Technology 📅 September 6, 2026 ⏱ 12 min read

Wiring a Long-Range UHF RFID Reader Into an Existing Access Controller

Long-range UHF RFID reader mounted on a pole at a boom-barrier lane, with a wiring cabinet showing Wiegand DATA0/DATA1 terminals and an RS-485 twisted pair going to the access controller.

A boom-barrier retrofit is the cheapest RFID project a site will ever run: the motor, the loop detector, the controller cabinet and the conduit all stay, and only the credential changes. What keeps it cheap is settling one piece of arithmetic early. A 96-bit EPC reaches that controller through a 26-bit Wiegand frame with 24 usable bits, and each reader family resolves that in its own way, which is why the mapping belongs in writing before the order is placed. This is the arithmetic, the wiring, and the test that proves the lane before the barrier goes live.

What decides the retrofit route

The brief is almost always the same. A site has a working gate: a barrier motor, a loop detector, a controller in a cabinet holding the cardholder database and the shift calendar, and cable pulled through conduit some years ago. The only thing changing is the credential. Instead of a driver stopping and presenting a proximity card at 5 cm, a passive UHF tag on the windscreen should be read at four to six metres while the vehicle rolls up.

The head end has an opinion about how that credential arrives. Most access controllers accept it on a Wiegand port: three conductors called DATA0, DATA1 and ground, idling high at about 5 V, each pulsed low in turn to clock one bit at a time. The controller counts the bits, checks two parity bits, splits the rest into a facility code and a card number, and looks that pair up in its own table. It receives a number of a fixed width and decides.

It is a thirty-year-old interface that is in the cabinet because it works, and the commercial case for the retrofit rests on leaving it there. Three things decide whether this is a two-hour job or a re-tender:

Frame width. What bit lengths the controller will accept — 26-bit only, or 26/34/37 selectable, or a pass-through mode.
Tag issuance. Whether you control what goes into the EPC memory of every tag the site will ever issue, or whether tags arrive pre-encoded from a third party.
Database ownership. Whether the cardholder table can be re-keyed, and by whom.

Answer those three before quoting. They select the option, and the option selects the hardware. If the site is a car park with a paid-for head end, the same three answers also shape what an RFID vehicle and parking management system has to do around the edges.

The bit budget: 96 bits into 24

Start with the frame, because the frame is fixed. The standard 26-bit Wiegand format, usually catalogued as H10301, is laid out as one leading parity bit, an 8-bit facility code, a 16-bit card number and one trailing parity bit. The leading parity covers the first twelve data bits, the trailing parity the last twelve. That leaves 24 usable bits: 256 facility codes and 65,536 card numbers per facility code. Counted as raw combinations that is 16,777,216 codes; card-format references that exclude facility code zero and card number zero quote 16,711,425 issuable credentials.

Now the other side. A Gen2 tag’s EPC bank commonly holds 96 bits. Under the GS1 EPC Tag Data Standard, release 2.3 of October 2025, an SGTIN-96 divides those 96 bits as 8 header, 3 filter, 3 partition, a GS1 Company Prefix of 20 to 40 bits, an indicator and item reference filling the remainder up to 24 bits, and a 38-bit serial. The serial occupies bit positions b37 down to b0 — that is, the bottom 38 bits of the EPC — and can run from 0 to 274,877,906,943.

So the whole EPC space is 2⁹⁶, roughly 7.9 × 10²⁸ values, and the pipe to the controller carries 24 bits. Seventy-two bits go somewhere. Where they go is a firmware decision, and it is a decision worth reading before you buy.

What the bytes actually look like

Take a concrete SGTIN-96 with filter 3, partition 5, company prefix 8901234, item reference 056789 and serial 4711. Encoded, that tag’s EPC is 3076 1F49 C837 7540 0000 1267.

Bit positions	SGTIN-96 field	Width	Value in this tag
b95–b88	EPC header	8	0x30
b87–b85	Filter	3	3
b84–b82	Partition	3	5
b81–b58	GS1 Company Prefix	24	8901234
b57–b38	Indicator + item reference	20	056789
b37–b0	Serial	38	4711
b23–b0	Bits that reach a Wiegand 26 frame	24	0x001267 → FC 0, card 4711

A low-24-bit truncation on this tag gives facility code 0 and card number 4711, which is tidy and legible. Now issue serial 16,781,927 to the next vehicle. Its EPC is 3076 1F49 C837 7540 0100 1267 — visibly different, four bytes in. Its low 24 bits are 0x001267. Facility code 0, card number 4711. The same credential. The controller will open the barrier for the second vehicle using the first vehicle’s permissions and write the first vehicle’s number into the audit log.

A plain serialised EPC behaves the same way, because a counter written into the low bytes wraps every 16,777,216 tags — and where the encoding tool puts the serial somewhere other than the low bytes, the truncation can deliver one constant to the controller for the entire tag population.

This is why the mapping matters more than any range figure on a datasheet. Two readers pointed at one tag can present two different card numbers, both legitimately, because one takes the low 24 bits, one takes a CRC or hash of the full EPC, and a third takes bytes 4 and 5 as the facility code with bytes 10 and 11 as the card number. Each of those is a defensible design. The one that matters is the one written into your commissioning file.

Wiegand 26 vs Wiegand 34, and what each can carry

The obvious response to running out of bits is to use more of them. The 34-bit format, catalogued as H10306, keeps the same two-parity-bit structure and widens the facility code from 8 bits to 16: even parity over the first 16 data bits, a 16-bit site code, a 16-bit card number, odd parity over the last 16. Eight extra bits sound modest. They multiply the credential space by 256.

Format	Total bits	Facility / site code	Card number	Usable bits	Distinct codes
Wiegand 26 (H10301)	26	8 bits (0–255)	16 bits (0–65,535)	24	16,777,216
Wiegand 34 (H10306)	34	16 bits (0–65,535)	16 bits (0–65,535)	32	4,294,967,296

Facility codes across multiple sites

The facility code is the cheapest tool available for keeping populations apart, and it repays being planned. With 26-bit frames, give each site a distinct facility code and each site gets a clean 65,536-number space of its own; the controller at Plant A then rejects a Plant B tag on facility code alone, before it ever consults the cardholder table. Two hundred and fifty-six sites is a generous ceiling for most groups. With 34-bit frames the same discipline scales to 65,536 sites, which is enough to allocate by region and depot and still leave room.

Where this pays off is a mixed estate — long-range UHF at the vehicle gates, short-range credentials at the pedestrian doors, one controller behind both. Keeping vehicle tags in their own facility code makes the audit trail readable and makes revocation surgical. The same principle carries over to an RFID access control and attendance system where staff carry one credential and their vehicle carries another.

Check the controller before you order

Confirm it in the controller’s own reader-configuration screen: find the port’s format list and note exactly which bit lengths appear. Then check three things that shape the rest of the design. First, how the controller treats parity, since some validate it and some pass the frame through either way. Second, whether it stores the facility code as part of the credential or works from the card number alone — a controller that works from the card number alone gives you 16 bits and a 65,536-number space, which changes the sizing below. Third, whether the port can be set to a pass-through or raw mode that hands the full frame to the host software; where it can, several of the questions further down answer themselves.

Three routes from EPC to head end

There are exactly three, and they are chosen by the three answers from the first section.

Option A: map a defined field of the EPC

Pick a field, publish it, and prove it. Not “the reader outputs Wiegand” but a written rule: bits b23–b16 of the EPC form the facility code, bits b15–b0 form the card number, even parity over data bits 1–12, odd parity over 13–24. If the tags carry SGTIN-96, that rule reaches into the serial field and nowhere else, which is what you want, because the serial is the only part that varies between two tags on the same product. Then prove uniqueness across the population you will actually issue — not the population today, the population at contract end. Option A costs nothing in hardware and everything in discipline.

Option B: pre-encode tags at commissioning

Write the EPC yourself, at issuance, so that the field the reader maps is a number you chose. In practice: allocate a facility code to the site, allocate card numbers sequentially from a register, and write an EPC whose low 24 or low 32 bits carry exactly that facility code and card number. The register holds the vehicle registration, the full EPC and the Wiegand credential in one row, so the software estate and the controller estate stay in step. This is the strongest option when you control tag supply, and it makes Option A’s uniqueness proof trivial — the numbers are unique because you issued them that way.

Option C: decide on the reader and close a contact

Let the reader decide and close a contact. A reader with general-purpose outputs can be told, in firmware or over LLRP with a SET_READER_CONFIG carrying GPOWriteData, to assert a port for a defined pulse duration when a tag matching a rule appears. The barrier sees a dry contact exactly as it would see one from a push button or a ticket machine. The credential decision has moved onto the reader or onto a local service, and the vehicle lane runs on that decision while the controller continues to run the pedestrian doors. This is the option to take when the tag population is large, when EPCs arrive pre-encoded by someone else, or when the access rule is richer than a card lookup — direction, dwell, tag plus loop, two tags in convoy. Our ReaderSense edge platform exists for exactly this class of decision-on-the-reader work.

Choosing between them

Your situation	A: map an EPC field	B: pre-encode at issuance	C: relay from the reader
You issue every tag yourself	Workable	Best fit	Workable
Tags arrive pre-encoded by a third party	Workable once the duplicate test passes	Use A or C	Best fit
Cardholder database stays as it is	Best fit	Pairs with a re-key	Barrier lane runs independently
Population under about 5,000 vehicles	Workable with 26-bit	Workable	Workable
Population above about 20,000	Use 34-bit	Use 34-bit	Best fit
One lane, one barrier, decision on the reader	Workable	Workable	Best fit
Access rules use direction, dwell or convoy logic	Option C is the route for these rules	Option C is the route for these rules	Best fit

The duplicate test you run before go-live

Truncation collisions surface quietly. The barrier opens, the log fills, and the question arrives months later as a dispute about who entered at 02:14. Run the test while the cabinet is still open.

What the numbers say before you start

If card numbers derive from EPC bits that were not allocated with the Wiegand frame in mind, treat them as effectively random within the space and apply the birthday calculation: the chance of at least one collision among n credentials in a space of d is approximately 1 − e^{−n(n−1)/2d}. For 24 usable bits, d is 16,777,216. That space sounds enormous; the arithmetic puts it in proportion.

Tags issued	Collision risk, Wiegand 26 (24 bits)	Collision risk, Wiegand 34 (32 bits)
250	0.19%	under 0.01%
500	0.74%	under 0.01%
1,000	2.9%	0.01%
2,000	11.2%	0.05%
5,000	52.5%	0.29%
10,000	94.9%	1.2%
20,000	above 99.99%	4.6%
50,000	above 99.99%	25.3%

Five thousand vehicles is an ordinary industrial park or a mid-size university. At that size, a 26-bit frame fed by unplanned EPC bits is more likely than not to contain a duplicate. That is the whole argument for Option B: allocate the numbers and the collision count is zero by construction.

A method that needs no script

Take the full planned population — every tag you will issue over the contract, not the pilot batch. Encode them. Read every one through the mapping you have actually configured, with the reader wired to the controller, and capture the facility code and card number the controller records. Sort the captured list, count distinct values, compare that count to the number of tags read. Any shortfall is a collision, and it will be a collision you can reproduce.

Where the full population cannot be encoded up front, size it so collisions stay at zero. Allocate card numbers from a sequential register rather than from EPC arithmetic, cap the register at 65,535 per facility code, and open a new facility code when it fills. A sequential allocation of 40,000 credentials sits comfortably across two facility codes, since each card field holds 65,535 numbers. Allocating the numbers puts the collision count at zero by construction, which is the standard the commissioning file should record.

What goes in the commissioning file

The mapping rule in words and in bit positions
The facility code or codes allocated, and the register they are issued from
The full list of EPCs read and the credential each produced
The distinct-count check, dated and signed
The re-test rule: repeat the check whenever a new tag batch is encoded

RS-485 and TCP: when the lane needs more than a number

Wiegand does one job well: a fixed-width number, one way, on three conductors. Acknowledgements, error codes, host queries and reader health reporting live on RS-485 or TCP, which is where the next two sections go.

What RS-485 adds

RS-485 is a differential, multi-drop serial bus, and being differential is what buys the distance: it is specified for data rates up to 10 Mbit/s, or for runs up to 1,200 m at low rates. The practical rule of thumb is that bit rate in bit/s multiplied by run length in metres should stay below 10⁸, and below roughly 90–100 kbit/s the length limit stops being rate-dependent and sits at that 1,200 m figure. Cable should be twisted pair of about 120 Ω characteristic impedance, terminated with a 120 Ω resistor at each end of the bus — both ends, and at the ends rather than at every drop.

On that bus a reader can send a tag report with an EPC, an antenna number, an RSSI value and a timestamp, and accept a command back. Several readers can share one pair, which matters when a site has six lanes and one cabinet. The trade is that both ends must agree on a protocol, so RS-485 suits a head end you or your integrator control.

TCP/IP, and where the decision then lives

Over Ethernet the reader talks to a server, and the credential decision moves to software: the full 96-bit EPC, no truncation, no facility code arithmetic, an audit trail with the actual tag identity in it. This is the right architecture when the customer is standing up a new platform anyway.

It introduces one obligation. Keep the barrier interlock local. If the network path decides whether the boom lifts, a switch reboot strands a vehicle in the lane with traffic behind it. Wire the reader’s relay or the controller’s local logic so that a defined local rule — a valid tag in a locally cached list, or a loop-plus-tag coincidence — can raise the barrier with the uplink down, and let the server reconcile the events when it returns. Every lane we commission has a documented answer to the question “what happens with the network unplugged?”, tested with the cable physically out.

Wiring, cable runs, power and grounding

Wiegand’s single-ended 5 V pulses are the reason for its distance limit. Manufacturers commonly publish 150 m (500 ft) as the maximum, and that figure assumes good shielded 18 AWG in a quiet environment; drop to 22 AWG and the same reference puts it at 250 ft, roughly 76 m, with a recommendation to stay nearer 200 ft in real installations. Beyond that limit the failure mode is intermittent bit errors, which parity catches as rejected reads, and the site experiences that as “the reader works most of the time” — which is why the run length belongs in the design rather than in the fault log.

Interface	Conductors	Practical run	What sets the limit	Termination
Wiegand	DATA0, DATA1, GND + shield	150 m at 18 AWG; about 76 m at 22 AWG	Single-ended 5 V pulses, cable capacitance, induced noise	None
RS-485	Twisted pair + GND + shield	1,200 m at 90–100 kbit/s or below	Differential drive; bit/s × metres below 10⁸	120 Ω at both bus ends
Ethernet	4 pairs	100 m per segment	IEEE 802.3 segment length	None

Timing, and why both ends must match

The SIA access-control standard protocol for the 26-bit Wiegand reader interface, SIA AC-01-1996.10, allows a pulse width between 20 and 100 µs and a pulse interval between 200 µs and 20 ms. Real hardware sits inside that: Suprema’s published Wiegand defaults, for example, are a 50 µs pulse width and a 2,000 µs interval. At those settings a 26-bit frame occupies about 53 ms on the wire and a 34-bit frame about 70 ms. At the slow end of the permitted range the same 26-bit frame takes 26 × 20 ms, or 520 ms. Set the reader and the controller to the same values so every bit lands inside the window the controller samples, and write both numbers down.

Shielding, grounding and surge

Use shielded cable and ground the shield at one end only, at the controller. Grounding both ends of a shield on a run between two buildings invites a circulating current through it. Keep the data run out of the same conduit as the barrier motor’s three-phase or single-phase feed — the motor’s switching transients are exactly the interference a single-ended 5 V interface is worst at rejecting. On an outdoor gate, fit surge protection on the data pair and on the mains feed, and bond the reader pole to the site earth; a gate is the tallest metal object in a flat car park and it will take a strike eventually.

Power, and why it caps transmit power

PoE is convenient and it is a budget. IEEE 802.3af delivers 15.4 W from the switch port and guarantees 12.95 W at the device; 802.3at raises that to about 30 W at the port and 25.5 W at the device. A four-port reader running all ports at full conducted power, with a heater in a cold climate and a relay coil energised, can sit above the 802.3af figure — at which point sensible firmware throttles transmit power to stay inside the budget, and the lane quietly loses a metre of range. Where the design needs full power on every port, specify 802.3at or a local supply, and confirm the switch port’s class rather than the switch’s aggregate rating.

Relay contacts

Check the reader relay’s rated current at the barrier’s actual coil voltage, not at 250 VAC resistive from the top of the datasheet. Barrier motors and gate operators are inductive loads; drive them through an interposing relay or the barrier controller’s own dry-contact input rather than switching the motor directly, and fit a flyback diode or RC snubber across a DC coil.

The read zone at a lane

Wiring is only half the retrofit. The other half is putting a defined volume of RF where the tag will be and keeping it out of everywhere else.

Where the tag actually is

A windscreen tag sits behind glass at an angle, and the height difference between a car and a cab-high truck is the single biggest reason a lane that reads every car misses every lorry, or the reverse. Measure both on the customer’s own vehicles at survey, then mount so the beam covers both heights, or plan for two antennas at two heights. Windscreen construction varies from model to model and affects what gets through the glass, so where a site runs mixed vehicles the placement — windscreen, headlamp area, or an external tag — is settled by measurement on those vehicles rather than by argument. That measurement takes half a morning and it decides the antenna schedule.

Gain, beamwidth and tilt

A representative outdoor lane panel gives a useful sense of scale: a circularly polarised UHF panel covering 865–960 MHz with 8.5 dBic gain, a 65° azimuth beamwidth at the 3 dB points, 20 dB front-to-back ratio and a 1 dB axial ratio, in a 259 × 259 × 34 mm radome. Circular polarisation is what lets a tag be read regardless of how the driver stuck it on. The 65° figure is the number to design around: at 4 m from the antenna, a 65° beam is already about 5 m wide, which is wider than one lane. Downtilt, offset and the 20 dB front-to-back ratio are the tools that keep the reader on its own lane; a physical baffle or a metal side plate is the tool of last resort and it works.

Dwell: how long the tag is in the zone

Approach speed	Metres per second	Time in a 2.5 m zone
5 km/h	1.39	1,800 ms
10 km/h	2.78	900 ms
15 km/h	4.17	600 ms
20 km/h	5.56	450 ms
30 km/h	8.33	300 ms

Compare those against the frame time computed earlier: a 26-bit Wiegand frame at typical settings occupies about 53 ms. Even at 30 km/h there is room for several reads and one frame, provided the reader is transmitting through the whole window rather than hopping away mid-approach. In a lower-band deployment the regulatory channel-use rules permit a reader to hold a channel long enough that a single approach fits inside one transmission, which is why session S0 behaviour and short tag populations suit vehicle lanes well.

Power, and the number to write down

Where India’s licence-free band applies, the rules made under G.S.R. 853(E) of 10 December 2021 — expressly in supersession of the 2005 rules — allocate 865–868 MHz for short-range devices. Interrogators may transmit at up to 2 W e.r.p., in channels of no more than 200 kHz, on the four channels centred at 865.7, 866.3, 866.9 and 867.5 MHz, with continuous transmission of no more than 4 s and at least 100 ms between transmissions on a channel; tags reply at −20 dBm e.r.p., against EN 302 208 as the reference standard. Equipment type-approved under the older rules stays valid for its life.

Turn that into a commissioning number. 2 W e.r.p. is 33.0 dBm e.r.p., which is 35.15 dBm e.i.r.p. Take the 8.5 dBic panel above, on a 10 m coax run; the panel is specified in dBic and is carried straight into the e.i.r.p. budget as its gain figure, which is common practice for a circularly polarised lane antenna. A common low-loss 400-series cable is specified at 3.9 dB per 100 ft — 12.8 dB per 100 m — at 900 MHz, so 10 m costs about 1.3 dB, and two connector pairs add roughly 0.2 dB. Conducted power at the reader port is then 35.15 − 8.5 + 1.5 = 28.15 dBm, about 650 mW. Change to a 6 dBi antenna and the same limit permits 35.15 − 6 + 1.5 = 30.65 dBm, about 1.16 W conducted. That single line of arithmetic is the difference between a compliant lane and a guess, and it belongs in the file.

Everything above sizes the zone on paper. The zone is confirmed on site: the read distance at a lane is whatever a site survey at the customer’s gate, with the customer’s vehicles and the customer’s tags, demonstrates it to be.

Commissioning checklist and handover test

The retrofits that go smoothly are the ones where the reader has already met the controller on a bench. Do that first.

Bench test, before the van is loaded

Wire the reader to the same controller model the site runs, on a 3 m cable, and read a tag. Confirm the controller displays a facility code and card number, and that they match the mapping rule you wrote down.
Set pulse width and interval on both ends to the same values, and record them.
Present at least two tags whose EPCs differ only above the mapped field, and confirm the controller sees two different credentials.
Confirm the controller’s behaviour on a parity error — some log it, some pass over it.
Test the relay path and the network-down path where either is in scope.

Lane test, on site

Twenty passes per direction, at the speed vehicles will actually approach, with the vehicles the site actually runs — car, van, cab-high truck.
Record reads per pass and misses per pass. Agree the pass mark in writing before testing, not after a result.
Park a tagged vehicle in the adjacent lane and run the whole sequence again. Adjacent-lane cross-reads are best found at commissioning, which is what this pass is for.
Test with the network unplugged and with the barrier in manual, and confirm the lane falls back to a state the site accepts.

The document set the customer keeps

The mapping definition, in bit positions
The facility code allocation and the card-number register
Reader transmit power as configured, antenna gain, cable loss, and the calculated e.r.p.
Wiegand format, pulse width and pulse interval; or the RS-485 rate, termination and address map
The duplicate-check result, with the distinct count and the tag count
The lane log sheet from the handover test, signed

That file is what makes the installation supportable in three years by an engineer who has never seen it. It is also what makes the next lane a repeat order instead of a fresh investigation.

Our UHF reader models carry WPC ETA and BIS registration for India’s licence-free UHF band, and we build FCC-band and ETSI-band variants configured per order. Because we write the reader firmware as well as building the hardware, the Wiegand mapping, the frame width, the pulse timing and the GPO rules are things we can specify to a customer’s existing controller and put in writing — which is the whole point of a retrofit. If you are scoping one, the practical starting point is a photograph of the controller’s reader-configuration screen and the make of the barrier; more on how we work with integrators on the RFID manufacturer and exporter page.

Frequently asked questions

Can a UHF RFID reader output Wiegand?

Yes. Long-range UHF readers commonly provide a Wiegand port with DATA0, DATA1 and ground, and the access controller treats it exactly as it treats a proximity card reader. The point to settle before ordering is what the port puts on the wire: which bits of the 96-bit EPC become the facility code and card number, and whether the reader can emit 26-bit, 34-bit or both. Ask for that mapping in writing.

How do you convert a 96-bit EPC to a Wiegand 26 card number?

You select from it rather than convert it. A 26-bit frame has 2 parity bits, an 8-bit facility code and a 16-bit card number, so 24 bits of the EPC reach the controller and the remaining 72 stay on the tag. The usual approach is to take the low 24 bits, which for an SGTIN-96 falls inside the 38-bit serial field. Whatever field is chosen, publish it as bit positions and prove the resulting numbers are unique across your whole tag population.

What is the difference between Wiegand 26 and Wiegand 34?

Wiegand 26 (H10301) carries an 8-bit facility code and a 16-bit card number between two parity bits — 24 usable bits, 16,777,216 codes. Wiegand 34 (H10306) widens the facility code to 16 bits, keeping the 16-bit card number, for 32 usable bits and 4,294,967,296 codes. The extra eight bits multiply the credential space by 256, which matters both for large vehicle fleets and for keeping multiple sites in separate facility-code ranges.

How long a cable run can a Wiegand reader drive?

Manufacturers commonly publish 150 m (500 ft) as the maximum, and that assumes good shielded 18 AWG in a quiet electrical environment. At 22 AWG the same reference gives about 76 m (250 ft), with a recommendation to stay nearer 60 m in practice. Beyond the limit the failure mode is intermittent bit errors, which present as a reader that works most of the time, so plan the run length up front. For anything longer, use RS-485.

Can I connect a long-range RFID reader to my existing boom barrier?

In most cases yes, and that is the cheapest way to do the project. Three answers decide the route: which Wiegand frame widths your controller accepts, whether you control tag encoding, and whether the cardholder database can be re-keyed. If all three are favourable, the reader feeds the existing controller on the existing cable. If tags arrive pre-encoded by someone else, drive the barrier from the reader’s relay output and leave the controller running the pedestrian doors.

Should I use Wiegand or RS485 for a long-range UHF reader?

Use Wiegand when the head end is an access controller you are keeping and the run is under about 150 m; it carries a fixed-width number in one direction, which is exactly what such a controller wants. Use RS-485 when you need the full EPC, RSSI, antenna number and timestamps, when several readers must share one cable to one cabinet, or when the run is long — RS-485 reaches 1,200 m at rates around 90–100 kbit/s with 120 Ω termination at both ends of the bus.

How do I stop two vehicle tags reading as the same card number?

Allocate the numbers instead of deriving them. Issue card numbers sequentially from a register, encode each tag so the mapped EPC field carries exactly that number, and open a new facility code when a register passes 65,535. If EPCs are already fixed, run the duplicate test: encode or collect the full planned population, read every tag through the configured mapping, and compare the distinct-credential count to the tag count. With 24 usable bits and unplanned numbering, 5,000 tags carry roughly a 52% chance of at least one collision.