![Page 1: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/1.jpg)
“Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact that the EPC Gen2 protocol is available publicly, but the ISO-18000 documents are not. The tutorial is “mostly correct” technically; however, the audience was expected to be mostly RF/Radar people, the talk is very light on the circuit details.
There are several errors on the OTA slides due to poor copying; so, caveat lector, if it the schematic looks wrong: it is. The table for the 130 process also has “um” where I should have had “nm”.
03 MAY 2016Brian Degnanhttp://users.ece.gatech.edu/~degs
![Page 2: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/2.jpg)
ReverseEngineeringapassiveUHFRFIDTag
Whynot?
BrianDegnan,Ph.D.
![Page 3: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/3.jpg)
What’sthisabout?
• AparAalimplem
entaAonGen2forUHFRFID
• Whytheelectronicsideisrelevant.
• Components(sam
ebutdifferent)• System
componentsandbounding
theproblem
• CircuitintuiAon
![Page 4: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/4.jpg)
TheTagSystem
• Gen2:860MHz-960M
Hzsub40kHz-640kHz• PassivelyPow
ered~20ktransistors
![Page 5: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/5.jpg)
gSystematalink
![Page 6: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/6.jpg)
Why
other?• IhaveW
ISPs!• Icanjustputaba\eryonit.• IcannottaketheAm
etodesignfrom
scratch• Rem
ovalofconstraintsopensinnovaAon
![Page 7: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/7.jpg)
EnergyStorage• 1000J~1m
^2sunlightsecondsecond
• 100Jreleasedfrom
ahuman
persecond• U
SAuses4W
EIRP
![Page 8: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/8.jpg)
MooreM
oreMooreLess
AssumpAons:
--Transistorsscaling--Processingpow
ercorrelatestotransistors
Moore’soriginalgraph.
![Page 9: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/9.jpg)
Degnanetal,AssessingTrendsinPerform
anceperWa\forSignalProcessingApplicaAons
TVLSI2014
![Page 10: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/10.jpg)
Howthingsusedtobe.
![Page 11: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/11.jpg)
![Page 12: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/12.jpg)
Advantages
• SuperiorPowerPerform
ance• SuperiorProcessingPow
er
![Page 13: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/13.jpg)
A130nmProcess
![Page 14: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/14.jpg)
eviceReview:
ransistor
• MOSFETisoneofm
anydevices.• Voltagecontrolledcurrentsource• Theinputlookslikeacapacitor• M
ulApleoperaAngregimes
• Mathem
aAcsandphysicsaresimple,but
realityisterrible.
![Page 15: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/15.jpg)
TransistorSymbols
![Page 16: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/16.jpg)
nFET@130nm
![Page 17: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/17.jpg)
• SubVth
• AboveVthGraph:65nmnFETgatesw
eepfromIBM
’s65nmadverAsem
ents.
![Page 18: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/18.jpg)
CompactEKVM
odel
![Page 19: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/19.jpg)
Boundingaprocess
![Page 20: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/20.jpg)
Diodes
![Page 21: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/21.jpg)
![Page 22: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/22.jpg)
![Page 23: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/23.jpg)
DiodeConnectedMOSFET
![Page 24: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/24.jpg)
LinearCapacitor
• Linearityisexcellent• Frequencyresponseisexcellent• ChargeDensityisLow
![Page 25: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/25.jpg)
DepleAonCapacitor
• Linearityisvariable• Frequencyresponseisvariable• ChargeDensityisexcellent
![Page 26: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/26.jpg)
(n)MOSC-Vcurveox
C
depC
Depletion
oxC
Inversion
max
,m
in,
min
, min
,m
in
w
here
d
Sidep
depox
depox
XC
CC
CC
C
ε≡
+=
ox oxox
tC
ε≡
d Sidep
XC
ε≡
![Page 27: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/27.jpg)
![Page 28: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/28.jpg)
Systemesign
• HarvestEnergy• Createastablepow
ersupply• ResettheSystem
• Decodetheincom
ingdatastream
• Respondtothedecodeddata
![Page 29: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/29.jpg)
Gen2Protocol
![Page 30: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/30.jpg)
Gen2Waveform
![Page 31: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/31.jpg)
Exam
ple Tag 0.5mm
2Tag:Digital~30%
EEPRO
M~20%
RF+DCreg~20%
Others(RN
G,ChargePum
p,supportfuncAons):30%
Barnetetal,APassiveU
HFRFIDtransponderforEPCGen2in0.13umCM
OS(TI
sgen2tag)ISSCC2007
![Page 32: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/32.jpg)
EnergyHarvesAng
![Page 33: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/33.jpg)
nergyarvesAng
• Num
berofstages• ReceivedEnergy• CurrentLoad• EtCetera
![Page 34: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/34.jpg)
![Page 35: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/35.jpg)
Wuetal,
MOSChargePum
psforLow-VoltageO
peraAonJSSCC1998
![Page 36: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/36.jpg)
owerRegulator
![Page 37: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/37.jpg)
![Page 38: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/38.jpg)
![Page 39: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/39.jpg)
DigitalPOR
![Page 40: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/40.jpg)
![Page 41: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/41.jpg)
emodulaAon
![Page 42: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/42.jpg)
![Page 43: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/43.jpg)
DataExtracAon
![Page 44: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/44.jpg)
![Page 45: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/45.jpg)
![Page 46: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/46.jpg)
![Page 47: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/47.jpg)
PRNG
• SRAMIniAalState
• ThermalN
oise• O
scillatorSampling
![Page 48: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/48.jpg)
OscillatorSam
pling
![Page 49: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/49.jpg)
ModulatedResponse
![Page 50: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/50.jpg)
![Page 51: “Reverse Engineering a passive UHF RFID Tag” was a · “Reverse Engineering a passive UHF RFID Tag” was a tutorial given at IEEE RFID 2016. The talk was motivated by the fact](https://reader034.vdocument.in/reader034/viewer/2022050308/5f7026688d0e116a257fdc67/html5/thumbnails/51.jpg)
QuesAons?