The reader is like a courier delivering a message to “drawer 10.” A standard chip has a locked metal drawer there. A special chip can put rewritable storage behind the same drawer number. The courier route may look familiar, but the drawer—and the meaning of the data inside it—is different.
Separate the radio conversation from the memory promise
A reader application usually hides several layers behind one button. At the radio layer, the reader inventories a tag, selects it, sends a command and receives a backscatter reply. At the memory layer, the IC decides which physical circuit responds to a bank and address, whether the location exists, and whether the current state permits the operation.
| Layer | Question | What a successful observation proves | What it does not prove |
|---|---|---|---|
| Air interface | Can reader and tag exchange a Gen2-style command and response? | Basic command-path interoperability under the test conditions | Conformance of every command, state or timing rule |
| Addressing | Does a read from MB10 return bytes? | The implementation exposes data at that logical location | That the bytes are a standard, factory-unique TID |
| Write behavior | Do requested bytes change and persist? | Observed nonvolatile programmability of those tested words | Untested boundaries, endurance, retention or lock semantics |
| Identity semantics | Who assigned the value and can it be changed? | Whether it is user-controlled or manufacturer-controlled | Authenticity or global uniqueness |
This distinction explains the apparent paradox. A special tag may accept a familiar write workflow at MB10 while departing from the standard manufacturing-permalock rule. It can be interoperable enough for a controlled toolchain without being equivalent to an ordinary serialized TID tag.
What the reader probably sends
At a useful level of abstraction, a host identifies a tag population, selects the target, specifies memory bank 10b, provides a word pointer and payload, and requests a Write or BlockWrite operation supported by the reader stack. The special IC then returns a response or fails to respond within the expected exchange.
The difficult part is not naming the bank. It is establishing the target chip's actual rules: whether one or several words are accepted, whether an access password is required, whether writing crosses a protected boundary, whether data is committed before RF power falls, and whether a lock command affects the same region.
A screen can show the payload the software intended to send, a cached value, or a generic “success” state. A command log plus independent readback after a full RF power loss is much harder to misinterpret.
Three plausible architectures—and why we cannot choose one from the outside
Without a designer data sheet or a verified programming specification, the internal mechanism is unknown. The following models are useful for planning tests, not for claiming how this particular compatible chip was fabricated.
Rewritable array mapped to MB10. Nonvolatile memory, such as EEPROM-like storage, may be directly exposed at the logical TID addresses. A normal-looking read then returns the programmed bits.
Indirection or response substitution. Control logic may preserve one internal identifier while returning a configurable buffer when MB10 is read. Different command paths could then reveal different values.
Protected engineering mode. A proprietary sequence may temporarily enable writes that ordinary mode rejects. State loss, password handling and reader compatibility would become central test questions.
External tests can narrow the possibilities. They cannot prove transistor-level architecture. For example, different values returned after two access paths suggest indirection, while a strict word-by-word write boundary suggests a mapped array—but neither observation is conclusive without internal documentation.
Use behavioral fingerprints instead of an invented chip story
- 01
Map the writable boundary
Change one 16-bit word at a time. Test the first claimed word, an interior word, the last claimed word, and one word outside the claim. Record both response code and adjacent readback.
- 02
Break host-state continuity
Turn off RF, close the application, move the tag, restart on a second reader and read again. This separates tag persistence from software caching.
- 03
Compare command paths
Where equipment permits, compare Read versus another supported read path and Write versus BlockWrite. Differences may expose reader- or implementation-specific behavior.
- 04
Probe protection states on sacrificial units
Test password and lock transitions only on samples you can lose. A permanent lock cannot be treated as reversible merely because the UI offers an Unlock button.
- 05
Repeat at the RF threshold
Lower power until reads remain reliable but writes begin to fail. Partial updates, false success indications or adjacent corruption are rejection signals.
Why programming range is usually the first practical limitation
A passive UHF tag rectifies incident RF energy to run its logic. A memory write requires the IC to maintain enough supply margin for a nonvolatile programming interval. Read sensitivity and write sensitivity are therefore separate specifications on well-documented production chips.
For a scale reference, NXP publishes −26.2 dBm read sensitivity and −23 dBm write sensitivity for UCODE X. The 3.2 dB gap means the cited chip needs about 2.09 times as much received power at the write threshold as at the read threshold. That example is not a specification for this special tag; it simply shows why “I can see the EPC” does not mean “I can program memory here.”
The special products sold on this site are reported to need a high-power reader and to operate at shorter range than ordinary non-changeable-TID inlays. Antenna geometry, polarization, cable loss, mounting material, regional reader settings and the IC itself all affect the result. The supplier's 0.1–10 m range is a broad observation, not a guaranteed write distance.
What the current product claim establishes—and what it leaves open
Observable, limited claims
- Special-purpose UHF tag with user-changeable TID-addressed behavior
- Reader workflow intended for EPC and TID-addressed programming
- Generation 1 wet inlay/card and Generation 2 dry inlay/card formats
- Supplier-reported shorter range and higher power requirement
- Sample testing required with the buyer's reader and antenna
Claims the evidence cannot support
- A standard TID remains factory unique after modification
- Exact internal chip architecture
- Full Gen2 conformance across commands and states
- Compatibility with every reader or middleware stack
- Guaranteed 10 m write range, retention or endurance
Cases where this architecture is the wrong engineering choice
Security decisions that trust immutable TID
If authorization depends on a value being manufacturer-controlled, making that value editable defeats the premise.
Gate, toll or passage systems with weak RF margin
These systems often need fast, repeatable reads at distance. A higher-power, shorter-range experimental tag creates an avoidable operational risk.
Middleware that branches on MDID/TMN
A substituted model identity can cause the host to send unsupported custom commands or apply the wrong memory map.
Deployments without control of the reader stack
If reader firmware, commands or power cannot be verified, abnormal memory behavior is difficult to diagnose and support.
High-volume encoding with no lot qualification
A one-tag demonstration says nothing about write yield, variation, endurance or line speed.
Any task solved cleanly by EPC or User memory
Standard writable storage offers better documentation, sourcing and interoperability.
A precise way to describe the product
Call it a special-purpose changeable-TID UHF RFID tag, state the exact tested memory behavior, and say that the resulting value is user-controlled rather than factory-unique. Attach the reader model, firmware, power, distance and command method to any performance claim. This wording is less dramatic than “standard TID can be rewritten,” but it is technically useful to a buyer.
The product does not prove that ordinary RFID TID is writable. It proves that a special chip can be built to answer familiar UHF commands while giving MB10 different storage rules. Buy it for that controlled behavior—not for the trust meaning of a normal TID.
Next: Turn the claim into a repeatable sample-validation protocol ↗
Primary references and product boundary
- GS1: Gen2v3 conformance requirements ↗ — command, memory and lock behavior expected from conforming tags.
- GS1: RAIN RFID memory-bank structure ↗ — conventional MB10 meaning and manufacturing permalock.
- NXP: UCODE X official product specifications ↗ — published read/write sensitivity example used only to explain RF thresholds.
- Generation 2 product page ↗ — supplier-provided format and operating limitations.