Detecting RFID Tag Position with Industrial Readers

1. Problem Statement: Presence vs. Position

Industrial RFID is widely used to confirm presence of a product on a conveyor, in a tool holder, on a workpiece carrier, or inside a tote. Many integrators, however, want to extend the same read event into a position estimate - for example, where the tag is along a 3 m rail, which slot of a 12-slot rack contains the carrier, or whether the carrier is in zone A or zone B of a process. The two questions are not equivalent in the physical layer:

The short answer used in the original technical discussion: a single UHF reader with a single antenna cannot deliver a deterministic 2-D position. RSSI is exposed by industrial readers (Siemens RF600 explicitly) and can be processed, but accuracy is governed by antenna pattern, tag orientation, multipath, and metal in the field - not by the reader firmware.

2. RFID Frequency Bands and Positioning Suitability

UHF (860-960 MHz) and HF (13.56 MHz) readers behave very differently when asked for position-like information. This is the first design decision.

For Siemens RF600 (UHF, EPC Class 1 Gen 2 / ISO 18000-63), position is always a derived quantity. RF600 readers expose RSSI per inventory event; the firmware does not output a 2-D coordinate.

3. RSSI - The Observable You Actually Have

RSSI is the only positioning-relevant signal most industrial UHF readers expose without specialized firmware. The free-space path loss model is:

RSSI(d) = P_tx + G_tx + G_tag - 20*log10(4*pi*d/lambda) - PL_other

• P_tx = EIRP (typically 0.5-2 W ERP regulated, e.g. ETSI EN 302 208 limits to 2 W ERP in 865-868 MHz band)
• G_tx, G_tag = antenna gains (dBi)
• d = distance tag-to-antenna (m)
• lambda = c/f, ~0.33 m at 900 MHz
• PL_other = losses from multipath, absorption, tag orientation, polarization mismatch

The 20*log10(d) term is what gives RSSI its position potential - but PL_other is the dominant error source in any real factory. A 3 dB fluctuation on the order of 1-3 dB is normal from tag rotation, and that maps to 10-40 % distance error from a single antenna.

4. Siemens RF600 - What Is and Is Not Available

The RF600 system consists of:

• Readers: RF610R, RF615R, RF630R, RF640R, RF650R, RF660R, RF680R, RF685R (UHF EPC Class 1 Gen 2)
• Antennas: RF ANT family - directional patch, wide-range, near-field
• Tags: RF600T series with user memory and RSSI capability
• Communication: PROFINET, EtherNet/IP, OPC UA via RF68xR; serial/IO-Link on RF610R/RF615R

Per the SIMATIC RF600 System Manual (Siemens Support entry ID 109751523) and the SIMATIC Ident product documentation, the reader returns the following per-tag data on each inventory cycle:

• EPC (Electronic Product Code)
• TID (Tag Identifier)
• User memory (if enabled)
• Antenna number (which physical antenna on the multiplexed reader received the tag)
• RSSI value in dBm (typically -20 to -75 dBm practical range)
• Timestamp (with RF68xR on PROFINET)

What the RF600 system does not provide as standard output:

• Phase of the backscattered signal (not exposed to the application in standard RF600 firmware)
• 2-D or 3-D coordinates
• Angle of arrival (no phased-array antenna in standard portfolio)
• Time-of-flight (narrowband signal, impulse width is many meters in spatial extent)

5. Practical Architectures for Position Estimation

5.1 Cell-of-Origin (one antenna per zone)

Place one reader (or one multiplexed antenna on a multiport reader) at each fixed zone. Position resolution equals the antenna footprint.

• RF600 readers RF660R/RF685R support up to 4 antennas internally; an external multiplexer extends this to 8
• Each antenna is mapped to a zone (Slot 1, Slot 2, Slot 3, Slot 4) in the PLC
• Accuracy: equals the physical size of one antenna footprint (e.g. 0.3-0.5 m wide patch)
• Cost: one reader with up to 4 antennas covers a 4-slot rack

5.2 Weighted Centroid from Multiple Antennas

With N >= 3 antennas at known positions, compute the weighted centroid:

x_est = sum(w_i * x_i) / sum(w_i), w_i = 10^(RSSI_i / 10)

Convert RSSI from dBm to linear mW before weighting, otherwise strong signals dominate. Typical accuracy in controlled lab: 0.3-1.0 m. Typical accuracy on a factory floor with metal: 1-3 m.

5.3 Path-Loss Triangulation

Solve the inverse path-loss equation per antenna:

d_i = lambda/(4*pi) * 10^((P_tx+G_tx+G_tag-RSSI_i)/(20))

Then minimize least-squares error over (x, y) such that sqrt((x-x_i)^2+(y-y_i)^2) approximates d_i. Requires at least 3 antennas with non-collinear geometry. Calibrate per environment with known tag positions to absorb PL_other.

5.4 Phase-Based Ranging (research-grade)

Some UHF RFID research platforms (Impinj R420/R660 with Speedway firmware, Kathrein RFID readers) expose the backscatter phase. Phase wrap at 0.33 m wavelength requires continuous-wave operation and an ambiguity-resolution step. Industrial accuracy 0.05-0.20 m. Not exposed by RF600 standard firmware.

6. PLC Integration Pattern (S7-1500 / TIA Portal)

RF600 readers integrate into an S7-1500 over PROFINET. The Ident profile exposes tag data through standardized I/O slots. Below is a typical ST snippet that reads EPC and RSSI from an RF685R and maps antenna number to a zone.

// FB_RFID_ZoneMap - read 4 tags, map antenna -> zone
// Inputs: i_hwAddr (HW identifier of RF685R), i_antPort (1..4)

FUNCTION_BLOCK FB_RFID_ZoneMap
VAR_INPUT
    i_hwAddr      : UINT;   // HW identifier of Ident device
    i_antPort     : INT;    // expected antenna port 1..4
END_VAR
VAR_OUTPUT
    o_zoneID      : INT;    // 1..4 or 0 = no read
    o_lastRSSI    : REAL;   // dBm, negative
    o_lastEPC     : STRING[24];
    o_sts         : WORD;   // 0x0001 present, 0x0002 readErr
END_VAR
VAR
    rt_Read       : RAL_IdentRead;          // Siemens Ident block
    s_EPC         : WSTRING[24];
    i_Antenna     : INT;
    r_RSSI        : REAL;
    t_Timestamp   : DATE_AND_TIME;
END_VAR

BEGIN
    // Trigger inventory on the configured antenna
    rt_Read(Req       := TRUE,
            Mode      := 1,                  // 1 = single tag read
            Antenna   := i_antPort,
            ID        := i_hwAddr,
            EPC       := s_EPC,
            RSSI      := r_RSSI,
            AntennaNo := i_Antenna);

    IF rt_Read.Done THEN
        o_lastEPC   := WSTRING_TO_STRING(s_EPC);
        o_lastRSSI  := r_RSSI;              // dBm, e.g. -47.0
        o_zoneID    := i_Antenna;           // direct 1:1 map
        o_sts       := o_sts OR 16#0001;
    ELSIF rt_Read.Error THEN
        o_sts       := o_sts OR 16#0002;
    END_IF;
END_FUNCTION_BLOCK

For multi-antenna triangulation, run a parallel instance per antenna and pass the three (RSSI, x_ant, y_ant) tuples into a lateration FB. The Ident profile and TIA Portal blocks are documented in the SIMATIC RF600 system manual and the SIMATIC Ident function block library (FB Ident profile) manual.

7. Other Vendors and How They Compare

For applications where RF600 falls short (zone resolution finer than the antenna footprint, or real 2-D tracking on a large area), step to UWB (Ultra-Wideband) tags and anchors. UWB IEEE 802.15.4z delivers sub-decimeter two-way ranging (TWR) and is not subject to the multipath collapse of narrowband UHF RFID.

8. Accuracy Reality Check

What the integrator can realistically expect from RSSI-based positioning with an industrial UHF RFID system in a metal-rich environment:

9. Environmental Factors That Will Trip the Commissioning

1. Metal backplane. Reflects UHF and creates standing waves (nulls every lambda/2 ~ 0.17 m). Move tag 50-100 mm off the metal or use a tag with a tuned spacer.
2. Liquid and high-moisture content. Absorbs UHF (water's dielectric loss). RSSI drops 6-10 dB; tag may drop out of inventory.
3. Tag orientation. Dipole tags have a deep null perpendicular to the broadside axis. Polarization diversity (two antennas, 90 deg apart) or a circularly polarized antenna mitigates this.
4. Reader-to-reader interference. Two RF600 readers in close proximity will collide unless you set the air-interface density and the readers use the Siemens "Reader talks first" handshake with time-division or Dense Reader Mode (DRM).
5. Regulatory power cap. ETSI EN 302 208 limits 865-868 MHz to 100 mW ERP in 4 channels, 2 W ERP in 4 channels - and only when Listen Before Talk (LBT) or polite spectrum access is honored. RSSI-based ranging assumes a known P_tx; verify the regulatory profile on the reader.
6. Multipath from moving equipment. A passing forklift changes RSSI for ~2 s. The "position" estimate jitters. Apply a moving average or Kalman filter with a process noise matched to expected speed.

10. Commissioning Procedure - Cell-of-Origin on a 4-Slot Rack

1. Mount one RF ANT 8 dBi directional patch per slot, beamwidth ~70 deg H / 70 deg V, on the back wall of each slot.
2. Connect all four antennas to a single RF685R (internal 4:1 multiplexer).
3. Assign antenna numbers 1-4 to the four slots in the TIA Portal Ident configuration.
4. Place a calibration tag at the center of each slot and read the nominal RSSI baseline (typical -38 to -52 dBm at 1 m). Record.
5. Define a "no-read" RSSI threshold of -75 dBm to reject far-field strays.
6. Define a "present" RSSI threshold of -65 dBm to reject fringe reads from adjacent slots.
7. Validate by placing tags at slot boundaries; confirm only the correct antenna reports the tag above threshold.
8. Export the EPC list and zone map over OPC UA to the SCADA - or use the PROFINET Ident record directly in the PLC program.

11. Limitations Matrix - Decide Before You Spec

12. When to Walk Away from RFID for Position

If the application demands continuous sub-meter position over a large area, RFID (UHF or HF) is the wrong tool. Switch to one of:

• UWB (IEEE 802.15.4z) - < 0.10 m accuracy, 50 m range, multipath-resistant
• BLE 5.1+ AoA / AoD - sub-meter, requires phased-array antenna beacons
• Vision - barcode / DataMatrix on the carrier, 1-D or 2-D pose, exact
• Mechanical indexing - encoder on a lift, fixture sensors at each station - exact and free of RF
• Hybrid - RFID to identify the carrier + a single photoeye or encoder to know its position - the cleanest pattern in many real cells

13. Summary - Decision Path

1. If zone count is high (e.g. 16 cells), RF600 still works - cascade multiple RF685R readers or add external multiplexers.
2. If you must have continuous coordinates, plan for a calibration phase with known tag positions, three or more antennas, and accept 0.5-1.0 m typical accuracy.
3. If you need < 0.3 m continuous position, replace RFID with UWB. The tags cost more, but the physics cooperate.