UHF — 860–960 MHz

UHF RFID works completely differently from its LF and HF cousins. At around 900 MHz a wavelength is about 33 cm, and the near field ends a few centimetres from the antenna. So there's no transformer-style coupling: the tag catches a real radio wave, lives off it, and answers by reflecting it.

Almost every UHF tag speaks one protocol, EPC Gen2 (ISO/IEC 18000-63), marketed as RAIN RFID. For what people actually do with it, see clothing and inventory tags. This page is about how it works.

#The antenna

A tag antenna wants to be about half a wavelength, roughly 16 cm, but a label is about 9. So the arms are folded into a meander, and the ends are widened (end-loading) to make them act longer. The chip's input is mostly capacitive, so a small matching loop tunes the antenna to it. That's what lets the tiny amount of harvested power actually reach the chip.

#Who gets what slice

UHF RFID shares spectrum with phones and everything else, so each region has its own slice and power limit:

Region	Band	Reader power
US, Canada	902–928 MHz, hopping across 50 channels	up to 4 W EIRP
Europe	865–868 MHz, four main channels	up to 2 W ERP
Japan	916.7–920.9 MHz	varies by licence

Tags are usually designed to work anywhere from 860 to 960 MHz, with best performance tuned for one region.

#The link budget: who runs out first

Every UHF read is two trips through the air:

• Forward link: the reader's signal has to arrive strong enough to power up the chip. Modern chips wake at around −20 to −25 dBm, a few microwatts. This is almost always what limits range.
• Return link: the tag's reflection is tiny, but reader receivers are extremely sensitive (−80 dBm and below), so it's rarely the bottleneck.

That's why a good fixed reader reaches about 10 m, a handheld a few metres, and writing a tag only works closer in: writing needs more power than reading.

#Backscatter

While a tag answers, the reader keeps transmitting an unmodulated carrier. That's the tag's power supply, and also the thing it reflects. The chip flips its antenna between two impedance states, which changes how much of that carrier bounces back. The reader has to pick out that faint flicker while its own transmitter is shouting right next to its receiver, which is the hardest part of building a UHF reader.

Into the weeds: How the bits are shaped

Reader to tag uses PIE (pulse-interval encoding): short gaps in the carrier, with a 0 or 1 set by the time between them. Tag to reader uses FM0 or Miller encoding (M = 2, 4 or 8) at link rates from about 40 to 640 kbit/s. Miller is slower but survives a noisy room full of other readers.

#Counting hundreds of tags

Hundreds of tags can't all answer at once, so Gen2 runs a lottery:

1. Select (optional): "only tags whose memory matches this pattern, pay attention".
2. Query with a number Q: "everyone pick a random slot from 0 to 2^Q − 1".
3. Each tag counts down. One that hits zero replies with a random 16-bit number (RN16).
4. The reader ACKs that number, and the tag sends its EPC.
5. That tag flips an inventoried flag and sits out the rest of the round. Collisions and empty slots make the reader adjust Q up or down.

The flags live in four sessions (S0–S3) that "remember" being counted for different lengths of time, from instantly forgotten to many seconds. That lets a reader re-read one tag continuously, or sweep a warehouse and count each tag exactly once.

#Water, metal and you

UHF hates the stuff it's stuck to. Water absorbs 900 MHz (a microwave oven runs at 2.45 GHz, but the idea is the same), so tags on drinks, or pressed against a hand, go quiet. Metal reflects and detunes the antenna. "On-metal" tags add a spacer and a ground plane so the metal becomes part of the design. Reader antennas are often circularly polarised, so a tag reads at any rotation, at the cost of a little range.

#Security

Gen2 was designed for counting, not secrets. The original spec has a 32-bit access password (to lock memory) and a 32-bit kill password (to disable the tag permanently), and that's about it. Gen2v2 (2013) adds optional cryptographic authentication, so a tag can prove it's genuine, plus an Untraceable command that hides part of the EPC from casual readers. Some chips support them, but most retail deployments don't use them yet.

With UHF reader

Turn the power down to read only the tag in front of you. Use session S0 to read one tag over and over, and S2/S3 to count a big pile once each. The TID bank tells you who made the chip: Impinj, NXP and EM are the usual suspects.