RFID Memory Banks
EPC · USER · TID · Reserved - the four memory banks every Gen2 tag has
What are memory banks?
An EPC Gen2 tag is not a single blob of writable memory - it's split into four separate memory banks, each with its own purpose and access rules. When you issue a Gen2 Read, Write, or Lock command, you have to tell the tag which bank you mean: that's the bank selector, a 2-bit field with values 0–3.
The four banks were defined by the GS1 EPC Gen2 air-interface protocol (now also ISO/IEC 18000-63) and are present on every passive UHF tag - from a 96-bit inventory inlay through to a sensor tag with kilobytes of user memory. What differs between tags is the size of each bank, not its existence.
The four banks
| Bank | Selector | Contents | Writable? |
|---|---|---|---|
RESERVED | 0 | Kill password (32 bits) + access password (32 bits) | Yes (typically write-once) |
EPC | 1 | CRC-16 + PC (protocol-control) word + EPC identifier (usually 96 bits, up to 496) | Yes - the bank you write when encoding tags |
TID | 2 | Tag-Identifier: chip vendor, model, and a per-chip serial number burned at the silicon foundry | No - read-only, written at manufacture |
USER | 3 | Application data - anything you want, if the chip has user memory at all | Yes (size varies: 0 bits on Monza R6, 128 bits on Impinj M730, up to 64 kbit on sensor tags) |
EPC bank - the one you encode
When people say "encode a tag," they usually mean writing the EPC bank. It holds the identifier the reader returns during inventory rounds - typically a SGTIN-96 or SSCC for retail/logistics use.
The first 16 bits are a CRC over the rest, written automatically by the chip; the next 16 bits are the Protocol Control (PC) word which advertises the EPC length to the reader. Then comes the EPC itself, starting at word offset 2 (byte offset 4). When you address writes you target the EPC after the CRC and PC, so most printer commands use offset 2 (words) or 32 (bits) as their starting point.
TID bank - why it's locked from the factory
The TID identifies the tag, not what's on it. It tells you exactly which chip you're talking to - vendor (Impinj, NXP, Alien…), model (Monza R6, Ucode 9, Higgs-9…), and on most modern chips a globally unique 38- or 64-bit chip serial number burned into silicon during fabrication.
Because TID is read-only and per-chip-unique, it's the closest thing UHF RFID has to a hardware fingerprint. Brand-protection systems use it alongside the EPC to detect cloned tags: the EPC might match, but a cloned tag will have a different TID.
USER bank - application-defined data
USER memory is whatever you want it to be - extra item attributes, expiry dates, batch numbers, calibration coefficients, sensor history. The catch is that it only exists if the chip has it. Many inventory-class chips (Impinj Monza R6, NXP Ucode 7) ship with zero user memory to keep the die size (and cost) down. If your application needs user memory, you have to spec a chip that has it.
RESERVED bank - passwords
The RESERVED bank holds two 32-bit passwords:
- Kill password (words 0–1) - present this and the tag self-destructs (never responds to inventory again). Useful for point-of-sale privacy.
- Access password (words 2–3) - required to perform privileged Gen2 operations on locked memory banks.
Both default to zero from the factory. Encoding workflows that care about security write a non-zero access password to the RESERVED bank, then use that password (via Gen2 Access or Permalock commands) to lock the EPC and USER banks against further writes.
Talking to memory banks from a printer
Most RFID-capable label printers expose the bank selector directly in their command language. In TSPL (TSC Printronix printers) you specify the bank as a quoted string:
RFID WRITE "EPC", 0, "E2801160600002054E5F8B41"
RFID READ "TID", 0, 12
RFID LOCK "USER", "12345678", 0 ZPL (Zebra) uses a numeric bank field on ^RF: 0 = EPC, 1 = TID (read-only), 2 = USER, 3 = RESERVED. SBPL (SATO) uses keyword arguments on ESC+IP1.
Whatever the syntax, the underlying protocol is the same - the printer translates your command into a Gen2 air-interface transaction with the bank selector baked in.