RFID Tag Memory Architecture: EPC, TID & User Memory

01Overview of the four memory banks

A Gen2 tag chip contains four logical memory banks: Reserved (64 bits, holding Kill/Access Password), EPC (96-496 bits, holding the unique identifier), TID (48-128 bits, holding chip vendor and model info, factory read-only), and User (0-512 bits, user-defined). Each bank is independently addressable with individual read/write permissions. This layered design keeps security credentials, unique ID, chip info and business data isolated — one of the essence of the Gen2 protocol.

• Reserved (64b): Kill Password + Access Password
• EPC (96-496b): unique identifier, rewritable
• TID (48-128b): chip vendor + model, factory read-only
• User (0-512b): user-defined, no standard structure

02EPC encoding: SGTIN-96 in detail

SGTIN-96 is GS1's recommended retail-level EPC encoding scheme; 96 bits suffice to identify 2^38 serials. The structure is: Header (8 bits, 0x30 for SGTIN-96) + Filter (3 bits, packaging type such as each/case/pallet) + Partition (3 bits, allocating bit-width between Company Prefix and Item Reference) + Company Prefix (20-40 bits, GS1-assigned) + Item Reference (4-24 bits, in-house product code) + Serial Number (38 bits, per-item serial).

The Partition field is the elegance of SGTIN-96. It allows Company Prefix to vary between 20-40 bits with Item Reference inversely varying between 24-4 bits, the two summing to a fixed 44 bits. This lets different-length GS1 company prefixes compress into one scheme. For example, a 7-bit prefix (typical large-country firm) sets Partition=5 with Item Reference at 24 bits; a 12-bit prefix (small-country firm) sets Partition=2 with Item Reference at 19 bits. This flexibility makes SGTIN-96 globally usable.

• SGTIN-96: Header 8b + Filter 3b + Partition 3b + CP + IR + SN
• Partition lets Company Prefix vary 20-40 bits, IR compensates inversely
• 96 bits can identify 2^38 serial numbers
• SGTIN-96 is the GS1 retail-level standard

03TID: the chip's ID card

The TID (Tag Identifier) is a read-only identifier burnt in at the factory, holding the vendor ID (e.g. Impinj=0xE2), chip model, mask version and serial. Its core value is anti-counterfeit — an attacker can copy the EPC but not the TID, since the TID is burnt into the chip ROM and not rewritable. In high-value anti-counterfeit scenarios, the backend can identify cloned tags by matching the TID against a whitelist database. Gen2 V2 further extends the TID to 128 bits, adding a chip security-capability bitmap so the reader can query whether a tag supports AES-128, QRS and other advanced features.

• TID is factory read-only: vendor ID + model + mask + serial
• Anti-counterfeit value: EPC can be copied, TID cannot
• Gen2 V2 extends TID to 128 bits with security capability bitmap
• Backend identifies clones via TID whitelist

04User Memory: extended storage and pitfalls

User Memory is the free storage area beyond EPC, ranging from 0 to 512 bits (some high-end chips reach 4K). Common uses include lot number, production date, QC status and serialised logistics encoding. But User Memory has no standard structure — Impinj Monza and NXP UCODE may arrange bytes completely differently, hurting cross-vendor interoperability. GS1 proposed the BM-11 standard for User Memory encoding, but industry adoption is below 30%.

The key principle: EPC is the source of truth, User Memory is cache. Any critical data must live in the backend database; User Memory is only a fallback. Use ASCII + 2-byte CRC for cross-reader verification. A common mistake is to store unrecoverable data (e.g. the unique serial) only in User Memory — once the chip dies, the data is lost forever. Another pitfall is write speed: writing User Memory is 3-5× slower than EPC because it uses slower EEPROM programming cycles, which must be factored into batch-encoding takt time.

• EPC is source of truth, User Memory is cache
• Write recommendation: ASCII + 2-byte CRC
• Write speed 3-5× slower than EPC
• Unrecoverable data must not live only in User Memory