Semi-Passive UHF RFID Sensor Tags: A Comprehensive Review

This paper presents a comprehensive overview and analysis of the state-of-the-art (SoA) in semi-passive or Battery-Assisted (BAP) Ultra-High Frequency (UHF) Radio Frequency Identification (RFID) sensor tags compliant with EPC Global G2/ISO-18000C. These tags operate on the same communication principle as fully passive sensor tags but incorporate a battery or an energy harvesting module. This additional power source extends communication ranges and enables power demanding applications using low-power microcontrollers (MCUs) and higher-end sensors. This article also analyzes various key features, including tag integrated circuit (IC) architecture, types of energy harvesting modules, and communication range. The main conclusions are threefold. Firstly, selecting the appropriate tag IC requires a careful analysis of its features such as sensitivity, sensor interfaces, or data logging capabilities. For instance, among the solutions examined in the SoA, half of them opted for a tag IC capable of MCU communication via SPI or I2C buses. Secondly, it is essential to assess both the forward and backward communication links to leverage the sensitivity of the tag IC in BAP mode. Interestingly, only one-third of the SoA solutions achieved the theoretical communication range anticipated by the sensitivity of the tag IC. Finally, an energy budget analysis is required to ensure that the energy generation suffices to meet the energy requirements of the tag. While most solutions rely on batteries as the energy source and analyze battery lifespan, only a few studies employing energy harvesters conduct an energy budget analysis due to the additional complexity involved.


I. INTRODUCTION
The UHF RFID technology has gained significant popularity in the Internet-of-Things (IoT) industry due to its cost-effectiveness, extended lifespan, and recent sensing capabilities [1].This technology has found applications in various fields including logistics, healthcare, transport, and industry, among others.Nevertheless, despite its widespread adoption, a major drawback of the UHF RFID technology lies The associate editor coordinating the review of this manuscript and approving it for publication was Maurice J. Khabbaz . in its limited system communication range, which is further exacerbated when new sensors are integrated into the system.
As shown in Fig. 1a, fully passive UHF sensor tags typically comprise an antenna, matching network, tag IC and sensors.Specifically, the tag IC is responsible for communicating with the reader through backscatter modulation of the incoming RF waveform transmitted by the reader.Furthermore, the tag IC also harvests energy from the same incoming RF waveform to power both itself and the sensors by means of an output voltage supply pin (VREG in Fig. 1a), eliminating the need for batteries.Consequently, passive tags exhibit unlimited lifespan, compact size, and low cost.However, due to the limited energy harvested, fully passive RFID sensor tags have a short communication range of only a few meters, as the energy is shared between the tag IC and the sensors.Moreover, the little energy harvested restricts the type of sensors that can be used.
As shown in Fig. 1b, semi-passive or BAP UHF sensor tags incorporate an external power source.Consequently, semipassive UHF sensing technology overcomes the limitations of fully passive solutions because it enables the utilization of a wider range of sensors trough a low-power MCU interface, without compromising the communication range and still ensuring long autonomy.In addition, recent developments have explored the adoption of energy harvesting modules instead of batteries, potentially offering unlimited autonomy.Moreover, improvements in tag IC designs have introduced a BAP mode by adding an input voltage pin (VBAT in Fig. 1b).This pin externally supplies the internal blocks of the tag IC, thereby providing enhanced sensitivities and consequently improving the communication range of the system.Fig. 2 shows a photo of a SoA example of a semi-passive UHF RFID sensor tag.It implements the architecture depicted in Fig. 1b with a tag IC, an MSP430 low-power MCU and a TMP112 I2C-based digital temperature sensor.It also includes a printed dipole antenna and holders for coin batteries [2].This work then focuses on the growing UHF semi-passive or BAP sensor tag solutions in the SoA that incorporate the widely adopted EPC C1G2/ISO 18000-6C standard.The paper examines the intended applications, architectures, sensing capabilities and communication ranges of these solutions.Additionally, it provides an in-depth analysis of the performances and features of the available tag ICs.Lastly, the type and performance of the energy source, whether a battery or an energy harvesting module, are also evaluated.
The paper is organized as follows.Section II provides an overview of semi-passive sensor tags within the SoA.Section III presents a detailed analysis of the architecture and performance of the tag ICs found in the SoA.Section IV examines the performance of the energy sources of the sensor tags, whether they are battery-assisted or employ an energy harvester module.Section V addresses the architectures and performance of the sensor tag with special focus on its communication range.Finally, Section VI concludes this paper.

II. SoA OF SEMI-PASSIVE SENSOR TAGS
Table 1 presents the key features of the EPC Global G2/ISO-18000C UHF semi-passive sensor tags in recent years.Table 1 is organized based on the tag IC manufacturer and publication year.As observed, except for a few custom solutions, most of the solutions use commercial off-the-shelf tag ICs.It is also interesting to see that the list of tag IC manufacturers is short.As shown, the Impinj MONZA 8K/2K is the most widely used, followed by the AMS SL900A, the EM Microelectronic EM4325, and the Farsens Rocky 100.Other solutions are also found with NXP and Fujitsu ICs.The reasons behind the selection of these ICs are discussed in detail in the next section.
Table 1 further provides information on the sensing parameters, sensor types and their interfaces with the tag.A wide range of sensed parameters is observed, including temperature, humidity, acceleration, and others, utilizing both analog and digital sensors.In addition, since the available power is not limited only to the one harvested from the incoming RF waveform combined sensing parameters can be implemented as in [7], [8], and [25], in which acceleration, light and temperature sensor are monitored in the same tag.For the same reason, it is interesting to see that most SoA solutions instead of directly connecting the sensor to the tag IC, they include an MCU in between for greater design flexibility.It is worth mentioning that temperature sensing predominates.The main reason, along with the fact that temperature is a basic parameter, is that temperature sensors can be implemented on standard CMOS processes with very low power consumption and therefore integrated with the tag IC.Several ICs like the [33] or the [34] have internal sensor, so temperature monitoring is straightforward in this case.
Table 1 also provides information of the different energy sources employed.Given its voltage stability and long-term energy availability, the majority solutions include a battery.However, to provide a semi-passive batteryless solution, several works incorporate energy harvesting modules with a variety of energy sources: Photovoltaic (PV), Radio Frequency (RF) and Thermoelectric Generators (TEG).
Finally, Table 1 shows that the solutions in the SoA addresses many different applications: industry, transport, healthcare, monitoring of buildings, goods, or infrastructure, etc.

III. TAG IC: ARCHITECTURE AND PERFORMANCE
As mentioned in section II, the list of commercially available UHF tag ICs used in semi-passive sensor tags is not long.The main reason for this is that these ICs fall under the EPC standard's class-3 category, which denotes battery-assisted (BAP) or semi-passive solutions.These ICs are specifically designed to handle and store sensor data and use additional power sources [30].Fig. 3 illustrates the block diagram of a class 3 semi-passive tag IC.Similar to passive UHF RFID tag ICs, class 3 semi-passive tag ICs consists of two main blocks: the analog front-end for energy harvesting and data communication, and the digital core that implements the EPC C1G2/ISO 18000-6C standard.Within the analog front-end, the Voltage Multiplier (VM) along with the Voltage Limiter transform the incoming RF waveform into a limited DC signal, subsequently charging the C SUPPLY capacitor.The Power Management Unit (PMU) monitors de V SUPPLY level and enables the Voltage Regulators for supplying both the digital core and the active blocks of the analog front-end: ASK Demodulator, PSK Modulator, Clock Generator, Bandgap Reference, etc.All these blocks are also present in passive UHF tag ICs but the main difference in this case is that the V SUPPLY node is externally accessible through a PSM (Power Supply Management) block, so that an external source can be used to power the tag IC.This improves the sensitivity of the tag IC and allows additional features to the IC, such as a digital interface for sensors or data logging.Next a detailed description of these features is presented: This characteristic provides semi-passive tag ICs with a crucial advantage over passive devices.It means that the tag IC presents two modes: passive mode and BAP mode, with improved sensitivity in the latter.
In passive mode, the read sensitivity of the tag IC depends on the voltage multiplier to generate enough DC voltage (V SUPPLY in Fig. 3) at its output considering its load conditions.The load conditions refer to the amount of current required to power the internal active tag IC blocks (ASK Demodulator, PSK Modulator, Clock Generator, Voltage Regulators, Bandgap Reference, etc.) and the external devices (MCU and sensors).
In this passive mode, the current needed to power the active internal blocks of the tag IC comes from transmitted signal of the reader.Without any external load, the sensitivity of the tag IC corresponds to the value shown in Table 2, it is typically obtained by querying only the tag's ID, so only the current consumption of the tag IC is considered.However, when an external load is added to the IC, the sensitivity deteriorates.An example of this fact in passive mode is found in [20], whose sensitivity degrades from −14 dBm to −9 dBm when the tag IC is loaded with a LED.Also, in [28] the sensitivity is reduced from −15.1 dBm to −11.2 dBm when getting data samples from the internal temperature sensor if compared to a simple tag ID reading operation.Finally, in [35] the sensitivity is reduced from −14 dBm to −10 dBm when a load of 5 µA at 1.8 V is used.In semi-passive sensor tags, even though the tag IC is in passive mode, there is a read range improvement when compared to a fully passive sensor tag.As the battery or the energy harvesting module supplies power to the MCU and the sensors, it alleviates the load conditions of the tag IC only to the power required for the tag IC itself.Thus, the sensitivity of the tag IC is not degraded, preserving the read range.
In tag ICs operating in BAP mode, the external supply is not only applied to the MCU and sensors but also to the internal blocks of the IC.The consequence is that there is now no need to wait for the voltage multiplier to provide enough DC output voltage, as the DC voltage is already available from the battery or the energy harvester.Specifically, since the ASK demodulator is externally powered, it can adequately demodulate the information carried in low power signals.Therefore, sensitivity is improved, because those low power signals that could not energize the tag IC now, in BAP mode, can be demodulated correctly because the tag IC is already powered.This is the main reason of the sensitivity enhancement in the BAP mode.
Table 2 summarizes the performance of the tag ICs found within the SoA of semi-passive applications.As observed, the majority of these tag ICs can be classified as class 3, as they feature a sensitivity improvement from passive to BAP mode.As shown in Table 2, both [31] and [32] report 7 dB sensitivity improvement from −19.1 dBm to −26.1 dBm and from −17 dBm to −24 dBm, respectively.Similarly, in [33] an improvement of 7 dB from −7 dBm to −15 dBm is achieved.A slightly larger improvement is shown in [37] from −17.6 dBm to −27 dBm.Interestingly, [34] and [35] offer a range of sensitivity values in BAP mode.In [34], the BAP sensitivity can be chosen from four different levels (−17 dBm, −22 dBm, −28 dBm or −31 dBm) by means a control word.In [35], it is possible to choose between a sensitivity of −17 dBm for the BAP mode or an enhanced BAP sensitivity of −35 dBm.Exceptions are [36] and [38], which lack BAP mode and thus do not provide enhanced sensitivity.Nevertheless, these two tag ICs are used in the literature because, as explained before, even in passive mode, the addition of an external power source improves the reading range by relaxing the load conditions.Finally, in [38] although there is a supply voltage pin, it is not intended for BAP mode but for memory access, which is FRAM type.

B. EXTERNAL SUPPLY
An essential feature of a tag IC for semi-passive application is an input for external supply, enabling the utilization of an external battery or an energy harvester module.Furthermore, it also desirable that the input pin for external supply may accept a wide range of input voltage levels to accommodate different types of power sources, an eventual voltage reduction in battery voltage or potential voltage fluctuations in energy harvesters.As observed in Table 2 most of the tag ICs fulfills this requirement.The ICs in [31] and [32] allow 1.6 V to 3.6 V voltage range.Similar ranges are found in [33] and [35], spanning from 1.5 V to 3 V and from 1.4 V to 3 V, respectively.The widest range is provided by [34], from 1.25 V to 3.65V.Again, there are some exceptions such as [37], which lacks an input voltage range because it only accepts 1.8V.As aforementioned, the voltage range in [38] is only to allow the FRAM memory access.Finally, [36] has no external supply.

C. SENSOR INTERFACE
As shown in Table 2, since these ICs are designed for sensor data communication, they commonly incorporate I2C (Inter-Integrated Circuit), as in [31] and [32], and SPI (Serial Peripheral Interface) as in [33], [34], [35], [36], and [38], as standard communication buses with sensors.Furthermore, most of these ICs implement Slave modules [31], [32], [33], and [38].This indicates the intention to communicate with an MCU that usually acts as the Master.The reason for incorporating an MCU is that due to the extra energy source, most solutions do not connect the sensor directly to the tag IC but through a low power MCU because it adds extra flexibility to the types of sensors that can be implemented.By using a low power MCU, multiple I2C, SPI communication ports are available for connecting both the tag IC and digital sensors.Furthermore, the MCU usually includes Analog-to-digital converters (ADCs) for interfacing with analog sensors.Consequently, almost any off-the-self digital or analog sensor can be interfaced.Moreover, the I2C or SPI buses support multiple slave devices, allowing for the addition of new sensors with minimum changes.Finally, the internal memory of the MCU can be used as an additional data logger with greater memory size and lifespan than the one provided by the tag IC.
However, it is worth noting that some ICs, such as [34] [35], incorporate an SPI bus that can be also configured as Master for direct communication with digital sensors, which normally act as Slave devices, so it avoids the MCU.This would eliminate the need for an intermediate MCU if a direct connection with the sensors is desired.

D. USER DATA LOGGING
Many of the ICs allocate internal memory for user data logging purposes.In general, memory depth is not extensive, but it allows the storage in a non-volatile memory (NVM).Additionally, if an RTC is also available, data can be connected to time stamps, enhancing the tag's capability for data, event, or alarm logging.For example, it can be used for event-triggered data logging from an external device such a sensor or a switch.As indicated in Table 2, most of the tag ICs allocate a portion of the internal memory for user data storage.The memory size ranges from 128 bit to over 8 Kbit.The ICs in [31], [33], and [34] shows the highest memory size, whereas [32], [35], and [38] offers memory sizes in the Kbit range.It is worth noting that [37] lacks memory space for user data, but improved models of the same manufacturer allow 640 bit for this purpose [39].
Finally, it is important to note that the number of erase/write cycles in the NVM are limited to 10 4 or 10 5 cycles, thus imposing a constraint on the lifespan of the sensor tag, particularly when a relatively high data storing rate is anticipated [8].In that case, using an intermediate MCU is preferred.

E. ADDITIONAL FEATURES
Additionally, several ICs provide additional functionalities, including: • Internal LDO: This feature ensures a stable voltage supply to an external device, eliminating the need for an external LDO (Low Dropout) regulator.This feature is shown in [35] and [36].Additionally, [35] incorporates a voltage monitor that activates the LDO regulator only when a sufficient supply voltage is available.
• Analog-to-Digital Converter: An integrated Analogto-Digital Converter enables the digitization of analog sensors.In this case, only [33] includes an ADC.
• Anti-tampering: To safeguard against unauthorized external modifications of data stored in the tag's memory.The ICs in [35] and [37] incorporate anti-tampering measures.
• RF event: This functionality enables the tag IC to trigger an event in response to a reader command.For instance, it can be utilized to wake up an external device, such as an MCU, from sleep mode.Solutions in [31], [32], and [35] incorporate this feature.
• Extra RF port: Some ICs like [31] and [32] include an additional RF port, which effectively eliminates orientation-related missed reads or blind spots by utilizing omnidirectional antennas.
• Internal temperature sensor: Some ICs have an internal temperature sensor as in [33] and [34].In addition to its potential use as an environmental sensor, it also serves the purpose of tag IC self-protection by monitoring temperature levels.
In summary, the final application of the semi-passive sensor tag, along with the types of sensors, data logging requirements, read range or the energy source employed are the characteristics to consider for proper tag IC choice.

IV. ENERGY SOURCE: ARCHITECTURE AND PERFORMANCE
This section discusses the architectures and performance of the energy sources employed in the SoA.The discussion starts with the solutions that use a battery, followed by the works that employs ambient energy harvesters.
As it is shown.battery capacities as low as a typical coin cell of 225 mAh or less can expand the sensor tag lifetime for several years, depending on the system duty cycle which impacts on the average power consumption.Examples are given in [8], where the lifetime ranges from 3.7 years for an average power consumption of 20.8 µW and a sensor data sampling rate of 2 samples/min, to 5.6 years for an average power consumption of 13.7 µW and a sensor data sampling rate of 1 sample/min.This last result is similar to [27] with a lifetime of 5.7 years for an average power consumption 12.1 µW and 1.6% duty cycle for a 605 mAh battery capacity.
In [15], the lifetime spans to 5.4 years for a small flexible battery of 33 mAh and 1.7 years for a 10 mAh flexible battery.The sampling rate is of 2 samples/h in this case, which explains the low average power consumption.Works in [26] and [29] are similar in that they both report long battery life for small batteries.Work in [26] reports the smallest capacity of 1 mAh for 9 months of battery life.It must be noted that this calculation is made considering only the tag IC standby current, which explains such low average power consumption.Still, this solution includes a battery recharging circuit to collect the excess of energy from the incoming RF signal.In [29] a battery life of 2 years for a 10 mAh capacity is reported.The low average power consumption is explained by an expected duty cycle of only 0.1%.However, the energy budget is comprehensive in this case because this work also considers the leakage current of the tag IC and, as is the previous case, the contribution of the excess of the incoming RF signal for battery recharging.
The work in [24] shows a different case as it reports a relatively short lifetime of 10 hours for a relatively large battery due to the high power consumption of the sensor in its active mode (49 mA).
Finally, work in [15] is the only that discusses the self-discharge of the battery.This is an important problem for such long-life systems.In fact, in this work lifetime is reduced from 5.4 years to 3.7 years when accounting for the self-discharge of the 33 mAh battery.
The architectures of the energy harvesters employed in the SoA of UHF semi-passive sensor tags are shown in Fig. 4, Fig. 5, and Fig. 6.Specifically, Fig. 4 shows the main blocks required for an RF harvester.This type of harvester collects energy from the incoming RF signals at the frequency band for which the harvester has been designed.In the case of the RF harvesters within the SoA, they are designed for the same UHF band and therefore collect energy from the same incoming RF signal that energizes the tag IC.In fact, the RF-DC rectifier of the RF harvester uses the same concept of the VM block within the tag IC.The only difference is that this RF-DC rectifier is optimized in terms of its conversion efficiency for the expected load.Moreover, high-performance Schottky diodes and high-Q passive components are used for the RF-DC rectifier and the matching network, respectively, as in [6], and [7].Furthermore, antennas with better performance are usually employed as in [12] with an 8.7 dBi patch antenna.Still, like to the tag IC, the RF harvester also exhibits a limited sensitivity, i.e., the minimum input power that the harvester needs to operate, and must be considered for the communication range calculations of the entire semi-passive sensor tag.In general, the RF harvester's sensitivity outperforms the sensitivity of the tag IC in fully passive mode.However, this may not be true when compared to the tag IC sensitivity in BAP mode.As a consequence, the sensitivity of the RF harvester tends to be the bottleneck for the sensitivity of the sensor tag and therefore for the forward communication range.Several examples are detailed in subsection IV-C.As also shown in Fig. 4, a step-up DC-DC converter is normally required, since the output voltage provided by the RF harvester usually falls below the input voltage range accepted by the tag IC.The drawback is that the step-up converter, although high, also has a limited efficiency, which reduces the amount of harvested power, as shown in subsection IV-C.Finally, if the RF energy harvester is intended to power the MCU and sensors, corresponding voltage regulators become necessary.In general, direct connection to the tag IC is feasible, provided that the recommended input voltage ranges are adhered to.Furthermore, Fig. 5 shows the blocks employed for the TEG or the indoor PV harvesters.In these cases, an RF-DC rectifier is not required as the output of these harvesters is already a DC signal.Again, in these cases the output voltage is typically below the input voltage range required by the tag IC for the low temperature gradients in TEGs or the indoor light intensities in PV cells.Therefore, a stepup DC-DC converter is also necessary is essential despite the associated energy losses due to the converter's limited efficiency.Subsection IV-C provides additional performance insights from the SoA.Again, if the PV or TEG harvester aims to power the MCU and sensors, corresponding voltage regulators are required.Finally, Fig. 6 shows the case of a PV harvester for outdoor conditions.The higher light intensity results in a greater output voltage, eliminating the need of a step-up DC-DC converter.Therefore, the harvester can be connected directly to the tag IC as long as the IC's input voltage range is respected by using a voltage limiter.Additionally, a diode connected series is also required to prevent any possible discharging of the tag, as exemplified in [16], [17] or [20].

C. ENERGY HARVESTING PERFORMANCE
Table 4 presents the performance of the harvesters from the works that provide sufficient details.In Table 4 ''Average Power Consumption'' is the power consumed by the sensor tag.''Area'' refers to the area occupied by the harvesting block.''V OUT '' is the voltage at the output of the harvesting block, either at the output of the RF-DC rectifier or the input of the step-up converter.''P OUT '' is the output power at the output of the step-up converter, so its efficiency is considered.Finally, ''Power Density'' is the ratio of output power to the occupied area.Thus, Table 4 allows a comparison among the different energy harvester solutions.However, this comparison must be made with caution considering the differences of energy sources, conditions, energy availability and target applications.
As mentioned before, photovoltaic cells provide the greatest output power along with the highest power density in outdoor conditions as in [4] and [17].Moreover, as mentioned before, given the high output voltage no boost converter is required.Different results are obtained when the photovoltaic modules are used in indoor applications [40], [41].As shown in Table 4, in [20], for a typical indoor light intensity of 800 lux, a module with a 5.5 cm 2 area, provides a final output power of 35 µW and 470 µW with output voltage of the PC cell of 0.4 V and 0.73 V depending on the type of light source.Similarly, in [17], for a light intensity of 100 lux from fluorescent light source and output power of 20 µW is harvested.These results can be compared with energy harvesters based on TEG.For example, in [21] the TEG module with an area of 54.4 cm 2 , provides an output power of 90 µW for 2.5 • C of temperature gradient.Therefore, TEG output power levels are noticeably lower than those offered by PV technology in outdoor conditions but are comparable to power densities of PV harvesters in certain indoor applications.Still, output voltage levels are much lower if compared to indoor PV harvesters, below 100 mV as shown in [21] or [23].Although this is due to the low temperature gradients used in these works, such a low output voltage requires special low start-up voltage step-up converters that impact the efficiency of the energy source [42].Finally, it is also worth noting that the output power and consequently the power density of TEGs has a quadratic increment with temperature gradient [43], [44].Therefore, higher temperature gradients would bring TEG harvesters closer to indoor PV counterparts both in terms of output power and output voltage levels.
Lastly, Table 4 presents the findings for RF harvesting from [4], [6], [7], [12], and [22].The last column shows the harvesting frequency band of these works.As mentioned, the RF harvesters within the SoA are designed for the same UHF band that powers the tag IC.This column also shows the 135590 VOLUME 11, 2023 Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.sensitivity of the harvester.As also mentioned, although works in the SoA show good sensitivity results for the RF harvester, these results are lower than the sensitivities of the majority of tag ICs in the BAP mode.Therefore, the sensitivity of RF harvesters can become a limiting factor for the entire tag's sensitivity and therefore for the forward communication range.This is the case of the system in [4] that uses the Monza X 8K tag IC with a sensitivity of −24 dBm in BAP mode, while the RF harvester sensitivity is −13.8 dBm.Similarly, [6] and [7] use the Monza X 2K IC with −24 dBm BAP sensitivity, but the RF harvesters have sensitivities of −9 dBm and −14 dBm, respectively.The work in [22] uses the Rocky100 IC.This tag IC also has a BAP sensitivity of −24 dBm, while the sensitivity of its RF harvester is only −15 dBm.Finally, work in [12] does not include a boost converter but requires a rectified output voltage of 2.1 V.This is achieved with an input voltage of −8 dBm for a 56 k load [45].This work uses the SL900A tag IC with a sensitivity of −15 dBm in BAP mode.Therefore, the RF harvester also limits the communication range in this case.A more detailed study of the SoA performance in terms of the communication range is discussed in Subsection V-C.
Concerning the output power of RF harvesters, the data presented in [7] is calculated based on the RF power at the input and the overall system efficiency, which includes both the RF-DC rectifier and the DC-DC boost converter in this case.For an input power of −9 dBm and 20% of efficiency, the calculated harvested power is 25 µW.In [12] an input power of −8 dBm and an efficiency of 50% for the RF-DC rectifier corresponds to 79 µW of output power.In [22] only the efficiency of the RF-DC rectifier is provided but not the overall efficiency.However, since the system employs a commercial boost converter, the harvested power can be estimated based on the boost efficiency at the specific voltage provided by the rectifier output [46].It results in 11 µW for −15 dBm input power.
Concerning power density of these solutions, unfortunately it could not be calculated as antenna dimensions are not provided, although these results of these works are within the SoA of RF harvesters [47], [48].
Finally, to ensure that the generated energy is sufficient to meet the energy demands of the sensor tag and to develop a battery-free sensor tag, it is essential to conduct an energy budget analysis.This analysis involves considering the supply voltage required by the tag's components such as the tag IC, MCU, and sensors, as well as their active and sleep current consumption.Furthermore, for a comprehensive analysis, the availability of the energy source must also be considered.By utilizing these values, it becomes possible to calculate the duty cycle of the sensor tag, which determines the sensor measurement rate and consequently the average system power consumption.Several works in the SoA of semi-passive sensor tags with energy harvesters discuss an energy budget analysis as in [7], [17], [21], and [23].

V. SEMI-PASIVE SENSOR TAGS: ARCHITECTURES AND PERFORMANCE
This section discusses the architectures and performance of the whole sensor tags in the SoA.The discussion starts with the architectures employed in the SoA.In addition, as the most considered parameter of semi-passive tags is the read range, this section discusses the theoretical forward link read range of the tag ICs.This helps analyze the performance of sensor tags within the SoA in terms of the read range.

A. ARCHITECTURES OF SENSOR TAGS
The state-of-the-art for semi-passive sensor tags utilizes two main architectures, as illustrated in Fig. 7 and Fig. 8.Both architectures incorporate a low power MCU that communicates with the tag IC via a first SPI or I2C port.The MCU is also responsible for communicating with a digital sensor through a second SPI or I2C port or, in some cases, it digitizes the output of an analog sensor by means of an ADC.As mentioned before, these architectures offer the advantage of data logging and high flexibility since any digital or analog sensor can be accommodated in practice.However, there are exceptions to these architectures.For example [11], [14], [20], [27], and [29] directly connect their sensors to the tag IC without using a low-power MCU.In general, these sensor tags employ the internal ADC to digitize an analog sensor.Other works, such as [12], [16], [17], and [26] use only the available internal temperature sensor.In [9], an analog sensor is part of the matching network between the antenna and the tag IC, so the sensing mechanism is based on the minimum transmit power required to activate tag IC.In [24] although the sensor is externally supplied, the sensing mechanism is integrated in the backward communication protocol.It does not make use of an MCU, but it does not fully follow the EPC Global G2/ISO-18000C communication standard.Finally, there is no solution utilizing digital sensors connected directly to the tag IC although it is possible for the tag ICs with an SPI Master module.
The architecture depicted in Fig. 7 is the most commonly used among the SoA solutions.It is employed in [3], [4], [8], [10], [18], [19], [21], and [22].As shown in Fig. 7, the battery or energy harvesting module supplies power to all the devices: the tag IC, the MCU and the sensor.Since they use class 3 tag ICs, once the tag IC is externally powered, it can utilize the BAP mode for extended communication range.
However, this is not the only architecture adopted in the SoA.Fig. 8 presents a different approach.It also employs an intermediate MCU for communication with digital sensors, but the main difference is that the battery/energy harvester supplies power to the MCU and the sensors, but not the tag IC.As previously mentioned, this is an acceptable solution since the sensitivity of the tag IC remains unaffected despite the power consumption of the MCU and sensors, as these are powered by the battery or energy harvester module.
This architecture is used in [3], [6], [7], [15], [23], [25], and [28], and it has been chosen in these SoA solutions for two primary reasons.The first reason is related to the characteristics of the battery or the energy harvester module.For instance, in [15] a paper battery with limited capacity is employed, so the sensor tag is kept in passive mode for autonomy extension.In [6] and [7], RF harvesting is employed with 135592 VOLUME 11, 2023 Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.a sensitivity is similar to that of the tag IC in passive mode.Consequently, utilizing the tag IC in BAP mode becomes impractical, as the energy harvesting module becomes the limiting factor for communication range.In fact, in [7] a test using BAP mode is also carried out, showing greater communication range but, in this case, a stable DC source seems to be employed.
The second reason is simply that the tag IC lacks BAP mode, as it is the case in [23], [25], and [28].In such cases, enhanced sensitivity is not possible.
In conclusion, to achieve an extended communication range, the BAP mode of the tag IC is desirable.However, it is important to also consider the type of harvester being used.For example, in the case of RF harvesting, the limited sensitivity of the harvester itself can make the BAP mode ineffective.Nevertheless, even if the harvested energy is insufficient to enable the IC's BAP mode, it does not necessarily make the harvester useless.By means of the second architecture, the role of the battery/energy harvester is to maintain the tag IC's sensitivity unaffected by load conditions.In this way, the reading range is improved.

B. SENSOR TAG READ RANGE
Table 5 shows the sensitivity and the communication range of the different tags IC adopted in the SoA based on the published sensitivities (usually measured with an ID query command) and calculated with (1).
Equation ( 1) computes the power reaching the input ports of the tag IC after the sensor tag antenna, where P IC is the input power, P TX the reader transmitted power and G TX and G Tag are the reader and antenna gains, respectively.In addition, η refers to the polarization losses and τ the antenna-to-tag mismatch.Finally, (λ/4πd) 2 refers to the free space losses.For the read range calculations, a reader with output power of 2W ERP (complying with the European UHF band power regulations), a 6 dBic gain circular polarized reader antenna and 2 dBi gain dipole sensor tag antenna are assumed.Perfect matching between the antenna and the sensor tag is considered for simplicity.
As mentioned earlier, class 3 tag ICs exhibit different sensitivity performance when configured in passive or BAP modes.This is shown in Table 5 when comparing the columns for the passive range and the BAP range.As observed, a 7 dB to 10 dB sensitivity improvement is achieved when the tag IC is configured in BAP mode.As a consequence, the read range is doubled or tripled.
Among the class 3 tag ICs, the tag IC in [35] achieves a remarkable performance.It has two distinct BAP sensitivities: BAP and enhanced BAP or E-BAP.In BAP mode it shows a sensitivity of −24 dBm with a theoretical reading range of 22.3 m.This sensitivity is similar to other tag ICs, and it is the choice of the solutions in the SoA.However, in E-BAP mode, the tag IC achieves a sensitivity of −35 dBm corresponding to a theoretical reading range of 79 m.Another example is [34], whose sensitivity in BAP mode ranges from −17 dBm to −31 dBm (it also allows intermediate values of −22 dBm and −28 dBm), so for a 2 W ERP reader and 2 dBi sensor tag antenna gain, its theoretical read range extends from 10 m to 50 m.
It should be noted that the read range shown in Table 5 represents only the communication range of the forward link, (reader-to-tag).The overall system communication range is not fully characterized until the backward link (tag-to-reader) is also analyzed, although in the SoA only a few papers discuss the backward link [16], [21].In passive mode, the tag IC sensitivity and hence the forward link is clearly the limiting factor for the overall read range.Conversely, in semipassive mode, the sensitivity of the reader in the backward link can become the bottleneck.
To illustrate this, Fig. 9 shows the signal power reaching both the input of the tag IC and the backscattered power at the reader side.The calculations are based on (1) and (2) [49].
Equation ( 2) provides the power received by the reader considering both the reader-to-tag and tag-to-reader communication links.In Equation 2, factor k represents the modulation factor, i.e., the losses associated with the backscattering mechanism of the tag.Fig. 9 illustrates the P IC and P REC for the European power regulations at the UHF band: 2 W ERP at 868 MHz.Again, it considers a 6 dBic gain circular polarized reader antenna and 2 dBi gain dipole sensor tag antenna and a modulation loss factor of −6 dB [50].Finally, to determine the forward  and backward link communication ranges, sensitivities of −24 dBm and −80 dBm are assigned to the tag IC and the reader, respectively.This last value can be found in SoA for reader sensitivities [16].As observed in Fig. 9, the forward link offers a potential range of 22 m for 2 W ERP and a tag IC sensitivity of −24 dBm.However, in this case, the overall read range would be limited to 18m when considering the backward link as well.Of course, it is possible to extend the overall communication range by increasing the gain of the reader antenna.Fig. 10 shows how the backward link communication range expands with higher reader gains.However, a drawback in this case is that the antenna becomes more directional, which may be a problem for applications that requires omnidirectional reading.Alternatively, recent works implement reflected signal amplification to extend the backward link communication range but at the cost of higher power consumption of the sensor tags [51].
As a summary of the previous discussions, Table 6 collects the communication range limits across different scenarios.In a fully passive configuration, which corresponds to Fig. 1a, the communication range is energy constrained due to the demanding load conditions of the tag IC, since the energy harvested from the reader energizes not only the tag IC but also the external MCU and sensors.In such cases, the sensitivity of the tag IC is degraded compared to the level shown in datasheets, which is measured using query commands for ID reading.Consequently, the forward link becomes the bottleneck in such scenarios.
Alternatively, there is a first semi-passive configuration when the battery or the energy harvester module supplies power to the MCU and the sensors but not the tag IC, as in Fig. 8. Therefore, the incoming energy from the reader is used only to activate tag IC.Therefore, the tag IC works under noload conditions, and, in this case, the expected sensitivity is the one provided by the manufacturer in passive mode.In this case, the range is constrained by the forward link, provided that the reader has an acceptable sensitivity.
The second semi-passive configuration case occurs when the battery or the energy harvester supplies power not only to the MCU and the sensors but also to the tag IC configured in BAP mode, as in Fig. 7. Here, the system is not energy limited but communication limited since it is the backward link the one that becomes the bottleneck due to limitations of the reader sensitivity.

C. SoA READ RANGE
Table 7 presents the actual communication range of the SoA solutions.Based on the previous discussion Table 7 distinguishes the three different previously mentioned sensor tag configurations: Fully Passive Range when the tag IC is in passive mode and there is no extra energy source attached to the sensor tag.Passive/No-load Range when the sensor tag uses an energy harvester, but the tag IC is in passive mode.BAP Range when the sensor tag uses an energy harvester, and the tag IC is in BAP mode.
As shown in Table 7, the read ranges exhibit a wide variation.Moreover, some solutions show a significant discrepancy when compared to the theoretical maximum read range in the last two columns.This theoretical read range is again based on the tag IC's sensitivities provided by the tag IC manufacturers and considering 2 W ERP transmission power, a 6 dBic gain for reader antenna and a 2 dBi gain for the sensor tag antenna.The main reasons for the discrepancies are discussed through the next subsections:

1) USE OF THE TAG IC IN PASSIVE MODE
As mentioned before, there are several cases in which the tag IC is not configured in BAP mode.Therefore, the sensitivity of the tag IC is that of the passive mode.However, as it was also previously discussed, the sensitivity is not deteriorated due to the assistance of the battery/energy harvester.For example, in [23], the tag IC does not have BAP mode, but the authors demonstrate a range improvement from 1.75m to 3m when comparing the fully passive configuration to the semi-passive configuration.As shown, the reported read range is similar to the theoretical range for the tag IC in passive mode, which illustrates the read range improvement in no-load conditions.
In [25] the case is similar, as the tag IC only works in passive mode so that the battery is only used to power the MCU and the sensors.In addition, a dipole antenna placed on a metal surface is used, degrading the antenna performance and consequently the read range.However, it is important to note that in this case, there is no intention to optimize the range.In fact, antenna performance degradation seems to be a goal to reduce the cross talk between nearby tags.
In [17], although the tag IC can be configured in BAP mode, it seems to be in passive mode.However, the read range is improved when fully passive and semi-passive configurations are compared.Again, the reported read range is similar to the theoretical range for the tag IC in passive mode and illustrates the read range improvement in no-load conditions.
Other examples are works [6] and [7] that use UHF RF energy harvesting to power a sensor tag.For the reasons mentioned earlier, the energy harvester only supplies power to the MCU and the sensor, so the tag IC operates in passive mode.This explains the reduction in the reading range.In fact, [7] claims a read range of 22 m when the tag IC is in BAP mode using a battery as a stable power source.However, the read range in [7] is the same as the range theoretically calculated.
In [6] the read range is reduced to a half, from 10 m to 5 m.A lower gain of the sensor tag antenna, and the fact that experiments were conducted in an office room, could explain it.
A last example is found in [15], where authors keep the sensor tag in passive mode to increase the autonomy of the batteries.In this work low-capacity printed batteries are used.

2) SENSITIVITY OF THE RF ENERGY HARVESTER
The characteristics of the energy harvester can contribute to a reduced sensor range.For example, the system in [4] utilizes both RF and photovoltaic harvesting and BAP mode for the tag IC.With the photovoltaic harvester the read range reaches 27 m, which is closed to the theoretical one in BAP mode, but it drops to 7.48m when only the RF harvester is employed, as the RF harvester's sensitivity of −13.8 dBm limits the overall communication range.It should be noted that authors report a 6 dBi gain for the sensor tag antenna, which should increase the read range beyond the theoretical calculated one.However, the authors also report a loss in antenna performance due to the loading effect of the solar panel, which is placed on top of the antenna.
Work in [12] utilizes the tag IC in BAP mode and adds UHF RF harvesting.However, the authors state a reading range of 3 m, which is lower than the potential range of 13 m calculated by authors (8 dBi linearly polarized sensor tag antenna is used) or the theoretical read range in BAP mode of 7.9 m in Table 7. Again, this is due to the sensitivity constraints of the harvester.As it was shown in Table 4 the RF harvesting sensitivity is −8 dBm input voltage for a 56 k load [45].
Similarly, [22] utilizes UHF RF Harvesting and although the tag IC is in BAP mode with enhanced sensitivity of −24 dBm, the overall sensitivity of the sensor tag is also limited by the RF harvester's sensitivity of −12.5 dBm, resulting in a reduced read range.

3) LIMITATIONS DUE TO THE APPLICATION
In certain cases, the application itself imposes constraints on the read range due to factors such as multipath effects, the influence of surroundings on antenna performance, or limitations related to antenna size.
For example, in [11] an open-loop antenna designed to be placed on the human body exhibits a gain of −10 dBi, which consequently reduces the potential read range.In [24] the reduced read range is a consequence on the testing conditions, with the authors reporting a 20 m read range in indoor environment and therefore affected by multipath effects.
In [14] the designed sensor tag shows a read range of only 0.98 m in passive mode and 1.13 m with a RF energy harvester.The authors attribute this limitation to the insufficient power reaching the reader and can be caused by the negative effect of the human body on the tag's antenna performance, since the antenna seems to be a dipole and the sensor tag is being placed near the chest.
A similar underlying reason accounts for reduced read performance in [16], [18], and [19].In [16] authors present two different solutions.One is an object tracker, where no sensor is involved.However, the second solution is a system to monitor buildings.In the latter case, a dipole antenna is placed on windows, which affects the performance of the antenna.Moreover, the authors state that the sensor tag antenna is not optimized for the effect of surrounding dielectric materials.Still, the reported read range of 7 m is not far from the minimum theorical read range of 10 m, as shown in Table 7.Similarly, works in [18] and [19] use a PIFA and a ceramic antenna, respectively, attached to the body.These types of antennas are negatively affected by the human body.In fact, both report a read range reduction when attached to the body compared to the sensor tag in free space.In [18] the authors report a read range degradation of 4 m, from 13 m to 9 m, although this is close to the theoretical minimum range of 10 m.In [19] the read range exhibits a stronger degradation from 17 m to 4 m.

4) LIMITATIONS OF THE READER
In some cases, the performance limitations of the reader contribute to a reduction in the read range.The work in [3] reports 1.8m reading range using Monza X 8K with a theoretical reading range of 28.4 m.There is limited information available on the possible causes of this reduced range.One possible reason is the fact that the authors utilize of a reader with a maximum transmit power of 23 dBm, a 5.5 dBic antenna and a −65 dBm receive sensitivity.Under these conditions the transmitted power falls well below the maximum 2 W ERP allowed in Europe (a transmit power of 29.65 dBm for a 5.5 dBic antenna gain is possible).Moreover, the sensitivity of the reader also affects the detection of the sensor tag response in backward communication, as it is 15 dB lower than the sensitivities observed in SoA readers [16].In fact, a theoretical calculation based on the transmission power and the sensitivity of its reader results in 5 m read range, limited by the sensitivity of the reader.
Similarly, in [10] the reduced range can be partially attributed to a combination of low gain of the sensor tag antenna and low transmitted power of 26 dBm with a 7 dBi gain of the reader antenna (a transmit power 25.15 dBm for a 7 dBic antenna is possible).This combination results in a theoretical read range of 5.5 m.

5) LIMITATIONS OF THE SENSING MECHANISM
A final example is found in [9], where the sensing mechanism intentionally introduces a mismatch between the tag IC and the antenna.Although this approach is a simple solution for resistive sensors, it reduces the reading range.Additionally, in this particular case, an extra reference tag IC is required.
Lastly, in [5], there is no study of maximum reading range.The reported 1.5 m is only the test setup conditions.
As a conclusion to this section, to achieve the longest communication range for a semi-passive sensor tag, the tag IC should be configured in BAP mode.Still, keeping the tag 135596 VOLUME 11, 2023 Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
IC in passive mode can be an acceptable solution if an RF harvester with limited sensitivity or a battery with low capacity is employed.Logically, configuring the tag IC in passive mode will result in a reduced communication range compared to the BAP mode, but will improve the communication range of a fully-passive solution.Additionally, the communication range is also affected by the influence of environmental factors such as multipath effects and antenna performance due to surrounding materials.Finally, given the high sensitivity of the tag ICs the overall communication range depends on both the forward and the backward links.Therefore, the performance of the reader must be also assessed, since the backward link can become the bottleneck of the overall communication range.

VI. CONCLUSION
This paper provides a comprehensive overview and analysis of the state-of-the-art in EPC Global G2/ISO-18000C compliant semi-passive UHF RFID sensor tags.The research highlights the significant interest in semi-passive or BAP sensor tags within the IoT industry, owing to their improved performance compared to fully passive tags.By incorporating a battery or energy harvesting module, semi-passive sensor tags extend the communication range and support power-demanding sensors and low-power MCUs without compromising communication capabilities.The paper thoroughly examines recent advancements in semi-passive UHF RFID sensor tags, evaluating crucial aspects such as application suitability, sensing capabilities, tag IC performance and features, and system communication range.The key conclusions drawn from this review are first that the tag IC include different features so that a careful analysis is crucial for optimal tag IC selection.For example, an application that requires an orientation-free solution may be interested in [31] or [32], whereas [33] is a proper option if an analog sensor is used and no MCU is to be avoided.Secondly, the overall communication range is not only limited by the tag IC's sensitivity but also by the performance of the energy harvester.As an example, the best sensitivity among the tag ICs is [35] with a published value of −35 dBm in E-BAP mode.This high sensitivity contrasts with the best sensitivity among the RF harvesters, which is found to be −15 dBm.In addition, the remarkable sensitivities of class 3 tag ICs in BAP mode also require analyzing the backward communication link so, for example, readers with a sensitivity lower than −80 dBm will limit the overall communication range.Finally, the external energy source employed for the sensor tag needs to be evaluated.Apart from a battery, which is a stable energy source, different energy harvester modules have been found within the SoA, such as PV, RF or TEG.The amount energy provided by these sources is very different.For example, a TEG in [21] is only able to provide 90 uW and 37 mV with a modest conversion efficiency, while a PV for an outdoor application provides 180 mW and 3.6 V as in [4] for a similar area, but the availability of these sources is different too.These aspects must be considered to assess the sensing rate along with the choice of the MCU or the sensors of the sensor tag.

FIGURE 1 .
FIGURE 1. UHF RFID Sensor tag architectures in fully passive (a) and semi-passive (b) configurations.

FIGURE 4 .
FIGURE 4. Architecture of an RF energy harvester.

FIGURE 5 .
FIGURE 5. Architecture of a TEG or an indoor PV energy harvester.

FIGURE 6 .
FIGURE 6. Architecture of an outdoor PV energy harvester.

FIGURE 7 .
FIGURE 7. Semi-passive sensor tag architecture with externally supplied tag IC.

FIGURE 8 .
FIGURE 8. Semi-passive sensor tag architecture with passive tag IC.

FIGURE 9 .
FIGURE 9. Theoretical forward and backward link communication range for tag IC and reader sensitivities of −24dBm and −80dBm, respectively.

FIGURE 10 .
FIGURE 10. communication range vs gain of the antenna and reader sensitivity of −80dBm.

TABLE 3 .
Semi-passive sensor tags with battery.

TABLE 4 .
Energy harvesters in semi-passive sensor tags.

TABLE 5 .
Tag IC read range performance.

TABLE 6 .
Sensor tag configuracions and communication range limits.

TABLE 7 .
Sensor tag configuracions and communication range limits.