Resolving S_RCV Error 1E0E and 1E10 on ET200S 1SI RS232 with S7-1500

When commissioning an ET 200S distributed I/O station with the 1SI serial interface module (6ES7 138-4DF01-0AB0) on a SIMATIC S7-1500 controller, engineers frequently encounter persistent STATUS outputs of 16#1E0E and 16#1E10 on the legacy S_RCV instruction. These status words indicate that the receive block cannot bind to the serial port. The root cause is almost always a misconfigured LADDR input—the parameter is being wired with the module's I/O start address instead of the Hardware Identifier (HWID) that TIA Portal assigns to the slot. This article walks through the diagnosis, the correct configuration, the supporting RS232 interface specifications, and the verification procedure required to bring the link up.

1. Problem Description

The reported fault occurs in the following hardware topology:

• Controller: SIMATIC S7-1511-1 PN (6ES7 511-1BK02-0AB0 or later firmware release) on PROFINET.
• Head-end: IM 151-3 PN (6ES7 151-3AA23-0AB0) terminating the ET 200S rack on PROFINET.
• Serial module: 1SI 6ES7 138-4DF01-0AB0 inserted in the ET 200S backplane, configured for RS232 transmission (not RS422/485).
• End device: A measurement gauge exposing an ASCII/RS232 port.
• Programming environment: STEP 7 Professional V14 (or higher) in TIA Portal.

The S_RCV instruction is called cyclically in OB1. The output STATUS returns hexadecimal 16#1E0E on every call, alternating with 16#1E10 depending on the runtime state. The ERROR and DONE bits never transition to TRUE, so no data is delivered to the receive DB. The module itself is reachable in the device view, is reporting no diagnostics in the IM 151-3 PN diagnostic buffer, and the physical LEDs on the 1SI module indicate normal operation (no SF/BF LED lit).

2. Error Code Reference

Both error codes are produced by the legacy point-to-point instruction set when the runtime cannot bind the call to a valid point-to-point port.

Both codes point to the same physical layer of the problem: the LADDR input is not pointing at the Hardware Identifier of the 1SI's serial interface. Once the correct identifier is wired into the block, both status codes clear and the receive buffer starts populating.

3. Root Cause — LADDR Mismatch

The S_SEND and S_RCV instructions predate the S7-1500. They were originally written for S7-300 CP 340/341 and S7-400 CP 440/441 point-to-point modules, and were carried forward as long-form FBs in the S7-1500 for migration scenarios. In the original S7-300/400 environment the LADDR input was filled with the logical base address of the CP — the same address that appeared in the hardware catalog under "I/O addresses."

On the S7-1500 platform the same FBs were generalized to support not only the new CM PtP modules (such as CM PtP RS232 BA (6ES7540-1AD01-0AA0) and CM PtP RS232 HF (6ES7541-1AD01-0AB0)) but also distributed point-to-point modules such as the ET 200S 1SI and the ET 200SP CM PtP. To unify the address model, the LADDR input on the S7-1500 was redefined to accept the Hardware Identifier — a 16-bit (or 32-bit on newer FBs) symbolic handle assigned by TIA Portal to each submodule during device configuration.

Engineers migrating S7-300 code or copying logic from a sample project frequently retain the I/Q start address at the LADDR pin. The block then performs an internal lookup that fails, returning 16#1E0E. The 16#1E10 returns occur on subsequent cycles because the runtime has now created a partial binding object that conflicts with itself.

4. Locating the Hardware Identifier in TIA Portal

There are three reliable methods to retrieve the Hardware Identifier for the 1SI module's serial interface.

4.1 Method A — Module Properties Dialog

1. Open the ET 200S station in the Device view of TIA Portal.
2. Click the 1SI module (6ES7 138-4DF01-0AB0) in the rack.
3. Open the Properties inspector (lower pane, "General" tab).
4. Navigate to System constants or to Hardware identifier.
5. Note the numeric value shown (for example 266). The same value is also published as a constant under the default name ~1SI_Slot1_Interface in the PLC tag table.

4.2 Method B — Default Tag Table

1. Expand PLC_1 > PLC tags > Default tag table.
2. Switch the view filter to Show all tags or filter on the constant prefix ~.
3. Locate the constant whose name references the 1SI module (e.g. ~1SI_1, ~1SI_1_Interface_1, or the renamed HWID_1SI).
4. The data type is HW_IO or HW_INTERFACE; the value is the numeric HWID.

4.3 Method C — System Constants View

1. From the project tree, right-click the S7-1500 CPU and select Information > System constants.
2. Filter the list by the 1SI module's name or by interface type Point-to-Point.
3. Copy the value directly into the LADDR input of the S_RCV / S_SEND call.

5. Step-by-Step Resolution Procedure

Prerequisites

• TIA Portal V14 or higher installed.
• The S7-1500 program containing the 1SI module and the S_RCV / S_SEND FBs.
• Online connection to the CPU (PROFINET or PROFIBUS).
• Read/write access to the project.

Procedure

1. Compile the project before going online. This populates the system constants and forces TIA Portal to assign a stable Hardware Identifier to every slot in the ET 200S station.
2. Open the FB / OB containing the S_RCV call. Double-click the LADDR input of the block. The I/O field shows whether the parameter is a constant, a tag, or unconnected.
3. Replace the start address with the Hardware Identifier discovered in Section 4. Use a symbolic reference (e.g. "1SI_Slot1_Interface") whenever possible so that the address follows the slot if you reorder the rack later.
4. Save and download the hardware configuration and the program block to the CPU. Use "Download to device > Hardware and software" so the new system constants are pushed to the PLC.
5. Reset the CPU (cold restart) to clear any partial binding objects from the previous configuration. The reset is necessary because the runtime keeps the old LADDR binding in its session state until a restart.
6. Monitor the call online. The STATUS output should now return 16#0000 (or the documented "no data yet" code) and NDR should pulse TRUE each time the 1SI module receives a complete frame.

6. Verification Procedure

After the LADDR correction has been downloaded, validate the link end-to-end with the following checks.

6.1 Online STATUS Inspection

1. Open the OB1 watch table with the S_RCV instance open.
2. Confirm STATUS = 16#0000 when no data is in flight.
3. Trigger a transmission from the gauge and confirm NDR pulses for one cycle, with the receive DB populated and a non-zero LEN output.

6.2 Module Diagnostic Buffer

1. In the project tree, right-click the IM 151-3 PN and select Online & diagnostics > Diagnostic buffer.
2. Look for "Port initialized" or "Protocol ASCII active" events. Any entry referencing "Port not configured" or "binding error" means the runtime is still resolving to a stale identifier.

6.3 LED Pattern

6.4 Loopback Test

1. Disconnect the gauge and insert a loopback plug (TX ↔ RX) on the 1SI port.
2. Send a known ASCII string via S_SEND and read it back with S_RCV.
3. If the loopback works but the gauge does not, the binding is correct and the residual problem is in the physical layer (cable, shielding, gauge-side protocol).

7. RS232 Interface Electrical Specifications

The 1SI 6ES7 138-4DF01-0AB0 implements a voltage-mode RS232 interface. The same electrical model applies to the modern S7-1500 CM PtP RS232 BA and HF modules (6ES7540-1AD01-0AA0 / 6ES7541-1AD01-0AB0) and to the ET 200SP CM PtP, so the same precautions apply across the platform.

8. Hardware Configuration in TIA Portal

Open the device view of the ET 200S station and click the 1SI module. The configuration tabs that matter for the RS232 link are listed below.

Save the configuration and download it. The Hardware Identifier is finalized at this point and is stable across compiles unless the slot order changes.

9. S_RCV / S_SEND Call Pattern in SCL or LAD

The 1SI module is driven by the long-form point-to-point FBs. The following SCL snippet shows the recommended call pattern.

// S_RCV — receive data from the gauge
"S_RCV_DB"(REQ   := bTrigger,
           CONT  := TRUE,
           LADDR := "1SI_Slot1_Interface",  // Hardware Identifier, NOT start address
           BUF   := P#DB_Rx.DBX0.0 BYTES 200);

if "S_RCV_DB".NDR then
    iRxLen := "S_RCV_DB".LEN;
    bNewFrame := TRUE;
end_if;

if "S_RCV_DB".ERROR then
    wStatus := "S_RCV_DB".STATUS;   // 16#1E0E / 16#1E10 on misconfiguration
end_if;

// S_SEND — transmit command to the gauge
"S_SEND_DB"(REQ   := bSend,
            CONT  := TRUE,
            LADDR := "1SI_Slot1_Interface",
            BUF   := P#DB_Tx.DBX0.0 BYTES 50,
            LEN   := iTxLen);

Notice the symbolic reference at LADDR. This binds the call to whatever Hardware Identifier TIA Portal assigned to the 1SI module, and it survives recompiles and slot reorders.

10. Alternative — Send_P2P / Receive_P2P for S7-1500

For new programs, Siemens recommends the native Send_P2P / Receive_P2P / Receive_Reset_P2P instructions, which are part of the SIMATIC S7-1500 base library. These instructions use the same Hardware Identifier model and expose richer diagnostics, including per-port error codes, buffer overrun counters, and parity-error statistics. The legacy S_SEND / S_RCV remain in the catalog specifically to support the 1SI migration scenario described in this article.

The Siemens TIA Portal help "RS232 mode (S7-1500)" lists the modules that participate in the new instruction model:

• CM PtP RS232 BA — 6ES7540-1AD01-0AA0
• CM PtP RS232 HF — 6ES7541-1AD01-0AB0
• CM PtP (ET 200SP) — 6ES7137-6AA00-0BA0 family

Migration to the ET 200SP platform is recommended where the application is being modernized; the 1SI itself remains in production for installed base support but is no longer the recommended choice for new S7-1500 installations.

11. Troubleshooting Matrix

12. Sample Program Reference

Siemens publishes a sample program for the 1SI ASCII protocol on the ET 200S — file zXX21_10_1SI_ASCII.zip for STEP 7 (TIA Portal). The archive contains:

• A reference project for STEP 7 V13 (and an updated build for V14 SP1).
• Pre-wired S_SEND / S_RCV calls with the LADDR set to the symbolic Hardware Identifier.
• An ASCII test pattern generator and a watch table for verification.

If the project must be opened on a different TIA Portal version than the one used to create it, use File > Open > Migrate project rather than re-saving. The migration path preserves the binding between the symbolic constant and the HWID.

13. Frequently Asked Questions