Configuring Siemens RFID210 IO-Link on ET 200S in TIA Portal

The SIMATIC RF200 IO-Link reader family (RF210R, RF260R, RF261R) talks to a controller through an ET 200S station equipped with the 4SI IO-Link master module. Each reader exchanges exactly 8 bytes of cyclic process input data (PII) and 8 bytes of cyclic process output data (PIQ). This article walks through the hardware integration of an RF210R on an IM 151-3 PN head-end, the TIA Portal device configuration, the SIMATIC S7-PCT port settings, the bit map of the PIQ/PII process image used to read an MDS D124 Moby D transponder, and the firmware-level Read Only constraint that explains why user memory writes are dropped.

1. System Overview and Architecture

The reference architecture has three logical layers:

1. IO-Link RFID reader - SIMATIC RF210R (order number 6GT2821-2AC10), operating at 13.56 MHz against ISO/IEC 15693 transponders such as the MDS D124.
2. ET 200S IO-Link master - 4SI IO-Link electronic module (6ES7138-4GA50-0AB0) plugged into a TM-E terminal block behind the IM 151-3 PN interface (6ES7151-3BA23-0AB0).
3. Controller - ET 200S CPU IM 151-8 PN/DP (6ES7151-8AB01-0AB0) or any S7-1200/S7-1500 connected over PROFINET.

2. Hardware Components and Order Numbers

3. Wiring the 4SI IO-Link Port

The 4SI module exposes four Type A M12 ports. Pin assignment of each port is:

• Pin 1: +24 V switched supply (L+), up to 200 mA
• Pin 3: 0 V (M)
• Pin 4: C/Q - IO-Link signal or digital I/O

Maximum cable length between the 4SI and the RF210R is 20 m per the IO-Link specification. Use a shielded 3-conductor cable (Siemens 6XV1840-2AH10 or compatible) and ground the shield at the cabinet entry point.

4. TIA Portal Device Configuration

1. Open TIA Portal V17 or later and add the IM 151-3 PN as the ET 200S head module from the hardware catalog.
2. Insert the 4SI IO-Link electronic module into slot 1 of the ET 200S station and confirm the assigned TM-E terminal block.
3. Open the device view of the 4SI module. Under "Properties > IO-Link > Port 1" select "IO-Link device". From the device catalog pick "RF210R" (or import the IODD via "Options > Manage IODD files").
4. Confirm the slot occupies 1 input word and 1 output word of PROFINET cyclic data. For the 8-byte PII / 8-byte PIQ requirement the slot is configured with the IODD-defined length.
5. Assign the PROFINET device a unique station name (e.g. "et200s-rfid") and a fixed IP address consistent with the project IP scheme.
6. Compile the configuration and download to the IM 151-3 PN.

5. SIMATIC S7-PCT Port Configuration

The SIMATIC Port Configuration Tool is launched from the 4SI module's context menu in the TIA Portal device view ("Start S7-PCT"). S7-PCT performs the IO-Link commissioning: it loads the IODD, sets vendor-specific parameters, and defines the cyclic process data length. For the RF210R the recommended settings are:

The Operating mode selection determines what is returned in the cyclic PII without any PIQ command:

• Scan user data: The first 4 bytes of user memory at address 0 are returned in PII bytes 4..7, refreshed every PROFINET cycle (~1 ms).
• Read UID: The first 4 bytes of the 8-byte UID are returned in PII bytes 4..7. The full UID requires an explicit read command using PIQ bit 0.

6. Process Image Structure (PIQ and PII)

The 8-byte PIQ / 8-byte PII structure is documented in the Siemens RF200 IO-Link manual entry 60641859, sections 5.2 (PIQ) and 5.3.3 (PII). The exact bit assignment depends on the reader firmware revision; the table below reflects firmware V1.0 of the RF210R. Always verify against the "Identification" tab of S7-PCT for the connected device.

6.1 Process Data Output (PIQ) - Controller to Reader

6.2 Process Data Input (PII) - Reader to Controller

7. Why All PII Bytes Read Zero

The original symptom - all 8 PII bytes stuck at 16#00 - has three common root causes and a fourth that is normal behaviour:

1. IO-Link not established. The 4SI port is still in DI/DO mode (the green "Port" LED on the 4SI is OFF or steady yellow instead of steady or flashing green). S7-PCT must switch Port 1 to IO-Link; selecting "IO-Link device" in the device view alone is not sufficient on older 4SI firmware revisions.
2. IODD not loaded. Without the IODD, TIA Portal cannot resolve the device description and the slot may map 0 bytes of cyclic data. Import the IODD via "Options > Manage IODD files" and reassign the device at Port 1.
3. Operating mode left at default "Inactive". The reader returns all zeros until the PCT Operating mode is set to "Scan user data" or "Read UID".
4. No transponder in field with ANT_OFF set. When the antenna is off and no tag is present, PII bytes 4..7 return 16#FF by design. Setting ANT_OFF without first verifying the antenna was previously on (and no tag was detected) will produce 16#00, not 16#FF.

Verify before continuing: open "Online & Diagnostics > IO-Link diagnostics" on the 4SI port and confirm port status is "OPERATE". The "IO-Link diagnostics" faceplate lists any cyclic-data errors and the current port state.

8. Reading the UID from MDS D124

The MDS D124 is part of the Moby D family and stores an 8-byte UID at address 0x00 in the manufacturer-reserved UID bank. To read the UID with the RF210R in firmware V1.0:

1. In PCT set Operating mode to "Read UID".
2. Drive PIQ bit 0 (RD) for one PROFINET cycle to trigger an explicit read.
3. Set PIQ bytes 1..3 to 0x00 0x00 0x00 (UID always starts at address 0).
4. Wait for PII bit 2 (RD_DONE) to be set.
5. Read PII bytes 4..7 - these contain the first 4 bytes of the UID. The remaining 4 bytes of the UID are read by re-issuing the command at address 0x04.

Sample SCL code (S7-1500 or IM 151-8 CPU, tags "RFID_PIQ" and "RFID_PII" of type AT pointing at the slot's I/O area):

// ----- Tag declarations (DB "DB_RFID") -----
// start_read  : Bool  - request from HMI or logic
// uid_bytes   : Array[0..7] of Byte
// read_active : Bool
// read_done   : Bool
// err_flag    : Bool

"DB_RFID".transponder_present := "RFID_PII".Byte_0.%X1;
"DB_RFID".read_done          := "RFID_PII".Byte_0.%X2;
"DB_RFID".err_flag            := "RFID_PII".Byte_0.%X4;

IF "start_read" AND NOT "DB_RFID".read_active THEN
    "RFID_PIQ".Byte_0.%X0 := 1;     // RD = 1 (rising edge)
    "RFID_PIQ".Byte_1 := 0;         // Address LSB
    "RFID_PIQ".Byte_2 := 0;         // Address MID
    "RFID_PIQ".Byte_3 := 0;         // Address MSB
    "DB_RFID".read_active := TRUE;
END_IF;

IF "DB_RFID".read_active AND "DB_RFID".read_done THEN
    "RFID_PIQ".Byte_0.%X0 := 0;     // Clear RD
    "DB_RFID".uid_bytes[0] := "RFID_PII".Byte_4;
    "DB_RFID".uid_bytes[1] := "RFID_PII".Byte_5;
    "DB_RFID".uid_bytes[2] := "RFID_PII".Byte_6;
    "DB_RFID".uid_bytes[3] := "RFID_PII".Byte_7;
    "DB_RFID".read_active := FALSE;
END_IF;

9. Reading User Memory from MDS D124

Switch PCT Operating mode to "Scan user data". The reader then continuously reads the first 4 bytes of user memory at address 0 and places them in PII bytes 4..7 on every PROFINET cycle. No PIQ command is required - the data is updated automatically.

To read user data at an arbitrary address, leave PCT in "Read user data" and use the explicit command mode:

// Read 4 bytes from user memory address 0x0010
IF "start_read_user" AND NOT "DB_RFID".read_active THEN
    "RFID_PIQ".Byte_0.%X0 := 1;         // RD
    "RFID_PIQ".Byte_1 := 16#10;          // Address LSB
    "RFID_PIQ".Byte_2 := 16#00;          // Address MID
    "RFID_PIQ".Byte_3 := 16#00;          // Address MSB
    "DB_RFID".read_active := TRUE;
END_IF;

IF "DB_RFID".read_active AND "DB_RFID".read_done THEN
    "RFID_PIQ".Byte_0.%X0 := 0;
    "DB_RFID".user_data[0] := "RFID_PII".Byte_4;
    "DB_RFID".user_data[1] := "RFID_PII".Byte_5;
    "DB_RFID".user_data[2] := "RFID_PII".Byte_6;
    "DB_RFID".user_data[3] := "RFID_PII".Byte_7;
    "DB_RFID".read_active := FALSE;
END_IF;

The MDS D124 provides 112 bytes of user memory, addressable from 0x0000 to 0x006F, organized in 28 blocks of 4 bytes. Sequential reads at successive addresses can collect the entire memory, but each read requires one PIQ command and one PROFINET cycle latency.

10. Why Writing User Data Does Not Work

The SIMATIC RF200 IO-Link readers are firmware-classified as Read Only readers. The Siemens application example 73565887 states explicitly: "With RF200 IO-Link Reader you can only read user data ('Read Only' Reader)."

This is a hardware limitation of the RF200 IO-Link firmware family (V1.0 and later). The PIQ bit WR (bit 1) is decoded by the firmware and the write command is silently dropped - the reader will not write to the transponder. Setting PIQ bit 1 produces no error and no WR_DONE acknowledgement; PII byte 0 bit 3 (WR_DONE) remains 0 because the firmware never executes the write.

To write user memory on Moby D transponders, replace the RF210R with one of the following alternatives:

If the application requires writing to the MDS D124, the simplest migration path is the RF310R plus an RF170C communication module on PROFINET. The standard Siemens Ident library provides pre-built function blocks (FB 45 "Read", FB 55 "Write", FB 65 "Initialize") that handle command sequencing, error recovery, and tag presence monitoring without manual bit manipulation.

11. Sample Ladder Logic for ET 200S CPU

The following STL snippet is compatible with the IM 151-8 CPU (and any S7-300/400 with the IM 151-3 PN) and reads 4 bytes of user memory on the rising edge of "start_read_user":

// Network 1 - edge detection
A "start_read_user"
FP "DB_RFID".edge_start_user
S "DB_RFID".read_active

// Network 2 - drive RD bit
A "DB_RFID".read_active
= "RFID_PIQ".Byte_0.%X0

// Network 3 - load start address 0x0010 (PIQ bytes 1..3)
A "DB_RFID".read_active
JCN NOVR
L B#16#10
T "RFID_PIQ".Byte_1
L B#16#00
T "RFID_PIQ".Byte_2
L B#16#00
T "RFID_PIQ".Byte_3
NOVR: NOP 0

// Network 4 - terminate command on RD_DONE or ERR
A "RFID_PII".Byte_0.%X2
O "RFID_PII".Byte_0.%X4
R "DB_RFID".read_active

// Network 5 - copy read data
A "RFID_PII".Byte_0.%X2
JCN END
L "RFID_PII".Byte_4
T "DB_RFID".user_data[0]
L "RFID_PII".Byte_5
T "DB_RFID".user_data[1]
L "RFID_PII".Byte_6
T "DB_RFID".user_data[2]
L "RFID_PII".Byte_7
T "DB_RFID".user_data[3]
END: NOP 0

12. Diagnostics and Watch Tables

Create a watch table in TIA Portal that monitors the 8-byte input and output ranges assigned to the 4SI slot. The expected behaviour when an MDS D124 is within the read range:

• PII byte 0 = 16#07 (ANT=1, TP=1, RD_DONE=1) - if Operating mode is "Scan user data".
• PII byte 0 = 16#07 only after an explicit RD command has been issued - if Operating mode is "Read UID".
• PII bytes 4..7 = first 4 bytes of UID (Read UID mode) or first 4 bytes of user memory at address 0 (Scan user data mode).

The 4SI also exposes port-level diagnostics through PROFINET alarms; an S7 "GET_DIAG" call (FB 126 in the S7-1500 diagnostics blocks) returns the current port status as a DWORD that can be mapped to an HMI tag.

13. Troubleshooting Matrix

14. Ident RFID Faceplate in TIA Portal V17+

TIA Portal V17 introduced the "Ident RFID" screen as part of the Automation Framework library. The screen is documented at 8.6.7 Ident RFID and provides a unified HMI faceplate for:

• Displaying the current PII status (antenna state, transponder present, error)
• Displaying UID and the most recent read user data
• Triggering read commands from the HMI
• Showing the active Operating mode (Scan user data / Read UID)

The Ident RFID faceplate requires the Automation Framework library to be installed and the RF reader to be configured with the Ident profile blocks. When using the raw IO-Link PIQ/PII interface as described in this article, you can still bind the same tags to a custom HMI screen - the underlying data model (8 bytes PII, 8 bytes PIQ, status byte, UID bytes) is identical.

15. Field Commissioning Checklist

1. Wire the RF210R to Port 1 of the 4SI module using a shielded 3-conductor IO-Link cable (max 20 m). Observe LED activity on both ends after power-up.
2. Import the IODD file for the RF210R firmware version using S7-PCT ("Options > Manage IODD files").
3. Configure Port 1 as IO-Link in PCT and set the cyclic data length to 8 bytes input / 8 bytes output.
4. Select Operating mode = "Scan user data" for continuous user-memory reads, or "Read UID" for tag identification.
5. Download the ET 200S configuration and verify the Port 1 LED turns steady or flashing green.
6. Place an MDS D124 in the antenna field and confirm PII byte 0 bit 1 (TP) goes high.
7. Trigger an RD command from the program (PIQ bit 0 = 1 for one cycle) and capture PII bytes 4..7 in a watch table.
8. If writing is required for the application, plan a migration to RF300/RF600 plus the Ident profile function blocks. The RF200 IO-Link firmware cannot be unlocked for writes.

16. Reference Documentation

• SIMATIC RF200 IO-Link manual (entry 60641859) - PIQ/PII structure, sections 5.2 and 5.3.3.
• Application example: RF200 IO-Link Reader (entry 73565887) - declares the RF200 as Read Only.
• TIA Portal Automation Framework - 8.6.7 Ident RFID - HMI faceplate for RF200/RF300/RF600 diagnostics.
• SIMATIC ET 200S distributed I/O system manual (entry 6ES7151-3BA00-series) - module compatibility and PROFINET configuration.