TID/EPC Memory & PC Word Calculator: Gen2 Tag Bank Layout Engine

EPC Gen2 Memory Bank Architecture

Every compliant RAIN UHF RFID tag conforms to the 4-bank memory mapping defined in ISO/IEC 18000-63 and the GS1 Tag Data Standard (TDS 2.0). Understanding the word addressing and bit structure of each bank is essential for designing high-performance asset tracking systems and preventing tag commissioning errors.

EPC Gen 2 memory banks architecture diagram showing Reserved, EPC, TID, and User memory allocation — Figure 1: 3D Exploded View of EPC Gen2 4-Bank Memory Allocation (Bank 00 Reserved, Bank 01 EPC, Bank 10 TID, Bank 11 User).

1. Detailed Breakdown of the 4 Memory Banks

Bank 00 (Reserved Memory) 64 Bits (4 Words)

Contains two 32-bit PIN passwords. Word 00–01: 32-bit Kill Password (permanently deactivates tag silicon if executed). Word 02–03: 32-bit Access Password (required to transition tag into the Secured state for memory locking or sensitive User bank writes).

Bank 01 (EPC Memory) Word 00 = CRC16 | Word 01 = PC | Word 02+ = EPC

The primary identification bank broadcast during inventory rounds. Word 00 (16 bits): Stored CRC-16 calculated over the PC word and EPC payload. Word 01 (16 bits): Protocol Control (PC) word encoding EPC length and formatting flags. Word 02+ (64 to 496 bits): Serialized Global Trade Item Number (SGTIN-96, SSCC-96, GIAI-96) or custom hex identifier.

Bank 10 (TID Memory - Transponder ID) Factory Burned • Read-Only

Permanent silicon wafer identification. Bits 00–07: 8-bit Class ID (0xE2 for standard Gen2). Bits 08–19: 12-bit Mask Designer ID (MDID) identifying the chip manufacturer (e.g., 0x801 for Impinj, 0x806 for NXP, 0x003 for Alien). Bits 20–31: 12-bit Model Code. Bits 32+: Globally unique factory serialization number.

Bank 11 (User Memory) 0 to 688+ Bits • Optional Extended Payload

Application-specific read/write memory. Utilized in aerospace maintenance (ATA Spec 2000), cold chain temperature logging calibration bytes, pharmaceutical batch expiration dates, or encrypted public keys.

2. Protocol Control (PC) Word Bit Structure (Word 01 of Bank 01)

The 16-bit PC Word informs reader firmware how many words of EPC data follow and how to interpret the bitstream:

Bits 0–4 (5 bits)	Bit 5 (1 bit)	Bit 6 (1 bit)	Bit 7 (1 bit)	Bits 8–15 (8 bits)
EPC Length (L)	UMI Flag	ISO/GS1 Toggle	XPC Indicator	Reserved (00000000)
Number of 16-bit EPC words (00110b = 6 words = 96 bits, 01000b = 8 words = 128 bits)	0 = User memory empty; 1 = User memory contains data	0 = GS1 EPC Tag Data Standard; 1 = ISO/IEC 15962 data format	0 = Standard 16-bit PC word; 1 = Extended Protocol Control (XPC) present	Must be set to zero for all standard Gen2 transponders

3. Silicon Vendor Mask Identification & Memory Matrix

When decoding the initial 32 bits of Bank 10 (TID), the Mask Designer ID (MDID) and chip model identify the exact silicon family:

Silicon IC Family	Manufacturer	Header Prefix	EPC Bits	User Mem	Read Sensitivity
Impinj M730	Impinj (0x801)	E280 1160	128 bits	0 bits	-24.0 dBm
Impinj M750	Impinj (0x801)	E280 1170	96 bits	32 bits	-24.0 dBm
Impinj Monza R6-P	Impinj (0x801)	E280 1105	128/96 bits	32/64 bits	-22.1 dBm
NXP UCODE 9	NXP (0x806)	E280 6894	96 bits	0 bits	-24.0 dBm
NXP UCODE DNA	NXP (0x806)	E280 6910	224 bits	3072 bits	-19.0 dBm (AES-128)
Alien Higgs-9	Alien (0x003)	E200 3412	496 bits	688 bits	-22.5 dBm

4. Gen2 20-Bit Lock Payload & State Machine

The ISO/IEC 18000-63 Lock command uses a 10-bit Mask field (which memory targets to update) and a 10-bit Action field (what lock status to apply):

The 5 Lock Target Zones (2 Bits Per Target):

1. Kill Password: Mask Bit 9, Action Bit 9 (Write-Lock) / Mask Bit 8, Action Bit 8 (Permalock)

2. Access Password: Mask Bit 7, Action Bit 7 (Write-Lock) / Mask Bit 6, Action Bit 6 (Permalock)

3. EPC Memory: Mask Bit 5, Action Bit 5 (Write-Lock) / Mask Bit 4, Action Bit 4 (Permalock)

4. TID Memory: Mask Bit 3, Action Bit 3 (Write-Lock) / Mask Bit 2, Action Bit 2 (Permalock)

5. User Memory: Mask Bit 1, Action Bit 1 (Write-Lock) / Mask Bit 0, Action Bit 0 (Permalock)

Lock Action Bit Pairs: 00b = Accessible (Open) | 01b = Secured Write-Lock | 10b = Perma-Open | 11b = Permalocked (Irreversible)

Need High-Speed Tag Encoding Middleware?

Our C# .NET 8 RFID Middleware automates serialization, PC word injection, and permalocking across industrial Zebra and Sato RFID print engines at over 300 tags per minute.

Request Encoding Demo Launch EPC Encoder Tool

Frequently Asked Questions

What are the four logical memory banks in EPC Gen2 (ISO/IEC 18000-63)?

EPC Gen2 tags have four standardized logical memory banks: Bank 00 (Reserved for 32-bit Kill and 32-bit Access passwords), Bank 01 (EPC containing 16-bit StoredCRC, 16-bit Protocol Control (PC) Word, and EPC data payload), Bank 10 (TID containing the unalterable 32-bit silicon factory mask identifier and 64-to-160-bit chip serial number), and Bank 11 (User Memory for custom application payloads, calibration tables, or encrypted keys).

How is the Protocol Control (PC) word calculated and why is it critical?

The PC word resides at Word 01 (bits 16–31) of Bank 01. Bits 0–4 define the EPC data length in 16-bit words (e.g., 6 words = 00110b for 96 bits, 8 words = 01000b for 128 bits). Bit 5 is the User Memory Indicator (UMI), asserting whether user memory contains data. Bit 6 is the ISO/GS1 toggle bit (0 for GS1 EPC TDS, 1 for ISO 15962). Bits 7–15 are reserved as zeros. If the PC word length does not match the actual written EPC length, readers will truncate reads or reject the tag backscatter.

Can the Factory Silicon TID (Bank 10) be forged, altered, or rewritten?

No. The factory silicon TID (Bank 10) is permanently etched into the microchip silicon mask during wafer fabrication. The manufacturer identifier (MDID) and chip model code are unalterable hardware fuses that cannot be modified via any RF write command. This makes the TID the gold standard for asset anti-cloning and anti-counterfeiting verification.

How does the Gen2 20-bit Lock command and state machine operate?

The Gen2 Lock command uses a 10-bit Mask field (specifying which of the 5 memory targets—Kill Password, Access Password, EPC Memory, TID Memory, or User Memory—are being targeted) and a 10-bit Action field. Each target has two control bits: write-protection mode and permalock mode. A value of 00b is Open/Unlocked, 01b is Write-Locked (requires Access Password), 10b is Perma-Open (cannot be locked), and 11b is Permalocked (permanently read-only or write-disabled forever).

What happens if a tag is locked without setting a non-zero Access Password?

If an Access Password remains 0x00000000, the tag is in the Open state. If a lock command requiring an access password is sent to a tag with an all-zero password, the tag cannot transition into the Secured state and will return an error code or lock out future writes unexpectedly. Always program a non-zero 32-bit Access Password before executing lock commands.

What are the memory allocations of Impinj M700, NXP UCODE 9, and Alien Higgs-9?

Impinj M730 features 128-bit EPC and 0 User memory; Impinj M750 features 96-bit EPC and 32-bit User memory. NXP UCODE 9 provides 96-bit EPC, 0 User memory, and high -24 dBm sensitivity. Alien Higgs-9 provides up to 496-bit EPC and 688-bit User memory for data-heavy military and aerospace tracking.

What is the BlockWrite command and how does it speed up high-volume tag commissioning?

Standard Gen2 Write commands write one 16-bit word at a time, requiring ~15–20 ms per word. The BlockWrite command allows encoding up to 8 words (128 bits) in a single command, reducing encoding cycle time by over 60% on industrial RFID printer-encoders (such as Zebra ZD621R and SATO CL4NX).

How does the Untraceable command in Gen2v2 protect consumer privacy?

The Gen2v2 Untraceable command allows readers with the correct privilege password to temporarily or permanently hide the TID bank, truncate the EPC bank to a basic header, and reduce RF backscatter sensitivity so the tag can only be detected at near-field distances (<0.5 m).

TID/EPC Memory & PC Word Calculator