Slocalization: Sub-{mu}W Ultra Wideband Backscatter Localization

Slocalization: Sub- µ W Ultra Wideband Backscaer Localization Pat Pannuto University of California, Berkeley Benjamin Kempke University of Michigan Prabal Dutta University of California, Berkeley ABSTRA CT Ultra wideband technology has shown great promise for providing high-quality location estimation, e ven in complex indoor multipath environments, but existing ultra wideband systems require tens to hundreds of milliwatts during operation. Backscatter communica- tion has demonstrated the viability of astonishingly low-pow er tags, but has thus far been restricted to narr owband systems with low localization resolution. The challenge to combining these compli- mentary technologies is that they share a compounding limitation, constrained transmit power . Regulations limit ultra wideband trans- missions to just -41.3 dBm/MHz, and a backscatter device can only reect the power it receives. The solution is long-term integration of this limited power , lifting the initially imperceptible signal out of the noise. This integration only works while the target is sta- tionary . Howev er , stationary describes the vast majority of objects, especially lost ones. With this insight, we design Slocalization, a sub-microwatt, decimeter-accurate localization system that opens a new tradeo space in localization systems and realizes an energy , size, and cost point that invites the localization of ev ery thing. T o evaluate this concept, we implement an energy-harvesting Slocal- ization tag and nd that Slocalization can recover ultra wideband backscatter in under fteen minutes across thirty meters of space and localize tags with a mean 3D Euclidean error of only 30 cm. 1 IN TRODUCTION Classically , high delity localization has been restricted to devices capable of actively b eaconing their position, placing an energy demand on the device to be localized, r equiring large energy stores, and resulting in limite d lifetimes. Recently , a body of work emerged that demonstrates the ability to locate passive RFID tags [ 30 , 46 , 48 ] or suciently large (i.e. human torso size d) tagless objects [ 2 ]. While the energy-free operation is appealing, these systems track their targets by observing changes in the environment, requiring that either the targets or their trackers move to be localized. Howev er , most things do not mov e. Indeed, a vast array of things from the TV r emote to warehouse assets to deploy ed sensors can be considered “nomadic, ” stationary but for o ccasional migration [ 36 ]. A key corollary to this observation is that the update rate for track- ing a nomadic object can be very low . T o that end, this paper intro- duces Slocalization , a new localization system that can lo calize static tags in both static and non-static environments with decimeter-level accuracy for less than one micro watt. At this power lev el, Slocal- ization is suitable for use with the burgeoning array of batteryless, energy harvesting systems [ 4 , 22 ]. A standalone Slocalization tag will well outlast the self-discharge lifetime of a standard coin cell battery [ 11 , 32 ]. Slocalization achieves this ultra-low power budget by reducing the location up date rate from order hertz to millihertz, or several minutes per location x. IPSN’18, April 11-13, 2018, Porto, Portugal For questions, email ppannuto@berkeley .e du . Slocalization lies at the intersection of two recent research thrusts: backscatter communication and ultra wideband (U WB) localization. Slocalization leverages backscatter to generate the U WB signals needed for high delity localization with minimal energy burden and utilizes the superior ranging resolution aorded by UWB sig- nals to recover decimeter-accurate estimates of tag position. In contrast to prior UWB systems, Slocalization tags do not actively emit RF energy , they only reect it, requiring a new system archi- tecture to capture, decode, and make use of these signals. One of the key challenges in backscatter communication is that RF path loss is suered twice, as the tag is simply a passive reector , resulting in very weak signals. FCC regulations further limit UWB signals to signicantly lower energy than narrowband, yet with Slocalization we are interested in cov ering whole rooms. T o inform design decisions and establish the feasibility of recovering signals, we develop a model for the UWB backscatter channel. W e use this model to explore what kind of signal energy can be recovered and how one might go about leveraging long integrations of the channel over time to extract a backscatter ed signal. T o move UWB backscatter from theory to practice, we develop a bandstitched, integrating U WB transceiver architecture . T oday , the only commercial UWB transceiver chip is the DecaW ave D W1000. Unfortunately , this chip is tailored to 802.15.4a communications, providing a relatively high-level interface, and do es not expose information on the underlying U WB channel to application dev el- opers. As both Adib [ 2 ] and Kempke [ 21 ] obser ve , developing a direct U WB frontend is prohibitively costly , requiring expensive or niche hardware . W e extend Kempke’s bandstitching receiver design to include transmission of U WB signals, demonstrating the rst end-to-end bandstitched GHz U WB transceiver ar chitecture. At this point, the weak tag signals are in the noise and cannot be seen. T o recover tag transmissions, Slocalization anchors inte- grate samples of the channel over time. A s environmental noise is generally white and Gaussian, its integration over time will r emain generally at. Integration of the periodic signal from the tag will cause it to rise above this noise, so long as the tag’s signal remains remains suciently stable during the course of the integration, that is, the tag has a good frequency source and does not move. With UWB backscatter in hand, we introduce the Slocalization architecture, an ov erview of which is shown in Figure 1 . Fixed an- chors with known positions in an environment emit pulses to sound the channel impulse response. Slocalization tags use a backscat- tering technique to perturb the channel impulse response with a periodic signal. Anchors integrate repeated measurements of the channel to lift the tag signal above the noise. After sucient in- tegration to identify the backscattered signal, anchors compute the time oset between the arrival of the backscattered path and the direct line-of-sight peak from the transmitting anchor . These time dierence of arrival estimates yield ellipsoids of possible tag locations for each pair of anchors. The Slocalization system nds the best intersection of these ellipsoids to realize tag position. T o the extent possible under law , the authors have waiv ed all copyright and related or neighboring rights to this work. This work is published from the United States. IPSN’18, April 11-13, 2018, Porto, Portugal Pat Pannuto, Benjamin Kempke, and Prabal Dua T ag Ancho r Ancho r Direct Pa th Scatter ed Path (a) Backscatter Setup CIR T ime (ns ) 0 1 2 3 4 5 6 7 8 Succ essive CIRs (b) CIR Behavior O ver Time 0 2 4 6 8 10 CIR Time (ns) 0.25s 0.50s 0.88s 1.50s 3.75s (c) Integrated CIR Over Time (d) Lateration Figure 1: Slocalization Concept of Operation. (a) Anchors emit periodic pulses that sound the ultra wideband channel. A tag modulates its antenna to either reect or absorb this signal, (b) perturbing the channel impulse response (CIR) over time. (c) Initially , the signal is too weak to detect. By integrating repeated estimates of the channel o ver time, the tag’s arrival signal appears and its arrival time can be estimated. (d) Anchors use the time dierence of arrival between the direct path between anchors and the backscatter path reected from the tag to form ellipsoids of possible tag locations. The intersection of sucient ellipsoids yields the absolute p osition of the tag. T o test whether the Slocalization system works in practice, we realize a prototype implementation. As we are motivate d by the vision of a batter yless future, we design our Slocalization tag to be energy har vesting, including only a 5 cm 2 solar cell and a 47 µ F capacitor for transient energy storage to power the tag. With this tag and the Slocalization transceiver , we are able to demonstrate the recovery and localization of U WB backscattered signals. Evaluating this prototype, we nd that in a complex, indoor en- vironment, Slocalization is able to localize the tag with only 30 cm average error . W e evaluate the impact of varying the integration time on the quality of the Slocalization result, as well as the range of integration times required to localize a tag as distance increases. W e then evaluate long-range performance, sho wing that across 30 m of space in both line-of-sight and non-line-of-sight conditions, Slo- calization can estimate tag distance to within 0.1 m in under fteen minutes. W e show that Slocalization is robust to motion and other interference sources in the environment, and nish by establishing the viability of concurrently localizing multiple Slocalization tags. In summary , the major contributions of this pap er are the de- velopment of a decimeter-accurate, FCC-compliant localization system capable of localizing sub-microwatt, static tags in static or mobile environments; the introduction of the rst ultra wideband backscatter platform; the presentation of a novel analysis of the ultra wideband backscatter channel; the development of a band- stitched ultra wideband transceiver architecture covering over one gigahertz of bandwidth; the introduction of integration to recover backscatter signals below the noise oor; and the demonstration of high-delity recovery of backscatter signals over thirty meters of free space in both line-of-sight and non-line-of-sight conditions. 2 BA CK GROUND AND RELA TED WORK While the backscattering concept dates back decades [ 40 , 45 ], there has b een a recent resurgence in research around backscatter , ex- tending the concept from beaconing simple identiers to high band- width communication [ 44 , 51 ], highly parallel communication [ 19 ], leveraging ambient envir onmental signals instead of active inter- rogators [ 25 ], or even motion capture [ 46 , 48 ]. Localization is a similarly mature line of research, howev er , with the advent of new FCC regulations in 2002, the last decade has se en an explosion of interest in U WB for localization due to the greatly improved resolution it can provide indoors [ 8 , 15 , 27 , 28 ]. Slocalization combines the best-in-class communication capabil- ities of backscatter with the best-in-class localization capabilities of UWB designs. W e begin by reviewing these technologies and how recent progress in each subarea has informed and inuenced the design of Slocalization. 2.1 Traditional Narrowband Backscatter In traditional backscatter systems, an interrogator (e.g. an RFID reader) emits a powerful, well-known signal—often a pure sine tone . T ags in the environment modulate the impedance of their antenna by op ening and closing a switch, changing their antenna from being highly reective to highly absorptive . A receiver 1 captures these reections and uses them to recover data from the tag. The key insight in backscatter is that it enables a vast energy asymmetr y between the anchor (interrogator ) and the tag, as the energy cost of actuating a switch to change impedance is very low . 2.2 Powering Backscatter Devices Broadly , backscatter devices can be categorized as passive or semi- passive . A passive device ships with no local energy store, rather it opportunistically harvests energy from the RF signal of the inter- rogator . A typical energy budget for such har vesting is well below 1 mW , however projects such as the WISP [ 41 ] and the UMass Moo [ 50 ] have demonstrated that this is sucient energy for an array of interesting computational applications. In contrast, semi- passive devices use an alternate power source , such as an on-board battery or indoor photovoltaics, for primar y system power and leverage the RF channel solely for communication [ 5 ]. Under FCC regulations, narrowband readers can transmit up to 4 W EIRP (36 dBm), facilitating a 7-8 m operating range for classical RFID devices [ 5 ]. Unfortunately , the transmission power allotted for UWB devices is much lower , -41.3 dBm [ 14 , 18 ]. Interestingly , recent w ork has demonstrated that it is possible to harvest as much as 16 µ W from a -18 dBm UHF signal, over 16 × what is needed to power a Slocalization tag [ 38 ]. 2 Our Slocalization prototype powers itself from a photo voltaic cell for simplicity , however any harvesting source (or energy store) capable of supplying 1 µ W can power Slocalization tags. 1 In RFID, the interrogator (reader) is usually also the receiver , however Section 5.2 explores advantages and disadvantages of separating these roles. 2 For a complete overview of modern RF harvesting, see Kim’s summary [ 22 ]. 2 Slocalization: Sub- µ W Ultra Wideband Backscaer Localization IPSN’18, April 11-13, 2018, Porto, Portugal 2.3 Backscatter Channel Access Mediating channel access is an interesting problem for the ex- tremely limited budget aorded most backscatter devices. Ambi- ent backscatter demonstrated that it is possible to develop a car- rier sense mechanism that is tailored to the energy constraints of backscatter devices [ 25 ]. Laissez-Faire showed that for the trans- mission rates of backscatter , when communicating to a suciently capable receiver , one can simply ignore contention, transmit blindly , and let the receiver sort it out [ 19 ]. Directly adopting a laissez-faire approach would not work for Slocalization as our technique for recovering UWB signals would require unr ealistically small jitter on the tags to preserve the subtle per-tag timing osets used to dis- tinguish tags. W e do embrace tag simplicity , howe ver . Slocalization requires no synchronization between tags and uses PN codes to distinguish transmissions from concurrently transmitting tags. 2.4 Localizing Passive Backscatter Devices Classic RFID tracking does not precisely locate devices, rather it identies which reader , if any , is nearest ( via signal strength) [ 39 , 43 , 47 ]. Several research eorts have demonstrated true localization by examining the narrowband channel. RF-IDraw uses interferom- etry to trace trajectories, but can suer from sever e static oset of absolute position [ 46 ]. Others show that channel parameters can be used to recover more accurate positions, but these systems ar e limited to only a few meters range in practice [ 29 , 48 ]. RFind sounds frequencies surrounding UHF RFID to further improve localization quality , but unfortunately is not FCC compliant 3 and still suers the range limitations of other RFID systems [ 31 ]. RFly addresses the reader–tag range limitation using a drone as a powered (6 W) relay , but the drone must still travel to within a few meters of each tag [ 30 ]. In contrast, Slocalization achieves FCC-compliant, decimeter-accurate localization in whole rooms over 30 m in size. 2.5 Theoretical Systems Some theoretical analyses explor e the viability of UWB backscatter . As theoretical systems, these designs rely heavily on antenna and channel models to validate design choices. Unfortunately , the stan- dard 802.15.4a channel model [ 34 ] is not well suited to modeling a “two-way” signal, i.e. a backscatter r eection, requiring simulations to mix in motion models or employ statistical tricks to attempt to model a complex, indoor UWB backscatter channel [ 17 ]. D’Errico et al. further explore how to design a hybrid system with a con- ventional RFID frontend for wakeup and energy har vesting [ 10 ]. The Slo calization design is independent of energy frontend and amenable to such a hybrid design. 2.6 Millihertz U WB Localization The quintessential sensor networking technique to reduce energy consumption is to reduce duty cycle. If the argument is truly that devices rarely or never move, then p erhaps running traditional localization systems at millihertz duty cycles is the right approach. 3 FCC 15.231(a) p ermits 12,500 µ V/m only for control signals. The pure tones sent at each f s step do not qualify . Rather, RFind should be subject to the periodic limit 5,000 µ V/m (or -21.2 dBm as opposed to -13.3 dBm). This r educes SNR to low single-digit values across the presented spectrum. However , RFind could leverage the integration technique presented in this work to recover sucient signal—UHF Slocalization! One immediate drawback for such a design is a poor peak to average power ratio , a prohibitive design point for battery-based systems. The capacitive storage banks of energy harvesting ar- chitectures, howev er , are well suited to intermittent high current operation. High peak power requirements do still require sucient storage (in capacitor volume and board area) to support operations. T o quantify these tradeos, we look at the state of the art in low power decimeter-accurate localization systems. For such a design, we only consider systems in which the underlying localization mechanism can achieve a stationary x. 2.6.1 Commercial Transceivers. The lowest power decimeter- accurate single-x localization with traditional radios is SurePoint, with 80 ms long ranging events at 280 mW , or 22.4 mJ per range [ 20 ]. SurePoint includes additional o verhead to schedule and maintain time slots. Howe ver , for the sake of argument, let us assume that the very low duty cycle eectively eliminates interference and that there is zero static p ow er draw b etween range events. T o realize Slocalization’s 1 µ W, SurePoint can only range once e very 6.2 hours. For energy harvesting applications, SurePoint’s 3.3 V operating level raises additional concerns. Using the harvesting and activation circuit from Monjolo [ 9 ], whose regulator is roughly 80% ecient across the 0.35-2 V input and 3.3 V/100-200 mA output range, re- quires 28 mJ in the storage capacitors, or roughly 14 cm 2 of board area for similar capacitors. The primary energy cost in Sur ePoint is the 145 mA DecaW ave UWB transceiver . Even an order of mag- nitude improvement in transceiv er energy would still realize only one transmission every 40 minutes at 1 µ W. 2.6.2 Impulse Frontends. Prior systems have also identied the transceiver as the most (energy) costly comp onent and replaced it with a simpler and cheaper U WB pulse generator . The current lowest power decimeter-accurate, FCC compliant, single-x local- ization system is Harmonium [ 21 ]. Capturing a location x requires the tag to transmit for 53 ms at 75 mW , or 4 mJ per range. T o realize a 1 µ W average power budget, a Harmonium tag could transmit ranging pulses every 1.1 hours. The Harmonium impulse generation circuit relies on exploiting the step recovery eect in RF BJT s. This requires the tag to have a relatively high operating voltage of 5 V . Again considering the Mon- jolo energy harvesting frontend, reaching 5 V adds an additional burden for energy harvesting designs. For a 5 V , 15 mA output, the regulator eciency improves to 85% thus requiring 4.7 mJ in the storage capacitors, or 2.4 cm 2 of board area for energy storage. A key aspect missing from the Harmonium system is dierenti- ating multiple tags. The authors suggest having the tag modulate a PN code, where the co de bit length is linearly proportional to the number of concurrent tags. However , this would result in a corresponding linear increase in the energy per range, resulting in a prohibitively energy-expensive transmission. 2.6.3 Comparing Passive and Activ e T ags. Ultimately , the energy required to op en and close a switch (to reect RF energy) is so much less than the energy required to radiate RF energy that even with a ve order of magnitude increase in “transmission duration, ” backscatter consumes signicantly less tag energy for a single location x. These energy savings motivate exploring the viability of UWB backscatter-base d localization. 3 IPSN’18, April 11-13, 2018, Porto, Portugal Pat Pannuto, Benjamin Kempke, and Prabal Dua 3 THE U WB BA CKSCA T TER CHANNEL Backscattered signals are much weaker than those from an ac- tive transmitter as they must travel twice the distance. Recov ering backscattered UWB signals is further confounded by limitations on UWB transmission p ow er [ 14 , 18 ]. The link budget for a Slocaliza- tion tag consists of three parts, also shown visually in Figure 2 : (1) Path loss from transmitter to tag (2) Loss at the Slocalization tag (3) Path loss from tag to r eceiver The total combined path loss can b e summarized through an adap- tation of the Friis transmission equation: P r = P t + G t + G b t + G b r + G r + 20 × log 10  λ 4 π R 1  + 20 × log 10  λ 4 π R 2  − L b (1) where P t and P r are the transmitted and received power , G t and G r are the anchor’s transmit and receive gains, G b t and G b r are the gains of the tag’s antenna from the perspe ctive of the transmit and receive antennas, λ is the wavelength (in meters), R 1 and R 2 are the distances (in meters) between the tag and the receive and transmit anchors, respectively , and L b is the reection loss ( 2 × RF switch insertion loss). All gain and power gures are in decibels. Using the example from Figur e 2 , with a (maximum permissible) transmitted signal power of -41.3 dBm/MHz and typical indoor settings of G t , G b t , G b r , G r = 0 dBi, λ = 0.075 m, L b = 1 dB, and R 1 , R 2 = 5 m, the power received from the backscatter tag is -159 dBm/MHz. 3.1 Integrating Signal from Noise In a stationary environment with no other signal sources, the ambi- ent noise is approximately white and Gaussian, that is its integral over a long period of time is r oughly zero. This observation leads to the slow in Slocalization: namely if one integrates a sucient number of samples o ver time, it is possible to extract the tag’s signal from the channel impulse response. In Section 7.7 of our evaluation, we explore the impact of additional interference sources such as environmental motion or other ambient ele ctronics, and show that these can be ltered out of the channel frequency response and do not signicantly aect the performance of Slocalization. Using the well-known interpretation of Johnson-Ny quist noise, we can express the noise as a function of integration time: P d B m = − 174 + 10 × log 10  1 t  (2) where P d B m is the noise power and t is the integration time in seconds. For intuition, integrating for 1 ms, 100 ms, 1 s, 1 min, or 1 h leads to noise of -144, -164, -174, -191, or -209 dBm respe ctively . 3.2 Integration Time vs Distance Recall the goal is to measure the distance between the tag and an anchor by determining the time of arrival of the reection from the tag. An SNR of approximately 26 dB in the channel impulse response is required for standard threshold-based leading edge detection techniques to accurately determine time of arrival [ 16 ]. From Equations (1) and (2) , w e should be able to derive a relation between anchor-tag-anchor distance and the required integration time. Figure 2: Link Budget. As the backscatter tag is not an active transmitter , its localization relies on the measurement of reected signals from another active transmitting source. The recov ered sig- nal suers path loss from the transmitter to the tag, losses internal to the tag, and path loss from the tag to the receiver . Slocalization requires long integration times to ameliorate these losses. There are tw o small details we must addr ess rst. Equation (1) estimates the power at the receiver , ho wever r eceive frontends also add noise, η r , often around 10 dB in practice. Second, receivers directly measure the channel frequency response (CFR) to estimate the channel impulse response (CIR). A s Section 4.2 explains, for a reasonable CFR resolution of 1,000 bins, coherent summation of integrated CFR samples will realize 30 dB of gain, G C F R / C I R , in the CIR. Putting this together , we can express the required noise as: ˆ P d B m = P r − η r + G C F R / C I R − S N R (3) or ˆ P d B m = − 165 dBm for R 1 , R 2 = 5 m and the typical values as used b efore . Substituting ˆ P d B m for P d B m in Equation (2) , it will require approximately 0.13 s of integration to recover the tag signal. More generally , using the estimates from this section, the minimum integration time required to recover the signal for a transmitter-tag distance R 1 and tag-receiver distance R 2 is: t = 10 − 3 . 67 × ( R 1 R 2 ) 2 (4) A variety of factors including obstructing materials and nulls in the tag’s antenna pattern can have a great eect on the parame- ters described in the backscatter path loss. Therefore, a signicant margin of error must be applied in integration time to achieve high likelihood of tag detection in realistic indoor environments. 4 TRANSCEI VER DESIGN The previous section described the UWB channel in theory . In this section, we explore the generation, manipulation, and recovery of backscattered UWB signals in practice. 4.1 U WB Bandstitching T o address the limited availability of U WB hardware, we previ- ously presented the design of a bandstitched U WB receiver [ 21 ]. The idea of bandstitching is that a more traditional and accessible narrowband receiver can capture a UWB sample by taking a series of narrowband samples at successiv e frequencies (3.33–3.36 GHz, 3.36–3.39 GHz. . . ), add these samples together in the frequency do- main, and then use this “stitched”-together sample to recover a high-delity UWB channel impulse response in the time domain. 4 Slocalization: Sub- µ W Ultra Wideband Backscaer Localization IPSN’18, April 11-13, 2018, Porto, Portugal 0 1x10 -6 2x10 -6 3x10 -6 4x10 -6 5x10 -6 6x10 -6 7x10 -6 8x10 -6 9x10 -6 0 500 1000 1500 2000 2500 3000 3500 Cycle-to- Cycle Jitter Requirement (s) Integration Time (s) Figure 3: Long Integrations Require Stable Cr ystals. T o re- cover tag signals, the receiver must be able to correlate the tag pulse train. This requires pulse generation to remain stable dur- ing the receiver’s integration window . This curve (simulated for a 256 Hz tag frequency) shows how p ermissible tag jitter (phase noise) falls as the integration time increases. W e extend the principle to U WB transmissions, creating a band- stitched UWB transceiver . While this modication is fairly straight- forward, bandstitching both the transmitter and receiver introduces an additional system-level constraint that frequency hopping be- tween the transmitter and receiver must be synchronized. This is trivial for the monostatic case, where the transmitter and r eceiver are the same, but requires external synchronization for bistatic congurations (where transmitters and r eceivers are separated). 4.2 Backscatter Signal Recovery Bandstitching captures the channel frequency response (CFR), but we are ultimately interested in using its dual, the channel impulse response (CIR), to estimate the arrival of the tag’s signal. Recovery rst requires searching for the precise tag frequency and phase oset, then integrating samples over time to enhance SNR, and nally estimating the arrival time of the tag signal. Signal Requirements. T o be able to extract the tag’s signal, the tag’s transmit sequence must have a zero mean, ensuring that no portion of the direct CIR is present after correlation. A dditionally , the sequence must employ a modulation rate higher than that of other dynamic sour ces within the environment. Slocalization mixes the transmit sequence with a pattern of the form sgn ( sin ( 2 π f × t )) to meet these requirements. Signal Stability . Timing jitter in the tag’s mo dulation sequence will cause the transmitted signal to shift slightly over time. T o successfully recov er the signal, over the course of the anchor’s inte- gration period, the modulation sequence must not deviate by more than 1/4 bit period from the average rate . Figure 3 shows the allo w- able signal jitter vs. integration time for the 256 Hz tag modulation rate used in this pap er , derived through Monte Carlo simulation. One of the b etter available frequency sources, the AM0805, has an RC jitter of 500 ppm. While some research RC oscillators show promise towards tens of ppm [ 7 ], realizing the necessary stability with commercially available components requires the use of the higher-power crystal mode to maintain code coherence. Signal Discovery . While the nominal frequency , f = 256 Hz, is known, in practice the fr equency modulate d by the tag may drift slightly , meaning the actual frequency transmitted will be some modest ϵ o the target. Furthermore, there will be a phase oset based on when the anchors begin sampling the CFR. This means that signal recov ery must search the space sin (( 2 π f × ϵ 0 ) × t + ϕ 0 ) for the ϵ 0 and ϕ 0 that most strongly correlate , where ϵ 0 is limited by the stability of the tag frequency source and ϕ 0 ∈ [ 0 , π ) . This 0 π /4 π /2 3 π /4 π 0 100 200 300 400 500 600 700 800 900 φ 0 (rad) Time (s) f cand =256.06294 f cand =256.063 f cand =256.062 f cand =256.061 Figure 4: Frequency Precision and Accuracy . W e record for 900 s with the tag near the anchor (so it can b e found with short integration time). W e break the recording into 10 s increments and search for the phase oset, ϕ 0 , for four xed candidate frequency values, f cand . Finding the precise frequency , f cand = 256 . 06294 , is computationally expensive. A coarser 0.01 Hz step exhibits low oset for f cand = 256 . 063 over this sample. How ever , if we process this whole recording as one long integration, at about 500 s for f cand = 256 . 0622 , continuing to integrate would b egin to reduce the recovered signal. With continuous integration, f cand = 256 . 0621 would alternate between b est possible and no signal roughly every 250 s when the tag is transmitting a simple square wav e. Because of this, for signals that require long integration times to detect, if f cand is too far o, the tag will never be found. search introduces a system tradeo explored in Figure 4 . If the tag drifts more than half a cycle over an integration period, additional integration will begin destructively combining. Longer integration times require more precisely identifying the tag fr equency , which increases the number of f cand that must be considered. Signal Integration. Integrating multiple samples over time is the key to pulling the tag signal above the noise oor . The actual inte- gration is simple, just sum together all the correlated CFR estimates. Figure 5 shows the tradeo between the number of CFR bins and the CIR variance. Due to the coherent summation of CFR bins, the required SNR for each CFR bin to realize a target CIR SNR decreases with an increasing numb er of bins. The coherent sum- mation of N bins yields a 10 × log 10 ( N ) increase in CIR SNR. T o achieve an approximate 26 dB CIR SNR 4 requires a CFR bin SNR of 26 − 10 × log 10 ( N ) , informing dwell time at each band. TDo A Estimation. Once integrated, the individual bands can be stitched together in the frequency domain, and the inverse FFT yields the CIR. T o nd the TDo A, the arrival time of the direct CIR is subtracted from the arrival time of the tag’s signal. Precisely estimating arrival time, particularly for lower SNR cases, is an active area of research [ 16 , 52 ]. Our current implementation uses a simple thresholding approach. Section 8.4 explores how more advanced techniques could further improve Slocalization accuracy . Additional Tradeos. The number of bandstitching steps along with the dwell time at each step denes the time to complete a full U WB sweep. V arious methods can be employed to increase the UWB sweep rate. The instantaneous bandwidth can be increased through the use of higher sampling rate ADCs. Multiple bands can be observed simultaneously through observation across multiple center frequencies. Our prototype implementation employs 25 MHz of instantaneous bandwidth utilizing one RF r eceive frontend, yield- ing 49 steps to generate 1.225 GHz of U WB sweep bandwidth. 4 26 dB of CIR SNR yields a negligible false positive rate in CIR T oA detection. 5 IPSN’18, April 11-13, 2018, Porto, Portugal Pat Pannuto, Benjamin Kempke, and Prabal Dua 0 0.2 0.4 0.6 0.8 1 1.2 1.4 0 0.2 0.4 0.6 0.8 1 True ToA Detect Threshold Normalized Amplitude Normalized Time 10 bins 100 bins 1000 bins (a) Impact of Bin Count on CIR Quality -5 -2.5 0 2.5 5 7.5 10 100 200 300 400 500 600 700 800 900 1000 Required Bin SNR dB Number of CFR Bins (b) Required CFR SNR vs. Number of Bandstitche d Bins Figure 5: Processing Impacts Precision. Introducing more band- stitching bins not only contributes to better CIR resolution from greater utilized bandwidth, but also impro ves the CIR SNR, given the same integration time for each CFR bin. The increase in SNR is due to the coherent contribution of many , noisy CFR bins. For the single-path case, the CIR SNR increases by 10 × log 10 ( N b i ns ) . 5 SLOCALIZA TION DESIGN In the Slocalization architecture, a localization event begins with a network of infrastructure nodes sounding the U WB channel. UWB reectors in the space appear as perturbations in the channel impulse response (CIR) recovered by the infrastructure nodes. A tag in the environment opens and shorts its antenna such that one such reection appears and disappears reliably over time . By comparing the dierence between the direct, line-of-sight (LoS) path and the tag’s backscattered path, a pair of infrastructure nodes can determine an ellipsoid of possible tag locations. With sucient infrastructure nodes, the intersection of ellipsoids reveals the tag’s nal location. 5.1 CIR Perturbation (T ag Design) Conceptually , a Slocalization tag is very simple. Figure 6 shows the complete architecture . The energy source could be an energy harvesting frontend or simply a battery . As discussed in Section 4.2 , all a tag needs to do is toggle an RF switch at a stable frequency . T o distinguish multiple tags, Slocalization inserts a cy clic shift register holding a PN code between the oscillator and the RF frontend. 5.2 CIR Coverage ( Anchor Placement) T o lo calize tags, Slo calization anchors must capture estimates of the time of ight from an anchor , to a tag, to an anchor . One key question is whether the transmitting and receiving anchors should be the same—a monostatic conguration—or separated in space—a bistatic conguration. Recall that the distance from the anchor to tag to anchor traces out an ellipsoid of p ossible tag locations, with the anchors as the foci. In a monostatic conguration, the foci are overlapped, creating a sphere of possible tag locations. In practice, these dierent shapes will change the best, average, and worst case integration time across space in an environment. Oscillator Ener gy S our ce Sh if t R eg Figure 6: UWB Backscatter T ag Design. A UWB antenna and RF switch are used in conjunction to modulate the reective char- acteristics of the RF channel. A shift register stor es a PN code for the tag to emit. A high-stability oscillator clocks the shift register to drive backscattered communication. meters meters -40 -30 -20 -10 0 10 20 30 40 -40 -30 -20 -10 0 10 20 30 40 0 100 200 300 400 500 600 minutes 60 60 60 60 60 40 40 40 40 40 20 20 20 20 10 10 10 5 5 5 1 1 (a) Monostatic (Center) meters meters -40 -30 -20 -10 0 10 20 30 40 -40 -30 -20 -10 0 10 20 30 40 0 100 200 300 400 500 600 minutes 240 240 240 240 120 120 120 120 60 60 60 60 40 40 40 40 30 30 30 30 20 20 20 20 10 10 10 10 (b) Bistatic (Center) meters meters -40 -30 -20 -10 0 10 20 30 40 -40 -30 -20 -10 0 10 20 30 40 0 100 200 300 400 500 600 minutes 480 480 240 240 120 120 60 60 20 5 1 (c) Monostatic (Corner ) meters meters -40 -30 -20 -10 0 10 20 30 40 -40 -30 -20 -10 0 10 20 30 40 0 100 200 300 400 500 600 minutes 480 480 480 480 360 360 360 360 240 240 120 120 60 60 20 20 (d) Bistatic (Corners) 0 0.2 0.4 0.6 0.8 1 0 500 1000 1500 2000 2500 3000 3500 4000 CDF Integration Time (min) Mono Center Bi Center Mono Corner Bi Corners (e) CDF of Integration Time Figure 7: Anchor Arrangement Aects Integration Time. The transmitting anchor can either be co-located (monostatic) or separated from the receiving anchor ( bistatic). Monostatic arrange- ments suer from high ash amplitude (the limited dynamic range of the RF frontend is o verwhelmed by nearby high energy reec- tions) and inadequate spatial coverage in large areas. Bistatic results in a better coverage but requires time synchronization between the transmitting and receiving anchors, now physically separate. Figure 7 considers four possible two-anchor placements for an 80 × 80 m room: rst placing anchors for the best case monostatic and bistatic coverage and then a more realistic scenario with an- chors mounted in corners of the room. While the ideally placed monostatic setup achieves the best coverage , it is unreasonable to expect an anchor to be placed in the center of every room. For the more realistic corner-based deployment, the bistatic conguration performs much better in the medium and long tail. For this reason, we use a bistatic anchor conguration in our implementation. 6 Slocalization: Sub- µ W Ultra Wideband Backscaer Localization IPSN’18, April 11-13, 2018, Porto, Portugal 5.3 CIR Measurement (Anchor Coordination) While Section 4.2 covers the signal processing to recover a distance estimate, Slocalization also requires that anchors coordinate so as not to trample each others’ channel estimates. Furthermore, in a bistatic conguration, Slocalization anchors must also synchronize the bandstitching steps between transmitter and receiver . T o reduce implementation complexity , Slocalization follows in the footsteps of WiTrack and Harmonium and simply runs a wired sync pulse to all of the anchors. W e note that several potential methods for accurate decentralized time synchronization have been explored in pre vious work using both wireless [ 12 , 33 ] and wired techniques [ 13 , 26 ], and leave their integration for future work. 6 IMPLEMEN T A TION All software and hardware designs are open source and made avail- able to the research community at github .com/lab11/slocalization . 6.1 Hardware Implementing Slo calization does not require many comp onents. Howev er , due the sensitivity of the backscatter channel and a focus on minimal power draw , car eful selection of components is required to maximize the potential of Slocalization. The tag , shown in Figure 8 , uses the UPG2422TK RF switch due to its minimal insertion loss, low power operation, and low switching voltage. An MCU emulates the functionality of a shift register and is used to facilitate greater experimental exibility . T o allow deep est sleep, the RF switch control lines are held by ip ops and the frequency r eference pro vided by a 50 nA RTC. The energy frontend consists of an indoor photovoltaic cell and a low-leakage capacitor . Anchors are USRP N210s synchronized with a shared clock and connected via gigabit Ethernet to a host computer that coordi- nates bandstitching. Transmit data are fed to the designate d TX anchor as a repeating sequence of twenty IQ samples, chosen as a sequence that minimizes dynamic range and maintains equal am- plitude across the 25 MHz of bandwidth occupied at each step. Due to the repetitive nature of the signal, this sequence is designed to generate twenty CFR peaks across 25 MHz, calibrated to a transmit amplitude abiding by the FCC requirement of -41.3 dBm/MHz. Receivers fe ed IQ samples back to the host PC for post-processing. An initial real-time integration step averages out high frequency ef- fects. 5 The 20-sample se quence is integrated one thousand times be- fore ooading the averaged IQ data. This 1000 × decimation yields a CFR up date rate of 1.25 kHz, enough to cover the Slocalization modulation rates while minimizing signal processing complexity . 6.2 Processing All processing is performed in MA TLAB on raw USRP data. Data Parsing and Trimming. A veraged IQ data includes tagged metadata identifying the precise time and target of retune e vents, which are used to segment the IQ data into separate bandstitching snapshots. After IQ data segmentation, the rst 80 ms of each step are trimmed to allow the r eceiver’s RF PLL to settle to the newly- tuned frequency . 5 At 20 samples/repetition and 25 Ms/s, a CFR update rate of 1.25 MHz is achievable but not useful for Slocalization’s low tag modulation rates. 47µF F OU T I 2 C R TC ~Q MCU Q CLK D Q D Q W ake I 2 C 1M Ω (a) T ag Schematic (b) Tag Part MPN Quantity Cost (USD@1k) MCU STM32L051K8T6 1 $1.80 Antenna AH086M555003-T 1 $1.57 Solar Cell AM-1417 1 $1.44 RF Switch UPG2422TK 1 $0.71 RTC AM0805AQ 1 $0.55 Crystal ABS07-32.768KHZ-7-T 1 $0.38 Flip Flop 74LVC1617S 2 $0.09 Passives — — $0.16 PCB — 1 $1.00 T otal $7.70 (c) Bill of Materials Figure 8: Realized T ag. W e insert a low-power MCU in place of a shift register for exibility . W e use an ultra low power real time clock from Ambiq to achieve the requisite oscillator stability for minimal power . T o minimize active pow er , we sleep the MCU between (potential) bit ips, requiring a pair of ip ops to drive the RF switch. The tag is powered with a small (3.5 cm × 1.4 cm) solar cell and limited energy storage (47 µ F) to demonstrate its applicability to demanding energy harvesting applications. Clock Ambiguity Resolution. Time is distribute d as a 10 MHz signal to each anchor , which multiplies it 10 × to provide clocking internal to the USRP . This reference is then divided by 4 × to pro- vide the reference for the transmit/r eceive RF PLL. Depending on the random timing introduced through the pow er-on sequencing internal to each radio, the phase of the nal 25 MHz signal can be oset in time between anchors. A signal processing step in software measures the phase dierence incurred between received bands and corrects for any phase oset incurred. T ag Frequency and Phase Search. Our implementation searches for a nominal frequency of 256 Hz ± 500 ppm in 5 ppm steps and eight possible phase osets at each step. Each candidate is fed through a Blackman window and the {frequency , oset} pair with the strongest correlation is selected. Integration and Calibration. Next, correlated CFR samples are integrated (summed in time). A one-time calibration performed in advance captures pair wise recordings of direct conne ctions between each pair of anchors. T o compensate for any phase oset incurred during RF signal generation and reconstruction, the integrated CFR is deconvolved with the calibration data to yield the actual CFR. TDo A Estimation. The direct CFR is recovered by stitching the captured CFRs with no correlation step and then deconvolving with the calibration data. T o improve the resolution of the CIR, the CFR is zer o-padded to be 10 × longer before applying the Inv erse Fourier Transform. T o estimate signal arrival time , we use the 30% height of the tallest peak in the CIR. The TDo A estimate is the dierence in T o A between the direct and backscatter CIRs. Localization. TDo As between a tag and participating anchors de- ne ellipsoids of possible locations. A minimum mean squared error solver uses gradient descent to nd a best-t position estimate. 7 IPSN’18, April 11-13, 2018, Porto, Portugal Pat Pannuto, Benjamin Kempke, and Prabal Dua 0 0.2 0.4 0.6 0.8 1 0 5 10 15 20 30% Height Direct Detect Backscatter Detect Normalized Amplitude Time (ns) (a) Anchor 1 to 2 Path 0 0.2 0.4 0.6 0.8 1 0 5 10 15 20 30% Height Direct Detect Backscatter Detect Normalized Amplitude Time (ns) (b) Anchor 1 to 3 Path 0 0.2 0.4 0.6 0.8 1 0 5 10 15 20 30% Height Direct Detect Backscatter Detect Normalized Amplitude Time (ns) (c) Anchor 2 to 3 Path Figure 9: TDoA in the Channel Impulse Resp onse. CIRs estimated fr om 1.225 GHz of bandstitched narrowband measurements for three anchor pairs. The dierence in time between the direct line-of-sight measurement and the backscattered signal yields the distance b etween the tag and anchors. Multiple anchors with a TDo A measurement from each are necessary to determine a tag’s 3D location accurately . 0 0.2 0.4 0.6 0.8 1 0 20 40 60 80 100 120 Insufficient SNR Normalized Amplitude Time (ns) (a) 50 ms Integration (2.45 s per x) 0 0.2 0.4 0.6 0.8 1 0 20 40 60 80 100 120 LoS Detected Correctly Normalized Amplitude Time (ns) (b) 250 ms Integration (12.25 s per x) 0 0.2 0.4 0.6 0.8 1 0 20 40 60 80 100 120 LoS Detected Correctly Normalized Amplitude Time (ns) (c) 1250 ms Integration (61.25 s per x) Figure 10: Eect of Integration Time on Channel Impulse Response and Arrival Time Estimation. The 30% height of the CIR’s leading edge is used to estimate the arrival time of the line-of-sight path, ne cessitating sucient SNR to resolve the leading edge. A number of integration lengths are shown for an e xample backscatter CIR. While 50 ms of integration time exhibits insucient SNR to resolve the line-of-sight path, anything more than 250 ms shows sucient SNR to resolve the backscatter CIR in this link scenario. 7 EV ALU A TION W e aim to establish the viability of Slocalization and explore its potential. W e demonstrate recovery of TDo A estimates from a backscatter signal, explore the impact of varying integration, and evaluate end-to-end localization performance, nding Slocalization achieves 30 cm average error across an array of points. Then, we evaluate the long range—and long integration—performance by localizing a tag between anchors that are 30 m apart, rst under direct line-of-sight and then non-line-of-sight conditions. W e next evaluate some of the underlying Slocalization components and investigate how Slocalization can handle and reject environmental interference. Finally , we show that we can distinguish and recover ranging information from multiple Slocalization tags transmitting in parallel in the same environment. 7.1 Can Slo calization Measure TDoA? W e set up three anchors congured for bistatic ranging and a single tag. Figure 9 shows the recovered CIR for the Anchor 1 → 2 , 1 → 3 , and 2 → 3 paths. The Slo calization system can clearly identify peaks for both the direct and backscattered path for all anchor pairings. This time dierence of arrival (TDo A) coupled with known 3D positions of anchors can be used to localize the tag. 7.2 Integration Time Integration time is the key factor that determines how fast Slocaliza- tion runs. Because the signal received from the tag is well below the noise oor , the Slocalization system nee ds to integrate numer ous samples of the environment over time to extract the tag’s signal. Recall, the goal is to be able to accurately detect the leading edge of the pulse reected by the tag, as the time oset of this e dge yields the distance b etween the tag and anchors. Figure 10 looks at the eect of varying this integration time for a sample link. For this experiment, the anchor-tag-anchor distance is just shy of 5 m, which allows us to push integration time down to 250 ms and still successfully recover the line-of-sight path. Note that 250 ms is only the integration time for one slice of the UWB sp ectrum. Band- stitching requires 250 ms of dwell time at each of the 49 frequency slices, thus requiring 12.25 s to fully resolve position. 7.3 3D Lo cation Estimation W e next investigate the quality of the location estimates provided by Slocalization. W e set up Slocalization in a 4.5 m × 3 m × 2.3 m indoor space—the room is typically furnished with tables, chairs, cabinets, etc., but with line-of-sight paths available between the tag and each anchor—and place the tag in 10 dier ent locations on a table in the room. W e congur e the bandstitching sweep to dwell for 2 s at each of the 49 measured bands, requiring 98 s total for each location x, an update rate of approximately 10 mHz. Figure 11 shows the estimate and ground truth of a single location x at 10 points in space and nds that the Slocalization system is able to achieve an average err or of only 30 cm across all 10 locations. 7.4 Long-Range Performance A key dierentiator of Slocalization from prior RFID-based local- ization systems is the ability to cover large areas. T o evaluate this, we place two anchors 30 m apart in a long hallway . W e set the tag 1 m away from anchor A (29 m from anchor B) and move it at 1 m increments to the center point (15 m from each anchor ), as shown in Figure 12a . W e congure Slocalization to dwell for 20 s at each band, recording 16.3 min of data at each location. Each point captures two measur ements, swapping the transmitter and r eceiver role among the anchors. This experiment runs for o ver eight hours, during which people move through the evaluation space ( a hallway connecting occupied oces) normally . 8 Slocalization: Sub- µ W Ultra Wideband Backscaer Localization IPSN’18, April 11-13, 2018, Porto, Portugal -0.5 0 0.5 1 1.5 2 2.5 3 3.5 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Y (m) X (m) Actual Position Slocalization Estimate TX Antenna RX Antenna Min Max Mean Median 2D XY Euclidean Error (m) 0.05 0.70 0.25 0.18 3D Euclidean Error (m) 0.08 0.70 0.30 0.26 Figure 11: Slocalization Performance Evaluation. Ground truth vs. estimated tag position in a 4.5 m × 3.0 m × 2.3 m interior room. A number of xed lo cations are chosen for the Slocalization tag, and the dierence between the calculated position and the true position are shown. Slocalization is able to achiev e 30 cm of aver- age 3D error using sub-microwatt tags across the entire evaluation space using only 98 se conds of integration time at each location. W e iterativ ely feed progressively longer samples of the data into the Slocalization TDo A estimator , checking the result against the expected TDoA and reporting when the estimate reaches accuracy targets from 0.1 m to 5 m. Full results are shown in Figure 12b . At the center point, furthest from each anchor and thus requiring the most time, Slocalization requires 18 s of integration per band, or 14.7 min total, to localize the tag to 0.09 m error . Manual examination of the data around the 12 m data point reveals that the tag’s signal was eventually r ecovered, but both the backscatter and the direct CIRs are ambiguous. Around this time, a small crowd of people carried a conversation directly in front of anchor B. While there is some resiliancy to non-line-of-sight conditions, U WB signals cannot reliably penetrate multiple bodies and travel 30 m. 7.5 Nulls and Reliability Our prior work in U WB localization has shown that U WB channel robustness is greatly enhanced by incorporating multiple antennas at each anchor , ideally three at 120 ° osets [ 20 ]. Our Slocalization prototype does not realize full antenna diversity . Rather each anchor simply has one de dicated transmit antenna and one receive antenna, separated by 72 cm. Figures 12c and 12d break apart the pr evious experiment, showing the performance of each path. While the exact cause of failures, such as the 9 m point in either direction or the longer ranges for A → B, can b e hard to ascertain, greater path diversity , such as recording on both antennas while acting as the receiving anchor , would improve Slocalization robustness. (a) Experimental Setup. 0 3 6 9 12 15 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Time (min) Bi-Static Position (m) 5.0m acc 0.5m acc 0.3m acc 0.2m acc 0.1m acc (b) LoS: Best of A → B or B → A 0 3 6 9 12 15 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Time (min) Bi-Static Position (m) 5.0m acc 0.5m acc 0.3m acc 0.2m acc 0.1m acc (c) LoS: A → B Only 0 3 6 9 12 15 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Time (min) Bi-Static Position (m) 5.0m acc 0.5m acc 0.3m acc 0.2m acc 0.1m acc (d) LoS: B → A Only 0 3 6 9 12 15 1 5 10 15 Time (min) Bi-Static Position (m) 5.0m acc 0.5m acc 0.3m acc 0.2m acc 0.1m acc (e) NLoS: Best of A → B or B → A Figure 12: Long Range and NLoS Performance. W e set up two anchors 30 m apart in a long hallway . W e place the tag at 1 m incre- ments, moving from anchor A towards the center of the hallway . For each location, we congure each anchor to both transmit and receive, colle cting 20 s of integration p er band, or 33 min per lo- cation. W e iteratively process each sample to nd the minimum integration ne cessary to reach var ying accuracy targets, nding Slocalization requires only 14.7 min for the worst-case 15 m posi- tion. W e then simulate an “in-walls” deployment by occluding both anchors with large tiles and measuring the NLoS performance at 5 m steps, nding that Slo calization p erforms b etter in this case. With anchors in the corners, Slocalization could localize an entire 15 m × 15 m room to de cimeter accuracy in under fteen minutes. 9 IPSN’18, April 11-13, 2018, Porto, Portugal Pat Pannuto, Benjamin Kempke, and Prabal Dua -120 -110 -100 -90 -80 -70 3.2 3.4 3.6 3.8 4 4.2 CFR Noise Density (dB) Frequency (GHz) No Filter 50Hz HPF 150Hz HPF (a) CFR Noise Static -120 -110 -100 -90 -80 -70 3.2 3.4 3.6 3.8 4 4.2 CFR Noise Density (dB) Frequency (GHz) No Filter 50Hz HPF 150Hz HPF (b) CFR Noise Walking -120 -110 -100 -90 -80 -70 3.2 3.4 3.6 3.8 4 4.2 CFR Noise Density (dB) Frequency (GHz) No Filter 50Hz HPF 150Hz HPF (c) CFR Noise Fluorescents Figure 13: Ee cts of D ynamic Environmental Processes on CFR. Slocalization must compensate for dynamic changes in the environ- ment to be able to detect backscattered signals. Here we see the eects of dierent dynamic channel conditions on the CFR, the noise it imparts, and the eect of various ltering strategies. The dashe d line is the required noise density requirement of a typical backscatter link with 100 dB of path loss. W alking around the environment imparts low-frequency noise which can be easily compensated through the use of a 50 Hz high-pass lter on CFR observations. D ynamic changes due to uorescent lighting imparts higher frequency noise, requiring the use of a higher frequency high-pass lter to cancel. A control run shown in (a) shows that ev en seemingly stationar y environments observe CFR noise, likely due to noise internal to the software-dened radio. T o minimize active power , the tag should set its modulation rate as low as possible, howev er these eects require setting the modulation high enough to not be drowned out by these common sources of noise. The chosen 256 Hz mo dulation rate balances these tensions. 7.6 Non-Line-of-Sight Real-world deployments may wish to hide infrastructure nodes. T o simulate “in-wall” anchors, we place a 0 . 6 × 1 . 2 m tile in front of each anchor and re-run the experiment from Figure 12a placing the tag at the 1 m, 5 m, 10 m and 15 m p ositions, with results in Figure 12e . Somewhat surprisingly , the NLoS performs better , need- ing only 8.2 min to localize the tag to 0.1 m accuracy at the 15 m point. Qualitatively , the recovered backscatter CIRs look smo other and less noisy from the NLoS experiments, suggesting that the obstruction perhaps is acting as a rudimentary lter . 7.7 Environmental Noise A principle design goal of Slocalization is accurate localization of a static tag in a static envir onment with static anchors. Howe ver , in many real-world scenarios, while the localization target may be stationary , the environment is not. Non-stationary environments will appear as noise in the CFR. As a baseline, in Figure 13a we capture the CFR noise for a static environment. W e then consider the obvious environmental noise source for indoor spaces, namely people moving throughout the environment. In practice human beings do not mo ve quickly in physical space, and Figure 13b shows that the simple addition of a 50 Hz high-pass lter is able to remo ve most of the CFR noise created by people moving about the space. The next source of noise Slocalization must deal with is that emit- ted by ambient devices in the space. In Figure 13c we nd that the uorescent lighting in our oce building emits signicant noise not successfully ltered by the 50 Hz lter added for removing hu- man motion. Raising this lter to 150 Hz successfully removes the noise introduced by the lighting, facilitating Slocalization. It is in Slocalization’s interest to keep this lter value as lo w as possible. The primary energy cost for the tag is throwing the antenna load switch, thus the lower the switching frequency , the lower the tag’s active power draw . In practice we have not found other signicant interference sources above 150 Hz testing in b oth a traditional of- ce setting and a home environment. W e set the tag oscillation frequency to 256 Hz to balance activ e power draw and detectability . -20 -10 0 10 20 0 100 200 300 400 500 600 700 800 900 Frequency Offset (ppm) Time Offset (ms) 0 1 2 3 4 5 6 7 8 9 Figure 14: Searching for Tags in Multi-User Settings. T o gen- erate the backscatter tag CIR, the time oset and frequency oset of the backscatter modulation sequence must be determined. In the case of PN-coded backscatter transmissions, this search space can be quite large. This shows the resulting correlation search space for a PN code of length 63 transmitted with a p eriod 983 ms. Three tags can be observed after an exhaustive search is performed. The peak values for each tag are used to accurately correlate and re- construct their corresponding backscatter CIRs. A 63 bit PN allows concurrent localization of 63 uncoordinated tags. 7.8 Multiple T ags The Slocalization design includes PN codes to allow the anchor infrastructure to distinguish multiple tags. Figure 14 places three concurrently transmitting Slocalization tags in the environment. The Slocalization system is able to cleanly distinguish each tag and localize it independently of the others. 7.9 Microbenchmarks Our prototype tag—including the photovoltaic harvesting frontend— measures 5 . 5 × 1 . 5 cm and weighs just 3.5 g. The tag draws 406 µ W while the microcontroller is active and 522 nW while it is in standby . Driving a worst-case constantly switching 0-1 signal through eight 74LV C595A [ 37 ] 8-bit shift registers at 512 Hz draws 277 nW , for a combined 800 nW during steady state operation. 10 Slocalization: Sub- µ W Ultra Wideband Backscaer Localization IPSN’18, April 11-13, 2018, Porto, Portugal 8 DISCUSSION With Slo calization, we have demonstrated the viability of UWB backscatter and shown the feasibility of localizing microwatt tags with decimeter-level accuracy . Before closing, we explore how much further Slocalization could go, and what could be done to make it faster (or equivalently cov er larger areas)? Could Slocalization be used to localize something smaller than a grain of rice? 8.1 Speeding Up Slocalization While Slocalization’s performance is acceptable for a large array of devices and applications, there are numerous enhancements that could improv e SNR, thus reducing required integration time, and accelerating localization. The RF frontends we employ exhibit an approximately 12 dB noise gure across the range of utilize d frequencies. This oers the potential for improvement with the addition of a low-noise amplier at each anchor receive antenna. Currently , Slocalization uses omnidirectional antennas to maximize anchor placement exibility . WiTrack employs directional antennas following the argument that the most likely deployment scenario is “in the walls. ” The same is likely true for Slocalization in many cases. Replacing the current omnidirectional antennas [ 3 ] with directional U WB antennas [ 1 ] could r ealize at least 5 dB of gain. The instantaneous bandwidth measured at each step is smaller than that attainable with the radio hardware utilized, as the gigabit Ethernet communication use d by the USRP N210 bottlenecks throughput. Larger instantaneous bandwidth could be attained by averaging on the FPGA fabric, lowering the necessar y Ethernet bandwidth and therefore increasing the sweep rate and attainable update rate given the same specications. 8.2 Scaling Up Slocalization The frequency stability and precision requirements outlined in Section 4.2 for the normal operation of Slocalization are the same as the requirements needed to supp ort frequency division. Coupling frequency division with the PN code division shown in this paper results in a multiplicative incr ease in the number of tags that can be simultaneously localized. This could b e further enhanced by exploiting the stationary nature of tags. O ver a long window of time (say , hourly) a tag could rotate thr ough PN codes. The lo calization engine would colle ct the order of PN sequences over time at the same location to pro vide another dimension for distinguishing tags. 8.3 Shoring Up Slocalization Prior localization schemes have consistently demonstrated that even just one or two range estimates beyond the minimum signif- icantly improve localization performance, especially in the long tail [ 20 , 23 ]. In a bistatic conguration, the number of channel soundings scales linearly with the number of anchors, as every other anchor can listen while one anchor is transmitting, enabling ecient capture of many range estimates in parallel. Our prior work has also demonstrated that deploying multiple antennas at each anchor can help ameliorate orientation issues, cross-polarization, or nulls [ 21 ]. The current USRP N210 anchor cannot record the signal received at three antennas in parallel, howev er , thus exploiting antenna diversity with the current system would require further reduction in update rate. -2 -1 0 1 2 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Error (m) CIR Threshold % Super Resolution Raw CIR Figure 15: T oA Estimation Error . Using threshold-based estima- tion requires that the chosen threshold lie ab ov e the noise in the CIR, otherwise the arrival time estimation will strike noise far too early rather than the desired arrival peak (resulting in range estimation error much greater than 1 m for CIR thresholds below 10% in this case). Simplistic super r esolution methods, such as the interpolation from Slocalization’s zero-padding of the CFR, can provide gr eater delity , but have limited impact and may be skew ed by outliers. For well-integrated samples, the T o A estimation mechanism is likely one of the largest causes of error in Slocalization measurements. 8.4 Cleaning Up Slocalization T o A Fixed thresholding is one of the simplest te chniques for estimating arrival time, and can contribute inaccuracies, especially when CIR noise is less predictable [ 16 ]. Ideally , tag arrival would be a vertical pulse in the CIR. One of the fundamental advantages of using UWB signals for localization is the narrow er , tighter pulse shape in the time domain, which enables better estimation of actual signal arrival time. Still, UWB pulses have shap e, and in a clean channel it is the leading edge of the pulse that captures the actual arrival time, not the peak. Figure 15 shows ho w increasing the CIR threshold aects the estimated distance as the arrival estimate moves up the peak. The zero-padding of the CFR during Slocalization processing is a very basic form of super resolution, aording the ner-resolution steps in Figure 15 . In RFind, Ma et al. observe that simply estimat- ing T o A from the CIR discards valuable phase information [ 31 ]. Leveraging this, they develop a new super resolution technique that aords sub-centimeter accuracy . With the even gr eater band- width available to Slocalization, and provided that Slocalization as shown can achieve 0.07 m accuracy on its own for a given mea- surement, combining these techniques could theoretically realize sub-microwatt, sub-millimeter whole room localization. 8.5 Scaling Down Slocalization Recently , there has been growing interest and initial demonstrations of viable millimeter-scale systems [ 24 , 35 , 42 ], so-called “smart dust. ” Whole room millimeter-accurate localization addresses a key deployment challenges for systems less than a millimeter in size. Fundamentally , a Slocalization tag requires very little: a stable clock source, a shift register , and a variable impedance antenna element. Leveraging recent advances in near threshold circuit and oscillator designs, these components could be realized with a p ow er budget on the order of nanowatts [ 7 ]. As nodes shrink, however , their physical antennas necessarily shrink as well, signicantly reducing gain. Electrically small U WB antennas are still an activ e area of research, but the smallest antennas yielding high eciency (near 0 dBi) are around 1 cm across [ 49 ]. A recent eort to optimize antennas for mm-scale nodes showed that narrowband mm-scale antennas realize gains of around -15 dBi within the Slo calization frequency range [ 6 ]. Assuming a similar correlation to achievable 11 IPSN’18, April 11-13, 2018, Porto, Portugal Pat Pannuto, Benjamin Kempke, and Prabal Dua UWB antenna gain along with the doubling in path loss due to the backscatter link, the Slocalization system would be required to realize another 30 dB of gain. This 30 dB of additional gain makes the integration times required for the current system intractable, but higher instantaneous bandwidth (up to 49 × = 17 dB) and low er noise gure (12 dB) would almost completely make up the dierence. 9 CONCLUSIONS W e show that by using ultra wideband backscatter , it is p ossible to realize both high accuracy localization and low energy oper- ation, demonstrating long-range, decimeter-accurate positioning on a sub-microwatt power budget without requiring any tag or environmental motion. This is enabled by embracing the localiza- tion of stationary devices, facilitating the long-term integration of the channel to recover signals far below the noise oor . Slocaliza- tion lowers the burden of localization for the long tail of everyday objects, inviting a future where location information is ubiquitous. 10 A CKNO WLEDGMEN TS This work was supported in part by the CONIX Research Center , one of six centers in JUMP, a Semiconductor Research Corporation (SRC) program sp onsored by D ARP A, and in part by T erraswarm, an SRC program sponsored by MARCO and D ARP A. W e would like to thank our reviewers for their insightful comments and our shepherd, Andrew Markham, for support and guidance towar ds evaluations that greatly strengthened the nal result. Finally , Slocalization could not have been a success without the support of Lab11, especially Joshua Adkins, Branden Ghena, Neal Jackson, and Noah Klugman. REFERENCES [1] A. M. Abbosh and M. E. Bialkowski 2007. A U WB directional antenna for microwave imaging applications. In 2007 IEEE A ntennas and Propagation Society International Symp osium . [2] F. Adib , Z. Kabelac, D. K atabi, and R. C. Miller 2014. 3D Tracking via Body Radio Reections (NSDI’14) . [3] R. Azim, M. T . Islam, and N. Misran, Compact T apered-Shape Slot Antenna for UWB Applications. IEEE A ntennas and Wireless Propagation Letters 10 (2011). [4] B. Campbell and P. Dutta 2014. An Energy-har vesting Sensor Architecture and T oolkit for Building Monitoring and Event Detection (BuildSys’14) . [5] V . Chawla and D . S. Ha, An overview of passive RFID (IEEE-COMM’07) . [6] Y . Chen, N. Chiotellis, L. X. Chuo, C. Pfeier , Y . Shi, R. G. Dreslinski, A. Gr- bic, T . Mudge, D. D . W entzlo, D. Blaauw , and H. S. Kim, Energy- Autonomous Wireless Communication for Millimeter-Scale Internet-of- Things Sensor No des (J-SAC’16) . [7] M. Choi, T . Jang, S. Bang, Y. Shi, D . Blaauw , and D. Sylvester , A 110 nW Resistive Frequency Locked On-Chip Oscillator with 34.3 ppm/ ° C T emperature Stability for System-on-Chip Designs. JSSC 51, 9 (2016). [8] D. Dardari, R. D’Errico, C. Roblin, A. Sibille , and M. Z. Win, Ultrawide Bandwidth RFID: The Next Generation? Proc. IEEE 98, 9 (2010). [9] S. DeBruin, B. Campbell, and P. Dutta 2013. Monjolo: An Energy-harvesting Energy Meter Architecture (SenSys’13) . [10] R. D’Errico, M. Bottazzi, F. Natali, E. Savioli, S. Bartoletti, A. Conti, D . Dardari, N. Decarli, F. Guidi, F . Dehmas, and others 2012. An U WB-UHF semi-passive RFID system for localization and tracking applications (RFID- T A ’12) . [11] Energizer. CR2032 Datasheet. (2017). [12] R. Exel 2012. Clo ck synchr onization in IEEE 802.11 wireless LANs using physical layer timestamps (ISPCS’12) . [13] R. Exel, T . Bigler , and T . Sauter, Asymmetry Mitigation in IEEE 802.3 Ethernet for High- Accuracy Clock Synchronization (IEEE- TIM’14) . [14] Federal Communications Commission 2002. First Report and Order 02-48 . Techni- cal Report. Federal Communications Commission. [15] S. Gezici, Z. Tian, G. B. Giannakis, H. K obayashi, A. F. Molisch, H. V . Poor , and Z. Sahinoglu, Localization via Ultra- Wideband Radios: A Look at Positioning Aspects for Future Sensor Networks (IEEE-SPM’05) . [16] I. Guvenc and Z. Sahinoglu 2005. Threshold-based TOA estimation for impulse radio UWB systems. In 2005 IEEE International Conference on Ultra- Wideband . [17] V . Heiries, K. Belmkaddem, F. Dehmas, B. Denis, L. Ouvry , and R. D’Errico 2011. U WB backscattering system for passive RFID tag ranging and tracking (ICUWM’11) . [18] W . Hirt 2007. The European U WB Radio Regulatory and Standards Framework: Overview and Implications (ICUWB’07) . [19] P. Hu, P. Zhang, and D . Ganesan 2015. Laissez-Faire: Fully Asymmetric Backscat- ter Communication (SIGCOMM’15) . [20] B. Kempke, P . Pannuto, B. Campbell, and P. Dutta 2016. SurePoint: Exploiting Ultra Wideband Flooding and Diversity to Provide Robust, Scalable, High-Fidelity Indoor Localization (SenSys’16) . [21] B. Kempke, P. Pannuto, and P. Dutta 2016. Harmonium: Asymmetric, Bandstitched UWB for Fast, Accurate, and Robust Indoor Localization (IPSN’16) . [22] S. Kim, R. V yas, J. Bito , K. Niotaki, A. Collado, A. Georgiadis, and M. M. T entzeris, Ambient RF Energy-Harvesting T echnologies for Self-Sustainable Standalone Wireless Sensor Platforms. Proc. IEEE 102, 11 (2014). [23] Y .-S. Kuo, P. Pannuto, K.-J. Hsiao, and P. Dutta 2014. Luxapose: Indoor Positioning with Mobile Phones and Visible Light (MobiCom’14) . [24] Y . Lee, S. Bang, I. Lee, Y. Kim, G. Kim, M. H. Ghaed, P. Pannuto, and others, A Modular 1 mm 3 Die-Stacked Sensing Platform with Low Power I 2 C Inter-die Communication and Multi-Modal Energy Harvesting. JSSC 48, 1 (2013). [25] V . Liu, A. Parks, V . T alla, S. Gollakota, D . W etherall, and J. R. Smith 2013. Ambient Backscatter: Wireless Communication out of Thin Air (SIGCOMM’13) . [26] P. Loschmidt, R. Exel, and G. Gaderer , Highly accurate timestamping for ethernet- based clock synchronization. Journal of Comp. Networks and Comm. (2012). [27] D. Lymberopoulos, J. Liu, X. Y ang, A. Naguib , A. Rowe, N. Trigoni, and N. Moayeri. Microsoft Localization Competition. (2015). [28] D. Lymberopoulos, J. Liu, Y. Zhang, P. Dutta, Y. Xue, and A. Rowe. Microsoft Localization Competition. (2016). [29] Y . Ma, X. Hui, and E. C. Kan 2016. 3D Real-time Indoor Localization via Broadband Nonlinear Backscatter in Passive Devices with cm Precision (MobiCom’16) . [30] Y . Ma, N. Selby , and F. Adib 2017. Drone Relays for Battery-Free Networks (SIGCOMM’17) . [31] Y . Ma, N. Selby , and F. Adib 2017. Minding the Billions: Ultra-wideband Lo caliza- tion for Deployed RFID T ags (MobiCom’17) . [32] Maxim Integrated 2002. Application Note 505 – Lithium Coin-Cell Batteries: Predicting an A pplication Lifetime . Te chnical Report. [33] C. McElroy , D . Neirynck, and M. McLaughlin 2014. Comparison of wireless clock synchronization algorithms for indoor location systems (ICC’14) . [34] A. F . Molisch, D . Cassioli, C. C. Chong, S. Emami, A. Fort, B. Kannan, J. K aredal, J. Kunisch, H. G. Schantz, K. Siwiak, and M. Z. Win, A Comprehensive Standardized Model for Ultrawideband Propagation Channels (IEEE- T AP’06) . [35] T . Nakagawa, M. Miyazaki, G. Ono, R. Fujiwara, T . Norimatsu, T . T erada, A. Maeki, Y . Ogata, S. K obayashi, N. Koshizuka, and K. Sakamura 2008. 1-cc computer using UWB-IR for wireless sensor network (ASPDA C’08) . [36] A. Nemmaluri, M. D. Corner, and P. Shenoy 2008. Sherlock: Automatically Locating Objects for Humans (MobiSys’08) . [37] Nexperia. 74LVC595A Datasheet. (2014). [38] A. N. Parks, A. P. Sample, Y. Zhao, and J. R. Smith 2013. A wireless sensing platform utilizing ambient RF energy (Bio WireleSS’13) . [39] RadiantRFID. Virtual Asset Tracker . (2017). [40] R. M. Richardson. Remotely actuated radio frequency powered devices. (1963). US Patent 3,098,971. [41] A. P . Sample, D . J. Y eager , P. S. Powledge, A. V . Mamishev , and J. R. Smith, Design of an RFID-Based Battery-Free Programmable Sensing Platform. IEEE TIM 57, 11 (2008). [42] Y . Shapira. T el A viv U Review. english.tau.ac.il/sites/default/les/me dia_server/ T AU%20Review%202008-09.pdf . (2008). Smart Dew. [43] C. Swedberg. Children’s of Alabama Expands RTLS Deployment for Asset Tracking. (2013). rdjournal.com/articles/view?10479/2 . [44] V . T alla and J. R. Smith 2013. Hybrid analog-digital backscatter: A new approach for battery-free sensing (RFID’13) . [45] C. W alton. Portable radio frequency emitting identier . (1983). US Patent 4,384,288. [46] J. W ang, D. V asisht, and D. Katabi 2014. RF-IDraw: Virtual T ouch Screen in the Air Using RF Signals (SIGCOMM’14) . [47] Wise Track. (2017). wisetrack.com/rd-asset-tracking-e quipment . [48] L. Y ang, Y. Chen, X.- Y. Li, C. Xiao, M. Li, and Y. Liu 2014. T agoram: Real-time Tracking of Mobile RFID Tags to High Precision Using COTS Devices (Mobi- Com’14) . [49] T . Y ang, W . A. Davis, and W . L. Stutzman 2008. The design of ultra-wideband antennas with performance close to the fundamental limit (URSI’08) . [50] H. Zhang, J. Gummeson, B. Ransford, and K. Fu, Moo: A batter yless computational RFID and sensing platform. University of Massachusetts Amherst, T ech. Rep (2011). [51] P. Zhang, J. Gummeson, and D . Ganesan 2012. BLINK: A High Throughput Link Layer for Backscatter Communication (MobiSys’12) . [52] L. Zhou, G. Li, Z. Zheng, and X. Y ang 2014. TOA Estimation with Cross Correlation-Based Music Algorithm for Wireless Location (CSNT’14) . 12