RF unlocked

Divide mechanized communication into two types—one in which people originate or use the payload messages directly and one in which the payload both originates and terminates with an object. Technologies for the direct method include everything from the telegraph to satellite television and film to streaming media. Among their other attributes, mechanisms of this type convey messages over distances large and small and are the focus of much societal attention.

The other sort, communication between objects, by in large limits itself to relatively short spans and tends to fly beneath the radar of our collective notice. These technologies, however, are weaving themselves more and more into the fabric of our daily lives and, in some cases, into the very fabric of our clothing. Just as people have changed the way they interact since the advent of e-mail and instant messaging, so, too, have shop floors, hospitals, retail establishments, and a host of other environments changed their methods of collecting and sharing information among devices.

Humans have not necessarily been cut out entirely from this segment, but when we are involved, our actions usually trigger a communication event rather than dictate or control its content. It is this last bit that allows these systems to go largely unnoticed and occasionally stir up controversy.

A simple and uncontroversial example is the familiar fob in an automotive RKE (remote-keyless-entry) system with which you lock or unlock a car's doors and trunk (Figure 1). A key press might mean "unlock" to you and me, but to the RKE system, the simple gesture starts a sequence of some 64 to 128 bits. The message payload includes identity information and the instruction. Though a human act initiates the message, its content is intended only for the machine and remains, one hopes, unknown to humans.

This familiar arrangement is in several ways typical of many machine-centric communications applications. The payload data is short, as is the link distance the system needs to accommodate. These systems impose low-duty-cycle demands on a channel, so many devices can share a band. On the other hand, the need for authentication is high as is the need for low-power operation. Also common to many of these applications is the fact that the more portable end of the link—the one that needs to use the smallest and lightest power source—is the one that needs to convey the information in unidirectional systems.

In the case of the RKE system, the fob typically operates on a small, nonrechargeable, lithium coin cell that users expect to last three to five years. To extend the battery's life, many systems employ ASK (amplitude-shift-keying) modulation at 2 to 20 kbps (Reference 1).

Despite its access to a power source with thousands of times greater capacity than the transmitter's, the RKE receiver must usually also operate on no more than 1 mA or so of current. Unlike the transmitter, which operates only when a user presses a key, the receiver must continuously monitor for an incoming message without draining the car battery—during a two-week stay in an airport parking lot, for example. Alternative receiver strategies include polling for an incoming signal between sleep states. The receiver in such an arrangement needs to quickly power up and make a polling determination to keep its duty cycle low and realize a power savings. Another power-savings strategy is to "sleep with one eye open," so to speak. A chip selectively biases only those sections it needs for a given activity.

Maxim's MAX1470 is a 3.3V superheterodyne ASK receiver for 300- to 450- MHz operation. Its 5.5-mA active-current draw falls to less than 1.5 µA. Except for a few passive components and an inexpensive, 10.7-MHz IF filter, the 1470 is a self-contained receiver from its RF input to its digital output for data rates as high as 100 kbps. The SSOP-28 package includes a low-noise amplifier, a mixer, a limiting amplifier, a filter, a peak detector, and a data slicer. The data slicer is a self-thresholding comparator circuit that converts the analog representation of the incoming data into a serial bit stream. The $1.65 (10,000) receiver also features an on-chip, PLL-based, quadrature VCO that generates all the needed timing signals from an external crystal.

A similar part, the MAX1473, includes the 1470 architecture and adds a one-step AGC that cuts the low-noise amplifier gain by 35 dB when the input RF signal exceeds –57 dBm. The $1.95 (10,000) IC operates from either 3.3 or 5V supplies and is available in an SSOP-32.

The corresponding ASK transmitter, the MAX1472, fits into a SOT23-8 and draws 100 nA in standby mode. Output power can vary from –10 to +10 dBm. At the upper end of the power range, the $1.39 (1000) transmitter draws 5.5 mA when operating at 315 MHz with a 50% duty-cycle data-coding method.

Maxim offers an evaluation kit, the MAX1470EV, in two versions for 315- and 433.92-MHz operation, both at 5 kbps. You can modify the kits by changing passive components to operate at 250 to 500 MHz. A further modification allows you to select data rates of 0 to 100 kbps. Maxim has posted the MAX1470EV Gerber files, which you can download to speed your layout design.

Microchip adds code-hopping capability to its ASK transmitters and receivers for additional security in the 310- to 440-MHz range. The rfHCS362G transmitter uses an encryption key that its programmer calculates based on the transmitter's serial number and a manufacturer's code that is unique to each OEM using the part. The transmitter uses the key and a synchronization counter to generate a unique 69-bit PWM or Manchester-encoded sequence for each transmission.

Whereas you mate Maxim's transmitter with a small microcontroller to allow you to transmit arbitrary short data messages, the $2.14 (1000) Microchip transmitter integrates the micro in its SO-18 package but limits your messages to event indications. The device has four logic inputs with internal 40-kΩ pulldown resistors that you can connect to pad switches. The transmitter distinguishes between single inputs and input combinations, extending its message complement to 15.

The rfHCS362 can operate from a 2 to 6.3V power source and develop an adjustable output over –12 to +2 dBm. The chip can send a battery-low signal to the receiver when the supply falls below a programmable threshold associated with an on-chip supply monitor. The maximum operating supply current is 1.2 mA, and the current drops to a maximum of 1 µA in standby. The device also provides an LED drive to indicate the battery condition at the transmitter. A flash pattern indicates the battery condition; the device offers a programmable choice from two sets of patterns.

Programmers and evaluation kits are available from the manufacturer, as is an FSK (frequency-shift-keying) version of the transmitter—the $2.24 (1000) rfHCS362F—available in an SSOP-20. Both ASK and FSK versions use the same code-hopping encoder, though you should not confuse its use in the FSK transmitter with FHSS (frequency-hopping-spread-spectrum) modulation: The code-hopper operates in the data domain and does not change the output spectrum as would an FHSS modulator.

The applications for short-haul UHF communication are certainly not limited to automotive RKE but include a broad range of security, remote-sensing, telemetry, and data-acquisition uses, some requiring two-way communication. For bidirectional applications, Micrel offers a pair of $6 (1000) UHF transceivers in LQFP-44s—the MICRF501 and 500, which cover 300 to 500 MHz and 700 to 1000 MHz, respectively. Both devices process FSK signals at 2.4 to 128 kbaud. At these signaling rates, the data rate you realize depends on the data-coding method you choose to ensure that the modulation signal is free of dc. Zero dc offset is a necessary condition, because the coded data modulates the VCO, and residual dc corresponds to a tuning error in the center frequency. For example, Manchester coding, which codes information not in the levels but in the transitions, follows each pulse with one of the opposite sense (Figure 2). The result is a bit rate that equals half the baud rate. A 3B4B block code provides a bit rate that is three-quarters of the baud rate. The MICRF50x's sensitivity to dc might appear as a liability, but you can use it to your advantage. For example, you can implement an FHSS-modulation scheme to improve channel reliability in the face of narrow-spectrum in-band interference or to gain from the probabilistic nature of spread-spectrum communications in environments with many, potentially colliding, message sources. Both transceivers deliver 10 dBm into 100Ω but draw less than 2 µA in power-down mode. The receiver sections typically provide –104-dBm sensitivity for a bit-error rate) of 10^–3 at 19.2 kbaud. The 1-dB input compression levels are –34 and –41 dBm for the 500 and 501, respectively.

You need an external micro to handle baseband functions, such as data encoding, packetizing, frequency-hopping, and clock recovery. To speed development, you can download assembly-language code for Microchip PIC processors from the Micrel Web site. You can also use RFOS, a C-language code set from Venture Technologies that you can port to the controller of your choice. Micrel can also supply evaluation kits and transceiver modules for quick prototyping and development.

Chipcon's CC1020 transceiver operates over the 424- to 470-MHz and the 848- to 940-MHz ranges. An on-chip digital modulator can implement ASK, OOK (on-off keying—essentially, ASK with 100% modulation), FSK, and GFSK (Gaussian-filtered FSK). FSK systems abruptly switch the carrier frequency between two values. The high dF/dt results in a broader spectrum than that which the two FSK frequencies define. The GFSK modulator imposes a slower transition, narrowing the spectrum and, consequently, reducing the adjacent channel power. Though it may appear counterintuitive at first glance, slowing the modulation transitions allows GFSK to modulate higher data rates within a given bandwidth than does FSK. For FHSS FSK modulation, the 1020's fast PLL-response time can follow as many as 100 hops per second.

Your application can control and interrogate the CC1020 through its four-wire SPI, which provides access to 51 registers. Among the many operational parameters you can control through the SPI is the output RF power, adjustable from –20 to +2 dBm in 1-dB increments. The corresponding controls on the receiver side set the VGA's minimum and maximum gain and gain-transition thresholds. You can also fix the VGA gain—a necessary configuration for ASK and OOK operation. To meet channel-width and -spacing requirements that differ by locale and band, you can program the 1020's on-chip receiver filter to one of seven bandwidths from 12.5 to 500 kHz. This feature also allows you to trade off the receiver's sensitivity and adjacent-channel rejection for greater frequency tolerance in applications that suffer from frequency drift. For example, at a carrier frequency of 868 MHz, using FSK modulation, the receiver sensitivity is –117 dBm with a 12.5-kHz channel bandwidth. Opening the receiver's filter to 25 kHz reduces the sensitivity 4 dB, and opening it further to 500 kHz drops the sensitivity to –94 dBm. You can gain another 2-dB sensitivity by using an optional external transmitting and receiving switch to isolate the receiver from the transmitter's output matching network.

Chipcon's $2.60 (1 million) transceiver can operate at one of seven crystal frequencies. All provide the nine octave-related rates from 600 baud to 153.6 kbaud. Depending on the crystal you choose, you can switch among 18 rates from a matrix of 32. Again, keep in mind that the data rate you realize depends on the baud rate and the data-coding method. At the system interface, the transceiver's data interface uses the NRZ format. The transceiver can pass the data through in that format or convert it to Manchester format. The advantage of NRZ is that it codes one bit per symbol, in which case the baud rate and bit rate are identical. Some FSK demodulators, however, require the constant dc level that results from demodulating Manchester-encoded or other dc-balanced data. The cost of compatibility with such demodulators is a halving of the bit rate for a given baud rate. The benefit, similar to the advantage of FM over AM in broadcast transmissions, is less susceptibility to interference sources near the receiver.

The CC1020 transceiver, available in a QFN-32 package, also provides a variety of programmable power-down and wake-up options and can provide an off-chip power amplifier and an off-chip low-noise amplifier for applications requiring greater transmitter power and receiver sensitivity, respectively. If the on-chip power amplifier and low-noise amplifier are sufficient for your application, you need to add only three resistors, eight capacitors, two inductors, and a crystal—not counting supply bypass capacitors. Whether you provide an external power amplifier or use an on-chip output stage, remember that you are responsible for ensuring that your product meets the regulatory requirements for the locale for which it is sold, even when operating in "unlicensed spectra" (see sidebar "Keep it legal").

Support materials available from Chipcon include a development kit, a reference design, and a Windows application called SmartRF Studio that allows you to program the CC1020 from your PC through the development kit. Don't discount the support value of the 62-page data sheet. It's well written and organized and likely worth a perusing even if you are only peripherally involved in the subject.

Standards-based wireless-LAN and -PAN (personal-area-network) technologies, such as 802.11, Home RF, and Bluetooth, famously share the 2.4-GHz ISM (industrial-scientific, and medical) band with wireless phones and microwave ovens. But don't forget that the industrial, scientific, and medical sectors that make heavy use of remote sensing and data acquisition along with more common data-communication functions. The heavy use of spread-spectrum techniques in this band allows autonomous networks to coexist essentially as noise sources for one another. As long as the noise energy doesn't reach too high a level, multiple networks can operate with overlapping service regions, particularly if they use dissimilar modulation schemes.

Nanotron Technologies offers the nanoNET TRX transceiver, which can deliver a 2-Mbps data rate and a 10^–3 bit-error-rate range of 60m indoors at 10-dBm output. The free-space range is 700m. The manufacturer also claims that the nanoNET TRX transceiver requires significantly less energy per bit than its competitors—ranging from a six-to-one benefit over 802.11b to a 60-to-one advantage over Bluetooth. Vendors of 802.11a make similar claims to a bit-energy advantage; their rationale is that their higher transmission bit rate requires less transmitter time and that the transmitter's power dissipation is not strictly proportional to the bit rate. Therefore, they can transmit a given block of data using less energy than competing methods (Reference 2). Nanotron's transceiver, however, operates at slower bit rates than 802.11b, so the fast-burst argument works against it. Nanotron has apparently overcome the disadvantage by designing and fabricating a more energy-efficient circuit. Indeed, with 802.11 operating at a two-to-one speed advantage, the nanoNET transceiver operates on somewhat less than one-tenth the power.

The company did not release details about the test-sample devices, the test suite, the performance maps, or other unprocessed data when it published its performance summaries. What vendor does? However, two factors give credence to its claims. First, most 2.4-GHz transceivers are fabricated in standard CMOS for its low cost and plentiful capacity. The nanoNET TRX is fabricated in silicon-germanium BiCMOS, which is available from numerous foundries. It uses the same starting material as standard CMOS but offers a number of advantages for low-power RFICs (Reference 3). Second, the modulation method Nanotron developed exploits functions that the manufacturer can implement with fairly simple and compact analog circuits.

The transceiver supports four modulation modes based on a CSS (chirp-spread-spectrum) scheme. CSS takes advantage of the relationship between a sinc pulse and a chirp, or linear frequency-modulated impulse (Reference 4). The Fourier transform of a time-domain sinc pulse,

is a rectangle in the frequency domain of spectral width B and amplitude proportional to U₀. In practice, you can't generate a precise sinc pulse because the definition extends to ±∞. The spectrum that corresponds to the truncated sinc that you can generate has some roll-off at the corners and some ripple energy beyond the ideal spectral width, but to a good approximation, realizable sinc pulses occupy their full target spectrum with little spill-over into the adjacent bands.

The frequency-domain representation of a linear, frequency-modulated impulse—a chirp—of fixed amplitude in the time domain also approximates a rectangle. Similar to the sinc pulse, the chirp waveform you can generate is a truncated version of the ideal, so, again, the spectrum shows rounded corners and some ripple energy that extends beyond the bandwidth B but remains a good approximation to the rectangular spectral plot. The two waveforms are related not just by the coincidence of spectral shape, however. You can transform one to the other by passing the signal through a dispersive delay line, such as a SAW filter (Figure 3).

The nanoNET TRX transmitter codes the data stream as a phase component, φ, of the carrier, ω, that the sinc pulse modulates:

Passing the modulated signal through the dispersive-delay line results in the chirp-pulse:

where T corresponds to the pulse duration, and µ is a modulation parameter. The IC integrates the timing circuits for clock, carrier, and chirp and draws upon few external components.

The €7.50 (100,000) transceiver's data rate is not world-class for office wireless LANs. But keep in mind that industrial applications generally use comparatively short, sparse messages and place a higher value on channel availability and robustness, which affect message latency, than on raw data rate. Another consideration for industrial front-end applications is I/O capability. The transceiver includes a four-channel, 14-bit ADC and a four-channel digital I/O in its MLF-48 package. The I/O capability simplifies a remote-node design and allows you to use a smaller, lower power microcontroller in industrial controls, building-climate- and lighting-management, alarms, and remote-metering applications.

Nanotron also offers evaluation boards, sample application software, and a protocol stack containing the MAC (media-access-control) and DLL (data-link-layer) code that you can port to the microcontroller of your choice. The protocol stack requires only 4 kbytes of ROM space. The MAC supports TDMA (time-division-multiple-access) and CSMA/CA (carrier-sense-multiple-access-with-collision-avoidance) protocols. Alternate-path routing and 128-bit encryption support network robustness and security.

The preceding transmitters and transceivers cover a broad range of carrier frequencies, modulation methods, data rates, and ancillary capabilities. They share one unsurprising trait: They all operate from low-voltage power sources. Passive-power RFID (radio-frequency- identification) tags need no local power source at all—a fact that has fueled their use to ubiquitous levels. Look around; you're probably wearing one. Building-access cards are one common application that exemplifies the tag's advantages over magnetic stripes, keypad access, or key-and-lock security systems: They operate without making contact with the reader, so no wear mechanisms are related to their use, and, though they are inexpensive, users cannot casually replicate them. An RF transponder can communicate through an encapsulant. RFID tags, for example, can thus work in environments too hostile for other technologies to operate reliably, such as those with high levels of dust, dirt, or excessive moisture (Reference 5). The tags are inexpensive, on-site-programmable, and lightweight, and they can fit into a variety of carriers to simplify their integration into an application. Active-power RFID tags, which include a battery in the carrier, are also available for situations that demand greater range.

The two ends of the RFID link are the reader, often a stationary device, and the transponder or tag, which is free to move into and out of the reader's domain. The reader uses an RF generator, and a resonant load, L_R and C_R, to establish an electromagnetic field. The tag is equipped with a tuned tank of its own, L_T and C_T. RFID systems can use two coupling methods. Bringing the two inductors into mutual proximity forms a loosely coupled, tuned, air-core RF transformer for low-frequency devices operating in the near field (Figure 4). Your building-access ID badge, which operates when you bring the badge to within a few centimeters of a reader, might take advantage of magnetic coupling. High-frequency devices depend on electromagnetic-wave propagation and benefit from larger operating ranges, such as those needed for highway-toll tags.

A passive tag uses the reader's RF-field energy as its power source and modulates a data stream back onto the carrier as either an amplitude or a phase signal. Active-power tags can also take advantage of a third method: establishing and modulating a second carrier for the back channel. RFID systems operate in one of three bands, depending on the application environment and the communication requirements. Low-frequency devices operating in the neighborhood of 125 kH can tolerate random transponder orientations. Applications that benefit from this capability include parcel-delivery systems that interrogate tags on packages as they pass on a conveyer, and inventory-control systems that must identify many individually tagged objects sharing one container. Tags operating at 13.56 MHz are useful for cost-sensitive, short-range applications, such as marking consumer goods. UHF tags operate in the 900-MHz band over a range of 2m. The ICs for this part of the spectrum are small and may implement an anticollision protocol.

Major vendors of RFID tags and support equipment include Philips Semiconductors, STMicroelectronics, Texas Instruments, and the lesser known EM Microelectronic. One such device, the 21-cent (1 million) EM4450 from EM Microelectronic, is a passive tag that operates from 100 to 150 kHz. The two-pin device includes an on-chip resonator capacitor, a rectifier, and a voltage limiter. It requires only one external component: a pickup coil.

Each device has laser-programmed device-ID and serial numbers, and 1 kbit of EEPROM organized as 32 words of 32 bits. The device password, the read-and-write-protection word, and the control word take three words of the EEPROM space. The combination allows the system to specify memory areas that may be read, those that are read-protected, and those that are write-inhibited. The password, required to gain access to protected memory areas and to execute certain instructions, does not allow readback under any mode.

Data transfers use even parity for rows and columns resulting in a 45-bit pattern per word. Attempts to access read-protected words result in a bit pattern of 45 zeros. Two transfer modes allow AM carrier modulation at either 32 or 64 cycles per bit, corresponding to about 1.9 and 3.9 kbps, respectively, at 125 kHz. At power-up, the device enters its standard read mode, which starts with a listen window during which the reader can issue a pattern that prepares the tag to receive data. If the tag receives only the carrier, it automatically sends a word after the listen-window period times out. The total tag-read transaction times are 12.8 and 25.6 msec, respectively, for the two bit-rate options.

RFID tags have enabled great savings in a wide rage of uses, but they also engender a certain amount of controversy, particularly among privacy-rights advocates (see "Who's in the debate?" this issue, pg 30). Passive tags have virtually unlimited lifetimes. They require no user input to activate them, the user cannot shut them off. If they come within range of a reader, they report their contents. Although few argue against tags for applications such as inventory control or theft protection, many are concerned about developments that can lead to tracking individuals through an environment, be it a store or a workplace. These concerns are growing as advanced processes enable manufacturers to shrink a tag die to the size of a pepper flake. Modern tag designs are also extending the useful operating range of RFID devices, which some fear will increase the ability of hidden readers to communicate with tags embedded in credit cards and other commonly carried items. Whether these concerns are legitimate or the paranoia of a public resistant to change is a discussion for public-policy debates—themselves terribly lacking in the area of technology use. For designers and marketers of devices that use RFID tags, they are issues that can affect the market acceptance of your product and are thus worthy of your consideration.

Author Information

You can reach Technical Editor Joshua Israelsohn at 1-617-558-4427, fax 1-617-558-4470, e-mail jisraelsohn@edn.com.