Link Budget Analysis for Backscatter-Based Passive IoT

Massive connectivity of billions of communicating devices for fifth-generation (5G) and beyond networks requires the deployment of self-sustaining, maintenance-free, and low-cost communication paradigms. Could passive Internet of Things (IoT) solve these challenges? Passive IoT can be realized with the backscatter communication (BackCom) paradigm, which uses ultra-low power, inexpensive passive tags to support massive connectivity. However, a comprehensive link budget analysis for BackCom networks has not yet been available. It is something that is necessary for practitioners and researchers to evaluate the potential of BackCom. This survey is organized as follows. First, we describe the BackCom configurations, passive IoT design targets, backscatter channel statistics, and the different components and operations of the backscatter tag. Second, we develop the forward link budget and the overall link budget. All the relevant parameters are described in detail. Third, we give numerical and simulation results to get insights on the achievable performance of BackCom networks. Since additive path losses and excess fading can limit the performance of BackCom networks, we examine potential solutions to overcome the resulting limitations, enabling massive IoT networks. We also discuss integrating BackCom with existing wireless technologies. We further highlight some applications and address open issues, challenges, and future research directions.


I. INTRODUCTION
The internet of things (IoT) allows various devices to connect to the internet to send data, receive instructions, or both. The global number of IoT devices has reached 20 billion in 2017. It will exceed more than 75 billion in 2025 because of the expansion of various IoT networks such as industrial IoT, parcel monitoring/warehouse applications, intelligent farming, sensing, smart home, and many more [1], [2]. These include traditional home appliances, Alexa-style digital assistants, internet-enabled sensors, and more. Thus, massive connectivity is needed. Moreover, powering these billions of IoT devices is a critical challenge. Deploying power cables or regularly replacing/recharging batteries is a non-viable solution. Hence, ultra-low power consumption, i.e., passive IoT, will enable long-term, maintenance-free, and energy-efficient networks [3], [4].
The associate editor coordinating the review of this manuscript and approving it for publication was Xiaofan He . Cellular networks can also support connectivity as highspeed IoT, medium-speed IoT, and narrow-band IoT (NB-IoT) [2], [5], [6]. NB-IoT targets low cost, long battery life, and high connection density while reducing power consumption, improving system capacity, and increasing spectrum efficiency. NB-IoT supports tens of billions of low-power IoT node connections for low-speed IoTs. The number of IoT connections enabled by medium-and high-speed cellular networks is significantly smaller than that of low-speed IoTs. Consequently, the state-of-art technology can only support around 10 billion IoT connections. However, the fifthgeneration (5G) and beyond networks may support hundreds of billions of connections. Therefore, passive IoT will enable some of those connections [1], [2], [7], [8] and has attracted the attention of both industry and academia.
Passive IoT devices do not have batteries but rely on energy harvesting (EH) [9], [10] from various sources, including solar, motion or vibration, ambient radio-frequency (RF), or an RF signal generated by the radio frequency identification (RFID) reader. Moreover, according to the recent 3rd generation partnership project (3GPP) discussion [10], the power consumption of such devices is low enough to function with EH, i.e., 1µW∼100µW, and the cost per device is extremely low, i.e., 0.01$∼0.5$. Due to technological advances, radio devices that are inexpensive, compact, and low maintenance have made significant progress recently [11], [12]. Hence, passive or battery-free IoT devices are an attractive solution for various types of applications, especially those requiring high connectivity at a low cost, such as sensor networks [4].
With promising features (e.g., long lifespan, low maintenance cost, and reduced environmental impact), passive IoT can provide pervasive connectivity for many applications, including smart homes/cities, logistics/inventory management, and transportation [13], [14]. Consequently, the impact of passive IoT on human life will be significant.

A. OTHER WIRELESS TECHNOLOGIES
While IoT networks have grown recently, one must also recognize traditional wireless networks. Each new wireless generation has appeared every decade since introducing mobile cellular networks in the 1980s (Fig. 1). The first four generations primarily focused on human-type communication (HTC). However, the current 5G and future networks support both HTC and machine-type communications As passive IoT-based network solutions will play a significant role in future/6G wireless, BackCom offers a potential path of realization. Moreover, integrating BackCom with cellular networks, television (TV) networks, universal mobile telecommunications system (UMTS), global system for mobile communications (GSM), Wireless Fidelity (Wi-Fi), Bluetooth, long-range (LoRa), and other wireless networks, has gained the tremendous attention of the research community.
Thus, several surveys [11], [12], [25], [26], [27], [28], [29], [30], [31] treat many relevant aspects. Reference [11] covers the basics and modulation of BackCom while summarizing recent research on bistatic BackCom (BiBC) systems. It also outlines the novel real-world applications enabled by BackCom and identifies open questions. Reference [12] provides a comprehensive overview of ambient BackCom (AmBC) systems, covering fundamentals, general architecture, advantages, challenges, applications, limitations, and VOLUME 10, 2022  research efforts/progress. Reference [25] presents the potential of BackCom for enabling green IoT through joint communication and sensing. It thus discusses operating principles, architecture, evolution, and cutting-edge applications. Reference [26] emphasizes BackCom to enable battery-free tags to solve limited battery lifetime problems in conventional networks, elaborating on the tag architecture and various types of BackCom. It provides signal processing techniques, such as channel coding, interference, decoding, and signal detection schemes. Reference [27] summarizes BackCom development and research advances over the last seven decades, including fundamental principles, applications, challenges, and potential research topics. Reference [28] also focuses on the signal processing aspects of BackCom by providing a detailed survey of the fundamentals, architecture, and challenges. The authors review the major experimental and theoretical work for multiple access schemes and resource allocation techniques. In [29], the authors review the history of IoT and BackCom, describing the various backscatter networks, applications, and open challenges. Reference [30] also describes the integral aspects of wireless-powered networks with BackCom emphasizing large-scale networks. Despite these efforts, no review paper has focused on the link budget analysis of BackCom systems.
The end-to-end backscatter channel is the cascade of the forward channel (i.e., emitter-to-tag) and backscatter channel (i.e., tag-to-reader), resulting in double path loss. Thus, the link budget must consider both of these. This budget can be used to determine the rate and coverage of BackCom-assisted (passive) IoT. The link budget is a detailed account of all gains and losses from the emitter to the reader. This budget is thus a critical tool to determine the minimum necessary received signal-to-noise ratios (SNRs). The link budget also reveals the likelihood of the tag activation, a critical event as the tag is powered by harvesting the incident RF signal (ambient or dedicated). EH circuits are typified by a low power conversion efficiency (PCE), a fundamental problem. Moreover, the EH unit of the tag consists of an antenna, matching network, and rectifier. The RF rectifier achieves nearly zero PCE when the input power is below a threshold. This region is the ''dead zone'' of the RF rectifier. Depending on it, the activation threshold of a tag may be defined as the minimal amount of incident RF power required to activate its EH unit. Below this threshold, the tag will be inactive and unable to perform any operations.
The link budget can thus determine the RF power levels of each point in the system more efficiently and inexpensively than, say, prototyping. Overall, the link budget analysis helps to determine the viability of potential uses of BackCom systems.
It is also important to list and describe all the link-budget parameters in one place for ease of access and reference. This survey thus aims to serve as a useful reference document for researchers and practicing engineers. Antenna and RF system designs and packaging technologies for BackCom systems are covered in [31]. In contrast, we focus explicitly on the link budget analysis for backscatter links to enable passive IoT. To our knowledge, no papers have comprehensively described all the relevant parameters for BackCom link budgets. Motivated by this critical gap in the literature, we provide a comprehensive overview, focus on BackCom link parameters, and extensively investigate BackCom feasibility (Fig. 2). Table 1 compares and contrasts our work with related BackCom literature reviews.
The contributions of this paper are summarized as follows: 1) We review the key parameters of the BackCom communication channel, passive tag parameters, and reader/emitter parameters. To this end, we discuss tag antenna parameters, backscatter modulation, impedance matching, EH, and the tag baseband processing unit. 2) We develop a complete link budget analysis and provide simulation examples for various practical scenarios. The simulation results also establish the viability of BackCom and provide insights on the performance of BackCom-enabled passive IoT.
3) The link budget calculations show that the forward link restricts the performance more than the backscatter link. The reason is that if the forward link is poor, then the tag is not activated at all. We thus propose and evaluate potential solutions to overcome this bottleneck to achieve higher overall performance in BackCom. We also provide simulations to evaluate the potential solutions. 4) Finally, integrating BackCom with various wireless technologies is discussed. Application scenarios, open issues, challenges, and future research directions are also discussed.
The rest of the paper is organized as follows. We first describe the three backscatter configurations, the tag types, and their functionalities in Section II. We next discuss the design targets for passive IoT and address the critical analysis factors, including the backscatter channel, tag, and reader/emitter in Section III. We also describe the components of the passive tag, emphasizing the research efforts to enhance efficiency. To investigate the feasibility of passive IoT, Section IV explicitly discusses the link budget. We outline the key link-budget design parameters and provide numerical examples and discussions. We also suggest the key factors and potential solutions for the link budget improvement. Section V discusses possible deployment scenarios for passive IoT, including symbiotic BackCom, Wi-Fi BackCom, Bluetooth BackCom, and LoRa BackCom. We show some applications of passive IoT in Section VI. Section VII addresses the open issues and future research directions. Finally, we conclude the paper in Section VIII. Table 2 summarizes the abbreviations.

II. INTRODUCTION TO BACKCOM
BackCom is an ultra-low-power paradigm where a backscatter device (tag) communicates with a reader without generating an RF signal. Tags use passive backscatter modulation [21]. Thus, BackCom provides energy efficient, spectrum efficient, and cost-effective solution for next-generation wireless networks [11], [12]. A basic BackCom system comprises a tag, a reader, and an emitter.
1) The tag has a low power integrated circuit (IC) capable of limited processing. It does not incorporate any active RF components and simply reflects the incident RF signals for data transmission (Section II-A).
2) The reader, on the other hand, has a dedicated power supply and RF components. Thus, it can perform complex RF operations such as demodulation and decoding to recover data from tags. A reader can be any active device with processing capabilities, such as mobile phones, Wi-Fi access points (APs), etc. Multiantenna readers also can improve BackCom performance (Section IV-E5).
3) The emitter (also known as the (RF) source) generates the RF signal reflected by the tags. It can be a dedicated beacon signal generator or an ambient legacy transmitter such as TV towers, cellular base stations (BSs), Wi-Fi APs, and others. The emitter can also be equipped with multiple antennas to enhance the received power at the tag via beamforming (Section IV-E3). Throughout the paper, we will refer to the emitter-totag and tag-to-reader links as the forward link and the backscatter link. The main BackCom configurations are monostatic BackCom (MoBC), BiBC, and AmBC (Fig. 3). 1) MoBC: This system comprises a reader and a tag ( Fig. 3 (a)). The reader performs the dual tasks of the RF signal emitter and the decoder of tag-reflected signals. Here, the received signals at the reader suffer a round-trip (dyadic) path-loss [32]. Consequently, there is a performance degradation. If the reader is far from the tag, the incident RF signal at the tag may be too weak to activate the tag, and moreover, the backscatter signal received at the reader is also weak for detection purposes [33]. Hence, MoBC systems work for short-range applications such as RFID. 2) BiBC: Unlike MoBC, a BiBC system has a separate dedicated RF carrier emitter and reader ( Fig. 3  (b)). This separation counteracts two drawbacks of MoBC. First, the separation eases the restricted range of the forward link. Second, this configuration can also alleviate the MoBC round-trip path loss. Moreover, the range and rates of the tags can be enhanced by deploying multiple emitters in optimal locations with a single centralized reader. Consequently, the range of communication is extended. Furthermore, the tag can harvest energy from surrounding carrier emitters' RF signals.Additionally, the doubly near-far problem, i.e., a tag located far from the emitter can experience a higher energy outage probability and a lower modulated backscatter signal strength [33], can be mitigated since tags can harvest energy and backscatter data from unmodulated RF signals received from nearby carrier emitters [33]. 3) AmBC: These systems utilize existing ambient RF emitters (Fig. 3 (c)) and do not employ dedicated RF emitters like BiBC systems. Recycling existing RF signals yields many benefits over BiBC and MoBC systems [21]. First, deploying and maintaining dedicated RF emitters is not needed, reducing costs and energy consumption. Second, additional spectrum allocations are unnecessary, improving spectrum resource utilization. However, such unpredictable and dynamic modulated RF signals can cause direct interference to readers, limiting the performance of the AmBC systems. Furthermore, the design and implementation of an AmBC system to achieve optimal performance can be challenging since the characteristics of ambient RF emitters (e.g., transmission power and locations) are not controllable. Finally, signals reflected by the tag can interfere with the legacy receivers [34].

A. TYPES OF BACKSCATTER TAGS
Tags can be categorized in terms of the availability of power [24]: (i) type-1 tags and (ii) type-2 tags. Type-1 tags are battery-powered. In contrast, type-2 tags operate using direct current (DC) power harvested from an RF signal and without batteries. Thus, these tags are low-cost devices. We briefly discuss the features of all tags and their applications. Table 3 also compares these two types.

1) TYPE-1 TAG (ACTIVE AND SEMI-PASSIVE)
These are also called semi-passive or active tags [24]. Semipassive tags harvest and store energy but with limited storage. Active tags do not harvest energy and have batteries to power their circuits [24]. In this case, the system's performance mostly depends on the reader's sensitivity, i.e., the minimum power level required to successfully detect the received signal from noise. Thus, the systems based on Type-1 tags are backscatter link limited, but not the forward link, i.e., activating the tag is not an issue. These tags can support features such as sensors, real-time tracking and identification, localization, and sound notifications [35].

2) TYPE-2 TAG (PASSIVE)
Type-2 backscatter tags (passive tags) are powered by EH. They harvest energy from ambient RF sources (e.g., TV towers, cellular BSs, and Wi-Fi APs) or a dedicated RF emitter. The harvesting process saves battery recharging/replacement costs. Moreover, these tags last longer and are less expensive than type-1 tags. Hence, passive tags offer many advantages, such as miniaturization, low fabrication/maintenance cost, long lifespan (beyond the limited shelf life of batteries), and reduced environmental impact, compared to battery-powered systems.
Because tags rely on EH, the typical communication range is limited [20], [29], [36]. 1 In particular, these tags are forward link limited due to the tag activation requirement (Section IV). However, the overall backscatter link range also depends on the reader's sensitivity.
Passive tags can be used for animal tracking (livestock and pets), smart agriculture, and smart homes. Moreover, they can be deployed for harsh environmental conditions such as bad humidity, high temperature and pressure environments, and extreme radiation conditions [25]. However, security and privacy issues may arise with using such tags [25], [29].
Passive chipless tags, which are made from plastic or conductive polymers rather than silicon-based ICs/microchips [37], [38], promise to further reduce the cost of tags; however, they lack the IC required to perform any on-tag logic or computation. These tags have limited memory (a few bits) and a short range (< 1m), limiting their practical applications [38].
Due to the above reasons, type-1 tags may not scale up to large-scale deployments. In contrast, passive tags offer simplicity, low manufacturing cost, and low maintenance requirements. Thus, they are more suitable for passive IoT [25], [39]. Hence, this article focuses on them, and the term ''tag'' refers to a passive tag unless otherwise stated.

III. DESIGN TARGETS FOR PASSIVE IoT
This section discusses the design targets/requirements for passive IoT networks and the details of the backscatter channel, tag, reader, and emitter.
We first state the requirements/targets for passive IoT networks [23], [24]: 1) Connection Density: The ultra-dense deployment of passive (and industrial) IoT devices requires connectivity supporting up to 100 connections per m 3 . 2) Battery-Free Devices: Battery-less devices with no energy storage capabilities or devices with limited energy storage are preferred. Hence, the devices should be capable of EH.

3) Power Consumption:
The devices should have ultra-low power consumption, i.e.,1 µW∼100 µW, to operate with EH. 4) Cost: The devices should have ultra-low cost (i.e., 0.01$∼0.5$ per device), extremely small size (i.e., printable), and have a long lifespan (i.e., more than 10 years) to sustain low-cost implementation and network deployment. 5) Coverage Capability: The devices must have a coverage range of 100 m to 200 m for industrial applications such as warehousing, 10 m to 20 m for smart homes, and 2 m to 5 m for wearables. 6) Data Rate: The devices must achieve 10 kbps to 100 kbps data rates to support diverse application scenarios [23].
Passive IoT networks will achieve lower complexity and power consumption than existing 3GPP low-power wide-area (LPWA) networks [40] (e.g., NB-IoT and enhanced MTC). Passive IoT, however, will support use cases not feasible by existing LPWA IoT. Hence, passive IoT is not a replacement for existing IoT networks. Passive IoT devices are now emerging, e.g., an integrated passive device (IPD) [41], [42]. This device is implemented in a single EIA 0805 (2.0 × 1.25 mm 2 ) surface-mount technology (SMT) component and includes an impedance matching network, Balun filter, and the entire front-end RF circuitry. The IPD will operate in the license-free 868 MHz RF band in Europe and the 915 MHz band in Australia and America. The product works seamlessly with LoRa and LoRa Smart Home RF transceivers Sx1261, Sx1262, and LLCC68 [43]. Whether BackCom systems can meet the above-mentioned criteria is important. This depends on a tag's ability to communicate reliably and to harvest enough energy. This can be quantified with a link budget analysis.
The reliability of BackCom systems depends on the ability of the tag to harvest enough energy and its ability to communicate with the reader. Hardware limitations and transmission impairments can cause failures. To understand such effects, we will develop the link budget analysis of BackCom systems. Furthermore, we also investigate other design targets for realizing passive IoT, such as data rate, power consumption, cost, supported energy sources or EH techniques, connectivity requirements, positioning accuracy, and others. This analysis considers functional impairments and trade-offs.
Before proceeding to the link budget, it is essential to understand all BackCom components.

A. BACKCOM CHANNEL
Backscatter channels have significantly different fading characteristics from conventional wireless links. In this case, the emitter-to-tag channel is the product of the forward and backscatter channels, which describe the signal propagation from the emitter to the tag and the tag to the reader, respectively. This product channel is known as a dyadic channel, which can be described by tuple (N , L, K ) with N -emitter, L-tag, and K -receiver antennas (Fig. 5).
In this dyadic channel, we can observe the so-called pinhole effect. In an ideal multipath channel, the MIMO capacity is approximately N times the capacity of a single antenna system, where N is the rank of the MIMO channel matrix. Ideally, N is the smaller of the number of transmit and receive antenna elements. However, in certain configurations, the rank can collapse to one sometimes, which is the pinhole or keyhole effect.
Each tag antenna behaves as a pinhole in the above configuration (Fig. 5), i.e., it collects all incoming multi-path components and sends them to the reader [44], [45]. Hence, there exists two sets of paths traveling to and from the lth The channel matrix for each tag antenna is then becomes the dyadic (outer) product, i.e., . . , L. Thus, the rank of the channel matrix H i is 1 and is referred to as the pinhole effect. Consequently, this effect decreases the capacity available in the channel [44], [45].
Moreover, the dyadic backscatter channel results in deeper fades, i.e., a higher probability of severe deep than conventional links. This happens because the dyadic channel is a product of two fading variables [46].

1) DYADIC BACKSCATTER CHANNEL PDF
Typically, the forward and backscatter links experience Rician fading [44]. Analytical treatments of this case are complicated. Therefore, Rayleigh fading in the forward and backscatter channels can provide a lower bound for the above case. For the sake of brevity, we refer the reader to [44], [47], and [48] for further details. Fig. 6 plots the envelope probability density function (PDF) of the (1, 1, 1) dyadic channel for different Rician-K R factors. The conventional Rician-K R channel PDFs are also plotted for comparison. Independent forward and backscatter links are assumed while each PDF has been normalized to unit power, i.e., E{α 2 } = 1, where α is the envelope of the channel.
To see that the dyadic channel creates deeper fades compared to non-dyadic channels, we resort to the coefficient of variation (c v ). It measures the dispersion of a probability distribution and is defined as c v = σ/µ × 100%, where σ is the standard deviation and µ is the mean [49]. For wireless channels, high c v values show deeper fading and vice versa. Hence, a low c v is preferable to avoid deeper fading. Table 4 calculates it for the dyadic backscatter and conventional channels (Fig. 6). It clearly shows the deeper fading effects of the dyadic channel, leading to outages and higher error rates.

B. BACKSCATTER TAG
A tag comprises multiple elements (Fig. 7). The analog front-end includes an EH unit and a transceiver (backscatter modulator/demodulator), which handles EH and signal modulation/demodulation. The baseband processing unit controls data coding/decoding and memory/sensor access. The clock generator (typically a simple local oscillator) synchronizes the operation of the processor (Section III-B8).
A sensor can sometimes be included in a tag when the tag has to collect measurements from the environment and communicate them to the reader. Such examples include wireless sensors (e.g., temperature, humidity, etc.), equipment, and living things monitoring in industries such as electric power, petroleum, livestock farming, and manufacturing [10].
Because the tag is battery-less, a highly sensitive EH module is required to harvest as much energy as possible from the RF signal (Section IV-E1). On the other hand, the processor/transceiver consumes minimal power and setup communication protocols. Extensive research efforts on tag designs VOLUME 10, 2022 are ongoing as the key facilitator for passive IoT deployment from both technical and theoretical perspectives, including fundamental limits and design challenges [21], [50], [51].
Next, we describe each tag block and discuss research efforts to enhance their efficiency.

1) ANTENNA
The tag antenna is used for both signal reception and transmission. Multiple requirements determine the tag antenna selection [52]; e.g., frequency band, size, form factor, required read range, cost, and reliability. The minimum required read range is specified for different equivalent isotropically radiated power (EIRP) of the reader/emitter, antenna orientation (some applications require a specific directional pattern such as omnidirectional or hemispherical coverage [53], [54]), and objects; the performance of the tag antenna highly depends on the object that it is placed on or even the vicinity of the tagged object (Section IV-C3). Thus, the tag antenna could be designed or tuned for optimum performance on a particular object or designed to be less sensitive to the surface on which the tag is placed [55]. Moreover, tag antenna performance strongly relies on the frequency-dependent complex impedance presented to the antenna [52].
BackCom operating frequencies vary significantly depending on transmission protocols, local regulations, and target applications [21]. For example, RFID systems use the super high frequency (SHF) band (2.4 GHz to 2.5 GHz and 5.725 GHz to 5.875 GHz) and the ultra-high frequency (UHF) (860 MHz to 960 MHz) to the high-frequency band (13.56 MHz) and the low-frequency band (125 MHz to 134.2 MHz). UHF tags are widely used because of small antennas, including microstrip antennas, dipole, and planner antennas [55].
Unlike active radio circuits (which demand more complicated designs and higher power consumption at increasing operating frequencies), passive have low power consumption when operating at higher frequencies, i.e., SHF. When operating at SHF, BackCom systems possess certain advantages, e.g., higher tag antenna gain is possible, and the antenna's half-wave dipole (calculated as half the wavelength) is reduced [56]. For instance, when operating at 915 MHz, 2.45 GHz, and 5.79 GHz, the half-wave dipole is 16 cm, 6 cm, and 2.5 cm, respectively [56]. Therefore, the antennas can be made small enough for each tag to use multiple antennas. Thus, the tag may employ multi-antenna processing techniques such as diversity, beamforming, space-time block coding (STBC)/space frequency block coding (SFBC) schemes to mitigate fading [57], [58].

2) BACKSCATTER MODULATION
Modulation is the process of mapping data onto an RF carrier. Active radios generate their own carrier signal for data modulation. As mentioned before, tags simply reflect an external RF signal [50]. To do that, the tag switches among a set of impedance values to generate different reflection coefficients [20], [21].
To create a general multi-level (M -ary) modulation scheme, the tag will useM load impedance values (Z m ). To transmit modulation symbol b m (k) at time k, the tag presents the impedance Z m (k) to the antenna of impedance Z a to generate the reflection coefficient m (k). The reflection coefficient then becomes [21] where 0 < β ≤ 1 is the tag's power reflection factor and z * is the complex conjugate of z.
In (1), the first condition, i.e., m = 1, . . . ,M , denotes modulation or active state at the tag, whereas the second condition, i.e., m = 0, denotes the inactive state or impedance matching/EH without reflection at the tag (Section III-B4).
A complete summary of tag modulation schemes and their performance is provided in [21] and [30].

3) BACKSCATTER DEMODULATION
Demodulation is the process of extracting the information bits from the modulated carrier signal. Unlike BiBC and AmBC, the monostatic tag must process the received signal from the emitter, which is co-located with the reader. The tag must respond to the reader's commands. For this task, a typical UHF RFID passive tag uses a simple envelope detector [66]. Most readers use OOK to send reader commands. The tag then demodulates and classifies the amplitude of the received signal into high or low levels (presence or absence of the RF signal from the reader). An OOK detector can be easily implemented with a diode and a resistor-capacitor oscillator circuit as a bandpass filter [67]. An ASK demodulator circuit is also designed in [68] with a power consumption of 4.28µW.

4) IMPEDANCE MATCHING
The tag may adjust its load impedance to match the antenna impedance. This results in the reflection coefficient being zero, i.e., state m = 0 in (1), and hence maximizes the energy absorption at the tag by efficiently coupling the incoming signal to the antenna. Fig. 8 shows a simple circuit diagram of the tag impedance matching. Here, form (1), the equivalent tag impedance is given as Z 0 (k) = Z l . The complex value load impedance and antenna impedance, respectively, are given as Z l = R l + jX l and Z a = R a + jX a where R l and R a are the load and antenna resistances, respectively, and X l and X a are the antenna and load reactances. Antenna impedance significantly impacts the system performance; it should be high enough to allow the tag to reliably perform load modulation and prevent system failure because of the slight errors in matching impedance. For example, when the matching circuitry impedance, Z l , misses the match by 2ω. According to (1), if the antenna's impedance is 50ω, there is an almost perfect match (only a 2% mismatch). If the antenna's impedance is 3ω; if Z l misses the match by 2ω, the mismatch would be 20% instead of 2%, making the link highly inefficient.
In general, given an antenna impedance, Z a , and a load impedance, Z l , the power transmission coefficient, τ -the normalized power delivered to the load -is [56] Hence, perfect impedance matching, i.e., maximum power transfer occurs when Z a = Z * l , and τ = 1 (P b = τ P t , where P t is the received power at the tag and P b is the power delivered). Otherwise, a matching network is placed between the antenna and tag to accomplish conjugate match [69].

5) TIME SWITCHING AND POWER SLITTING
The tag operates in one of the two modes [85]: (i) time switching (TS) or (ii) power splitting (PS). The TS scheme divides each time frame into two orthogonal time slots, one for EH and the other for data transmission. Thus, the tag periodically switches between harvesting energy and reflecting data. However, this requires tight time synchronization between the emitter, tag, and reader [85]. On the other hand, the PS scheme achieves simultaneous EH and data transmission. To achieve this, the received RF signal is divided into two parts based on a power splitting ratio, which is the power reflection coefficient, β. The tag thus reflects a β portion of the received signal power for data transmission and absorbs the 1 − β portion for EH. Since this scheme eliminates time synchronization, it is more suitable for (passive) tags [86].

6) EH
The EH circuit uses a rectifier block (RF-to-DC converter) to harvest energy from the received RF signals. The rectifier outputs a stable DC voltage. Rectifiers are typically complementary metal-oxide semiconductor (CMOS) diodes with transistors [87] or Schottky diodes, due to their low cost and low power requirements [88]. The EH circuit's activation threshold and energy transfer efficiency dictate the tag's performance, range, and overall reliability. The activation threshold depends on the minimum power needed to power up the semiconductor devices used in the EH circuit. RF-to-DC conversion efficiency, which is the ratio of input power to output power, is determined by the performance of the receiving antenna, the impedance matching network between the antenna and the rectifying circuit, and the overall power conversion efficiency of the rectifier's subsequent stage, that is, the voltage multiplier [89].
We briefly mention that it is typical to model the EH process by a linear model -that is, the amount of the harvested energy is proportional to the incident RF power. The linear EH model offers low complexity and analytical tractability. Nevertheless, it does not actually represent (i) a saturation plateau with high input powers, and (ii) zero output if input RF is below a minimum input power level. Thus, several non-linear models have been proposed [90].

7) RECTIFIER DESIGNS
The basic RF-to-DC rectifier topologies are shown in Fig. 9; (a) single diode (single-stage), (b) voltage doubler, and (c) voltage multiplier (multi-stage) [89]. A single diode half-wave rectifier passes either the negative or the positive VOLUME 10, 2022 half of the alternating current (AC) and blocks the remaining half. However, the voltage doubler is a full-wave rectifier and converts the incident AC signal to a constant polarity voltage at its output. This rectifier results in a higher average DC voltage than the previous one. The voltage multiplier (multi-stage) is a full-wave rectifier that further increases the output voltage with a network of capacitors and diodes. However, the multi-stage rectifiers decrease the overall power conversion efficiency, which degrades for every additional stage; the efficiency of every single stage is a multiplying factor smaller than one. Multi-stage rectifiers can increase the DC voltage level for high AC input power, although they have lower overall power efficiency. For passive tags with relatively low input power, i.e., the available power is comparable to the amount of power required to switch on the rectifying diodes, we may prefer fewer diodes to have higher RF-to-DC efficiency.
Reducing the rectifier's energy consumption to improve the RF-DC conversion [91], [92]. With RF EH design based on CMOS, we can achieve a high RF EH activation threshold (more than −20 dBm) and self-startup power consumption as low as hundreds of nA. In particular, internal threshold elimination technology [93], [94], thin oxide layer cross-coupled rectification scheme [95], subthreshold auxiliary transistor compensation technology [96], maximum power point tracking (MPPT) function integration [78], [94], [97], auxiliary RF rectified power detection [98] are used to enhance the performance of CMOS based energy harvester circuits. However, this setup requires a long design, production time, and expensive chip manufacturing costs [84]. A good summary of the RF EH circuit design based on CMOS and Schottky diodes and their performance is provided in [91], [99], and [100].
RF EH scheme based on commercial off-the-shelf (COTS) components is another approach, e.g., Powercast [82], [101], E-peas [83]. Powercast P2110B 915 MHz RF power harvester receiver converts RF to DC and provides RF harvesting and power management to battery-free, micro-power devices. P2110B power harvester from Powercast, with the activation threshold of −11 dBm, can convert 915 MHz RF signal into DC signal, store the energy in the capacitor, and provide power management DC-DC boost output. Moreover, E-peas introduced AEM40940, which integrates a low-power rectifier and a boost converter. It operates at 915 MHz with a activation threshold of −19.5 dBm. A high sensitive RF EH using COTS components is also proposed in [84] with low start-up power of 245 nW and a higher acivation threshold of −22.5 dBm. Table 5 summarizes the state-of-the-art results of the recent RF EH circuit design developments.
Typically, the amount of output power of the energy harvester for practical cases is from 1∼µW to 100∼µW [31]. This is mainly because energy conversion efficiency is usually low, especially for low-cost devices with limited size. Therefore, to realize battery-free IoT, passive devices, i.e., tags, should support µW level power consumption [99], [102].

8) BASEBAND PROCESSING UNIT
The baseband processor unit of the tag performs several operations depending on the BackCom configuration. In MoBC (aka RFID), the tag must process commands from the reader. Thus, the baseband processor decodes the signal from the reader, computes 16-bit cyclic redundancy check (CRC) check, processes the commands, accesses the memory, and encodes the data to be sent to the reader [65], [103]. In BiBC and AmBC configurations, however, the tag simply reflects the RF signal from the emitter. Thus, baseband processor design for such tags will be much simpler.
The baseband processor usually accounts of the most of the power consumption of the tag, although a tag includes an analog RF front-end. This front end must harvest energy as much as possible from the RF signal through the EH unit. In contrast, the power consumption of the baseband processor is to implement protocol processing.
Thus, that the power consumption of the baseband processor is supported by EH is of great importance [104], [105].
Such ultra-low-power baseband processors leave some room in the energy budget of the tag to incorporate sensors. Thus, the sensing actions can be supported with higher energy, improving measurement performance.
For example, if a tag consumes 10µW to 30µW to operate and the power conversion efficiency is 30%. Consequently, the tag requires about 30µW 100µW of incident RF power on the antenna [104].

C. BACKSCATTER READER/EMITTER
The link budget and the reliability of the BackCom depend not only on the tag's operation but also on the emitter and the reader. Specifically, the maximum output power of the emitter and the receiver sensitivity of the reader are the two critical parameters. The former determines the distance of the forward link, whereas the latter determines the success of the backscatter link. For instance, a reader with a receive sensitivity of −60 dBm cannot detect an incoming signal of −65 dBm. A fixed reader usually has a higher receive sensitivity than a hand-held reader. At a reliable communication level defined by a relatively low bit error rate (BER) or packet error rate (PER) and for different incident carrier powers, the ICs and commercialized readers have a sensitivity of −96 dbm to −70 dBm.
The reader antenna gain is another critical parameter for stationary readers. Most commercial reader antennas have a gain of 6 dBi [106]. Clearly, the antenna gain is a vital system parameter for both forward and backscatter links (Section IV-C1).
The regulations of the federal communications commission (FCC) limit the transmit power to 30dBm [107]. Thus, this restriction imposes practical limitations on EH-based BackCom systems. For example, at 432.625 MHz, the received signal power at a distance of 37 m for 2 dBi and 2 dBi transmit and receive antenna gains and 30 dBm equivalent EIRP is −22.5 dBm, a typical sensitivity of the receiver [84]. We should note that this accounts for the free space loss only, but does not consider other system impairments or safety margins. Therefore, this distance reduces even further because of non-ideal factors such as impedance mismatch, antenna gain error, transmission line loss, ground reflection, and multi-path effects.

IV. LINK BUDGET FOR BACKCOM
This helps to determine if BackCom meets the design targets of passive IoT networks. This section thus studies the link budget of different BackCom configurations.
The link budget accounts for all the power gains and losses a signal experiences as it travels from a transmitter to a receiver via the channel. In particular, it includes all the RF losses and gains and determines the RF power levels of each point efficiently. Thus, this analysis is an inexpensive first step compared to hardware prototyping. The link budget calculation can detect the points of failure in a communication system while also establishing the system's performance margins, such as signal-to-noise ratio (SNR), bit-error rate, and capacity [21], [56]. Hence, it is a method of predicting system reliability.
As mentioned before, the tag must be activated first of all. This requires that it receives a sufficient amount of incident RF power. After that, the tag must be able to respond to the reader queries and transmit its data as long as necessary. Both these tasks are important for the reliability. To understand the viability of both these processes, we split the BackCom link budget into two critical parts, namely forward and backscatter link budgets. Both these are equally essential and play significant roles in the planning and design of BackCom systems. They, in fact, account for the amount of received power at the tag and the reader, respectively [21]. Thus, we may determine the feasibility of realizing passive IoT networks using BackCom and other novel applications. However, a comprehensive review of the link budget parameters has yet to be reported.
Depending on monostatic, bistatic, or ambient type, the overall link budget varies. However, the forward link budget does not depend on the configuration (Fig. 10).

A. FORWARD LINK BUDGET
This determines of the received power level at the tag, which must exceed the activation threshold of the tag. From Fig. 10, the received power (dBm) at the tag is given as where P T denotes the transmit power of the emitter in dBm, L T denotes the total losses in dB at the emitter, i.e., feeder loss, circuit loss (or any other loss), and X f denotes the polarization mismatches of the forward link in dB. Here, G T and G t are the antenna gains of the emitter and the tag antennas in dBi, respectively, L f path denotes the total propagation losses in dB of the forward link. Moreover, represents the on-object penalty gain of the antenna of the tag in dB, discounting any loss factors internal to the tag circuit, τ denotes the power transmission coefficient in dB, and F f is the forward link fade margin in dB.
This forward link budget can estimate the probability of activating the tag. However, once the tag activated, the backscatter link budget determines the received power level at the reader. This will determine the achievable data rate and other quality of service (QoS) parameters.

B. OVERALL LINK BUDGET
This part determines the received power at the reader, which depends on the specific BackCom configuration. Therefore, we cover three different cases.

1) MoBC
With the co-located emitter and reader, the tag reflected signal follows the same path as the forward link. Hence, the overall link budget of an MoBC system may be expressed as where L t denotes the total system loss in dB at the tag, M is the modulation factor in dB, and F o denotes the overall fade margin in dB. Further, P R denotes the received power at the reader in dBm.

2) BiBC
Unlike MoBC, the tag-reflected signal in a BiBC network avoids the round-trip path loss. Thus, the overall link budget ( Fig. 10) is given as where X b and L b path denote the polarization mismatch and total propagation losses in dB of the backscatter link, G R is the antenna gains of the reader antenna in dBi, and L R denotes the total system loss in dB at the reader.

3) AmBC
The overall link budget of an AmBC system is similar to BiBC (6). However, some parameters that may differ between the two are described next.
Remark 1: When assessing the coverage of wireless networks, 3GPP frequently uses maximum coupling loss (MCL). It is defined as the maximum loss in the conducted power level under which the system can operate [108]. MCL is the difference between the power levels measured at the transmitter and receiver antenna ports. This metric is defined as maximum path-loss (MPL) when transmitter and receiver antenna gains are also considered. For passive IoT, forward and backscatter link MPL can be respectively calculated as where P 0 tag and P 0 r are, respectively, the tag activation threshold and the reader sensitivity in dBm.

C. DESIGN PARAMETERS
This subsection briefly outlines the design parameters determining the BackCom link budgets.

1) ANTENNA DESIGN -GAIN AND LOSS
The tag and the emitter/reader antennas significantly affect the performance metrics such as the range and rates of Back-Com [52].
• Antenna Gain: This is a key performance parameter that combines its directivity and radiation efficiency. When it is transmitting, the gain describes how well the antenna converts input power into radio waves toward a specified direction. In a receiving antenna, the gain describes how well it converts radio waves arriving from a specified direction into electrical power. When no direction is specified, the gain refers to the peak value of the gain, i.e., in the direction of the antenna's main lobe. The gain is expressed as a ratio in decibels relative to an isotropic radiator (dBi). The antenna's effective area is proportional to the gain for a given frequency. An antenna's effective length is proportional to the square root of the antenna's gain for a particular frequency and radiation resistance. Because of reciprocity, the gain of any antenna when receiving is equal to its gain when transmitting. Antenna gain depends mainly on the carrier frequency, size of the antenna, and the antenna type; for a fixed antenna aperture, the gain of the antenna will increase with frequency as [56] G where v ∈ {T , R, t}, λ is the wavelength [m], and A eff is the effective area of the antenna [m].
There are inevitable trade-offs between the tag antenna gain, G t , impedance (power transmission coefficient τ -Section IV-C4), and bandwidth for the tag antenna design process [52]. Hence, estimating the range trade-off between the impedance matching and the gain for a given frequency is crucial when designing the tag antenna.
• The Losses (L T , L R , L t ) include cable and body losses on both sides (the emitter/reader and the tag). Cable losses depend on the length and type of cable and frequency; it is ∼ −0.5 dB for tag antenna [52] and varies from 1 dB to 6 dB for cell tower antenna. Remark 2: EIRP expresses how much transmitted power is radiated in the desired direction. It gets particular importance in an antenna or antenna array with a highly directional radiation pattern (beam). We generally measure the EIRP at the angle where the maximum radiated power is obtained. EIRP includes many losses and the gain of the transmitter antenna and can be calculated as (at the max value) [107], [109] The EIRP from a phased-array transmitter with N elements is then given by [110] where, P T is the output power from each element in dBm, G T is the antenna gain in dBi andL T [111].
Polarization shows the field vector's changing magnitude and direction over time. The orientation of the tag and the emitter/reader has a significant impact on the received power at the antenna and the transmission range [21], [56]. Ideally, the antenna's polarization needs to match that of the incident wave to maximize the received power of the antenna. Since the tag's orientation is often arbitrary, the power coupled to the tag antenna changes depending on the antenna's orientation relative to the polarization of the incident wave. The tag can receive power regardless of orientation when the emitter/reader transmitter's antennas are circularly polarized. Another solution is to use two linearly polarized antennas on the tag, which are oriented at 45 • for each other [56]. The polarization mismatch factor, 0 ≤ X f , X b ≤ 1 (in a linear scale), accounts for the power lost due to polarization mismatch, which is greatly important. For example, when the emitter/reader's antennas are circularly polarized, and the RF tag antenna is linearly polarized, there is a 3 dB polarization mismatch in the forward and backscatter links. Thus X f = X b = 0.5 in a linear scale [56], [112].

3) ON-OBJECT ANTENNA GAIN PENALTY ( )
The tag antennas may function efficiently when the tag is isolated from conductive and dielectric materials by a few wavelengths. However, tag may cease to operate when brought close to or mounted on an object, which affects the antenna radiation efficiency and directionality. This loss reduces the reflected power for communication and the power available for EH. The on-object antenna gain penalty, , accounts for these losses. The ratio between the free space antenna gain to that of the tag mounted to an object on a linear scale is defined as the on-object gain penalty and given as To make independent of the angle of arrival of the RF waves, as a rule-of-thumb, the gains used to compute G t,free-space and G t,on-object are averaged over the half-space facing away from the object. Since depends on material properties, object geometry, frequency, and antenna type, analytical computations are not feasible, but careful modeling or measurements are need to find .

4) POWER TRANSMISSION COEFFICIENT (τ )
According to (3), to maximize the received RF energy (rectifier input), perfect impedance matching, i.e., τ = 0, is desired. However, the geometric limitations of the antenna and the variable input impedance of the tag prevent this state [84].

5) MODULATION FACTOR (M)
According to (1), the tag transmits its data by switching the load impedance between two or more states. Hence, the amount of power reflected at the tag depends on not only the antenna and its surrounding materials but also the modulation factor, which is given as [113] and [56] where A and B are the reflection coefficients for state A and state B, which can be calculated through (1). The modulated backscatter power depends on the difference between the reflection coefficients of each state and not on the absolute reflected power from the tag. The modulation factor significantly impacts the performance of the tag. For example, twostate modulation, which switches the reflection coefficient between an open and a short circuit to maximize reflected power in the backscatter link, will suffer from a shortage of power coupled to operate the tag's internal operations.
Consequently, there is a trade-off when determining the value of the modulation factor. When the reflection coefficient is switched between a short circuit and a matched load, the tag generally has a modulation factor of 0.25. This helps in balancing the reflected power and absorbed power, i.e., the VOLUME 10, 2022 tag can absorb enough energy during the matched-load phase to operate in the short-circuit mode [56].
Large-scale fading includes path-loss and shadowing. It captures the diminishing effect of the signal strength while the signal travels from one point to another. Hence it provides an insight into the range of communication. It is a function of the distance, the operating frequency, the prevailing atmospheric and environmental conditions such as indoor, outdoor, urban, rural, suburban, open, woodland, sea, and others. Researchers have thus developed many path-loss models. Free Space Path-Loss Model: This is the most basic propagation models, which expresses the loss in signal strength of an electromagnetic wave as it travels over free space. The free space path-loss is thus expressed in dB as [114] L path = 32.45 + 20 log 10 (d) + 20 log 10 (f ), where d (km) is the distance and f (MHz) is the operating frequency.
Cost-231 Hata Model: This model, intended for frequencies ranging from 1.5 MHz to 2 GHz, includes correction factors for urban, suburban, and rural environments. It predicts the basic path-loss (dB) as L path = 46.3 + 33.9 log 10 (f ) − 13.82 log 10 (h b ) + a(h r , f ) + (44.9 − 6.55 log 10 (h b )) log 10 where C = 0 dB for medium-sized city and suburban areas and C = 3 dB for urban environments [114], The received power at the tag or the reader can vary drastically because of the small-scale fading of the channel. This is due to the constructive and destructive interference of signals scattered by objects in the propagation environment. The three most prominent effects of small-scale fading are rapid variations in signal intensity over a short travel time or time interval, random frequency modulation due to Doppler effects, and temporal dispersion due to multi-path propagation delays [56]. Small-scale fading is modeled by treating the received signal as a random variable with a predefined probability distribution. Once a suitable distribution is selected, a safety factor, or fade margin, is included in the link budget calculation to guarantee an outage probability threshold. The fade margin determines how much transitory path loss or signal fading may be tolerated before the system performance deteriorates. The fade margin (dB) is defined as where v ∈ {o, f }, F R (x) denotes the cumulative distribution function (CDF) of the received signal envelope, and P avg denotes the average power in the channel [56]. For the forward link fade margin, F f , the common probability distributions to model it are Rayleigh and Rician (for the LoS case). However, for the overall fade margin, F o , the fading in the backscatter link is described with different distributions. In general, in MoBC, the forward and backscatter channels are identical, resulting in the deepest fading. Whereas, in the BiBC and AmBC, the fading is always less severe than the MoBC. Therefore, in MoBC, the required fade margin to achieve a certain outage probability is higher than that of the BiBC and AmBC.

D. NUMERICAL EXAMPLES AND DISCUSSION
Here, we evaluate the link budget of BackCom systems to establish their viability, deployment, and adoption for future wireless applications. Hence, we perform the link budget calculations under several configurations, channel distributions, and environmental conditions. For the overall link budget calculation, we consider the bistatic and ambient setups, as they are better suited for passive IoT than the monostatic setup. Table 6 summarizes the simulation parameters [56]. Moreover, without loss of generality, we assume that the system losses, L T , L t , and L R , are 0 dBm. Fig.11 plots the forward-link budget for different path-loss models, tag-mounted materials, and operating frequencies. Fig.11(a) shows it at 915 MHz, whereas Fig.11(b) is for 5.8 GHz. In both cases, we adopt four different path-loss models, namely (i) free-space path-loss model, (ii) Cost-231 Hata urban model, (ii) Cost-231 Hata rural/suburban model, and (iii) 3GPP UMi model. These different models allow us to understand how the amount of received power at the tag depends on the operating environment. The tag's received power also depends on the materials on which the tag is mounted. We consider two frequently-used materials, namely cardboard and aluminum cases. The activation threshold (e.g., −20 dBm for commercial RFID tags) is represented as a horizontal line in this figure to get useful insights on the activation distance of a tag. With 915 MHz and the tag is attached to a cardboard object, the fading and polarization  mismatches limit the range of the tag to less than 5 m, i.e., the received power at the tag for distances greater than 5 m is not sufficient to activate the tag. When the tag is mounted on an aluminum object, the reduced antenna impedance leads to a high on-object antenna gain penalty, , and an extremely small power transmission coefficient, τ , preventing the tag from turning on. For 5.8 GHz, the maximum range of the tag-mounted on cardboard object varies from 3 m 10 m depending on the path-loss model. Similarly, for 915 MHz, the received power at the tag for 5.8 GHz is insufficient to activate the tag because of the small power transmission coefficient caused by the reduced antenna impedance. Fig.12 illustrates the overall link budget of an AmBC system with Cost-231 Hata urban path-loss model for different emitter-tag distances, r f . The receiver sensitivity, i.e., −92 dBm, is represented as a horizontal line in this figure to obtain useful insights. Fig.12(a) shows the received power at the reader for 915 MHz, while Fig.12(b) plots the received power at the reader at 5.8 GHz. In both operating frequencies, two sets of curves are plotted to investigate the effect of tagmounted materials. Similarly, in Fig.11, the received power at the reader is smaller when the tag is attached to an alu-minum object rather than a cardboard object because of a tiny modulation factor, M , caused by the low antenna impedance. An overview of Fig.11 and Fig.12 shows that the forward link limits the range of BackCom systems.
Energy beamforming at a multi-antenna emitter can increase the tag's received power. It shapes the RF signal beam of the emitter toward the tag, preventing power diffusion in all directions. Maximum ratio transmission (MRT) beamforming based on the forward channel can act as an optimal energy beamformer for the case of a single tag, providing the maximum possible power to the tag. A reconfigurable intelligent surface (RIS) adopted in the forward link can further improve the received signal power at the tag by controlling the signal propagation (Section IV-E2). The RIS-assisted beamforming is designed by jointly optimizing the beamformer at the emitter and a phase-shifts at the RIS.
We next investigate the effects of energy beamforming and RIS on the tag's received power. To compare these beamforming techniques, we also consider random beamforming, where the emitter designs a precoder by generating a normalized random vector. VOLUME 10, 2022   Here, the emitter has perfect channel state information (CSI). In RIS-assisted case, a RIS with 100 elements is placed 8 m away from the emitter. The minimum distance between the RIS and the tag ( √ 65 m = 8.0623 m) occurs when the tag is 1 m away from the emitter (or the initial location of the tag).
As per Fig.13, the tag receives more RF power when the emitter increases the number of antennas and adopts beamforming. This has two beneficial effects. First, the tag harvests more energy, enhancing the emitter-to-tag distance for a given activation threshold. Second, the tag can reflect increased power levels, increasing the achievable data rate of the tag-toreader link. The RIS in the forward link delivers more power to the tag (or supports longer tag-emitter distances), which ultimately enhances the achieved rate of the tag. Fig. 14, Fig. 15, and Fig. 16 also plot the SNR/signalto-interference-plus-noise ratio (SINR) outage at 915 MHz with Cost-231 Hata urban path-loss model for MoBC, BiBC, and AmBC configurations, respectively. We adopt the same three beamforming scenarios. We plot two sets of curves for each beamforming design for each configuration by varying the number of emitter antennas while utilizing one receiving antenna at the reader. In AmBC, we assume that the reader/user is common for both primary and BackCom systems, resulting in an AmBC system with a common reader or symbiotic radio (SR) system (Section V-A). Hence, the reader performs primary interference cancellation before decoding the backscatter data. The MRT technique is employed in energy beamforming by only considering the backscatter transmission. In RIS-assisted beamforming, the precoder at the transmitter and the phase shifts at the RIS are optimized to facilitate backscatter transmission rather than primary transmission.
Just like the received power of the tag increases with beamforming (Fig. 13), a multi-antenna emitter with MRT beamforming and RIS-aided systems considerably enhances the outage performance of different BackCom setups; i.e., enhanced forward range for a given outage probability.

E. BACKCOM LINK IMPROVEMENT
The above examples and discussions reveal that, the forward link, rather than the backscatter link, limits the overall performance. Hence, improving the forward connection's reliability and performance is critical to achieving higher overall BackCom performance. This subsection discusses some of  the potential solutions (Fig. 17) for improving the performance of the forward link and the backscatter link.
Careful and intelligent use of these solutions improves the link budget without compromising the cost benefits of the tags, i.e., without modifying their fundamental design. Specifically, the solutions, e.g., multiple-antenna emitter/tag/reader and dedicated power beacons, effectively combat fading and interference, which impacts the performance of BackCom systems.

1) EFFICIENT ENERGY HARVESTER CIRCUITS
Harvesting as much energy as possible with high efficiency from incoming RF signals is crucial for tag operations and communication. Ambient RF signals such as TV, FM, UMTS, GSM, Wi-Fi, Long Term Evolution (LTE), and 5G-NR, have the lowest power density compared to other ambient sources like solar, thermal, and vibrational [116]. Hence, ambient RF sources are variant along with their power level [91], [100]. RF energy harvester thus should accommodate various input power levels and maintain the optimal efficiency [117]. Motivated by this, [117], [118], [119], [120] have developed multiband and broadband rectifiers that cover different ambient frequency bands to integrate the power from mixed signals into a single DC output. Those rectifiers and their performance are described in [31].
Practical applications of EH techniques are limited by their low power conversion efficiency. Another critical challenge for EH devices is the activation threshold of the tag (Section III-B7). overcoming the threshold effect might considerably enhance the efficiency and the performance of BackCom. A critical parameter that affects the activation threshold is the threshold voltage, V th , of the rectifying devices, e.g., diodes, MOSFETs. To circumvent this threshold voltage limitation and harvest the energy from more than one energy source, recent research suggests numerous strategies such as hybrid rectifying techniques [116], [121], threshold voltage compensation [72], [73], [93], and MPPT function integration [78], [94] (Section III-B7). Adopting these novel designs and methodologies may enhance the performance of BackCom systems.

2) RIS-ASSISTED COMMUNICATION
RISs, comprising many adjustable reflecting elements arranged in either reflect-array or meta-surface configurations, can reconfigure the propagation properties of electromagnetic waves impinging on these reflecting elements. These create controllable phase-shifts [122], [123], [124], [125], [126], [127], which can mitigate adverse wireless channel propagation effects. The collaborative design of RIS phase shifts enables constructive or destructive reception of VOLUME 10, 2022 reflected signals, which improves the received signal energy and SNR. Consequently, RISs will extend the tag communication range [128], [129], [130], [131], [132], [133]. Fig. 13 illustrates the effect of a RIS at 915 MHz. It enhances the forward link range by modifying the wireless propagation environment. In particular, for N = 4 at the emitter, the RIS improves the forward link range by 76% and 10% over random beamforming and energy beamforming cases, respectively. Hence, the RIS-assisted BackCom system is reliable and extends the coverage range in low-cost passive IoT networks.

3) MULTI-ANTENNA EMITTER AND ENERGY BEAMFORMING
Energy beamforming, which forms sharp energy beams toward target users based on instantaneous CSI, improves the range by increasing both wireless power and energy efficiency [85], [134], [135]. The small amount of energy harvested by a tag is one of the main factors that limits the range of BackCom. Energy beamforming can alleviate the problem [136], [137], [138], [139]. Moreover, having multi-antenna at the emitter will enhance the efficiency of wireless energy transfer. Energy beamforming using multi-antenna emitters will increase the amount of energy harvested at the tag and hence the reliability and the communication range of BackCom [139]. As observed from Fig. 13, adopting the energy beamforming technique and increasing the number of antennas at the emitter result in high received power at the tag and, consequently, an enhancement in communication range.

4) DEDICATED POWER BEACONS
Instead of exploiting ambient RF signals, tags may harvest/reflect RF signals from dedicated power emitters/beacons. These power beacons can thus solely be used for energizing the tags and function as RF signal emitters for the tags. Hence, these often generate continuous waveforms that are not typical from RF sources such as BSs, APs, Wi-Fi routers, and others [139]. Moreover, these emitters can include multiple antennas, allowing the use of energy beamforming techniques to focus more energy toward the tags. This will enhance the EH efficiency of the tags [138], [139]. However, the emitter must be aware of the forward link CSI. However, the CSI reduces to the tag direction for a free-space channel [140]. Thus, the emitter can generate a beam utilizing well-known beamforming techniques. Thus, beamformer weights are obtained by conjugating the observation of the pilot signal reflected by the tag [140]. In contrast, beamformer designs for a scattering channel are more complex, the pinhole channel properties can be exploited to design beamformers [139].
A tag's EH efficiency can also be increased by optimizing the RF beacon signals, which are input to the energy harvester. The input affects the RF-to-DC conversion efficiency [141]. Thus, the tag can significantly improve its DC power level with specially designed beacon signals. These include orthogonal frequency-division multiplexing (OFDM), white noise, chaotic, and multisine waveforms [141], [142], [143], [144]. In particular, multisine waveform methods, which allocate the power to the frequency bands with large channel gains or small path-losses, can improve read reliability and the tag read range [141]. Also, increasing the peak-to-average power ratio of beacon signals will improve the tag's EH efficiency [141].

5) MIMO TAG/READER
MIMO systems improve the link throughput and reliability of conventional wireless links. MIMO adds multiple antennas to the transmit and receive sides of a link. Likewise, MIMO for the tag-to-reader link is one practical and promising way to increase the reliability of BackCom systems. This will leverage power gain, transmit diversity gain, and receive diversity gain to enhance signal detection, thereby improving the BER performance and reading range [47], [50], [57], [58], [145], [146], [147], [148], [149], [150], [151]. Adopting multiple antennas at the tag increases the amount of ambient RF energy that can be harvested and reflected back. Such tags enjoy the pinhole diversity gain, i,e., each tag antenna corresponds to a pinhole in the backscatter channel that provides a set of separated propagation paths [48].
Multiple-antenna tags offer sophisticated signal processing solutions to improve their performance regarding the harvested power or reliability. Space-time codes (STC), spatial modulation (SM), and antenna selection are some promising approaches discussed below.
STC distributes the data signals across time and space (antenna) dimensions. This distribution creates multiple degrees of freedom. Thus, these can improve the reliability of MIMO BackCom systems. Orthogonal space-time block codes (OSTBC), a subset of STCs, offer full diversity with low-complexity maximum-likelihood decoding without requiring CSI. Researchers have thus investigated OSTBC for BackCom systems because of the limited power and processing capability of tags [50], [57], [58], [145], [146], [147]. OSTBC achieve the maximum diversity order equal to the number of tag antennas with linear decoding complexity. Moreover, the diversity order does not depend on the number of reader antennas. However, that affects the coding gain and the SNR threshold at which the maximum diversity order is achieved [145]. The efficient design of query signals, the signal transmitted by the reader, can also help achieve higher diversity order [147], [152]. Interestingly, some simple STCs that do not have good performance in conventional channels perform well in backscatter channels [57], [146]. This calls for further investigation of the existing simple codes, which do not perform well in the conventional channels but may do well in the backscatter channel.
SM-based techniques, which exploit the antenna index as an additional means for sending information, improve the BER performance and spectral efficiency of MIMO Back-Com systems [153], [154]. SM techniques map the data bits into two sub-blocks. The first sub-block selects a symbol from a conventional signal constellation. The second sub-block maps to the spatial constellation that specifies the position of the active transmit antennas. The combination of OSTBC (Alamouti scheme) and generalized SM for multiple (two) transmitting antennas at a time instant provides diversity gain and ensures significant improvements in terms of BER [153].
Antenna Selection involves choosing a subset of the transmit antennas. Unlike SM, the signal constellation is fixed regardless of the number of antennas. Thus, the number of information bits transmitted in each channel use is less than that of SM. However, antenna selection provides diversity gains. Antenna selection at the tag also facilitates EH and backscattering simultaneously [149], [150]. However, a single antenna tag performs backscattering and EH operations either power-splitting or time-switching (Section III-B6). Multiple antenna tags can avoid this bottleneck through optimal antenna selection schemes [149], [150]. For example, a subset of antennas can be selected to maximize the detection probability [149]. The tag then reflects the RF signals with the selected antennas and harvest energy with the remaining antennas. Thus, both operations can occur simultaneously. This scheme can thus extend coverage and increase the reliability.
However, using MIMO in the tag and the reader may increase power consumption, time delay, and system complexity because the complexity of CSI estimation goes up with the number of spatial channels [148], [149], [150]. This becomes a significant challenge because of strict energy constraints in tags. Thus, the ability to exploit MIMO gains such as transmit diversity gain and receive diversity gain without requiring any knowledge of CSI at the reader or the tag is desirable. Motivated by this, [58] investigates differential OSTBC where neither the tag nor the reader requires CSI. This scheme enjoys a straightforward encoding design and low decoding complexity and can provide full spatial diversity without requiring any CSI.

6) CHANNEL CODING SCHEMES AT THE TAG
Channel codes can protect the message from interference, collision, and jamming issues. Thus, they improve the BER performance and range of tags. Line codes, also known as digital baseband modulation [155], [156], and error correcting codes (ECCs), e.g., linear block codes, which are primarily designed for active communication systems, can enhance the performance of BackCom systems [157], [158]. However, due to the passive IoT requirements (Section III) and the limited tag processing and storage capabilities, channel codes designs for passive tags must support low complexity and low power consumption [159], [160], [161], [162].
Commercial RFID tags widely adopt line coding, e.g., Miller and FM0 [65]. However, the line codes are not designed to take advantage of specific physical layer features of backscatter and the symbol period is the only available variable to adjust the link's reliability and rate [163]. Hence, despite their simplicity, the line codes cannot provide a robust transmission link under poor channel conditions [50]. The use of ECCs is one practical solution [157], [164], [165].
Nonetheless, practical challenges exist when using ECCs for low-complexity tags with strict energy constraints [159], [160], [161], [162]. Clearly, tags need short, low-complexity codes that achieve close-to-optimal performance [166], [167]. However, tags computational load can be reduced by shifting some operations (e.g., encoding) to the reader side [157]. Moreover, because CSI acquisition is difficult for BackCom systems, decoding algorithms that can operate with limited or no CSI are of great importance [168], [169]. Moreover, decoding decoding delays may limit the potential number of tags served by a single reader [170].
Motivated by the above challenges, several ECCs have been developed for tags. Examples are Bose-Chaudhuri-Hocquenghem (BCH) codes [64], Reed Solomon codes [158], [164], Reed-Muller codes [158], balanced block codes VOLUME 10, 2022 [171], Hamming codes [157] and Polar codes [157]. Specifically, Polar codes have been developed for an AmBC. The tag maps its data bits into reliable virtual channels and the code rate is automatically adjusted for different channel quality [157]. Polar codes can achieve up to 11.5× throughput gain or extends the range limit by 1.9× compared to passive LoRa (PLoRa) [172] with a Hamming code. Moreover, using a periodic signal to represent the data, [173] develops a low-power encoding technique to increase the communication range and support multiple tags. Thus, RFID tags can mutually communicate at a rate of 3.33 bps over 90 feet, given an incident RF power of 0 dBm.

V. INTEGRATION OF BACKCOM WITH EXISTING TECHNOLOGIES
Such integration is crucial to support optimized networks. It reaps the benefits of diverse technologies and supports many applications without the need for new infrastructure. Because they use passive backscatter modulation, tags can be integrated with existing wireless systems, including symbiotic, Wi-Fi, Bluetooth, LoRa, and ultra-wideband (UWB). This section thus presents several BackCom integration scenarios.
A. SR BACKCOM SR refers to the mutually coexistence of two networks (generically called primary and secondary) that share radio resources [174]. For example, an AmBC network can be the secondary network, and a primary network (e.g., cellular) can be slightly modified to improve the performance of both. In SR, the backscatter transmission shares the radio spectrum, RF emitter, and the reader with the primary transmission. Specifically, the primary emitter (e.g., cellular BS) supports both primary and backscatter transmissions. Meanwhile, the primary reader (e.g., smartphone) decodes the information from both primary and backscatter transmissions. SR paradigm has two main advantages: (i) the tag transmission can assist the primary transmission by providing additional multi-path, 2 (ii) the primary transmission offers a transmission opportunity to the tag. SR aims to simultaneously satisfy the demands of both the primary and the backscatter networks. This results in multi-objective optimization problems. Motivated by this, resource allocation [177], [178], beamforming design optimization [177], [179], energy efficiency maximization [180], user association [181], and efficient multiple access schemes [181], [182], [183], [184] have been investigated. Moreover, RIS-assisted symbiotic BackCom introduces an additional design degree of freedom. The RIS can reconfigure the wire-2 SR is divided into parasitic SR (PSR) and commensal SR (CSR) based on the symbol rate of the tag. In PSR, the symbol rates for the primary and the tag are equal, and the tag transmission cause interference to the primary transmission. While in CSR, the tag's symbol rate is much lower than that of the primary one, and the tag signal is treated as a multi-path component [175], [176]. less propagation environment on the fly to improve the system performance [185], [186], [187], [188], [189].
Full-duplex wireless allows a node simultaneously transmit and receive data in the same frequency band [190], [191]. This technology can support the coexistence of primary user(s) and tags [192], [193], [194], [195]. Thus, a full-duplex emitter/reader can transmit the RF carrier in the forward link and simultaneously receive data from the tags in the backscatter link [192], [193], [194], [195]. However, fullduplex wireless is fundamentally limited by self-interference. Nonetheless, with optimal transmit and receive beamforming designs at the full-duplex emitter, the self-interference can be suppressed in full-duplex enabled BackCom networks [196], [197].
Cognitive radio (CR) networks facilitate efficient spectrum usage through various spectrum sensing methods [198]. Spectrum sensing may be based on energy detection [199], [200], [201]. Integrating BackCom with CR can simultaneously improve the spectrum efficiency and the energy efficiency [202], [203]. In ambient-based CR networks, the secondary transmitter can backscatter its data to the intended receiver even when the primary user is active. It can thus improve the secondary network throughput significantly [203].

B. WI-FI BACKCOM
Wi-Fi BackCom allows RF-powered tags to communicate directly with standard Wi-Fi devices. The basic components are a Wi-Fi reader, a Wi-Fi helper/assistant, and a Wi-Fi tag. Any commercial Wi-Fi device, including routers/Wi-Fi APs and mobile devices, can act as the reader and assistant [204], [205]. Wi-Fi (bacscatter) tags, which may be embedded in everyday objects, are battery-free and can harvest energy from RF signals such as TV, cellular, and Wi-Fi. It is worth noting that Wi-Fi BackCom may also be used to connect battery-free devices to the Internet using various power harvesting sources such as solar and mechanical energy.
Similar to RFID systems, Wi-Fi BackCom adopts a request-response model and follows RFID transmission using Wi-Fi devices [204]. The Wi-Fi tag transmits its data by backscattering the signal emitted by the Wi-Fi assistant. The Wi-Fi reader decodes these signals by using the channel variations induced on received Wi-Fi packets [204] or using the successive interference cancellation (SIC) technique [36]. Multiple Wi-Fi sources can help the Wi-Fi BackCom of a single tag.
Recent research has investigated several versions of Wi-Fi BackCom, including Wi-Fi backscatter [204], BackFi [36], passive Wi-Fi [206], and HitchHike [207]. These studies and findings thus reduce the specialized hardware requirements and provide a feasibility framework for using Wi-Fi Back-Com in future wireless.

C. BLUETOOTH BACKCOM
The latest version of Bluetooth or Bluetooth low energy (BLE) is important short-range communication technology.
It is already present in billions of devices, e.g., smartphones, smartwatches, tablets, and computers. BLE has advertising channels -used for broadcast and device detection and data channels -used for bi-directional data transmission [140], [208]. Unlike classical Bluetooth, BLE has 40 2 MHz channels in 2.4 GHz 2.4835 GHz. Among these 40 channels, three are allocated for advertising. Every BLE receiver must listen for incoming advertising packets on these channels. However, the reception of advertising packets on just one channel is sufficient to receive the message. Hence, a Bluetooth device can use one of these advertising channels to emit a continuous waveform-like Bluetooth signal. In particular, BLE employs Gaussian-shaped Binary Frequency Shift Keying (GFSK) to encode the '0' and '1' data bits using two frequencies. Thus, it is possible to transmit a stream of constant ones or zeros to generate a continuous waveform or a single tone [140].
In the presence of this signal, a tag can modulate and reflect its data towards a reader [209]. Commercially available BLE devices such as an Apple iPad and a generic personal computer can successfully demodulate the backscattered signal without requiring any changes to their hardware, software, or firmware [210].

D. LORA BACKCOM
LoRa (short for 'long-range') is a low-power wireless technique based on Chirp Spread Spectrum (CSS) technology. It uses chirp pulses to encode data on radio waves (similar to how dolphins and bats communicate) [40]. In CSS modulation, a continuous chirp that increases linearly with frequency represents a '0' bit, whereas a '1' bit is a chirp that is cyclically shifted in time. Due to the properties of CSS modulation, the LoRa modulated signals are robust against interference and hence, can be received over long distances. Specifically, LoRa can withstand both in-band and out-ofband interference. For example, Sx1276 receiver hardware, which has a receiver sensitivity of −148 dBm, can successfully decode LoRa signals even with 95 dB strong out of band interference [211]. The LoRa receiver demodulates by multiplying the received signal with a down-chirp, transforming from the time domain to the frequency domain, and generating a peak on a fast Fourier transform (FFT) bin. Thus, it can decode signals with an extremely low SNR. This is also a vital requirement for BackCom. Because of its modulation and demodulation features, LoRa can enhance the BackCom range while ensuring low power consumption [212]. Hence, LoRa backscatter may help realizing passive IoT networks [84], [172], [212], [213], [214].

E. UWB BACKCOM
Future BackCom systems are expected to provide reliable communication, precise identification, accurate real-time localization, high security, and high connectivity while consuming ultra-low power and being inexpensive [215], [216], [217]. However, current systems that employ standard carrier wave (CW) backscattering have insufficient range resolution. They are highly susceptible to narrowband and multi-user interference. Also, they are vulnerable to multi-path signal cancellation owing to the relatively low bandwidth signal.
UWB technology, which can transmit sub-nanosecond duration pulses in its impulse radio UWB (IR-UWB) implementation, is one of the potential wireless techniques for overcoming those limitations in current RFID systems [215], [216], [217]. UWB uses an enormous fractional bandwidth (over 500 MHz), which allows it to resolve multi-path and penetrate a wide range of materials. Consequently, it enables exact signal localization based on the time-of-arrival estimation. UWB advantages include, but are not limited to, lowpower transmitters, highly accurate ranging and positioning capability at the sub-meter level, improved coverage because of multi-path robustness, higher security due to low detection probability [218], [219], and the ability to operate and coexist numerous devices in small areas owing to efficient multiple channel access and interference mitigation. Because of these advantages and the wide range of frequencies, we can effectively integrate BackCom and UWB for many applications [215].

VI. POTENTIAL USE CASES
BackCom-enabled passive IoT will help the automation and digitalization of various industries to improve productivity efficiency and increase life comforts [10]. Passive IoT will find various applications (Fig. 18) while avoiding high maintenance costs, serious environmental issues, and even safety hazards (e.g., the power and petroleum industries). Smart homes/cities, logistics/inventory management, transportation, and the biomedical field are also potential areas. In the following, we briefly review some of these.

1) BACKCOM FOR SMART HOMES/CITIES
One promising application of future passive IoT is intelligent homes/cities. A smart home is a convenient home setup in which appliances and devices can be controlled remotely from anywhere with an internet connection using mobile or other network devices. In contrast, a smart city is a municipality that connects everything via the internet to increase operational efficiency, share information with the public, and improve the quality of government services and citizen welfare.
When a cellular BS or Wi-Fi AP communicates with a smartphone, the tags in the home/city can transmit their signals to the smartphone by backscattering the cellular/Wi-Fi signals. In a smart home, the smartphone acts as an information center for monitoring the home environment status, such as air quality, room temperature, usage of electronic devices, gas leakage/smoke detection, and others [14]. In a smart city, with the help of passive IoT, communication among buildings, bridges, streets, and humans is possible, contributing to human life's safety. For instance, tags attached to a bridge may monitor its structural health. Since tags do not have batteries, they have a long lifespan, low maintenance cost, and reduced environmental impact. These benefits are critical for smart homes/cities and indicate that passive IoT offers a possible solution.

2) BACKCOM FOR TRANSPORTATION
Deploying tags that interact with road signs, building surfaces, and nearby vehicles can enhance traveling safety. Public transportation can benefit most from passive IoT regarding operational efficiency, cost, and safety. The vehicles can be tracked for their speed, position, running or stopped, or at any danger by using passive IoT. Trucks are usually used for transportation or for carrying heavy loads. In these situations, it is vital to examine the interior conditions of the truck, including humidity, temperature, and light level. Consequently, the impact of passive IoT on transportation efficiency will be significant, and the global automotive industry will be revolutionized as a result of passive IoT [13], [220], [221], [222].

3) BACKCOM FOR HEALTHCARE
Passive IoT offers numerous benefits for the healthcare sector. These are monitoring objects, staff, and patients, identification and authentication of individuals, and automatic data collecting and sensing [140]. Real-time position tracking, such as patient flow monitoring in hospitals, and mobility tracking across choke points, such as entry to designated areas. Moreover, continuous inventory for maintenance and monitoring of usage of drugs and materials tracking to avoid left-ins during surgery, such as specimen and blood products. IoT networks help to prevent using the wrong drug, dose, time, or procedure, maintain electronic medical records, and identify newborns. In addition, staff identification and authentication for granting access and asset identification and authentication are typical applications of passive IoT systems.
Some critical applications of passive IoT devices in sensing include detecting medical conditions and supplying real-time data on patient health indicators. Automatic data collection and transmission help reduce processing time, prevent data entry errors, automate care and procedure audits, and manage medical inventories. Consequently, the features of passive IoT systems, including low cost, low maintenance, and extended lifespan, will provide noteworthy benefits and open up novel technological solutions in the healthcare sector in the fully digital future world [223], [224].

4) BACKCOM FOR LOGISTICS
Real-time monitoring of raw material purchasing, commodity design, production, storage, transportation, distribution, sale of products and semi-products, after-sales service, returns processing, farming, mining, hazardous environment applications, and port inventory tracking is a critical task in every business and warehouse [13], [225]. This task also yields product-related information efficiently, accurately, and timely, allowing businesses to adapt quickly to dynamic and evolving markets. Furthermore, real-time information can assist customers with product availability. Many firms use passive RFID or barcode label systems to perform the above tasks, but these require much human labor, which might cause delays or errors and reduce labor productivity. Thus, BackCom-enabled passive IoT may overcome the limitations of current methods while also providing novel efficient and fully automated solutions [13], [225].

5) BACKCOM FOR AGRICULTURE
Monitoring environmental humidity, soil moisture, barometric pressure, temperature, and other parameters offers a precise analysis of micro-climate conditions [226]. BackCom offers cheap, effective, low-maintenance, and low-cost wireless telemetry for this task [226], [227], [228], [229], [230]. Specifically, [228] proposes a backscatter leaf sensing system for plant water stress measurements. Moreover, the authors in [227] design a tag to monitor plants by sensing the temperature difference between leaves and plants using ambient backscattering over FM signals. Reference [230] also develops a scatter radio sensor network for monitoring plant physiology using moisture content levels.

6) BACKCOM FOR UNDERWATER APPLICATIONS
Underwater BackCom systems with battery-free devices are a fundamental primitive for various applications such as tracking, navigation, safety, environmental monitoring, marine life understanding, underwater exploration, and many more [231], [232]. For example, backscatter nodes/devices can tag underwater objects or marine animals and track them in real time to understand their mobility and migration patterns. Low-power/battery-less and distributed underwater localization systems are needed for environmental, industrial, and defense applications [232]. Underwater backscatter localization networks, for instance, can enable a novel navigation system for underwater drones and divers employing battery-less GPS anchors. Furthermore, underwater assets can be tagged with backscatter devices and their location be exploited to enable complex robotic manipulation activities [231], [232].

VII. OPEN ISSUES AND FUTURE RESEARCH DIRECTIONS
Recent BackCom advancements have revealed the potential of the technology and its compatibility with various existing communication systems, including cellular, TV, FM, Wi-Fi, Bluetooth, LoRa, and UWB. However, BackCom must meet the design goals of passive IoT networks through efficient design and deployment. In particular, channel estimation, efficient coding schemes, multiple access schemes, scheduling, and MAC layer design need further investigation. Motivated by these, we summarize some of the challenges, open issues, and future research directions.

A. CHANNEL ESTIMATION
Antenna selection, beamforming, signal detection, and other communication tasks require accurate channel estimation. For instance, with the availability of CSI, the emitter can design energy beamforming to increase the harvested power at the tag. Similarly, the reader may provide multiple tag access. Due to the strict energy constraints of the tag and its limitations on sending pilot signals [149], [233], channel estimation is challenging for BackCom. Moreover, for multiple tags, CSI acquisition is challenging. This complexity will intensify when the network scales up in size. The CSI estimation here involves three cases:(1) forward channel, (2) backscatter channel, and (3) the dyadic channel. Full CSI on these will enable optimal beamforming designs. Thus, channel estimation with low complexity and low power consumption is vital. However, CSI free/limited energy beamforming schemes have also been developed [234], [235], [236], [237], [238], [239], [240]. Moreover, blind channel estimation can overcome the lack of training symbols [241]. Developing methods for BackCom CSI estimation using symbiotic methods is another interesting future research topic. To this end, machine learning-based signal detection and channel estimation methods can overcome the limitations of traditional BackCom estimation/detection methods [242], [243], [244], [245], [246].

B. MULTIPLE ANTENNA TAG/READER
Multiple antenna tags/reader can exploit both pinhole diversity gains and conventional diversity gains, which significantly enhance the performance and reliability of BackCom systems. However, several challenges with this setup should be further investigated, (i) CSI acquisition which is required to benefit the most from this setup becomes challenging because of the strict energy constraint of passive tags, (ii) tags with multiple antennas can operate at high operating frequencies, e.g., SHF. However, the excess path loss is then higher. Thus, improving the power efficiency of tags and operating in high frequencies is a need.

C. CODING SCHEMES
Because of the limited tag processing and storage capabilities, channel codes for BackCom systems should be designed with minimal cost, low chip complexity, and low power consumption. The decoding process should also be of low complexity; otherwise, decoding induced-delays would limit the potential number of tags served by a single receiver. Therefore, conventional error-correcting codes, which are primarily designed for high-end devices with active radios, may not meet the various requirements of BackCom systems, and sophisticated modifications are thus required to make them compatible with this technology [164]. Given the flexibility of code and decoder design that polar codes offer [247], one interesting future research direction is developing Polar codes able to satisfy the demands of BackCom systems, with particular attention to low encoding complexity, rate flexibility, and low decoding latency while maintaining good error correction performance. Parity-Check (PC) Polar codes which include parity-check coding, reliability calculation and rate matching is one promising solution [248].

D. SYNCHRONIZATION
Time synchronization in all networks, either wired or wireless, is essential. It enables successful communication among nodes but is especially vital for wireless networks. Wireless time synchronization serves many different purposes, including location, proximity, energy efficiency, mobility, and others, and allows for TDMA and other multiple access algorithms (Section VII-H) to work. Synchronization errors include timing offsets and carrier frequency offsets.
We must design synchronization techniques for backscatter systems considering that tags indeed avoid RF signal generation. The tag should synchronize with the incident signal to know precisely when to perform backscatter modulation. Inaccurate synchronization decreases achievable throughput, increases inter-symbol interference (ISI), and reduces the communication range.
For BackCom networks, synchronization can be challenging as the power consumption of synchronization process increases exponentially at a lower incoming signal power level [249]. A simple low-power energy detector synchronization scheme is thus used but with low accuracy (of 2 µs at the input power of −20 dBm for Wi-Fi backscattering) [207]. Reference [249] is the only work that explicitly investigates the accurate synchronization for BackCom with Wi-Fi. Hence, for backscatter systems based on different wireless standards, effective strategies and techniques need to be identified to achieve the minimum required synchronization accuracy and desired high sensitivity with µW level power consumption. Moreover, synchronization schemes supporting the coexistence of multiple backscatter devices without mutually interfering must be further investigated [250].

E. INTERFERENCE MANAGEMENT
Interference occurs when unwanted signals disrupt or weaken the desired signal. It can prevent reception entirely, cause only a temporary signal loss, or affect the signal's quality. Common types of interference are self-interference, multiple access interference, co-channel interference (CCI), and adjacent channel interference (ACI). The use of the same device for both transmission and reception causes selfinterference. The transmission from multiple devices in the same frequency resource induces multiple access interference. CCI occurs in links that reuse the same frequency channel, whereas ACI is the interference caused by links that use nearby frequency bands to communicate in the same geographical area. Hence, managing/mitigating this interference is important for the performance of any communication system.
In BackCom systems, multiple tags operating at the same frequency in proximity can produce considerable mutual interference, resulting in multiple access interference and CCI. In particular, AmBC tags communicate by reflecting ambient signals, causing interference on licensed systems [251], which must be avoided. To this end, future research must consider modeling and analyzing BackCom generated interference. Stochastic geometry models and geographical analysis can evaluate the interference caused by AmBC systems to licensed systems. Moreover, interference alignment and interference cancellation techniques can be employed [252]. Large-scale BackCom networks can manage interference via position management, frequency allocation, communication range control, scheduling, and multiple-access schemes.

F. PHYSICAL LAYER SECURITY
Broadcast wireless transmissions are accessible to both authorized and illegitimate users. This openness creates a vulnerability against malicious attacks, passive eavesdropping, active jamming, and other security breaches. Traditional security approaches, such as cryptographic key sharing, may need to be revised to give enough protection and reduce complexity.
Physical layer security (PLS) exploits the intrinsic characteristics of the wireless environment, including the propagation channel (fading, noise), RF front-end, and/or the communication signal itself to secure the communication process without sharing the security keys. For example, the computational complexity of encryption techniques could be overwhelming for ultra-low-power nodes. Thus, security by exploiting the radio channel's physical properties is a promising solution [253], [254], [255], [256], [257]. PLS techniques include coding and signal-processing strategies and can achieve security at a reduced computational complexity [258]. PLS techniques can thus establish a secure legitimate channel for tags that cannot support complex power-consuming protocols with highly secure encryption [253], [259], [260], [261].
Despite the previous research efforts, PLS techniques to match the features of passive IoT, e.g., low-cost and low power consumption, wide-range coverage, massive connections, and diversified services, still need to be solved. Exploiting PLS techniques to deal with active and passive malicious attacks, e.g., eavesdropping, message modification, and jamming on BackCom systems, is challenging and needs further investigation.

G. UNIVERSAL BACKCOM
As the frequency increases, the energy required to generate the RF carrier signal increases. However, tags benefit from not having to generate the RF carrier, and AmBC systems scavenge an ambient RF signal. Thus, tags may work with multiple carrier frequencies, e.g., millimeter and terahertz frequencies. Such higher frequencies allow the dense packing of antennas into a small space, resulting in a highly directed beam. This will achieve a more extended BackCom range [262]. Another research direction is to develop frequency-independent BackCom for various protocols and frequency bands, like TV, FM, cellular, UWB, millimeter, and terahertz. This frequency independence opens up the potential of using BackCom globally, regardless of location, country, or application [215].

H. MAC LAYER & MULTIPLE ACCESS SCHEMES
The MAC layer controls the access of the devices to the physical transmission medium. It affects network reliability and efficiency. Most current BackCom research uses the centralized MAC protocol, where a central entity allocates resources to users sharing a medium, e.g., TDMA and FDMA. However, this may not be suitable for large-scale (passive) IoT networks with a complex and dynamic network topology. Thus, coordinating the channel access of tags remains challenging. Consequently, the network and MAC levels must address BackCom challenges, such as network management, carrier sensing, deploying network devices, device polling, and many more [263].
On the other hand, supporting numerous small data packets from many tags simultaneously is a challenge. Thus, tag multiple access schemes include sparse code multiple access (SCMA), a code domain approaches for non-orthogonal multiple access (NOMA) [264], coded-backscatter multiple access (CBMA) [265], Buzz multiple access [266], µ code [173], and distributed chirp spread spectrum coding [263]. If the reader can decode in parallel [267], then multiple tags can transmit simultaneously. Power-domain NOMA is another way to achieve this goal [268]. However, sophisticated resource allocation techniques must be developed to allow for the reliable simultaneous transmissions of many tags.

I. UAV/RIS/RELAY-ASSISTED BACKCOM
The forward link's reliability and performance are critical to achieving higher overall performance in BackCom. The forward link improves by using relays [269], [270], [271], unmanned aerial vehicles (UAVs) [272], [273], and RIS [128], [129], [130]. These solutions will extend the coverage/read range of BackCom significantly. For example, [270] investigates a relaying scheme where energy-constrained gateways close to the tags assist them in communicating with an AP. UAVs can provide strong excitation signals to the tags [272]. They can also reduce the backscatter data collection overhead [274], [275]. The adaptation of RIS in the forward link can amplify the emitter signal that reaches the tag and increases the communication range [133], [276], [277]. Therefore, we can leverage these assisting technologies to provide RF EH sources and improve the BackCom throughput. Integrating these with BackCom is an important future research direction to facilitate large-scale communication networks. Performance optimization, resource allocation, and scheduling, subject to the passive IoT constraints and requirements, are potential research directions for BackCom.

VIII. CONCLUSION
Future wireless (e.g., 6G) networks will enable massive seamless connectivity to facilitate the digital economy and society. BackCom systems can help with this goal of developing optimized future networks. Their integration with other wireless technologies will enable connectivity and massive scalability of networks.
This paper thus presented a comprehensive overview of BackCom to investigate its feasibility for future wireless needs, particularly for passive IoT. First, we described the (backscatter) tags and discussed their relevant parameters and functionalities. Second, we investigated the ability of tags to communicate by conducting a complete link budget analysis and simulation examples. We also evaluated potential solutions to circumvent the limitations, enabling massive IoT networks. Third, we discussed integrating Back-Com with existing wireless technologies. Moreover, we have highlighted some applications of this innovative technology. Finally, we have addressed some practical open research problems and future research directions.

(Diluka A. Loku Galappaththige and Fatemeh Rezaei contributed equally to this work.)
CHINTHA TELLAMBURA (Fellow, IEEE) received the B.Sc. degree (Hons.) from the University of Moratuwa, Sri Lanka, the M.Sc. degree in electronics from the King's College, University of London, U.K., and the Ph.D. degree in electrical engineering from the University of Victoria, Canada.
He was with Monash University, Australia, from 1997 to 2002. He is currently a Professor with the Department of Electrical and Computer Engineering, University of Alberta. He has authored or coauthored over 600 journals and conference papers with an H-index of 80 (Google Scholar). His current research interests include design, modeling, and analysis of current and future wireless networks. Prof