ETSI TR 101 543 V1.1.1 (2011-04)

Technical Report
Electromagnetic compatibility
and Radio spectrum Matters (ERM);
RFID evaluation tests undertaken in support of M/436 Phase 1

2 ETSI TR 101 543 V1.1.1 (2011-04)

Reference
DTR/ERM-TG34-0100
Keywords
privacy, RFID, security
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: +33 4 92 94 42 00  Fax: +33 4 93 65 47 16

Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88

Important notice
Individual copies of the present document can be downloaded from:
http://www.etsi.org
The present document may be made available in more than one electronic version or in print. In any case of existing or
perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF).
In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive
within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, please send your comment to one of the following services:
http://portal.etsi.org/chaircor/ETSI_support.asp
Copyright Notification
No part may be reproduced except as authorized by written permission.
The copyright and the foregoing restriction extend to reproduction in all media.

© European Telecommunications Standards Institute 2011.
All rights reserved.
TM TM TM TM
DECT , PLUGTESTS , UMTS , TIPHON , the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered
for the benefit of its Members.
TM
3GPP is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners.
LTE™ is a Trade Mark of ETSI currently being registered
for the benefit of its Members and of the 3GPP Organizational Partners.
GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association.
ETSI
3 ETSI TR 101 543 V1.1.1 (2011-04)
Contents
Intellectual Property Rights . 5
Foreword . 5
1 Scope . 6
2 References . 6
2.1 Normative references . 6
2.2 Informative references . 6
3 Definitions, symbols and abbreviations . 6
3.1 Definitions . 6
3.2 Symbols . 7
3.3 Abbreviations . 7
4 Introduction . 7
4.0 General . 7
4.1 Test Area . 8
4.2 Equipment . 8
4.3 Test Supervisors . 9
5 Overview of the Tests. . 9
5.1 Range tests. 9
5.2 Write Tests . 9
5.3 Illicit Reading . 9
5.4 Eavesdropping . 10
5.5 Detection inside buildings . 10
5.6 Combined EAS/RFID systems . 10
5.7 Magnetic fields . 10
6 Test procedures and results . 10
6.1 Reading range . 10
6.1.1 Reading range for LF systems . 11
6.1.2 Reading range for HF systems . 11
6.1.3 Reading range for UHF . 12
6.2 Write range . 13
6.2.1 Write range at LF . 13
6.2.2 Write range at HF . 13
6.2.3 Write range at UHF. 14
6.3 Illicit reading . 15
6.3.1 Illicit reading of the contents of shopping bags . 15
6.3.2 Containers with pills . 16
6.3.3 Proximity cards . 17
6.3.4 Airline label tag . 17
6.3.5 LF tags . 17
6.4 Eavesdropping . 18
6.4.1 LF and HF tests . 18
6.4.2 Measurements at UHF . 18
6.5 Detection inside buildings . 18
6.6 Combined EAS/RFID system. 19
6.7 Magnetic fields . 19
7 Visits to operational installations . 20
8 Analysis of results . 20
9 Conclusions . 21
Annex A: Results recorded during the tests . 22
A.1 Results of reading tests . 22
ETSI
4 ETSI TR 101 543 V1.1.1 (2011-04)
A.2 Results of write tests. 24
A.3 Noise floor measurements . 25
Annex B: Reports on visits to operational sites . 26
B.1 Visit to library at Doetinchem . 26
B.2 Visit to Metro Future Store . 27
Annex C: Bibliography . 29
History . 30

ETSI
5 ETSI TR 101 543 V1.1.1 (2011-04)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://webapp.etsi.org/IPR/home.asp).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This Technical Report (TR) has been produced by ETSI Technical Committee Electromagnetic compatibility and Radio
spectrum Matters (ERM).
ETSI
6 ETSI TR 101 543 V1.1.1 (2011-04)
1 Scope
The present document describes some RFID Evaluation Tests that were carried to evaluate the characteristics and
performance of RFID equipment operating at their three principal frequencies of use. The information derived from the
tests is directly relevant to the work of STF 396 in preparing their response to EC Mandate M/436 [i.1].
2 References
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
reference document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found at
http://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee
their long term validity.
2.1 Normative references
The following referenced documents are necessary for the application of the present document.
Not applicable.
2.2 Informative references
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] EC Mandate M/436: "Standardisation mandate to the European Standardisation Organisations
CEN, CENELEC and ETSI in the field of Information and Communication Technologies Applied
to Radio Frequency Identification (RFID) and Systems".
[i.2] ETSI TR 187 020: "Radio Frequency Identification (RFID); Coordinated ESO response to Phase 1
of EU Mandate M436".
[i.3] ISO/IEC 14443: "Identification cards -- Contactless integrated circuit cards -- Proximity cards".
3 Definitions, symbols and abbreviations
3.1 Definitions
For the purposes of the present document, the following terms and definitions apply:
batteryless transponder: transponder that derives all of the power necessary for its operation from the field generated
by an interrogator
eavesdropping: illicit reading of the response from a tag that is being activated by an authorised RFID interrogator
effective radiated power: product of the power supplied to the antenna and its gain relative to a half wave dipole in the
direction of maximum gain
global scroll: mode in which an interrogator is able to read the same tag continuously for test purposes only
ETSI
7 ETSI TR 101 543 V1.1.1 (2011-04)
interrogator: equipment that will activate an adjacent tag and read its data
NOTE: It may also enter or modify the information in a tag.
radiated measurements: measurements which involve the absolute measurement of a radiated field
tag: transponder that holds data and responds to an interrogation signal
3.2 Symbols
For the purposes of the present document, the following symbols apply:
A Amps
dB decibel
dBm power level relative to 1 mW
kHz kilo Hertz
m metres
MHz Mega Hertz
mm millimetres
σ standard deviation
uA/m micro Amps/metre
3.3 Abbreviations
For the purposes of the present document, the following abbreviations apply:
CCTV Closed Circuit Television
DST Digital Signal Transponder
e.r.p. effective radiated power
EAS Electronic Article Surveillance
HF High Frequency
IR Infra Rred
LF Low Frequency
R&TTE Radio and Telecommunications Terminal Equipment
RFID Radio Frequency IDentification
SRD Short Range Device
STF Special Task Force
UHF Ultra High Frequency
4 Introduction
4.0 General
th th
The present document describes some RFID Evaluation Tests that were carried out at Nedap on 6 to 8 September
2010. The purpose of the tests was to evaluate the characteristics and performance of RFID equipment operating at their
three principal frequencies of use. The information derived from the tests is directly relevant to the work of STF 396 in
preparing their response to EC Mandate M/436. Additionally it provided a number of the experts in the STF with the
opportunity to witness at first hand the operation of RFID in a number of defined scenarios.
The reason for these tests arose from the apparent lack of any documented work on practical tests that determined the
risk of illicitly reading or writing data to tags. The absence of this information has sometimes led to unrealistic claims
by the media and other bodies on what is possible. These tests provided information on the capabilities and limitations
of RFID when used in a typical operational environment.
ETSI
8 ETSI TR 101 543 V1.1.1 (2011-04)
The absence of any controlled experiments regarding illicit reading and writing of data is seen by the STF as a major
obstacle for consumer acceptance. The uncertainty regarding what is referred to as the actual read and write range and
the potential risks has lead to confusion and distrust among the public. This particularly includes concerns over the
illicit reading and writing to tags. There is also confusion around the various RFID technologies, their capabilities and
intended use. The scenarios specified in the tests were intended to address these particular concerns.
4.1 Test Area
The majority of the tests were performed in the meeting area at the Nedap premises. This is a large open plan space with
conditions that were considered typical of many environments where RFID might be used operationally. In addition
tests were carried out in a mock up of a room in a house, which was also located in the Nedap premises.
The test programme included visits to a working library equipped with RFID and to the Metro Future Store, which uses
RFID in its daily operations.
4.2 Equipment
The tests were carried out at the three principal frequencies of use using the equipment listed below:
Low Frequency (< 135 kHz)
1) Nedap 120 kHz interrogator XS Accessor III
2) DC 1000 Loop antenna
3) General purpose LF cards
4) TPU Write unit
5) TI interrogator RI-TRP-251B-30 and antenna RI-ANT-G01E-30
6) Animal tag RI-TRP-0983-30
7) Key fob tag RI-TRP-RFOB-30
High Frequency (13,56 MHz)
1) Nedap 13,56 MHz Interrogator
2) Loop antenna (40 × 150 cm) for library use
3) General purpose HF vicinity cards
4) Handheld interrogator Quick Scan
5) NXP CL RD 701 interrogator driven by Golden Reader Software
6) Passport fitted with RFID card
7) Transportation card
UHF (865 MHz - 868 MHz)
1) Nedap uPASS Reach interrogator
2) Nedap Handheld reader
3) Prototype interrogator
4) Three different designs of retail label tag
5) Airline label tag
ETSI
9 ETSI TR 101 543 V1.1.1 (2011-04)
Test equipment
1) Rhode and Schwartz Measurement receiver Type EB200
2) Rhode and Schwartz loop antenna Type HFH-Z2
3) Rhode and Schwartz spectrum analyser Type ZVL3
4) DC Coil for magnetic field DC 190
STF 396 appreciates the assistance given by manufacturers in making their equipment available for these tests. They
also wish to thank the staff at the public library at Doetinchem and at the Metro Future Store for hosting conducted
visits to their premises.
For the purpose of the tests, RFID tags are defined as batteryless transponders, which only send a response when they
are within range of the energising field of an interrogator.
4.3 Test Supervisors
The tests were supervised by the Chairman of ETSI_ ERM_TG34 (John Falck) who was assisted by the leader of
STF 396 (Scott Cadzow) and Dr. Christian Schenk.
Members of STF 396 who were present at the event were invited to participate in a number of the tests.
5 Overview of the Tests
The tests were divided into six different sections covering each of the main areas of concern. These sections are
separately summarised below.
5.1 Range tests
The purpose of these tests was to determine the maximum range at which it was possible to read a tag and to estimate
the variability in performance between different tags. Measurements were made at LF, HF and UHF. For the LF and the
HF tests, all of the tags had a form factor similar to a credit card. Two variants of the HF tag were supplied, which were
the vicinity card and the proximity card. These were tested separately. Three different designs of tag were tested at
UHF. They were of different physical sizes and intended predominantly for use as labels in retail applications.
All of the tags tested were batteryless (passive) and were fitted with air cored coils. The tests at UHF included an
assessment of the degradation in reading performance of tags when applied to certain materials or affected by the
environment or rotated from their optimum orientation.
5.2 Write Tests
These tests measured the maximum distance at which it was possible to write data to a tag. The tests were carried out at
all three of the principal operating frequencies. The same tags used in the reading tests were also used for measuring the
maximum write range.
5.3 Illicit Reading
These tests covered a range of scenarios that had been raised by the experts during their discussions within the STF.
They each represented situations that could arise during the normal course of people's daily lives. They included such
situations as monitoring tagged items in shopping bags, as well as plastic bottles/ cartons of pills in handbags. In view
of the results showing the limited reading range at LF and HF, it was decided to perform these measurements only at
UHF. In addition tests were carried out to assess the ease with which the data in both a passport and a transport card
(e.g. Oyster card) could be read. Further measurements were made to determine the range at which it was possible to
read an airline tag fitted to a person's suitcase. Finally tests were undertaken to determine the reading range of an animal
tag and the ease with which it might be possible to compromise the security of the RFID tag embedded in a key fob.
ETSI
10 ETSI TR 101 543 V1.1.1 (2011-04)
5.4 Eavesdropping
Concern had been expressed by some members of the STF about the ability of a person with criminal intent to monitor
remotely the response from a tag while it was being read by an interrogator. In order to quantify the extent to which this
was possible, a tag was continuously activated by an adjacent interrogator. Using a measuring receiver set to high
sensitivity, the signal from the tag was repeatedly read at increasing ranges until it could no longer be detected. The
results were believed to be indicative of the maximum ranges that eavesdropping would be possible. These
measurements were carried out at each of the three main operating frequencies.
5.5 Detection inside buildings
Claims had been made by the press that it was relatively easy for a person to read all of the tags that were inside a
person's home. The experts were clearly interested to assess the extent to which this was possible. Tests were performed
in a mock-up of a room inside a house. A tagged object was placed at different positions inside the room while an
interrogator, which was immediately outside the room, was moved along the 20 cm thick brick wall in an attempt to
read the tag. Due to the limited reading range at LF and HF, this test was carried out at UHF only.
5.6 Combined EAS/RFID systems
It had been suggested that a likely spot for an eavesdropper would be at the exit of a shop equipped with a combined
EAS/RFID system. The experts wished to know whether the handheld reader might adversely affect the performance of
the EAS/RFID equipment located at the exit as shoppers left the premises. Similarly there was also a concern that the
EAS/RFID equipment would influence the performance of a handheld reader being used to read tags illicitly. Tests
were therefore carried out to determine if either of these effects was evident.
5.7 Magnetic fields
TR 187 020 [i.2], which had been circulated for Public Enquiry, included a statement saying that RFID tags were
susceptible to damage from magnetic fields. There was no independent reference in the document to support this
statement so it was decided to carry out a test to investigate if it was correct. A LF tag was placed in close proximity to
a calibrated coil. The maximum range at which the tag could be measured both with and without a current passing
through the coil was compared. Since LF is the closest frequency to d.c. it was considered unnecessary to repeat this test
at HF and UHF.
6 Test procedures and results
Both before and after the tests, measurements were made of the noise floor levels at each of the three frequencies of
interest. The results are shown on table A.5.
These levels were considered typical of what might be experienced in the environments where RFID systems would be
deployed.
A description of the procedure for carrying out each of the tests together with details of the test results is provided
below.
6.1 Reading range
Tests on the reading range at each of the three principal operating frequencies were performed in accordance with the
Test Plan. Details on each of the tests are provided below.
ETSI
11 ETSI TR 101 543 V1.1.1 (2011-04)
6.1.1 Reading range for LF systems
A loop antenna of approximate dimensions 40 × 80 cm was positioned so that its centre was level and parallel with a
wooden table. The loop antenna was connected to a Nedap 120 kHz interrogator. The field generated by the loop when
powered by the interrogator was measured and found to be 59 µA/m @ 10 m. A ruler was laid along the length of the
table. With the loop antenna energised by the interrogator, a tag in its optimum orientation with respect to the loop was
moved slowly towards the antenna. See figure 1.

Figure 1: Measuring reading range at LF
The distance at which the tag was first read by the interrogator was recorded. The tag was moved slowly away from the
loop until it just ceased to be read and the distance was again recorded. This procedure was repeated three times.
The same process was repeated for a further nine tags. The results from the measurements are shown in table A.1.
It will be seen from the results that the average range of an LF tag under the test conditions described above is 88 cm.
Also there was only a difference in reading range of about 2 cm when moving the tag towards the loop and moving it
further away. Based on a very small sample size, the vast majority of LF tags would have reading ranges of between
82 cm and 93 cm.
6.1.2 Reading range for HF systems
These tests used a loop antenna configured in the form of a figure of eight as supplied by Nedap for their library system.
The centre of the lower loop was arranged to be level with a wooden table. The loop was connected to an interrogator
operating at 13,56 MHz. The field generated by the loop antenna was 53,5 dBµA/m @ 10 m.
With the interrogator set to transmit continuously, a vicinity tag in its optimum orientation was moved slowly towards
the loop antenna. See figure 2.
ETSI
12 ETSI TR 101 543 V1.1.1 (2011-04)

Figure 2: Measuring reading range at HF
The distance at which the vicinity tag was first read by the interrogator was recorded. The tag was moved slowly away
from the loop antenna until it just ceased to be read and the distance was again recorded. This test was repeated three
times.
The same process was repeated for a further twenty four vicinity tags. The results from the measurements are shown in
table A.2.
The average range of an HF vicinity tag under the test conditions described above was 82 cm. Also there was only a
difference in reading range of about 2 cm when moving the vicinity tag towards the loop and moving it further away.
Although the sample size was small, a large population of HF vicinity tags could be expected to have reading ranges of
between 85 cm and 78 cm.
6.1.3 Reading range for UHF
These tests were performed using the Nedap uPASS Reach interrogator, which combined the functions of antenna and
interrogator within a single case. The unit was arranged to be at the same height as a wooden measuring table as shown
in figure 3.
Figure 3: Measuring reading range at UHF
The conducted power from the interrogator was measured at 27,7 dBm, which was equivalent to a radiated power of
33,25 dBm e.r.p. The equipment operated in the band 865 MHz to 868 MHz.
ETSI
13 ETSI TR 101 543 V1.1.1 (2011-04)
The tests on reading range were performed on three different designs of retail tag. With the interrogator switched on, a
tag in its optimum orientation with respect to the transmission was moved slowly towards the coil. The distance at
which the tag was first read by the interrogator was recorded. The tag was moved slowly away from the interrogator
until it just ceased to be read and the distance was again recorded. This procedure was repeated three times.
The same process was performed for a further ninety nine tags. The results from the measurements are shown in
table A.3.
The average range of an UHF tag under the test conditions described above was 345 cm. Also typically there was only a
difference in reading range of about 3 cm when moving the tag towards the loop and moving it further away. Although
the sample size was small, large populations of UHF tags could be expected to have reading ranges of between 372 cm
and 315 cm.
During the course of the tests at UHF, it was demonstrated that the reading range was affected by a number of factors.
For instance the nature of the material to which the tag was attached could modify the performance. This was
particularly apparent for objects containing either water or metal. Mis-orientation of the tag from its optimum alignment
and changes to the environment also reduced the reading range. For example it was shown that the movement of people
in the immediate vicinity of the interrogation zone could have a noticeable effect. It was also demonstrated that
shielding of the tag by means of aluminium foil prevented the tag from being read.
6.2 Write range
Tests to measure the distance at which it was possible to write to a tag were carried out at LF, HF and UHF. A
description of each of these tests is provided below.
6.2.1 Write range at LF
These tests were performed using a purpose made writing unit. A picture of the equipment is shown in figure 4.
.
Figure 4: Measuring write range at LF
Tests on the maximum range at which it was possible to write data were carried out on five tags. The tags were
progressively moved further away from the antenna until writing was no longer possible. The range at which this
occurred for each tag is summarised in table A.4.
The typical maximum write range was 4,6 cm with no tag functioning above 6 cm.
6.2.2 Write range at HF
At HF it was possible to write to a vicinity card using the same equipment set up as used for the reading tests. The
maximum range at which it was possible to write data was measured for five vicinity cards. The results are shown in
table A.4.
ETSI
14 ETSI TR 101 543 V1.1.1 (2011-04)
Typically the write range for a HF vicinity card was 60 cm with the vast majority of cards having a write range of less
than 80 cm.
6.2.3 Write range at UHF
Measurements of the write range at UHF were performed on a prototype interrogator. See figure 5.

Figure 5: Write range equipment at UHF
Conducted measurements on the prototype interrogator showed that it was set to a level of 28,1 dBm, which was
equivalent to a transmitted power level of 34,6 dBm e.r.p. This exceeded
...