
frequency within the 900 MHz ISM band for UHF RFID commu- and the reader. Such an approach restores the coherent nature of
nications, and the relay needs to figure out that frequency in order the communication link and allows the relay to act as a transparent
to downconvert and filter in baseband. In contrast to performing a intermediary between the reader and the RFIDs in the environment.
standard Fourier transform which would require digitizing and A few additional points are worth noting:
processing the signal at tens of MHz of bandwidth RFly emulates In the presence of multiple RFID readers in the environment,
the behavior of the Fourier transform through a simple energy de- the relay automatically selects the frequency of the reader
tection and correlation mechanism. In particular, the relay gradually with the strongest receive signal as per Eq. 5. Once it locks
sweeps the center frequency for downconversion, correlates with all onto the corresponding readers center frequency, the base-
the possible center frequencies within the ISM band, and chooses band filters on the downlink and uplink filter out the signals
the frequency where the correlation peaks. Mathematically, if the of all other readers, naturally managing the interference.4
incoming signal is x (t ), we can express the operation as: The above discussion focuses on the operation of a single
X relay. In practice, RFlys design can extend to multiple relays,
fc = arg max x (t )e j2 f t (5) which may be daisy chained. The system architecture and
f t
analysis of such a system are outside the scope of this paper.
Note that in contrast to a Fourier transform which would first Finally, in contrast to past relay architectures which can
digitize and store x (t ) then perform the transform operation, RFlys achieve up to 2 range extension between communicating
approach is akin to a streaming algorithm that operates on contiguous nodes, RFlys relay enables increasing the communication
1-ms chunks of the readers transmitted wave. In practice, the entire range by orders of magnitude between the reader and RFIDs
sweeping operation takes 20 ms, after which, the relay locks onto in the environment. This owes primarily to the fact that
the frequency of the reader.3 battery-free RFIDs rely on the signal received on the down-
link channel to power up, typically requiring about -15dBm
4.3 Addressing Intra-Link Self-Interference of received signal strength [12]. This requirement limits the
Next, we describe how RFly addresses intra-link interference, i.e., path loss budget on the downlink channel; as a result, existing
the interference due to the leakage between a given relays transmit readers have a maximum range of few meters [47, 50]. In
and receive antennas. This is denoted by Intrau and Intrad in Fig. 3. contrast, by employing a relay, we can decouple the commu-
RFlys solution to this challenge is an out-of-band full-duplex de- nication range from the powering up range in passive RFID
sign, i.e., the relay transmits at a signal whose frequency is different communications. Specifically, while the half-link between the
from the one it receives at. To do so, it leverages the downconvert- relay and an RFID remains limited to few meters, the range
upconvert approach described in 4.2. For example, on the downlink between the relay and the reader is only limited by our iso-
channel, it downconverts with the readers center frequency but up- lation ability (as evident from Eq. 4). In 7, we demonstrate
converts with another frequency f 2 , effectively achieving frequency how we can achieve multiple tens of meters in range.
division between the reader-relay half-link and the relay-RFID half-
link. 5 THROUGH-RELAY LOCALIZATION
Note, however, this downconvert-upconvert strategy breaks the co- In this section, we describe how RFly can localize a single RFID by
herent nature of RFID communication. Said differently, this strategy mounting our relay on a drone. The same technique generalizes to a
distorts the phase of the RFIDs response, which is particularly prob- large number of tags in the environment.
lematic since localization relies on accurate phase measurements. RFlys approach builds on past work on synthetic aperture radar
Specifically, since the relay and the reader have different oscilla- (SAR) [17, 28, 45]. Specifically, as the drone flies, the relay cap-
tors, they are not synchronized and as a result, the relay introduces tures the RFID responses from different locations along the drones
a carrier frequency offset (CFO) and phase offset into the signal. trajectory, and treats these spatial measurements as an antenna ar-
Mathematically, the relay generates some frequency f different than ray. Subsequently, by applying antenna array equations to these
the readers frequency f , and introduces a random, unknown phase measurements, it can localize the RFIDs.
offset o to the downlink signal. We can express the time-varying While our approach is inspired by SAR, it faces two key chal-
induced phase as: lenges which are unique to our system architecture:
(t ) = 2 ( f f )t + 0 (6) (1) Phase entanglement: First, since the reader obtains phase
To address this challenge, we leverage the fact that RFly has con- measurements through the relay, the measured phase does not
trol over both the downlink and uplink relays. Hence, we design the consist of single direction as in typical antenna array scenarios
uplink forwarding path such that it inverts the effect of the downlink (e.g., Fig. 2(a)). Rather, the phase consists of two half-links:
path by mirroring its behavior. Specifically, on the uplink processing one between the reader and the relay and another between
path, it upconverts with the same oscillator used for downconversion the relay and the RFID tag, as shown in Fig. 2(b). In order
to apply antenna array equations, RFly must first disentangle
3 Note that in certain regions of the world, the regulations dictate that the reader hops
frequencies every half second according to a prespecified pattern. Once the relay iden-
4 In the event that multiple readers transmit at the same frequency, we can leverage past
tifies the center frequency at a given point in time, it can lock onto the same hopping
pattern. [2] work on multi-reader interference management [25].
SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA Yunfei Ma, Nicholas Selby, Fadel Adib
equation as follows:
e j2 f (2d1i /c ) e j2 f2 (2d2j /c )
X X
h= (9)
i j
The equation shows that even if we know the location of the drone,
we still cannot isolate the phase of the relay-RFID half-link. This is
because the position of the drone would only allow us to estimate
the impact of the direct path on the reader-relay channel but not that
of the multipath. As a result, even if we factor out this impact, we
still cannot isolate the relay-RFID half-link because of the residual
multipath on the reader-relay half-link.
Figure 5: Multipath. The signals bounce off various objects in the Embedding an RFID into the relay. Next, in order to separate the
environment on each of the two half-links, complicating localization. two half-link channels, we embed an RFID into our relay itself.
(Note that even if the embedded RFID is outside the reading range of
the two half-links and distill the phases corresponding to the the reader, the reader may still capture its phase through the relay.)
relay-RFID link as we describe in 5.1. Since the on-board RFID and the relay are co-located, the RFIDs
(2) Multipath: The second challenge stems from multipath in channel as recorded by the reader reduces entirely to the half-link
the environment. Specifically, the packets traveling on each of between the reader and the relay.6 Hence, in order to eliminate the
the links do not arrive only on the direct line-of-sight between impact of the reader-relay half-link, the reader may simply divide
the nodes. Rather, they bounce off of different objects in the channel of any given RFID by the channel of the relay-embedded
the environment, including walls and furniture, as shown in RFID hb . The resulting equation becomes entirely a factor of the
Fig. 5. This problem is exacerbated by the fact that the direct half-link between the relay and the RFID in the environment as
path on each of these links may be significantly attenuated by shown below:
h
e j2 f (2d2j /c )
X
an obstacle (e.g., furniture). As a result, the direct path may h = = (10)
not always be the path with the strongest signal. In 5.2, we hb j
describe how RFly leverages the structure of indoor multipath Aside from enabling RFly to eliminate the impact of the half-
to identify the direct path and localize the RFIDs. link between the reader and the relay, this approach provides two
In what follows, we discuss how RFly addresses each of these additional interesting features. First, since we embed the RFID into
challenges. the relay, it abides by the EPC Gen2 protocol which enables RFly
to naturally avoid collisions between the relay-embedded RFID and
5.1 Disentangling the Phase Half-Links other RFIDs in the environment. By storing the identifier of the relay-
We start by characterizing the problem of the phase entanglement embedded RFID on the reader, the reader can always distinguish
before we delve into the solution. it from other RFIDs in the environment. Second, while the relay-
embedded RFID will likely be out of the range of the reader itself,
Phase Received through the Relay. Let us start by assuming that it is always within the range of the relay. Said differently, the relay-
there is a single direct (line-of-sight) path from the reader to the embedded RFID can always be powered up by the relay since it
relay (with distance d 1 ) and a single path from the relay to the reader is in close proximity to the relays antennas on the drone. Hence,
(with distance d 2 ). Mathematically, it follows from Eq. 2 that we can whenever the reader receives a response from the relay-embedded
express the channel of the signal received at the reader as: RFID, it knows that the drones relay is within its radio range. This
h LO S = e j2 (f (2d1 /c )+f2 (2d2 /c )) (7) enables the reader to identify when the relay itself is within its radio
range whenever it can decode the relay-embedded RFID.
where f and f 2 correspond to the frequencies of the signals on each Finally, we note that since the channel of the relay-embedded
of the half-links as explained in 4.2.5 RFID consists entirely of the half-link between the ground-based
In practice, however, due to indoor multipath, the packets traverse reader and the relay, this channel may be used to localize the drone
multiple paths on each of the half-links, whose distances we denote itself by leveraging standard SAR equations. However, localizing
d 1i and d 2i respectively, as shown in Fig. 5. Due to the superposition the drone itself solely from RF measurements is outside the scope
of signals over the wireless medium, the different paths linearly of this paper. Instead, in this paper, we rely on accurate vision-based
combine at the receiver. Hence, in the presence of multipath, we may systems for localizing and navigating the drone.
express the received channel at the reader as:
5.2 Localization Algorithm
e j2 ( f (2d1i /c )+f2 (2d2j /c ) )
XX
h= (8)
i j
Now that we have isolated the channel corresponding to the half-link
between the relay and an RFID in the environment, we can proceed
Since each of the paths on the first half-link traverses all the paths to localizing the RFID.
of the second half-link and vice-versa, we may re-factor the above 6 In practice, it still has a multiplicative constant which does not change as the drone flies
since the distance between the relay-embedded RFID and the relay remains constant. As
5 Note that, in practice, the effect of the second half-link would be f 2 + f
f . However, a result, we can ignore that constant since it does not affect the antenna array equations
f f is less than few hundred Hz; hence, it is negligible in the channel estimates. and can be factored out.
Drone Relays for Battery-Free Networks SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA
At a high level, RFly leverages the fact that the drones movement 3 3
Y-axis (meters)
Y-axis (meters)
non-linear projections are the most suitable for RFly since they can 1.5 1.5
Actual tag location Actual tag location
synthesize RF measurements over long trajectories.
1 1
For simplicity, let us focus on how this localization method works
in 2D space. Intuitively, this formulation leverages the fact that every 0.5 0.5
point (x, y) in 2D space can be described by a set of distances from
the different points along the drones trajectory. Hence, to localize, 0 0
it applies a matched filter on all possible locations and chooses the Drone flightpath Drone flightpath
highest peak.7 -0.5
-0.5 0 0.5 1 1.5 2 2.5 3
-0.5
-0.5 0 0.5 1 1.5 2 2.5 3
Mathematically, consider K locations along the drones trajectory
x-axis (meters) x-axis (meters)
where it captures responses from a given RFID. If the coordinates of (a) Line-of-sight (b) Strong Multipath
these points are (x 1 , y1 ) . . . (x K , yK ), and the isolated channels for Figure 6: RFlys localization. The figures plot P (x, y) as a heatmap,
a given RFID are (h 1 . . . h K ), the 2D location of the RFID may be
where red indicates high likelihood of the RFIDs location and navy
estimated as: blue indicates low likelihood. The white triangle indicates the actual
(x, y) = arg max P (x, y) (11) location of an RFID and the cyan line denotes the drones trajectory
(x,y )
used for localization.
where
X K f
P (x, y) = hle j2 c 2 (x xl ) +(yyl ) Finally, we list a few interesting features of RFlys localization
2 2
(12)
l =1 algorithm:
Fig. 6(a) depicts an example where the RFID is in line-of-sight While the above localization method was described in 2D for
of the relay. The figure shows a heatmap of P (x, y) in 2D space, simplicity, it can be extended to 3D if the robots trajectory is
where red indicates high likelihood of the RFIDs location and navy two-dimensional.
blue indicates low likelihood. The white triangle indicates the actual RFlys localization accuracy improves when integrating Eq. 12
location of the RFID, and the cyan line marks the robots trajectory. over longer trajectories as we show empirically in 7.3. This
We make the following observations from this experiment: is because a larger aperture results in narrower beamwidths
for localization [9, 37]. In practice, however, the integration
RFlys estimated location of the RFID (denoted by the peak path is limited to 3-5 meters due to the limited communication
of this heatmap in dark red) is very accurate relative to the range between the relay and the RFID tag.
RFIDs actual location, with an error less than 7 cm. The above localization algorithm naturally extends to multi-
The heatmap exhibits few light blue patches. These are due ple tags in the environment. In particular, the standard RFID
to environmental noise as well as the sidelobes of the antenna protocol (the EPC Gen2) can read multiple tags, and our
array projections. algorithm operates on the channels of each of the tags inde-
RFly can obtain an RFIDs 2D location from a 1D trajectory pendently.
since it leverages non-linear projections in Eq. 12. Aside from the ability to accurately localize RFIDs, RFlys
The above example demonstrates that RFly can estimate an RFIDs approach of leveraging drones does not suffer from blind
location by simply picking the peak in P (x, y) when the line-of-sight spots which are typically very challenging with stationary
path is the most dominant. However, indoor environments are abound RFID readers (due to destructive interference or orientation
with multipath due to the various reflectors (walls, furniture, ceil- mismatch) [31]. This is because the drone can capture each
ings, etc.). Fig. 6(b) shows P (x, y) for an experiment run with heavy RFIDs response from different perspectives.
multipath due to steel shelves in the surrounding environment. The RFlys algorithm can seamlessly deal with scenarios where
figure shows multiple dark red regions, indicating various potential an RFID is within the communication range of both the relay
positions for the RFID. and an RFID reader in the environment. In such scenarios,
To address multipath, RFlys underlying insight is that indirect the channel from the (stationary) reader to the RFID remains
reflections (caused by reflectors) always arrive along a longer path constant, while that from the relay to the RFID varies due to
than the direct path from the RFID to the relay. Hence, the ghost motion. As a result, the constant channel is factored out by
locations caused by multipath reflections are always further from the Eq. 12 and does not affect the localization results.
robots trajectory than the actual tag location. RFly harnesses this It is worth noting that the reader may still use f in Eq. 12
insight in its localization process. In particular, rather than picking despite the fact that the isolated channel is measured at f 2 .
the highest peak in Eq. 12, it chooses the peak nearest to its trajectory. This owes to the fact that the relay can ensure that ( f
f 2 )/f < 0.01 by shifting the center frequency by as little as
7 The literature also discusses multi-resolution algorithms for optimizing the search, 1MHz while still ensuring that the half-links do not interfere
which we omit in our discussion for brevity and refer the interested reader to [9, 37, 46]. as explained in 4.3.
SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA Yunfei Ma, Nicholas Selby, Fadel Adib
RFly Analog Relay RFly Analog Relay RFly Analog Relay RFly Analog Relay
1 1 1 1
0.8 0.8 0.8 0.8
0.6 0.6 0.6 0.6
CDF
CDF
CDF
CDF
0.4 0.4 0.4 0.4
0.2 0.2 0.2 0.2
0 0 0 0
0 20 40 60 80 100 120 140 0 20 40 60 80 100 120 140 0 20 40 60 80 100 0 20 40 60 80 100
Isolation (in dB) Isolation (in dB) Isolation (in dB) Isolation (in dB)
(a) Inter-downlink Isolation. (b) Inter-uplink Isolation. (c) Intra-downlink Isolation. (d) Intra-uplink Isolation.
Figure 9: RFlys Isolation from self-interference cancellation. RFly can achieve at least 50dB improvement in isolation over a traditional
analog relay.
battery. Since the battery is designed to support up to 21.6 Amps, experiment, we vary the power and the center frequency of the in-
the relay consumes less than 3% of the drones battery. put signal (within the UHF ISM band). We perform four types of
experiments:
6.3 RFID System Implementation and Evaluation To measure Intrad , we feed f 1 + 50kHz to the input of the
The overall system consists of RFlys relay mounted on a low-cost downlink (to emulate a query) and measure the power at the
commercial drone, an RFID reader which is compliant with the EPC output of the downlink at f 1 + 50kHz.
Gen2 protocol, and off-the-shelf low-cost passive RFID tags. To measure Intrau , we feed f 2 + 500kHz to the input of
RFID Reader: State-of-the-art commercial off-the-shelf RFID read- the uplink (to emulate an RFIDs response) and measure the
ers have limitations in accurately measuring the phase with a full power at the output of the downlink at f 2 + 500kHz.
360-degree cycle. For example, the ThingMagic M6e reader [4] To measure Interdu , we feed f 2 + 50kHz to the input of the
can only report phases between 0 and 180 degrees, while the Imp- uplink (to emulate a the leakage of a query from downlink to
inj R420 [2] experiences 180 degrees random phase jumps. Hence, uplink) and measure the power at the output of the uplink at
we adapt a USRP RFID reader implementation developed in [26] f 1 + 50kHz.
and incorporate RFlys localization algorithm described in 5. The To measure Interud , we feed f 1 + 500kHz to the input of
reader handles a variety of commands including the Query com- the downlink (to emulate a the leakage of a tags response)
mand, ACK command, Select command, and QueryRep Command. and measure the power at the output of the downlink at f 2 +
We retrieve the complex channels from USRP and post-process them 500kHz.
in MATLAB. We compute the isolation as the signal attenuation (between the
Passive RFID Tags: We use the Alien Squiggle General Purpose input and output of interest) plus the gain. This allows us to factor
tags [12] in our evaluation, which are the current industry standard. out the gain of the circuit. We also count the isolation of the antennas
The cost of each tag is $0.12. toward the total isolation.
The CDFs for the isolations are shown in Fig. 9. The figures
Ground Truth: We use OptiTrack [5], which is an optical tracking
also report the amount of isolation achieved by a baseline analog
system, as a ground truth for location measurements. The system
relay. The baseline implements a traditional analog relay design that
consists of an array of infrared cameras mounted on a ceiling, and
achieves isolation by antenna separation and polarization. Note that
can achieve sub-cm localization accuracy in tracking objects tagged
the antennas are spaced relatively closely (at 10cm separation) to
with infrared-reflective markers in its line-of-sight. The optical track-
enable a compact relay that can be mounted on a drone. Recall that
ing system serves two purposes: first, it measures the ground truth
RFly can only rely on analog cancellation in order to preserve phase
location of the target RFID tag. Second, it captures the flight path
and timing characteristics for localization.
trajectory of the drone. Note that the drones trajectory may also be
The figures demonstrate the following findings:
acquired from its odometry sensors.
RFlys relay achieves median isolations of 110, 92, 77, and
7 RESULTS 64dB. These consist at least 50dB improvement over a tradi-
In this section, we report the results of RFlys evaluation. tional analog relay.
The inter-link isolations (110dB and 92dB) are higher than
7.1 Does RFlys Relay Satisfy the Two Key the intra-link isolations (77dB and 64dB). This is expected be-
cause RFlys isolation is achieved primarily through baseband
Properties?
filters that are optimized for maximizing low frequency can-
First, we evaluate whether RFlys relay satisfies its two key proper- cellation (which is used in RFlys inter-link isolation) rather
ties: bidirectionally full-duplex and phase-preserving. than minimizing high frequency feed-through (which results
(a) Self-interference Cancellation: We evaluate the amount of iso- in intra-link leakage). Note that additional RF filters can be
lation achieved on each of the four self-interference links described used if higher isolations are needed.
in 4. We run 100 experimental trials in total. In each trial, we use The downlink isolation is higher than the uplink isolation.
the USRP to generate an input signal that is fed to the relay, and we This is because the downlink (low-pass) filter results in more
perform power measurements using a spectrum analyzer. In each attenuation than the uplink (band-pass) filter. Note that this
SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA Yunfei Ma, Nicholas Selby, Fadel Adib
60
0.4
40
0.2 20
RFly
No-Mirror
0 0
0 20 40 60 80 100 120 140 160 180 0 10 20 30 40 50 60
Phase Error (in degrees) Distance (m)
Figure 10: Phase accuracy with and without the mirrored archi- Figure 11: RFlys detection with range. RFly can detect RFIDs
tecture. RFly enables preserving the phase of the relayed signal to more than 50 m away from the reader with 100% accuracy in line-
enable SAR-based localization. of-sight and 75% in non-line-of-sight. Without the relay, the range
decreases to less than 10 m.
discrepancy is benign since RFlys relay is optimized for read rate stays at 100% even if the relay is more than 50 m in line-
downlink isolation (as explained in 6.1) to enable more of-sight. In non-line-of-sight scenarios, the read rate drops to 75%
amplified power delivery to an RFID. at a distance of 55 m.
(b) Phase Preservation: Unlike conventional relay technologies We note few important points about these results:
which introduce random frequency and phase offsets, RFlys relay These results are not surprising as per Eq. 4. Specifically,
is phase-preserving. In particular, it only introduces a constant phase based on 7.1, RFly can achieve more than 70 dB isolation
offset (due to the hardware path) which can be eliminated using the across each of its sources of self-interference. This translates
drone-embedded RFID as described in 5.1. to a theoretical range of 83 m in line-of-sight. In non-line-of-
To measure the phase-preserving capability of RFlys relay, we sight environments, it naturally decreases due to attenuation.
place an RFID tag 0.5 m away from the relay and connect the Most of the gain comes from the reader-relay half-link. Specif-
relay over the wire to the USRP-implemented reader. We run 50 ically, the relay-RFID half-link remains restricted to 3-5 m
experimental trials in total. In each trial, we generate a readers query since the relay still needs to power up the tag. However, the
with a random initial phase using the USRP and feed it as an input reader-relay half link is primarily limited by isolation as de-
to the downlink relay. The relays uplink output is also connected scribed in 4.
directly to a reader. The readers decoder computes the channel of
(b) Localization Accuracy: We mount RFlys relay on a drone and
the RFID and extracts its phase. We measure the offset as the phase
run experiments to measure the localization accuracy throughout
difference between estimated channels across the different trials.
the experimental environment detailed above. To obtain an accurate
We use the embedded RFID in order to factor out the effect of the
ground truth for locations, we use the OptiTrack system described
hardware channel.
in 6. The system uses infrared-reflective markers on the drone and
The CDF of the phase offset is shown in Fig. 10. The median
the RFIDs in order to measure their exact locations. We ensure that
phase error in our mirrored architecture is 0.34 and the 99t h per-
the drone remains within the field of view of the OptiTrack infrared
centile error is 1.2 . In contrast, without a mirrored architecture (i.e.,
cameras. In order to test RFly throughout a large area, we vary
if the upconversion/downconversion frequencies are not locked to
the location of the RFID reader across two floors of our building.
the same synthesizers), the phase is completely random as shown in
Throughout these experiments, the RFID of interest is placed on the
Fig. 10. This shows that RFly can preserve the phase of an RFIDs
ground in order to focus on RFlys ability to perform 2D localization.
response and use it for localization.
To perform localization, RFly utilizes the embedded RFID tag
to disentangle the phase and applies the nonlinear antenna array
7.2 How Does the Overall System Perform?
equation to compute target tag location in 2D space as described
Next, to evaluate that RFly can detect and accurately localize battery- in 5. We perform coordinate conversion between RFlys frame
free RFIDs over a wide area, we run 100 experimental trials locations of reference and the OptiTracks frame of reference. We compute
throughout two floors our research facility building. The building the localization error as the difference between the RFly-computed
is 30 40 m wide. Our experiments encompass both line-of-sight location and the OptiTrack computed location.
and non-line-of-sight settings and span three floors of our research Fig. 12 plots the CDF of the localization error across 100 exper-
facility. imental trials. These results demonstrate that RFly has a median
(a) Range Evaluation: To evaluate RFlys range improvement, we localization error of 19 cm and a 90t h percentile error of 53 cm.
run two types of experiments: one with the relay and one baseline This accuracy is comparable with state-of-the-art localization sys-
without the relay. At each location we measure the percentage of tems [44, 45, 48]. Moreover, in contrast to past RFID localization
decodable RFID tag responses to determine the reading rate. proposals that are limited in range to within few meters [45, 46],
Fig. 11 plots the reading rate as a function of distance. The figure RFly can achieve this accuracy at 10 the range of past systems.
shows that in the absence of a relay, the read rate drops to zero at This is due to the combination of its phase-preserving relay and
a range of 10 m. In contrast, in the presence of a relay, the readers through-relay localization algorithm.
Drone Relays for Battery-Free Networks SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA
1
2 SAR
1
0.4
0.5
0.2
0
0
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0.5 1 1.5 2 2.5
Localization Error (in meters) Aperture (m)
Figure 12: CDF of localization error. RFly achieves a median Figure 13: RFlys localization accuracy vs. aperture size. RFlys
localization error of 19 cm and a 90t h percentile error of 53 cm accuracy improves with a larger aperture.
across all the experiments.
2.5 SAR
7.3 How Does Localization Accuracy vary with
stations [15, 21, 29, 36, 52]. In contrast to all past relay designs, a drone around a warehouse to catalog the various items. The key
RFly introduces the first phase-preserving and bidirectionally full- challenge facing these vision-based techniques is that they can only
duplex relay. Note that the loss of phase and timing information work in line-of-sight environments; hence, they would miss most
is benign for existing relays since they were intended purely for objects in a warehouse since items are tightly packed together. In
communication purposes rather than for localization. However, it is contrast, by relying on RF signals, RFly can localize objects even if
critical for RFlys relay to preserve phase and timing information in they are occluded from its field of view.
order to localize the RFIDs. Another body of work has experimented with mounting an entire
Past full-duplex relay proposals fall into two categories: ana- RFID reader on a drones and flying in outdoor fields to detect the
log and digital [29]. Analog designs simply amplify and transmit RFIDs within its radio range [7, 30, 40]. However, because RFID
the packets [39]. As such, they suffer from the problem of self- readers and their large antennas are heavy, these proposals require
interference and they require large physical separation (and often larger, powerful drones (similar to delivery drones), which are unsafe
occlusions like walls) between the antennas to overcome that in- to operate near humans. As such, these proposals have either been
terference [18, 39].8 In contrast to these designs, RFlys intelligent deployed in outdoor yards [7] or have been tested in safeguarded
filtering and mirrored architecture allow us to embed the entire de- environments with no humans around. RFly differs from these past
sign on a miniature circuit, which we can mount on a drone. The systems in technology and capability. Technologically, it introduces
second category of full-duplex relays are digital i.e., require some a new relay design that is low-power and low-weight and can be
form of digital processing of the packet symbols [15, 21, 38], which mounted on small, light drones. In terms of capability, it not only
results in the loss of phase and timing information. In contrast to detects RFIDs within its radio range but accurately localizes them to
these past proposals, RFlys relay preserves phase and timing in- within tens of centimeters.
formation on both the uplink and downlink channels, enabling it to
localize RFIDs through the relay. 9 DISCUSSION & LIMITATIONS
RF-based localization is a classical area of research in wireless RFly demonstrates new possibilities for bringing ubiquitous connec-
networking spanning over two decades of academic research [10, 14, tivity and localization to battery-free networks. However, our current
24, 45, 46, 48]. Past proposals have demonstrated the ability to local- prototype still has few limitations that are left for future work:
ize active transmitters (such as WiFi [24, 44, 48] or active tags [27]) Reliance on vision-based systems: Our current evaluation
and battery-free nodes (such as RFIDs [45, 46]). In contrast to active relies on vision-based systems for navigation, obstacle avoid-
transmitters which can operate over a longer range, passive RFIDs ance, and stability. In particular, we place infrared-reflective
have no batteries; hence, their communication range is limited to markers on the drone and require it to remain within the field
within few centimeters to few meters. RFlys relay design and local- of view of the OptiTracks infrared cameras; hence, the drone
ization algorithm enable localization at distances 10 longer than would need to fly high enough to remain within the cameras
past state-of-the-art RFID localization proposals. field of view. However, it is desirable to enable the drone to
Algorithmically, RFly is inspired by past proposals in synthetic operate in more challenging environments. Future research
aperture radar (SAR) [17, 28, 45]. Specifically, we leverage the could leverage RF for drone self-localization and apply the
drones motion and exploit the fact that the drones trajectory emu- SAR equations on the channel of reader-relay half-link as de-
lates an antenna array. We introduce two primary innovations over all scribed in 5.2. Moreover, it would be interesting to explore
past systems. First, since indoor drones cannot carry an RFID reader, using RF signals for imaging indoor environments and aiding
we introduce a new relay design that enables a reader to capture in obstacle avoidance.
the phase of the signal. And second, we develop a new localization Operation Range: The systems range is limited to 55 m
algorithm that can operate on RF signals obtained through the relay due to the extent of self-interference cancellation. To cover
by intelligently disentangling the phase measurements as described a larger area, one could improve the design of cancellation
in 5.1. circuits and algorithms by building on past work in full-duplex
Longer-Range backscatter communication. RFly is also related designs [15, 38] or MIMO techniques [11].
to non-localization systems that enable backscatter devices to com- Swarm Extension: RFly currently operates with a single drone.
municate over a long range. These proposals either require bulky and It is desirable to extend the systems operation to swarms
expensive battery-powered RFIDs,9 or they require designing new of drones. Future research could explore designs that daisy-
backscatter hardware [35, 51]. In contrast, our system operates with chain the drone-based relays (as discussed in 4) to extend
passive off-the-shelf RFIDs which cost few cents and are widely the range of operation. The phase-preserving characteristics
deployed and adopted by the industry [33]. This is possible since our may also be leveraged by the drones to localize other drones
relay is designed to operate as transparent intermediary for RFID in cluttered environments.
communications. Despite these limitations, RFly marks an important step toward
Drone Solutions. Recently, few startups have proposed leveraging enabling long-range communication and localization in battery-free
drones in warehouse inventory control [7, 16, 20]. By mounting a networks. More importantly, it motivates new directions in network-
barcode reader or a camera on a drone, these proposals aim to fly ing research that combine the agility of drones with the sensing
capability of RF signals. It also motivates new relay designs that
8 Without such separation, these proposals cannot amplify too much. enable communication, sensing, and localization beyond the realm
9 Active RFIDs cost 100 1000 more than passive RFIDs [13]. of battery-free networks.
Drone Relays for Battery-Free Networks SIGCOMM 17, August 21-25, 2017, Los Angeles, CA, USA