120 may be based on the maximum range for powering a tag 130, e.g., if the maximum range for powering a tag 130 is 10 meters, then the readers 120 may be up to 20 meters apart from each other so that each tag can be powered by at least one reader. Each reader 120 is oriented so that its antenna(s) emits interrogation signals 121 largely downward, toward the floor, with less RF energy propagating sideways.

In this example, reader 120a is in interrogator mode and readers 120b-120c are in listener mode. Reader 120a transmits an interrogation signal 121 via a free-space channel 122, which could include one or more reflections, to the RFID tag 130. Reader 120a should be close enough to the tag 130, which is passive, for the interrogation signal 121 to power or charge the tag 130 enough to produce a detectable reply 131. Given constraints on maximum power, channel loss, and tag backscattering efficiency, the distance between the RFID tag 130 and reader 120a should be about 20 meters or less (e.g., 15, 10, or 5 meters). The other readers 120b-120d can be farther away from the tag 130 (e.g., up to 25, 50, 75, 100, 125, 250, or even 500 meters away) because they are not powering or charging the tag 130 and hence do not suffer from self-interference. Given constraints on maximum power, channel loss, and tag backscattering efficiency as well as self-interference cancellation, the distance between the RFID tag 130 and reader 120a may be about 20 meters or less (e.g., 15, 10, or 5 meters).

The other readers 120b-120d can be farther away from the tag 130 (e.g., up to 25, 50, 75, or even 100 meters away) because they are not powering or charging the tag 130, so they do not have to perform self-interference cancellation in order to detect the response 131. The maximum distance between the other readers 120b-120d and the tag 130 depends on the amplitude of the reply 131, the channel loss, and the sensitivity of the readers 120 and can be up to 500 meters with the right receiver, antenna, and path-loss conditions. (The amplitude of the tag reply response is generally 10 dB below its turn-on power, which is typically around −17 dBm (and decreasing over time as tag performance improves). The channel loss is around 32 dB at 1 meter and increases by about 6 dB for every doubling of distance. The sensitivity of a reasonable RFID receiver is −80 dBm.) The readers 120 may be arrayed within the room so that every reader 120 should be able to detect replies from every tag 130 or so that not every reader 120 can detect replies from every tag 130, depending in part on the shape and size of the room.

The tag 130 may have a dipole antenna that radiates the reply 131 in a donut-shaped pattern. Because the readers 120 are at different locations with respect to the tag 130, this RF field impinges each reader 120 from a different azimuth and/or elevation as shown at top and bottom, respectively, of FIG. 1C. In certain circumstances, such as if the channel between the reader 120a and the tag 130 is reverse-link limited, the listeners 120b-120d can receive the tag's reply 131 without error even if the reader 120a receives the reply 131 with error. Each reader 120 can calculate the corresponding azimuth and elevation AOAs and transmit the calculated AOAs for each tag 130 to the controller 110. Each reader 120 can also estimate the range or distance to tag 130 based on the amplitude or RSSI of the reply 131 The controller 110 may aggregate the AOAs and/or ranges from the different readers 120 and use them to estimate the tag's location, e.g., by trilateration or triangulation. Because a single interrogation signal 131 yields multiple simultaneous AOA measurements from different locations by up to all of the readers 120 in the system 100, the controller 110 can derive or estimate the location of the RFID tag 130 after just one hop, unlike in conventional RFID systems, which may take many hops to locate a tag 130 in two or three dimensions. With more AOA measurements, the controller can estimate the tag's location relative to the readers 120 more precisely. If the readers' absolute locations are known, the controller 110 can use them to estimate the tag's absolute location as well.

Readers 120b-120d also detect the interrogation signal 121 from reader 120a before detecting the tag reply 131. As explained in greater detail below, when a reader 120 is in listener mode, it scans the relevant RFID communication band (e.g., 902 to 928 MHz in the United States or 865 to 868 MHz in Europe) for the interrogation signal 121, which may be broadcast on one of many channels (e.g., 50 channels) within that band. When a reader 120 in listener mode detects an interrogation signal 121 on a particular channel, it listens for a reply 131 on the same channel within a predetermined or preset time window of the end of the interrogation signal 121. The reader 120 may also demodulate or decode the interrogation signal 121 and use the decoded interrogation signal 121 to interpret the reply 131 from the tag 130.

The interrogation signal 121 tells the tag 130 how to respond (i.e., the modulation, preamble-type, and bit rate for the reply 123). The readers 120 in listener mode listen for the commands 121 to know how the tag 130 should respond to the command 121. The readers 120 in listener mode also determine the end-time of the command 121 to know when to expect the tag reply 123 based on the timing constraints placed on the tag's reply 123.

Because the readers 120 are mounted on the ceiling and broadcast interrogation signals 131 downward (toward tags 130), they generally detect the interrogation signals 131 from other readers 120 via non-line-of-sight (NLOS) paths. In FIGS. 1B and 1C, for example, reader 120a emits the interrogation signal 131 downward, causing at least a portion of the signal 131 to reflect or scatter off the floor, shelving, and/or other objects. The other readers 120b-120d detected this reflected or scattered energy, possibly instead of or in addition to detected energy that propagates directly from reader 120a without scattering or reflecting off another surface. Even accounting for attenuation along the NLOS path, the detected interrogation signal 131 has an amplitude great enough to be detected with high fidelity (e.g., SNR>10 dB) by the readers 120b-120d in listener mode.

The RFID tag location system 100 can also include or interact with handheld readers, vehicle- or cart-mounted readers, or other readers that are not connected to the system controller 110 via a wired connection. These readers may be switchable between interrogator and listener modes or they may be conventional readers that operate exclusively as interrogators, i.e., by transmitting interrogation signals and receiving tag replies without detecting or processing interrogation signals from other readers. In either case, when a handheld reader transmits an interrogation signal, the readers that are both in listener mode and within range detect both that interrogation signal and any tag replies. These readers may compute the estimated AOA of the tag reply and the location of the responding tag from the tag replies and report the locations, AOA, and/or tag reply parameters (e.g., magnitude, phase, time of arrival) to the system controller for more processing.

If desired, the handheld reader may broadcast a command to the other (fixed) readers that switches the other readers into listener mode before transmitting the interrogation signal. Alternatively, the other readers can scan the RFID channels for handheld readers when not transmitting or in interrogator mode. Or the readers (including the handheld reader) can use a self-synchronizing PN sequence to drive the frequency hopping such that all readers (fixed and/or handheld) can synchronize to the hopping pattern. The fixed readers could also always be in listener mode (and possibly lack transmitters and associated hardware) for operation exclusively with handheld or mobile readers (interrogators).

FIG. 2 illustrates the reader 120 in greater detail, including components that can be enabled if the reader 120 is in interrogator mode or disabled if the reader 120 is in listener mode. The reader 120 includes an RF antenna and front end 210, a processor 212, an RF calibration and tuning block 214, a hop generator 220, and a hop receiver 230. The RF antenna and front end 210 may include one or more antenna elements, amplifiers, filters, and/or other analog RF components for transmitting RFID interrogation signals 121 and receiving tag replies 131 and RFID interrogation signals 121 from other readers. The processor 212 may be implemented in a microcontroller, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other suitable device and controls the operation of the reader 120. It stores information in and retrieves information from a memory (not shown) and communicates with the system controller via a network connection (not shown), such as an Ethernet connection. And the processor 212 switches the reader 120 between interrogator and listener modes, with the hop generator 220 being disabled or off in interrogator mode and enabled or on in interrogator mode and the hop receiver 230 being enabled or on in both modes. The RF calibration and tuning block 214 performs RF calibration and tuning functions.

The hop generator 220 generates the interrogation signals 121 that the reader 120 transmits to the RFID tags 130 and other readers 120 (FIGS. 1A-1C). It may also generate commands or communications signals intended for other readers 120, e.g., on a dedicated reader communications channel or with particular preambles or payloads. It includes a digital command generator 222, which generates the digital queries, commands, and/or other information conveyed by the interrogation signals 121, and RF electronics 224 for turning the digital signals from the command generator 222 into analog signals suitable for transmission by the antenna 210. The RF electronics 224 may include a digital-to-analog converter (DAC) that converts the digital signal into a baseband analog signal, a mixer and local oscillator to mix the baseband analog signal up to an intermediate frequency, and filters and/or pulse shapers to remove sidebands and/or spurs.

The hop receiver 230 includes a receiver front end 232 coupled to a command demodulator 234 and a tag reply demodulator 236. Generally, the receiver front end 232 digitizes, down-converts, and estimates the phase of the RF signals detected by the antenna(s). When the reader 120 is in listener mode, the receiver front end 232 also detects the channels on which the other readers 120 transmit interrogation signals 121 and estimates the carrier frequencies of those other interrogation signals 121. There are a variety of ways to configure the receiver front end 232; in this example, it receives analog in-phase and quadrature (I/Q) signals at 40 MHz and converts them into digital I/Q samples at baseband (5 MHz) as explained in greater detail below. In other examples, the receiver front end could include a low intermediate frequency heterodyne receiver or other suitable receiver. The command demodulator 234 is enabled when the reader 120 is in listener mode and demodulates the baseband command I/Q samples to produce interrogator signals 231 at the command bit rate (e.g., 40 kbps to 160 kbps). The command demodulator 234 uses the command payload to determine what the reader 120 in interrogator mode is asking of the tag 130 (e.g., modulation, preamble type, expected reply type, etc.). For example, the reader 120 in interrogator mode may ask the tag 130 to send the first 64 bits of its electronic product code (EPC) using Miller-2 modulation at a 320 kHz backscatter link frequency (BLF) with the standard preamble. The readers 120 in listener mode use that information to decode the tag reply 131. The command demodulator 234 is disabled when the reader 120 is in interrogator mode. The tag reply demodulator 236 is enabled in both interrogator and listener modes and demodulates the baseband tag reply I/Q samples to produce tag reply signals 233 at the tag reply bit rate.

FIG. 3 shows one of many possible implementations of the receiver front end 232. This implementation includes an analog-to-digital converter (ADC) 310 that is clocked by a clock generator 312 and converts analog I/Q signals at 40 MHz on one or more channels into digital I/Q samples at 40 MHz. The ADC 310 also generates an end-of-hop (EOH) signal indicating the end of each hop. The EOH signal indicates that the reader 120 in listener mode can stop processing the current hop, and aggregate the hop statistics (e.g., power levels, time stamps of various events, etc.). The EOH signals that the receiver should prepare for the next hop or other next action, such as go idle or sleep.

A downconverter 320 coupled to the output of the ADC 310 mixes the digital I/Q samples down to baseband (e.g., 5 MSa/s). When the reader 120 is in listener mode, a channel detector and selector 322 detects and selects the channel of the detected interrogation signal 121 as described below. A decimator 330 down-samples the digital samples for processing by the command demodulator 234 and tag reply demodulator 236. In other words, once the receiver determines the 500 kHz channel of the received reply 123, it converts that channel to baseband and applies a baseband filter. It also down-samples the 40 MHz samples to 5 MHz to reduce the digital signal processing load.

In listener mode, a frequency estimator 332, which is enabled by the command demodulator 234, estimates the phase and frequency of the detected hop and provides these estimates to the downconverter 320, which compensates for frequency and phase, effectively removing both from the signal. The frequency estimator 332 also estimates the amplitude of the detected tag reply 131 and provides the amplitude estimate to the tag demodulator 236, e.g., for locating the RFID tag that sent the detected tag reply 131. This is a listener-only feature. In practice, the local clock references of the readers 120 may be different and may drift. The frequency estimator 332 makes it possible to track and remove the CW portion of the hop or at least remove enough of it so that a very narrow notch filter can remove any residual frequency offset. The readers 120 in listener mode may sense CW portions of the hop that are much larger than the tag reply 131 directly from the reader 120 in interrogator mode. The readers 120 in listener mode track and remove those CW portions to stay within the tag demodulator's dynamic range.