RFID EPC Gen2 Tag State Workbench

Step through Ready, Arbitrate, Reply, Acknowledged, Open, Secured, and Killed tag behavior.

animation
rfid
epc-gen2
networking
short-range
interactive
Learner-ready EPC Gen2 tag state workbench showing reader commands, slot counters, RN16 and handle exchange, access-state transitions, command validation, and technical caveats for a simplified single-tag model.
Animation EPC Gen2 Tag state machine Single-tag teaching model

RFID EPC Gen2 Tag State Workbench

Send reader commands and watch one UHF RFID tag move through inventory and access states. The workbench shows the state, slot counter, RN16/handle, and command response together so the protocol sequence is visible before the standard details get heavy.

Ready Current tag state
Power-up Last reader command
- Slot counter
No token RN16 or handle
No handle Access permission

Inventory path

A powered tag starts in Ready. A matching Query chooses a random slot; slot zero replies with RN16, while nonzero slots wait in Arbitrate until QueryRep counts down.

Access path

ACK proves the reader heard the RN16 and makes the tag send EPC data. Req_RN then creates a handle used by Read, Access, Lock, and related access commands.

Safety rule

Invalid commands are not magic shortcuts. Real tags either ignore them or return defined errors depending on state, handle, and parameters; this model explains the simplified result.

Live tag state machine

The tag is powered and waiting for a matching Query command.

Ready
EPC Gen2 tag state machine State diagram with active state and last transition highlighted. Ready powered, idle Arbitrate slot counter Reply RN16 sent Acknowledged EPC sent Open handle active Secured privileged Killed terminal
ReadyPowered by the field, waiting for a matching Query.
ArbitrateSlot counter is nonzero; QueryRep counts it down.
ReplySlot zero reached; the tag has sent RN16.
AcknowledgedACK matched RN16; PC/EPC/CRC has been sent.
OpenReq_RN returned a handle for access commands.
SecuredPrivileged access is available in the teaching model.
KilledTerminal state; the tag no longer responds.
ReadyPower-up, waiting
ArbitrateNonzero slot counter
ReplyRN16 backscatter
AcknowledgedPC/EPC/CRC sent
OpenHandle for access
SecuredPrivileged commands
KilledNo further response

Slot counter and command flow

Use QueryRep to count down a nonzero slot. When the counter reaches zero, the tag enters Reply and generates RN16.

1. Query selects Reader starts an inventory round and gives Q, session, and target values.
2. RN16 replies Slot zero makes the tag send a short random number, not the EPC yet.
3. ACK reveals EPC ACK echoes RN16. The selected tag then sends PC, EPC, and CRC.
4. Req_RN gives handle The handle identifies this tag for access commands until the session changes.
Waiting for Query

Start with Query or press Step guided path. The tag will either select a slot or remain silent if the target does not match.

Access permission check

No handle is active yet, so access commands such as Read, Access, Lock, and Kill are not valid.

Command and response log

Inventory commands

  • Query starts a round and provides Q/session/target context.
  • QueryRep advances slots by decrementing the slot counter.
  • ACK must match RN16 before the tag sends EPC data.

Access commands

  • Req_RN returns a handle for later access commands.
  • Read can operate in Open or Secured if memory rules permit.
  • Access moves a password-protected tag from Open to Secured.

State rules

  • Ready is powered but not inventorying.
  • Reply is temporary: the reader must ACK the RN16.
  • Killed is terminal in the air-interface state machine.

Model caveats

  • This workbench shows one tag, not collisions across many tags.
  • Error behavior is simplified; the standard has detailed fault tables.
  • Security command details vary by Gen2 version and tag capability.
Guided practice for independent learners
  1. Use the default path and press Step guided path until the tag reaches Open. Name each token: slot counter, RN16, EPC, handle.
  2. Power cycle, set the planned slot to 3, and run Query. Use QueryRep until the tag replies. Explain why the tag was silent in Arbitrate.
  3. Turn off Query target matches this tag, send Query, and observe that a powered tag can remain in Ready with no response.
  4. Choose Password-protected access. Compare what Read can do in Open with what Lock can do only in Secured.
Technical accuracy notes and source links

EPC Gen2 and ISO/IEC 18000-63 define a richer air-interface state machine than this teaching model can show. The workbench focuses on the common inventory and access path: Query, slot arbitration, RN16, ACK, EPC, Req_RN, Open/Secured, and selected access commands. It deliberately avoids pretending to be a conformance simulator.

  • RN16 versus handle: The first RN16 is used for inventory acknowledgement. Req_RN returns a new random number that is used as a handle for access commands.
  • Zero access password: In the simplified path, a tag with a zero access password enters Secured after Req_RN instead of requiring Access password authentication.
  • Session and target flags: The checkbox models whether the selected tag matches the Query context; real tags maintain inventoried flags per session.
  • Invalid commands: Real command response depends on state, handle, CRC, unsupported parameters, and security suite. The log summarizes the learning consequence.
GS1 UHF Gen2 air interface GS1 Gen2 protocol PDF ISO/IEC 18000-63 GS1 EPC Tag Data Standard