EPC Encoding & Tag Memory

Why encoding matters

A passive UHF tag is, at heart, a small memory chip connected to an antenna. Whatever you write into that memory is all the reader will ever get back. Encode it well and every reader, printer and software layer in your supply chain understands it. Encode it badly - duplicate serials, home-made formats, wrong filter values, unlocked memory - and you inherit data problems that are expensive to fix once lakhs of tagged items are in circulation.

This chapter focuses on EPC Gen2 (ISO/IEC 18000-63) tags, the standard for UHF described in RFID Standards & Regulations. HF and NFC tags organise memory differently (blocks and sectors, or NDEF files), but many of the same principles apply.

The four Gen2 memory banks

Every Gen2 chip divides its memory into four logically separate banks, numbered 0 to 3. Readers address them by bank number and word offset, where one word is 16 bits.

Bank 00 - Reserved

Holds two 32-bit passwords. The kill password must be non-zero for the kill command to work. The access password moves a tag from the "open" state to the "secured" state, which is needed to change locked memory. A value of all zeros means "no access password", and the tag enters the secured state without one. Passwords can be read-locked so that no reader can retrieve them.

Bank 01 - EPC

The first word (offset 00h) is a CRC-16 that the tag computes itself; you never write it. The second word (offset 10h, counted in bits) is the Protocol Control (PC) word. Its top five bits give the EPC length in 16-bit words, and the remaining bits carry flags such as user-memory present (UMI), an XPC indicator and a toggle that says whether the following data is a GS1 EPC or an ISO identifier. For a 96-bit EPC (6 words) with no flags set, the PC word is 3000 in hex. The EPC itself starts at bit offset 20h.

Bank 10 - TID

The TID begins with a class identifier (E2 for chips registered under the GS1 EPCglobal scheme), followed by a manufacturer designer ID and a tag model number. Most modern UHF chips also carry a factory-programmed unique serial number in an extended TID. The TID is normally permalocked, so it cannot be changed.

Bank 11 - User

Optional memory for extra data such as maintenance dates, batch details or a small record. It is slower to read than the EPC (it needs a separate Read command after inventory), so keep it for data you truly need on the tag. Chip choices are discussed in Which RFID Chip for Which Application.

SGTIN-96 structure

The GS1 EPC Tag Data Standard defines the SGTIN (Serialised Global Trade Item Number). A normal barcode GTIN identifies a product type - every bottle of the same shampoo shares one GTIN. Adding a serial number makes every single bottle unique. SGTIN-96 packs that into exactly 96 bits:

The partition table

A GTIN contains 13 digits of company prefix plus item reference (the check digit is dropped). Company prefixes vary in length from 6 to 12 digits, so the partition value records the split:

Worked example: GTIN + serial to SGTIN-96 hex

Let us encode one item from start to finish. The numbers are illustrative: assume a company whose GS1 Company Prefix is 8901234 (7 digits; 890 is the GS1 India prefix range). Its product has the GTIN-13 8901234567890, and we want to tag the unit with serial number 12345 for retail sale.

Step 1 - Check the GTIN and make it 14 digits

Verify the check digit. Take the first 12 digits, 8 9 0 1 2 3 4 5 6 7 8 9, and multiply alternately by 1 and 3 from the left: 8 + 27 + 0 + 3 + 2 + 9 + 4 + 15 + 6 + 21 + 8 + 27 = 130. The check digit is the amount needed to reach the next multiple of 10: 130 is already a multiple, so the check digit is 0. Correct. As a GTIN-14 with indicator digit 0 it is 08901234567890.

Step 2 - Split the GTIN-14 into fields

• Indicator digit: 0
• Company prefix: 8901234 (7 digits)
• Remaining item digits: 56789
• Check digit: 0 - dropped, because it can be recalculated

The SGTIN item reference is the indicator digit followed by the item digits: 056789, 6 digits. A 7-digit company prefix means partition 5 (24 bits for the prefix, 20 bits for the item reference). The integer value of the item reference is 56789; its leading zero is restored on decoding because partition 5 says it has 6 digits.

Step 3 - Convert each field to binary

Check the total: 8 + 3 + 3 + 24 + 20 + 38 = 96 bits. Each value is padded with leading zeros to its exact field width.

Step 4 - Join the bits and convert to hex

Concatenate all fields in order, then read the 96-bit string four bits at a time:

0011 0000 0011 0110 0001 1111 0100 1001 1100 1000 0011 0111 0111 0101 0100 0000 0000 0000 0000 0000 0011 0000 0011 1001

Each group of four becomes one hex character: 3 0 3 6 1 F 4 9 C 8 3 7 7 5 4 0 0 0 0 0 3 0 3 9. The EPC to write to the tag is:

30361F49C837754000003039

Notice that the fields do not line up with hex characters - the filter and partition fields straddle nibble boundaries. That is why you cannot "read" an SGTIN by eye from the hex, except for the leading 30 header.

Step 5 - Software representations

• Pure identity URI (used in business software and EPCIS): urn:epc:id:sgtin:8901234.056789.12345
• Tag URI (also records the filter and scheme): urn:epc:tag:sgtin-96:1.8901234.056789.12345

Other EPC schemes: SSCC, GRAI, GIAI and more

The same header-filter-partition pattern is used for other GS1 keys. The most common 96-bit schemes are:

Where a numeric 38-bit serial is not enough, for example when serials contain letters, the SGTIN-198 scheme (header 36) supports alphanumeric serials of up to 20 characters, at the cost of a longer EPC bank. Newer editions of the Tag Data Standard also add further schemes and a more flexible "Digital Link" based encoding; check what your trading partners expect before choosing.

Lock, permalock and kill

Lock states

The Gen2 Lock command sets protection independently for each password and for the EPC, TID and User banks. Each can be:

• Unlocked - writable in the open or secured state.
• Locked - writable only in the secured state, that is after the reader presents the correct access password. For the passwords, lock also blocks reading.
• Permalocked - permanently locked; can never be changed again.
• Permaunlocked - permanently writable; can never be locked.

Lock protects against writing, not against reading: the EPC and TID banks remain readable by any Gen2 reader. Hiding data from readers needs Gen2v2 Untraceable or other chip-specific privacy features.

Kill

The kill command permanently disables a tag. It only works if the kill password is non-zero and the reader supplies it correctly. Kill is used, for example, where retailers want to guarantee that a tag on a sold item can never be read again. Because it is irreversible, protect the kill password carefully and never leave it at zero if you might need it, nor at a guessable value if you do not want third parties to kill your tags.

TID-based anti-cloning

Copying an EPC is trivial: anyone with a writable blank tag can encode the same 24 hex characters. The TID, however, is written by the chip manufacturer and permalocked, and on serialised chips it is unique. That gives a simple control:

1. At encoding time, read the TID and store the EPC-TID pair in your database.
2. Whenever a tag is read in a sensitive process (returns, authentication, high-value check-in), read both EPC and TID.
3. If the EPC exists but the TID does not match, flag a likely clone or relabelled item.

This defeats casual cloning with ordinary blank tags. It does not stop a determined attacker using specialist equipment that can emulate a tag's TID. For genuinely high-value or safety-critical items, use chips with cryptographic authentication (Gen2v2 Authenticate, or HF/NFC chips with AES), discussed in RFID Security & Privacy.

Encoding best practices

• Use GS1 identifiers with your own company prefix for anything that leaves your premises. Home-made numbers risk collisions with other companies' tags in shared environments.
• Guarantee unique serials. Allocate serials centrally, never from two printers that might overlap. Duplicate EPCs break inventory counts.
• Set the filter value correctly so readers can select only items, only cases or only pallets.
• Encode, then verify. Read back every tag after writing and reject or void failures. Good RFID printers do this automatically and overstrike bad labels.
• Capture the TID with every encoded EPC.
• Lock the EPC with a non-default access password where tampering is a risk; permalock only when the data must never change.
• Keep personal data off the tag. Store a reference number on the tag and keep names or health data in a secured database.
• Print the human-readable and barcode form of the same identifier on the label as a fallback.

The practical side of high-volume encoding - printer calibration, inlay position and void handling - is covered in RFID Printing & Encoding, and suitable labels are on our UHF RFID labels page.