Resolving the Siemens RF180C "Read Stuck in BUSY" Fault with RF350R Readers and MOBY E Tags

This technical reference documents a field-verified fault in which an ET 200SP CPU 1512SP running TIA Portal V15 with the Ident library V5.1 commands an RF180C communications module connected to two RF350R readers with ANT18 antennas. The system interrogates MOBY E MDS E623 transponders. The Reset_RF300 block returns DONE = TRUE and clears the LEDs, but every subsequent Read call latches BUSY = TRUE indefinitely and never returns DONE, ERROR, or transponder data. The root cause is a known loop defect in the Ident optional package V4.1 / library V5.1 Read block path. The fix is to roll the Read/Write blocks back to Ident blocks V4.0 while keeping the V4.1 optional package, or upgrade TIA to V15.1+ and adopt Ident library V5.2.

1. Affected System Topology

The hardware chain reported in the field fault is a representative Siemens SIMATIC Ident topology. Use it as a reference for your own station.

The RF180C is a PROFINET IO device that exposes a Siemens Ident profile channel to the CPU. Each RF350R occupies a logical channel; the two readers are usually assigned to channel 0 and channel 1 of the same RF180C (verify in your HWCN — see diagnostic section). The CPU calls the Ident Function Block (FB) on the assigned channel; the FB serializes a command frame, hands it to the Ident profile, and the RF180C transmits it to the addressed reader.

2. Technological Object Configuration That Triggers the Fault

The reported configuration that produces the BUSY latch is reproduced below. The values are correct for MOBY E; the problem is not the configuration — it is the library/optional package that compiles the FBs against this object.

3. Root Cause: Ident Library / Optional Package Mismatch

Siemens distributes the RFID/RFID function blocks as an "Ident blocks" library (FB45/FB55/FB56/FB300-style blocks depending on generation) plus an optional package (the TIA option file that adds the Ident profile, channel wizards, and the FB source variants). On TIA Portal V15 the engineering station will default to the newest Ident optional package V4.1 combined with the matching Ident library V5.1.

Field troubleshooting on the reported station shows:

1. Reset_RF300 uses a short, single-frame command and completes.
2. Read issues a multi-step command (INIT → READ → END). With Ident library V5.1 / optional package V4.1, the block is observed to enter an internal handshake loop and never advances the BUSY state to DONE or ERROR.
3. Swapping the read/write blocks in the project to the V4.0 version of the Ident block source (while leaving the V4.1 optional package installed) restores normal command sequencing.
4. Upgrading TIA Portal to V15.1 or later and adopting Ident library V5.2 is the forward-compatible fix and is recommended for new projects.

This is a software/firmware version compatibility fault, not a hardware fault. Replacing the RF180C, RF350R, ANT18, or MDS E623 will not resolve the BUSY condition. The Ident diagnostic buffer in TIA (Devices & Networks → RF180C → Online & Diagnostics → Ident profile) typically shows the command accepted at the channel level, with no corresponding completion record — consistent with a stalled client-side state machine, not a transport error.

4. Diagnostic Procedure

Run the following steps in order. They are designed to separate library defects from real RF/wiring faults so you do not chase a hardware replacement when the cause is purely software versioning.

4.1 Confirm the TIA / Library / Optional Package Versions

1. In TIA Portal, open Project tree → Options → Support packages and note the installed Ident optional package version (e.g., Ident_Blocks_V4.0, Ident_Blocks_V4.1).
2. Open the Project library tab and inspect the version of the Ident block you are calling. Right-click the FB → Properties → Version. Record both the block family (RF300) and the version (e.g., V5.1).
3. Record the TIA Portal version: Help → About → TIA Portal Information → Installed Software. The reported station: TIA V15, library V5.1 → vulnerable to the V4.1 loop bug.
4. Cross-check on a second engineering PC if possible. The corrupted package can be cached locally; a clean install of TIA V15 with the same Ident support package should reproduce the same fault.

4.2 Validate the RF180C Channel Address Mapping

The BUSY condition can also be triggered by mismatched logical address wiring between the RF180C and the technological object. Confirm:

1. Open Devices & Networks → RF180C → Properties → Module parameters → Ident channel. Note the start address of input and output ranges (e.g., I 100..107 / Q 100..107 for channel 0, I 108..115 / Q 108..115 for channel 1).
2. Open the technological object the FB is bound to. Confirm the hardware identifier and the channel index match the RF180C. If the FB is wired to a stale HwID from a previous module replacement, the FB will spin on BUSY waiting for an acknowledge that never arrives.
3. Right-click the RF180C → Assign IO address to technological object if TIA offers it. This guarantees the HwID and channel reference are consistent.

4.3 Read the Online Diagnostic Buffer

1. Go online to the CPU.
2. Open Online & Diagnostics → RF180C → Diagnostic buffer for each channel.
3. Look for "Ident command started" followed by the absence of a "Ident command finished" entry. The presence of a started entry without a matching finished is the fingerprint of the V4.1/V5.1 stall.
4. Also inspect the technological object → Diagnostics page. Busy will be permanently TRUE; Status will not advance; Error will be FALSE; Command in progress will display the Read request that was issued.

4.4 Isolate Hardware vs. Library

The fastest discriminating test is the one the original maintainer used:

1. Take a backup copy of the project.
2. Delete the Read instance and reinsert the Ident block V4.0 version of the Read FB.
3. Recompile and download only the program blocks (not the HWCN — leave the device configuration as is).
4. Re-run the Read call. If it now completes, you have a library defect and the hardware is healthy.

If the V4.0 block also stalls, the cause is downstream of the FB and you should verify the RF180C ↔ RF350R cable, the +24 V supply to the readers, and the antenna air gap (see Section 6).

5. Resolution

5.1 Recommended Fix (Long Term): Upgrade to TIA V15.1 and Ident Library V5.2

1. Update TIA Portal to V15.1 or higher (V16, V17, V18 are also valid; the V5.2 / newer library family is the supported line).
2. Install the matching Ident optional package for the new TIA version.
3. Update the Project library entries for the Ident FBs to the new version.
4. Reinsert the technological objects; TIA will automatically migrate the parameters.
5. Recompile fully (Hardware + Software), then download to the CPU.
6. Run the verification sequence in Section 7.

5.2 Hotfix (Keep TIA V15): Downgrade the Read/Write Blocks to V4.0

This is the workaround the maintainer adopted in the field. It is a project-local fix that does not require re-installing TIA.

1. Open the Global libraries pane in TIA V15.
2. Locate the older Ident blocks V4.0 library (or open a reference project that contains it). Note: the optional package version in the project is V4.1, but the V4.0 block source can coexist with it because the FB compiles against the same Ident profile interface.
3. Drag the V4.0 Read and Write FBs into your Project library.
4. Replace the V5.1 instances in your program with the V4.0 instance, keeping the same instance DB or recompiling to a new one.
5. Verify the I/O / HwID wiring is unchanged.
6. Compile and download.
7. Run the verification sequence in Section 7.

5.3 Hardware Sanity Checks While You Are Inside the Cabinet

While the project is open and the panel is exposed, verify the wiring per the Siemens RF180C operating instructions:

• 24 V supply to RF180C: 19.2 V – 28.8 V DC at the module, with the on-module LED green.
• RF180C ↔ RF350R cable: Use Siemens pre-assembled cable 6GT2891-0CHxx or pinout per the manual; the RS-422 pair is not interchangeable with a standard Ethernet cable.
• ANT18 connection: Confirm the antenna pigtail is seated; the ANT18 is a separate accessory with its own cable.
• Transponder distance: MOBY E with the ANT18 typical read range is approximately 0–100 mm depending on tag orientation and metal environment.
• Multiple transponders in the field: RF300 air interface with MOBY E is a single-tag-per-inventory model; if two MDS E623 are in the antenna field simultaneously, the Read will return collision handling and the FB may stay BUSY waiting for the application's anti-collision response.

6. Fault Decision Matrix

Use this matrix to rapidly rule in / rule out the library defect against other common causes of an Ident FB stuck in BUSY.

7. Verification Procedure

After applying the fix, the following sequence confirms the fault is cleared and the system is healthy. Run it from a watch table with the CPU in RUN.

1. Reset_RF300 test: Trigger the reset on channel 0. Confirm DONE = TRUE within 2 s and the channel status returns to READY.
2. Presence check: Place an MDS E623 in front of ANT18. Confirm the presence bit toggles to TRUE within < 100 ms and back to FALSE when removed.
3. Read test: Trigger Read on a 16-byte data block starting at offset 0. Confirm BUSY goes FALSE and DONE goes TRUE within ~200 ms. The output buffer should contain the last 16 bytes written to the tag.
4. Write test: Write a known pattern (e.g., ASCII "RFID_TEST_0001") to a free page. Read it back and compare at the SCL/ST level.
5. Error path test: Remove the tag during a Read. Confirm ERROR = TRUE, STATUS contains the expected transponder not present code, and BUSY = FALSE. This verifies the FB state machine advances on errors as well as on success.
6. Channel 1 repeat: Repeat steps 1–5 for the second RF350R to confirm the fix is global, not per-channel.
7. Diagnostic buffer review: Open the RF180C diagnostic buffer; confirm every command has a matching finished entry, with no orphan started entries.

8. Common Ident STATUS Codes

When the system is healthy, the FB reports status codes in the STATUS output. A BUSY-without-DONE-and-without-ERROR condition is the V4.1 loop signature; once fixed, these are the codes you will see:

For the complete list, refer to the SIMATIC RF180C operating instructions and the Ident profile error code appendix.

9. Ident Library / Optional Package Compatibility Reference

The following table summarizes which Ident optional package / library pairing has been field-verified to work cleanly with the RF180C + RF350R + MOBY E configuration. Use it to plan TIA upgrades.

10. Field-Engineering Notes and Caveats

• Single vs. multipoint: The RF180C can host up to two RF350R readers. If you have one reader and the second channel is enabled in the technological object with no physical reader attached, the FB for the second channel can stall in BUSY. Disable the unused channel in the RF180C device configuration.
• OB1 vs. cyclic: If Read is called from a fast OB (e.g., OB35 at 100 ms), and the response is slower than the OB period, the FB will queue and may appear stuck if the instance DB is not being reset on cycle re-entry. Always call the Ident FBs with the standard edge-triggered REQ pattern from a slower task or use the cyclic mode setting on the TO.
• PROFINET send clock: The RF180C default send clock is 1 ms. If the controller is set to 0.25 ms, the RF180C may reject the AR. Check Properties → PROFINET interface → Real-time settings → Send clock on both controller and device.
• Tag memory boundaries: MOBY E MDS E623 has a fixed user memory size (verify the exact variant — the family includes 992 byte and 1984 byte versions). Reads or writes outside the boundary return 0xE1FE_0B00.
• Reset LED vs. reset command: The Reset LED parameter in the technological object only controls the reader LED after a reset; it is unrelated to the Reset Reader command. Do not conflate the two.
• PROFINET naming: The RF180C must have a unique PROFINET device name in the project; a duplicate name causes the IO AR to come up but the Ident channel to stay disabled. Symptoms look similar to the BUSY stall — confirm the device name is unique before chasing a library defect.
• Firmware consistency: If you mix an old RF180C firmware (e.g., V1.0) with a new Ident library, the FB can hang. Update the RF180C firmware to the latest version available in the Siemens support downloads before declaring the FB at fault.

11. FAQ