Passive RFID read-out for sensors without radio or batteries

Passive RFID sensor read-out solves a specific problem: how to get a result off a device that cannot afford to run a radio. On harvested power, a single active radio packet can cost more energy than many measurement cycles. If the sensor only needs to report a few bytes now and then, it can hand the communication cost to someone else.

That someone else is an RFID reader. This article explains how passive tags communicate, how dual-interface chips let a sensor use them as a mailbox, how UHF and NFC compare, and what to watch for in a real design.

How passive RFID communicates without a battery

A passive RFID tag is an antenna and a chip with no power source of its own. All of its operating energy comes from the reader.

The GS1 EPC Gen2 UHF RFID standard, currently version 3.0.1 ratified in February 2026, describes the mechanism precisely. The reader (the "interrogator") transmits a continuous-wave RF signal. The tag rectifies part of it to power its chip. To reply, it changes the reflection coefficient of its antenna, so the reader sees its own carrier modulated by the tag's data. This is called backscatter. The protocol is interrogator-talks-first and half-duplex: a tag only answers when a reader asks.

Gen2 operates between 860 MHz and 930 MHz, and it harmonises with ISO/IEC 18000-63, which covers 860 MHz to 960 MHz. The exact band a reader uses depends on local radio regulations.

High-frequency tags at 13.56 MHz, including NFC tags under ISO/IEC 15693, work differently. Reader and tag couple magnetically through their antennas like a loose transformer, and the tag replies by switching a load on and off. The range is shorter, but the coupling can deliver more power to the tag.

Dual-interface tags: an RFID chip as a sensor mailbox

An ordinary RFID tag stores an identifier and some user memory written during commissioning. A dual-interface tag adds a wired port, usually I²C, so a microcontroller on the same board can read and write that memory directly.

The sensor and the reader never talk to each other. They share a mailbox:

1. The sensor wakes on harvested energy, measures and evaluates.
2. It writes a short result record into the tag's user memory over I²C.
3. It goes back to sleep.
4. Hours or days later, a reader passes, powers the tag through its antenna and reads the memory.

Two commercial examples show the range of options:

• The Impinj Monza X-8K is a UHF Gen2 chip with 8,192 bits of user memory accessible through both the RF interface and a standard I²C bus. Impinj highlights that the memory can be accessed even when the host device is powered off, and the chip offers a wake-up trigger and two antenna ports for far-field and near-field use.
• The ST25DV04K from STMicroelectronics is an NFC Forum Type 5 tag based on ISO/IEC 15693, with 4 Kbit of EEPROM, a 1 MHz I²C interface, a 256-byte mailbox for fast transfer and an analogue output that can power external components when the field allows. ST lists this particular part as not recommended for new designs, but the dual-interface concept is widespread in its successors.

The energy cost to the sensor is one short I²C write. Everything after that is paid for by the reader.

UHF versus NFC versus an active radio

The ranges in the table are indicative. Read range depends on reader power, antenna design, tag orientation and, above all, what the tag is mounted on.

What passive read-out cannot do

The limitation is latency. A passive tag only reports when a reader is close enough. If the nearest reader is 200 km away, so is your next data point.

That is acceptable for faults that develop over days or weeks, such as a wheel flat that slowly grows or a bearing that starts to degrade. It is not acceptable for a hot axle box that needs a train stopped within minutes. Passive read-out is a maintenance channel, not a safety alarm. Our article on wheel flats on freight wagons explains why the two kinds of monitoring complement each other.

The second limitation is payload. Tags hold kilobits, not megabytes. You will not get raw vibration recordings out this way. The sensor must decide locally and send conclusions.

Rail: readers are already at the trackside

Rail is a natural fit because the infrastructure partly exists. According to the supplier TagMaster, the Swedish Transport Administration, Trafikverket, began rolling out long-range UHF RFID readers at detection sites from the end of 2011, as part of a nationwide system for tracking freight wagons. The readers comply with EPC Gen2 (ISO 18000-6C), the supplier says it cooperates with Trafikverket and GS1, and axle counters are connected directly to the readers so that wagons without tags are also detected. Using an ISO standard is intended to give cross-border interoperability across Europe.

Where such readers already identify wagons, adding condition data is mostly a question of what is written into the tag's memory and how the back office interprets it.

Ideas from research: sensing through identification

Using RFID infrastructure for sensing is not new. In 2005, Philipose, Smith and colleagues described the wireless identification and sensing platform (WISP) in IEEE Pervasive Computing. Their working prototype was a one-bit tilt sensor: a mercury switch connected one of two tag chips to the antenna, depending on tilt, so the reader saw either one ID or the other. Standard tags at the time were readable at up to eight metres, and the modified tag remained readable, at a degraded rate, to about three metres.

Later work moved computation onto the tag. The NFC-WISP presented at UbiComp 2015 used a TI MSP430 microcontroller to sample temperature and 3D acceleration every three seconds and report whether an object was static or moving. The lesson from both: the reader does the heavy lifting, and the sensor's job is to put something meaningful into a small memory.

Design checklist for a passive RFID sensor link

• Define the payload first. Decide what a maintenance planner needs: sensor identity, time or position reference, fault type, severity grade, and a measure of confidence or signal quality. Fit it into a fixed record of a few tens of bytes.
• Plan the memory. Decide whether you overwrite the latest result or keep a short ring buffer, and check the write endurance of the tag memory in the datasheet against your write rate over the product's lifetime.
• Design the antenna for metal. Tags on bogies, axle boxes or machine frames need antennas designed for metal mounting. Test read rates at the real mounting position and at the real passing speed.
• Check the read window. At line speed, a tag is in the reader's field only briefly. Make sure the record can be read within that window, with retries.
• Protect integrity. A record that anyone with a reader could alter is not evidence. Plan checksums at minimum, and signatures if results feed into maintenance decisions.
• Expose sensor health. Include a flag that tells the reader whether the sensor's own signal was valid, so a loose mount is not read as a healthy wheel.
• Plan the back office. Readers deliver records; something has to match them to assets, trend them and raise work orders.

How NeuroControls approaches this

Passive read-out is part of the VCD4.3, our energy-autonomous freight-wagon sensor. It is powered by the vibration it monitors, grades wheel flats and bearing faults on board and is read out over passive RFID, so the sensor never runs a radio. It has been demonstrated on a rail-wheel fault rig, is built to order and was developed as the demonstrator we led in the EdgeAI project. The power side of the design is covered in our article on energy harvesting sensors.

The principle that each device has one clear job and a defined interface also runs through our wired systems, as described in the hub-and-node architecture. For details on the special sensor, see our special sensors page; for rail applications, our rail industry page; and for how the pieces fit together, our system architecture.