How it works, and what it does not protect · chapter 3 of 4 · 5 minutes
3 How a tag is actually read, from the request to the answer
What happens between an application asking and a battery-less tag answering — the tone it reflects, the queue it has to win, and why every command starts with an inventory.
Built from §6.2.2.1 §6.2.3.1 §5.2.2.1 §5.2.2.2 §5.2.2.3 §5.2.2.4
3.1 Why a tag with no battery can answer at all
Making a radio wave needs an oscillator, a mixer and an amplifier, and each of those costs more power than a tag running on scavenged energy will ever hold. So the cheapest Ambient IoT tag does not have one.
Instead a carrier-wave node — a transmitter whose only job is to hum — sends one plain tone with nothing written on it TS 38.194. The tag sits in that tone and switches what its antenna looks like, so more or less of the tone bounces back. That switching is the message.
The physical layer writes it as a multiplication: what comes back is the tag's own pattern times the carrier that was already there TS 38.291.
Nothing in that asks the tag to make a wave, so the requirement placed on it is not transmit power but backscatter loss — how much weaker the reflection is than the tone that produced it TS 38.191.
3.2 The other direction is a light switch
Downwards, the reader is ordinary equipment doing something plain: it turns its output on and off TS 38.300. That is all a tag with a diode and a comparator can read — light, or dark TR 38.769.
There is no error correction on that link at all, and no coding step in the chain. Every message opens with a timing pattern instead — eight fixed bits saying a message is starting, then four more sent at the rate the message will use, so the tag can read the rate off them TS 38.291.
3.3 An inventory, step by step
The accept in step 5 is an acknowledgement and nothing else. The request has been taken, not answered, and no tag has heard anything yet §6.2.2.1.
Steps 7 and 8 exist because everything the page matches answers in the same instant. So the tags are made to queue: a slot is a time and a frequency at once, and two tags that pick the same instant but different frequency shifts do not collide TS 38.391.
The report in step 9 is one message of the tag's own signalling language, and it carries no protection at all TS 24.369.
The parts doing the work — the front door, the Ambient IoT Function, the credential store — are the subject of What an Ambient IoT system is made of, and what an unprotected report costs is What the security protects, and what it leaves open on purpose.
3.4 There is no command without an inventory
Commanding a tag therefore starts by finding it. The one difference is a follow-on indication in the request, telling the base station that a command comes after the inventory §6.2.3.1.
Four command types exist §5.2.2.1. Read and Write move bytes out of and into the tag's own memory §5.2.2.2; Permanent Disable stops it answering an inventory ever again §5.2.2.3; Application-Specific hands over a lump of data the network does not look inside §5.2.2.4.
3.5 The number behind the odd design
The cheapest device's clock may be off by 1% to 10% TR 38.769. Almost everything above bends around that one figure.
It is why known patterns are put in the middle of a message and not only at the front TS 38.291: a tag that has lost the beat can find it again on the way past.
It is also why the tags queue in time and frequency and nothing else. Letting many of them share one slot by giving each a different code was set aside, because with that much drift the codes stop telling each other apart TR 38.769.
Check yourself
Answers appear when you pick one, with where they come from.
Q3.1 What has the network done by the time the application is told its inventory request was accepted?
The accept travels back in steps 5 and 6; the readers only broadcast the page in step 9, after it. §6.2.2.1
Q3.2 How does one tag win the right to send its report?
The page opens a set of slots, the tag chooses one and invents a random number, and hearing its own number back is what tells it the slot is its own. TS 38.391
Q3.3 How does a command procedure begin?
Steps 7 to 11 of the command procedure are steps 7 to 11 of the inventory procedure, so the tag is found before it is commanded. §6.2.3.1
Q3.4 Why does the cheapest tag need no transmitter?
A carrier-wave node emits one plain tone and the tag switches how much of it its antenna returns, so there is nothing to generate. TS 38.194
Q3.5 What does the cheapest device's clock accuracy explain?
With that much drift the tag loses the beat partway through a message, so it is given something to re-read the timing from on the way past. TS 38.291
This chapter was written against TS 23.369 version 20.0.0, and built from a source register generated 2026-08-04. A newer version of the document may say something else.