Think of a UHF tag as a small filing cabinet with four drawers. EPC and User memory are the drawers the owner may fill. TID is closer to the model plate fixed to the cabinet at the factory. Reader software can point at that drawer and ask to write, but a normal chip refuses because the relevant locations have already been permanently locked.
One tag, four banks, four different jobs
The phrase “RFID number” causes much of the confusion. A Gen2 reader is not looking at one number. It addresses one of four logical banks with a two-bit memory-bank selector: 00b, 01b, 10b or 11b. The banks share an air interface, not a common permission policy.
| Selector | Bank | What it is for | Normal write expectation |
|---|---|---|---|
00b | Reserved (MB00) | Kill and Access passwords, if implemented | IC- and lock-state dependent |
01b | EPC (MB01) | Inventory identifier, plus protocol-control words | Commissioned by the user; may later be locked |
10b | TID (MB10) | Allocation class, IC designer/model and optional serialized identity | Standard identity region is factory permalocked |
11b | User (MB11) | Optional application data | Writable when present and permitted |
GS1 places overwrite responsibility for EPC memory on the user. It treats TID differently: for the E2 allocation class used by modern RAIN tags, the identity layout and manufacturing lock are prescribed. Calling both banks “memory” does not make them interchangeable.
Read the first 32 TID bits before calling them a serial number
In the GS1 description, TID locations are bit locations. Reader SDKs often ask for a 16-bit word pointer, so documentation may show the same region in word-oriented form. Mixing those units is an easy way to write the wrong test script.
Allocation class. E2h indicates the GS1/EPC TID structure discussed here.
Feature indicators. XTID, Security and File flags signal whether corresponding structures or commands exist.
MDID. A 9-bit Mask-Designer Identifier allocated by GS1.
TMN. A 12-bit Tag Model Number assigned by the MDID holder.
Extended TID. When present, the XTID structure can include model/version information and a serialized value.
MDID and TMN are not merely decoration. GS1 says different custom-command or optional-feature behavior must be represented by different MDID/TMN combinations. Middleware can therefore use TID as a capability clue before it sends model-specific commands.
A real production example: NXP UCODE 9
NXP's UCODE 9 data sheet turns the abstract format into an actual map. Its 96-bit TID begins with allocation class E2h, contains NXP's MDID 806h, uses the published TMN value 995h or 915h for the documented variants, carries an XTID header of 2000h, and includes a 48-bit serial number. The data sheet marks the TID locations through 5Fh as locked.
The same document says the serial-number parity is calculated and locked during manufacturing so that a change to the stored TID can be detected. That is a concrete commercial implementation—not proof that every IC uses identical circuitry, but strong evidence of how a conventional factory identity is built.
The standard specifies the externally visible layout and lock behavior. It does not require every foundry to use the same physical storage process. “Laser-written TID” is therefore too universal a description; “manufacturer-written and permalocked TID” is the defensible one.
What happens when software tries to write MB10?
A typical host sequence selects a tag, specifies Memory Bank 10b, supplies a word pointer and data, and asks the reader to transmit a Gen2 Write or BlockWrite operation. That sequence proves only that the reader made a request. It does not prove that the tag accepted the change.
- 01
The reader addresses MB10
This is legal protocol syntax. Read access to TID is normal, so readers expose the bank in a generic memory interface.
- 02
The tag checks the address and state
The IC resolves whether the location exists, whether the command is supported, whether a password state is required, and whether the target is locked.
- 03
The tag changes data or returns an error
A standard locked TID must not change. A host may surface “memory locked,” “non-specific error,” “no response,” or a vendor-specific status.
- 04
Readback settles the question
Capture the tag response, read the same words again, remove RF power, and repeat. A green status icon without byte-for-byte readback is weak evidence.
GS1's Gen2v3 conformance requirements make the boundary testable. The procedure attempts to write the entire TID with a test pattern and verifies that neither TID nor other banks were overwritten. In other words, refusal is part of conformance—not a reader malfunction.
Why EPC, User memory and a database are usually better answers
If the business requirement is “assign my own number,” EPC is normally the right field. If the requirement is “store additional on-tag data,” User memory is the place to evaluate. If data changes often, is sensitive, or is larger than a few words, store it in a controlled database and keep only a lookup key on the tag.
Fast inventory identity
Use it for the code a normal inventory round should return and for identifiers commissioned by the application owner.
Small auxiliary payload
Use it when the selected IC provides enough capacity and the data genuinely needs to travel with the object.
Mutable business record
Use a backend for history, permissions, personal data, large records and changes that need audit control.
IC identity evidence
Keep the standard TID as a stable reference and, if useful, bind its expected relationship to EPC in the backend.
Where a changeable-TID tag should not be substituted
Anti-counterfeit trust anchored only in TID
Once the value is user-controlled, it no longer proves factory uniqueness. Use an authenticated IC and a verification backend designed for the threat model.
Regulated traceability or immutable audit evidence
A writable identifier weakens the chain of custody. Use qualified standard tags, controlled issuance and auditable backend records.
Mixed-vendor middleware that identifies IC capabilities by MDID/TMN
Changing those fields can make software select the wrong command set. Preserve the real model identity or isolate the experiment.
Ordinary inventory where EPC already solves the problem
The special behavior adds compatibility, RF and governance risk without adding business value.
So what is a “changeable-TID” product?
A special-purpose changeable-TID UHF RFID tag exposes user-changeable behavior at addresses a reader labels as TID. That can be useful in an authorized laboratory, a controlled migration test or OEM engineering work. It does not alter the GS1 rule for conventional TID, and the modified value must not be presented as a factory-unique serial number.
Normal TID is the chip's factory identity plate. A changeable-TID tag is a special test part whose identity plate has deliberately been made editable. The two may use the same reader commands, but they do not carry the same trust meaning.
Next: How can a special tag expose writable MB10 behavior without changing the standard? ↗
Primary references
- GS1: How data is stored on a RAIN RFID tag ↗ — memory-bank roles, TID field layout and manufacturing permalock.
- GS1: Gen2v3 conformance requirements ↗ — locked-memory and attempted-TID-write tests.
- NXP: UCODE 9 product data sheet ↗ — a concrete 96-bit locked TID map and serialized implementation.