Resolving Siemens RF180C ERR_1 ERR_2 Slow Flashing on S7-1500

Problem Overview

The Siemens RF180C (order number 6GT2002-0BA00) is a PROFINET communications gateway for the SIMATIC RF300 family of industrial RFID readers. When commissioning an RF180C with a SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0) using the official SIMATIC RF300 example project (Entry ID 109483372) under TIA Portal V14, a recurring symptom is the slow synchronous flashing of the front-panel ERR_1 and ERR_2 LEDs while every other LED - LINK, RX/TX, READY, BF - appears normal. This article traces the symptom to its root cause, lays out the diagnostic procedure, and provides the field-proven resolution using the Ident_Profile and Reset_RF300 function blocks of the RF300 function library.

The synchronous slow flash is often misread as a "firmware update in progress" condition because the same pattern is emitted by the loader when an image is being transferred. In steady state, however, the pattern is the RF180C's "reader reset / reader initialize required" indicator. The fix is not to reflash the firmware; it is to drive the readers through their initialization sequence from the S7-1500 application.

Hardware Setup and Part Identification

For the S7-1500 CPU 1512C-1 PN, the article number 6ES7512-1CK00-0AB0 is the original V2.0 release. Successor part numbers such as 6ES7512-1CK01-0AB0 and 6ES7512-1CM02-0AB0 carry different firmware versions and a different system behavior, so be aware of the part number when cross-referencing TIA Portal projects. The example project 109483372_SIMATIC_RF300_RF180C_S7-1500.zip is published for the original V2.0 firmware and runs unchanged on later firmware revisions when recompiled.

For the RF180C, the order number 6GT2002-0BA00 corresponds to hardware revision FS09 (visible in TIA Portal as "Hardware version 9"). The GSDML file used in the project is GSDML-V2.32-Siemens-RF180C-20150826.xml or later. The current firmware at the time of this article is V2.2.1; the device ships with V2.0 from the factory and is upgraded in the field by TIA Portal when the project is downloaded.

Understanding the RF180C LED Array

The RF180C front panel exposes six status LEDs that provide a complete picture of the module's runtime state:

The ERR_1 and ERR_2 LEDs follow the truth table below (per the RF180C operating instructions, document BA_RF180C_76):

The pattern observed in the source article - slow flash on both ERR_1 and ERR_2 in phase - is therefore either an in-flight firmware update or a collective "reader reset required" state. After a firmware update completes, the loader returns the module to OPERATE and the ERR LEDs are cleared by the S7-1500 application issuing a reader reset.

Root Cause Analysis

The RF300 protocol is a "command-driven" protocol: the reader does not enter OPERATE state on its own. The S7-1500 application must explicitly bring each attached reader into OPERATE state by issuing one of the following commands through the RF180C:

1. A "RESET" command via the RESET_RF300 FB (or its newer equivalent in the Ident_Profile FB).
2. An initialization sequence via the Ident_Profile FB (FB 13650 in the RF300 library).
3. A power-cycle of the reader's 24 V supply.

When the example project (Entry ID 109483372) is downloaded to the CPU 1512C-1 PN, the application program contains the Ident_Profile FB and a reset routine. The reset routine, however, is only effective after the application has been started and the OB1 cycle has executed. If the download finished, the CPU is in RUN, and the ERR_1 / ERR_2 LEDs are still slow-flashing, the application is not reaching the reset call - either because:

• The cyclic OB1 is not calling the reset FB (FB removed from the call tree).
• The Ident_Profile FB has the wrong HW identifier (LADDR is a per-port identifier, not a per-module identifier).
• Two Ident_Profile FBs are racing for the same port (duplicate instance DBs).
• The "RF300 / Ident system" HSP is not installed and the FB is a placeholder.
• The RF180C has just been firmware-upgraded, the reset is queued, and the next reset call will clear the LEDs.

The "Firmware V2.0 / Hardware V7.0" offline vs. "Firmware V2.2.1 / Hardware V9.0" online mismatch reported in the source is the smoking gun for a completed firmware upgrade. The user correctly identified this via the device properties in TIA Portal, but misattributed the cause - the RF180C's bootloader is the component that emitted the synchronous slow flash, but the bootloader is now finished and the reader initialization is now the responsibility of the S7-1500 application.

Diagnostic Procedure

Use the following ordered checklist to isolate the root cause of the ERR_1 / ERR_2 slow flash.

Step 1 - Confirm the PROFINET layer

Resolve any BF (Bus Fault) LED before interpreting the ERR_1 / ERR_2 LEDs. A flashing or solid BF LED indicates that the RF180C has no PROFINET cyclic IO exchange and the reader LEDs are not meaningful. The BF LED is cleared by:

• Assigning the correct PROFINET device name (use "Online > Accessible devices > Assign PROFINET device name").
• Confirming the IP address is unique and on the same subnet as the CPU's PROFINET interface.
• Verifying the PROFINET cable integrity (M12 D-coded, max 100 m per segment).
• Confirming the GSDML file in the project matches the RF180C's hardware revision (FS09 requires GSDML from 2015-08-26 or later).

Step 2 - Read the diagnostic buffer

Open TIA Portal and navigate to Online > Online & diagnostics > Diagnostic buffer for the RF180C. The relevant event IDs are:

If the most recent event is 0x0901 followed by 0x0902, the firmware update is complete and the next event should be 0x0302 (port back to OK) once the application issues a reset. If no 0x0302 follows, the application has not yet issued the reset.

Step 3 - Inspect the application program

Open the S7-1500 program blocks in TIA Portal and verify that the following are present in OB1 (or a higher-priority cyclic OB):

• One Ident_Profile FB per RF180C reader port, each with a unique instance DB.
• A "RESET" or "INIT" call at startup, before the first READ or WRITE.
• The LADDR (HW identifier) wired to the correct reader port. The HW identifier is visible in Device view > RF180C > Properties > System constants > HW identifier for each of the 4 ports.
• The reader-specific FBs READ, WRITE, and RESET_RF300 are called only after the Ident_Profile / initialization has returned STATUS = 0.

Step 4 - Watch the LEDs during reset

Force a reset by triggering the FB in the program or by cycling the reader's 24 V supply. The ERR_1 / ERR_2 LEDs should extinguish within 2-3 seconds of the reset acknowledgment. If they remain in slow flash, the reset command was rejected - read the Ident_Profile STATUS output and the diagnostic buffer for the rejection reason.

Solution: Drive the Reader Reset from the S7-1500 Application

The fix is to ensure the S7-1500 application calls the reader initialization FBs. The RF300 function library is part of the "SIMATIC RF300/600 identification system" HSP and is also pre-wired in the example project 109483372.

Required function blocks

Minimum OB1 snippet to clear the ERR LEDs

Insert the following structured text (SCL) into OB1 of the S7-1500. Replace HW_ID_PORT_1 with the system constant for reader port 1 of your RF180C.

// RF180C reader initialization at startup
IF "FirstRun" THEN
  "FirstRun" := FALSE;
  // Issue cold reset to reader port 1
  "iDB_Ident_Profile_P1"(LADDR := "HW_ID_PORT_1",
                          CMD := 16#01,        // RESET command
                          DOP := 16#00,        // Reset mode 0 = cold
                          ADR := 16#00,        // Address 0 = port
                          DONE => "ix_Done_P1",
                          BUSY => "ix_Busy_P1",
                          ERROR => "ix_Err_P1",
                          STATUS => "iw_Status_P1");
END_IF;

// Cyclic call: poll Ident_Profile for completion
"iDB_Ident_Profile_P1"(LADDR := "HW_ID_PORT_1",
                        CMD := 16#00,           // NOP - poll only
                        DOP := 16#00,
                        ADR := 16#00,
                        DONE => "ix_Done_P1",
                        BUSY => "ix_Busy_P1",
                        ERROR => "ix_Err_P1",
                        STATUS => "iw_Status_P1");

Reset command codes (CMD parameter):

The reset mode is set via the DOP parameter for the RESET command:

Verification of the reset

After issuing the reset, verify the following:

1. ERR_1 and ERR_2 LEDs extinguish within 2-3 seconds.
2. STATUS from Ident_Profile reads 0x0000 (OK) or 0x0001 (no command active).
3. Diagnostic buffer shows a new 0x0302 "Channel OK" event for each initialized port.
4. A subsequent READ command returns DONE = TRUE, ERROR = FALSE, STATUS = 0x0000, and a valid transponder UID (4 or 8 bytes depending on the transponder type).

Firmware vs Hardware Version Mismatch

The user observed an offline-online mismatch:

This mismatch is the expected output of a completed firmware upgrade. The RF180C is shipped from the factory with firmware V2.0 and hardware FS07; when the user downloads the project (which targets a newer firmware), TIA Portal prompts to upgrade the firmware to V2.2.1. After the upgrade, the bootloader reports the new firmware version (V2.2.1) and the immutable hardware revision (FS09). The "hardware mismatch" is therefore not a fault - it is a tell-tale that the firmware upgrade has completed.

The user attempted to roll back the firmware to V2.0 using the procedure in Entry ID 51812897 but observed that the hardware version remained at 9.0. This is normal: the hardware revision cannot be downgraded in the field. The user's real complaint, however, was the slow-flashing ERR_1 / ERR_2 LEDs - and that complaint is resolved by driving the reader reset from the S7-1500 application, not by downgrading the firmware.

TIA Portal V14 Project Setup Checklist

Use the following ordered procedure to build a clean RF180C project against the example project 109483372.

1. Install TIA Portal V14 (or V14 SP1 if available). Apply the latest updates via Support packages > Siemens Automation > TIA Portal Updates.
2. Install the "SIMATIC RF300/600 identification system" HSP via Options > Support packages. Restart TIA Portal after the HSP install.
3. Create a new project and add an S7-1500 station with CPU 6ES7512-1CK00-0AB0. The example project supplies the correct device description.
4. Add the RF180C (6GT2002-0BA00) to the PROFINET subnet of the CPU. Confirm the GSDML version matches FS09.
5. Assign a unique PROFINET device name to the RF180C (e.g., "rf180c-1"). Use the "Assign PROFINET device name" tool from the project tree.
6. Open Properties > Module parameters on the RF180C and configure each of the 4 reader ports. Disable any port that has no physical reader attached to avoid spurious channel errors.
7. From the project tree, open the S7-1500 program and verify the Ident_Profile FB is present in OB1. The example project pre-wires it; if you re-built the project from scratch, drag the FB from the library.
8. Confirm the LADDR input of the Ident_Profile FB is wired to the system constant HW_ID_PORT_1 (or the correct port).
9. Compile the project and download to the CPU 1512C-1 PN.
10. Watch the RF180C LEDs during download. The ERR_1 / ERR_2 LEDs will slow-flash during the firmware update; once the update completes and OB1 starts cycling the Ident_Profile, the LEDs will clear.
11. Use Online > Online & diagnostics > Diagnostic buffer to confirm a 0x0302 "Channel OK" event for each port.

Edge Cases and Field-Proven Pitfalls

1. Wrong HW identifier wired to the FB

The HW identifier is per reader port, not per RF180C module. A project with 4 ports requires 4 separate Ident_Profile FBs (or one FB that addresses all 4 ports in series). The most common error is wiring the LADDR of the RF180C module (which does not exist as a single identifier) to the FB. The FB will return STATUS = 0x8600 (hardware fault) and the LEDs will continue to slow-flash.

2. Two Ident_Profile FBs racing for the same port

If two FBs (e.g., a user-written FB and the example-project FB) are both enabled in OB1 with the same LADDR, the reader will reject the second command and the first will time out. The pattern is identical to the firmware-update pattern: slow-flash ERR_1 / ERR_2. Resolution: comment out or delete the redundant FB instance.

3. TIA Portal V14 with the wrong CPU firmware

The example project 109483372 was built for CPU V2.0. If you are running the project on a CPU 6ES7512-1CK01-0AB0 (V2.1+), the program will download, but the Ident_Profile FB may not initialize correctly because the system constants changed. Re-compile the project to the new firmware (right-click the CPU > "Compile all" with the new CPU as the target).

4. Multiple readers attached to a single port

The RF180C has 4 ports, and each port supports exactly one reader. If you daisy-chain readers on a single port, the second reader will not be detected and the ERR LED for that port group will slow-flash.

5. M12 7/8" power not connected

The RF180C's reader ports are powered by a separate 24 V supply on the M12 7/8" connector. If the 24 V is missing, the readers will not power up and the ERR LEDs will slow-flash. Verify the M12 7/8" cable and the 24 V supply.

6. Long cycle time of the cyclic OB

The Ident_Profile / RF300 FBs have a watchdog time of 100 ms by default. If the cyclic OB has a longer cycle time, the readers will be flagged as "lost" and the ERR LEDs will slow-flash. Solutions: (a) call the FB in OB1 with a higher priority, (b) reduce the OB cycle time, (c) increase the RF180C's watchdog time in Properties > Module parameters > Watchdog.

7. PROFINET name not unique

If two RF180C modules on the same PROFINET subnet have the same device name, the BF LED will flash (not the ERR LEDs) and the cyclic IO will be exchanged with the wrong module. The symptom is readers that "work" in TIA Portal's online view but respond to commands for the wrong port. Resolution: assign a unique device name to each RF180C.

8. Mixed firmware across multiple RF180C modules

If the project contains more than one RF180C and they have different firmware versions (e.g., one V2.0 from the factory, one upgraded to V2.2.1), the firmware-update prompt will be issued for both. After the upgrade, all modules will report V2.2.1 / FS09 online, but only the modules that received the update will have the new firmware loaded. Verify with Online > Accessible devices > Module information that all modules show the same firmware version.

Status Code Reference for Ident_Profile

The STATUS output of the Ident_Profile FB is the primary diagnostic for failed reset, read, and write commands. The most common values are:

Frequently Asked Questions