The Impinj Monza 4 tag ICs allow for an Electronic Product Code (EPC) of up to 496 bits and user memory of 512 bits. But, how do you manage how much of the EPC is backscattered? What if we have a tag we believe supports more than 96 bits but, when queried, will only return the most minimal of EPC? How do we know if there is non-zero data written in the User Memory bank of the tag?
The answer is to use a combination of querying the Tag ID (TID), knowing the memory map of the tag IC in question and being able to decode the Protocol Control (PC) word. The video tutorial included in this posting will walk you through each of these.
Every tag IC should have a memory map available, usually included in the data sheet. This will show how much memory is available to the user and where it is located (which memory bank and bit locations) such as the memory map for the Impinj Monza 4U chip shown below.
If you are not sure of the manufacturer and model of the tag IC, then you will need to query the TID to get that information; the video walks you through how to use the Impinj MultiReader program to gather that data.
Using the TID and the correct memory map for that IC, you can now tell which memory locations are Read-Only Memory (ROM) and which are Non-Volatile Memory (NVM). It is not always straight-forward about how much memory is allocated, where it is mapped to, and under what conditions; some tag ICs (Monza 4 included) can have a variety of maps depending on the configuration.
The next key is to understand the Protocol Control word format - how to query and decipher it, which is also covered in the video. It is quite possible that you have a tag that supports more than 96 bits but if the PC word is 3000, it's going to backscatter 96 bits all day long. You can dig through the EPC GEN 2 specification if you feel so inclined, but it's explained in the following screencast.
Quick Cheat Sheet on PCBits (make sure you see screencast link above, first, to understand what this is displaying)