How to Write UHF RFID Tags: EPC, TID, User Memory, Passwords and Lock

Writing a UHF RFID tag, often called encoding, means changing data in the chip’s memory with a reader/writer. In most projects that is one number: the EPC your software uses to identify an item, a card or a vehicle. Some projects also write user memory, set passwords and lock the tag so the number cannot be changed later.

Every passive tag built to EPC Gen2 (ISO/IEC 18000-63, formerly ISO 18000-6C) uses the same memory layout, so the rules below apply whatever chip or reader you use. This guide covers the four memory banks, what to write where, how passwords and lock work, and a routine for batch encoding without writing the wrong tag.

The four memory banks of a Gen2 tag

A Gen2 chip splits its memory into four banks. Memory is addressed in 16-bit words, and the basic Write command changes one word at a time. The full definitions are in the GS1 EPC UHF Gen2 air interface standard.

The PC word matters when you write the EPC. Its first five bits give the EPC length in 16-bit words, from 0 to 31, so an EPC can be up to 496 bits long. If you write a 128-bit number while the PC still says 96 bits, readers report only the first 96. Good encoding software updates the PC for you; check it whenever an EPC reads back cut short or with extra characters at the end.

During an inventory, a tag sends only its PC, EPC and CRC. The TID and user memory need separate commands after the reader has singled out one tag, so reading them from hundreds of tags takes far longer than reading EPCs. The multi-tag read rate guide explains why.

EPC or TID: which number identifies the tag?

Both numbers are on every tag, and they do different jobs.

Blank tags leave the supplier with a default EPC that may repeat across a roll, so never treat an unencoded EPC as an ID. The usual pattern is to write a meaningful EPC and store the TID next to it at encoding time. If the same EPC later turns up with a different TID, your software knows it has found a duplicate or a replaced tag. If you plan to identify tags by TID alone, check that your reader’s output mode can deliver it; many keyboard-output readers send only one bank.

What to write into the EPC

Decide the numbering scheme before you encode the first tag. Changing it later means rewriting every tag in service.

The GS1 schemes are defined in the GS1 EPC Tag Data Standard. Use one when tags leave your organization or trading partners must decode them. In a closed system a plain internal number works, provided you follow a few rules:

• Use one fixed length. A 96-bit EPC is 24 hex characters; a 128-bit EPC is 32. Mixed lengths break lookups and filters.
• Generate numbers from your database, not by hand, and check that each number is unused before it is written.
• Give each site or product family a common prefix. Readers can then filter on those first bytes, which also speeds up counts.
• Do not start internal numbers with a GS1 header such as 30 unless the number really is an SGTIN. Other software may try to decode it.
• Plan for short outputs. Wiegand 26 carries 24 bits and Wiegand 34 carries 32 bits, and some keyboard-output readers type a shortened number, so only part of a 96-bit EPC may reach the controller or host. Put the unique digits in the bytes the reader sends. See Wiegand 26 vs 34 and check sample numbers with the card number converter.

When user memory is worth using

User memory holds data that must travel with the item and be readable without a network: the last service date of a tool, a batch code, a short record for field checks. It has costs:

• Not every chip has it, and sizes range from none to several kilobits. Check the chip datasheet first.
• Each tag must be singled out before user memory can be read or written, which slows bulk counts.
• Writing needs more energy than reading, so the working distance is shorter.
• Data on the tag can drift out of step with your database.

If your database is reachable wherever tags are read, keep the data there and use the EPC as the key. Write user memory only for data that must be available offline.

Passwords, lock and kill

The Reserved bank holds two 32-bit passwords. The access password moves a tag into the “secured” state, which is needed to change password-locked memory. The kill password authorizes a command that silences the tag permanently.

Lock sets how each bank can be written:

The passwords have the same four settings, but for them the lock controls reading as well as writing. Five rules prevent most mistakes:

1. Lock stops changes, not reads. A locked EPC can still be read by any Gen2 reader.
2. Set a nonzero access password before locking. A tag whose access password is the default 00000000 enters the secured state without a password, so password-locking it protects nothing.
3. Treat permalock as final. No command reverses it. Try your lock routine on spare tags first.
4. Kill is permanent. A killed tag never answers again, and a tag with a zero kill password cannot be killed. Closed systems that never use kill often lock the kill password so nobody can set one later.
5. Keep passwords in your back-end system, not in a file on the encoding PC. If every tag shares one password, anyone who learns it can rewrite them all; some systems derive a per-tag password from the TID and a secret key.

Gen2 version 2 adds optional features such as cryptographic authentication. Our reader specifications list ISO 18000-6C / EPC Gen2 and do not include them.

Step by step: encoding tags at a desk

1. Lower the RF power to the lowest level that still writes reliably, so only the tag on the pad is in the field.
2. Check that exactly one tag is present. Run an inventory first. If more than one EPC appears, move the other tags away. Never write while the count is above one.
3. Read the TID and the current EPC of that tag.
4. Write the new EPC, updating the PC length bits if the size changes.
5. Read it back and compare. Retry once; if it still fails, set the tag aside.
6. Write user memory, if you use it, and verify it the same way.
7. Write the passwords, then lock. The order matters: once a bank is locked, changing it needs the password.
8. Log the result: EPC, TID, time, operator and lock state.
9. Test a sample on the production reader, such as the gate reader or handheld, before you issue the batch.

Encoding is much slower than reading. The basic Write command changes one 16-bit word, so a 96-bit EPC takes six writes, and the standard allows a tag up to 20 ms to finish each one. Read-back and handling add more time on top.

Common encoding errors

Which readers can write UHF tags

Encoding needs two things: a reader that can write, and software that sends the write commands. Keyboard output cannot carry those commands, because keyboard emulation sends data one way, from reader to computer.

A desktop reader/writer is the natural encoding station. The four models share the same published RF specifications, a 2 dBi antenna and RF output adjustable from 12.5 to 26 dBm, so choose by the desk: the compact U140-U for a back-office encoding station, the flat U120-U USB UHF desktop reader/writer for an enrollment desk, or the square U160-U for the largest pad. Turning the output down pulls the field in toward the pad, which helps you write one tag at a time. Integrated readers such as the U610-M 7 dBi integrated UHF reader write through the SDK when your application already controls the reader, but their 7–12 dBi antennas read at several meters (0–5 m on the U610-M, 0–20 m on the U650-M 12 dBi long-range reader), so keep other tags well clear.

Our range has no RFID label printer-encoders, which print and encode large label runs in one pass; the desktop units suit cards, hard tags, lower-volume issuing and verification. None of our 125 kHz or 13.56 MHz readers write cards. Order the band for the country of use (see UHF frequency bands by country) and compare every model on the UHF RFID readers page.

Encoding station checklist

• Chip: EPC size, user memory size and serialized TID confirmed from the datasheet.
• Numbering: GS1 or internal scheme, one fixed EPC length, numbers from the database.
• Reader: band matches the country of use; write-capable build and software in place.
• Field: RF power at the lowest reliable level; other tags kept away.
• Process: one-tag check before every write, read-back after every write.
• Security: lock policy tested on spare tags; permalock only after sign-off.
• Records: EPC–TID pairs, time and operator logged.
• Acceptance: sample tags read on the production reader before issue.

To try the routine on your own tags, request an evaluation unit on the samples page.