Do not test whether the tag works once. Test where it stops working, whether the change survives a full restart, whether another reader sees the same bytes, and whether neighboring memory stays untouched. Decide the pass mark before testing so a lucky result cannot move the goalposts.
Step zero: prove that special MB10 behavior is actually needed
Write one sentence describing the requirement. If it says “we need our own inventory number,” use EPC. If it says “we need a small mutable field,” evaluate User memory. If it says “the record changes often,” use a database. Proceed with a changeable-TID sample only when the lab or migration task specifically requires a user-controlled value at the TID-addressed location.
Record the authorized use and exclusions. Do not test third-party credentials, access-control identities, toll identifiers or product-authentication values without the owner's written authority. A technically successful write can still be an invalid deployment.
Freeze the equipment before collecting data
“Reader at full power” is not a reproducible setting. Capture the entire RF and software path. If the reader reports conducted power, use that value. If it exposes only an index or percentage, record the index and obtain the vendor's mapping when possible.
| Record | Minimum detail | Failure it helps explain |
|---|---|---|
| Tag | Generation, form factor, lot/sample ID, physical condition | Antenna or lot variation mistaken for command variation |
| Reader | Manufacturer, model, serial, firmware, region | Unsupported operation or different error handling |
| Antenna path | Port, antenna model/gain, cable type/length, connectors | Unaccounted cable loss or radiation-pattern change |
| RF settings | Conducted power, channel/hop mode, session, target strategy | Unrepeatable field strength or population behavior |
| Host stack | Application, SDK, driver and command-log versions | UI caching or vendor-specific address interpretation |
| Geometry | Measured distance, tag angle, polarization, surface, nearby objects | RF null, detuning or polarization loss |
Keep the test inside the legal regional UHF band and reader-power limit. If the production site uses a different region or antenna path, its results are a separate qualification.
Build an untouched baseline
- 01
Give the physical item a sample ID
Mark the fixture or bag, not the RF element. Photograph both sides and the test orientation.
- 02
Read all accessible banks
Save Reserved, EPC, TID and User data with bank selector, word pointer, word count, raw hex, response and timestamp. Do not rely on a formatted display alone.
- 03
Repeat at close range
Run a short repeated-read set at a fixed, high-margin position. Any changing MB10 bytes before a write invalidate the baseline.
- 04
Read with an independent path
Use a second reader or at least a separate application/SDK when available. Compare raw words, not labels.
Map the writable region one word at a time
Start on an expendable sample. Change a single 16-bit word using a pattern that is visibly different from the original yet easy to restore. Log the original, requested and returned values. Repeat at the lower boundary, an interior address, the upper boundary and one address immediately outside the claim.
Minimum write evidence
sample_id · tag_format · reader_firmware · command · bank · word_pointer · word_count · original_hex · requested_hex · response_code · immediate_readback · RF_power · distance · timestampThe outside-boundary attempt matters. GS1 conformance testing uses the same general principle: attempt a disallowed operation and confirm that the protected target and unrelated memory remain unchanged. For a special tag, an out-of-range write should fail cleanly. A successful response with adjacent corruption is an immediate stop condition.
Distinguish immediate echo from nonvolatile persistence
After immediate readback succeeds, remove RF power completely. Do not merely stop inventory; physically disable the RF output or move the tag outside the field. Close the host application, wait, reopen it and read the raw words again. Then repeat with the independent reader path.
Confirms that the current session returns the requested value. It may still be a volatile or cached state.
Confirms survival after the tag loses harvested power and the host loses session state.
Checks whether the value remains after hours or the period relevant to the workflow.
Reduces the chance that one application's cache or formatting produced the result.
Exercise data patterns, not only one friendly value
A robust test writes patterns that stress both bit directions: 0000h, FFFFh, AAAAh, 5555h, then randomized words. Restore the original only after every pattern has passed cold readback. Record whether a write changes bits from 0→1 and 1→0 equally reliably.
Repeat enough cycles to expose gross instability, but do not invent an endurance rating. Without an authoritative data sheet, a hundred successful cycles does not prove a 100,000-cycle life. Report only the cycle count actually completed, the failure count and the test conditions.
Test protection states on sacrificial units
Use separate, clearly labeled samples for password, temporary-lock, permanent-lock and Kill experiments. Before issuing any irreversible command, save the full baseline and the exact payload. After each transition, test Read and Write separately and repeat after a cold restart.
A generic reader UI may calculate a standard LOCK payload while the special IC implements only part of the expected behavior. Observed success on one word must not be generalized to the entire bank.
Measure RF margin with a power sweep
Maximum distance is a poor acceptance metric because it is dominated by one favorable moment. At a fixed geometry, step reader power upward from failure to reliable inventory, then to reliable read, then to reliable write. Repeat the sweep in both directions to reveal borderline behavior.
| Test axis | Suggested method | Report separately |
|---|---|---|
| Power | 1 dB steps near the transition where the reader permits | Inventory, read and write success thresholds |
| Distance | Fixed increments, then smaller steps around failure | Reliable distance at the production power |
| Orientation | 0°, 45°, 90° and the intended installation angle | Minimum result, not only the best orientation |
| Surface | Free air, intended substrate, nearby metal/liquid if relevant | Change from the reference fixture |
| Population | Single tag, then the intended tag density | Collision/selection behavior and write yield |
| Sample | Every item in the pilot | Median, minimum, failures and outliers |
The supplier's 0.1–10 m statement should be treated as a broad observed envelope, not a procurement specification. Write the quotation around a repeatable minimum in the buyer's geometry.
Define a pass/fail rule that purchasing can use
Memory integrity
Every required word accepts the allowed patterns, persists after cold restart and leaves neighboring banks/words unchanged.
Reader compatibility
The exact production firmware and command path complete the operation without hidden manual recovery.
RF margin
The worst accepted sample meets the required write performance on the real mounting surface with defined margin.
Protection behavior
Password and lock states match the written acceptance rule, or the deployment explicitly does not depend on them.
Lot identity
The quotation identifies generation, format, sample/lot reference, supplied claims and exclusions.
Use boundary
The workflow is authorized and does not treat a user-controlled MB10 value as factory-authentic identity.
When the validation result should be “do not deploy”
Read works but write margin is narrow
A moving gate, conveyor or low-power reader will magnify the difference. Use a standard high-sensitivity tag or redesign the RF path.
Data changes without clean command evidence
If caching, proprietary mode or hidden software steps cannot be excluded, the process is not supportable.
Adjacent data or lock state changes unexpectedly
Memory integrity is a hard failure, not a tuning issue.
Samples disagree about the writable boundary
Do not scale until the lot, silicon and programming specification are controlled.
The system needs an immutable trust anchor
A successful writable-TID test proves precisely the wrong property for that requirement.
The production reader cannot expose raw responses
Without usable diagnostics, field failures will be hard to distinguish from RF or software faults.
A good test report lets another engineer reproduce the same bytes with the same hardware—and tells purchasing exactly what failure would reject a shipment. If the evidence is only “the demo software said success,” the product has not been validated.
Choose the right memory first: EPC vs TID vs User memory: which bank should hold your data? ↗
Primary references and related reading
- GS1: Gen2v3 conformance requirements ↗ — locked-memory, overrun and TID write-attempt test logic.
- GS1: RAIN RFID memory-bank structure ↗ — standard bank roles and TID lock rule.
- NXP: UCODE X official specifications ↗ — an example showing that read and write sensitivity are separate IC parameters.
- Foundation 1: why standard TID cannot be rewritten ↗
- Foundation 2: how special changeable-TID behavior can work ↗