Resolving Siemens RF260R Error 0xE6FE03 on S7-300 with RF185C

Error 0xE6FE03 on a Siemens RF260R reader attached to an S7-300 through an RF185C communications module almost always points to a parameter-assignment fault in the IdentProfile WRITE-CONFIG telegram — most commonly because the air-interface selection byte (byte 16) was copied from an RF300 sample program and left at the RF300 default instead of being set to 0x01 for the RF200 family. This field reference walks through the exact byte layout, the diagnostic logic, and the step-by-step fix that gets the Init command returning 0x0000 on a brand-new RF260R/RF185C/S7-300 station.

1. Problem Overview

During commissioning of a SIMATIC RF260R (6GT2811-0AA00 / -0AA01) RFID reader connected through an RF185C communications module (6GT2002-0HD00) to a SIMATIC S7-300 CPU — using the RS422 variant of the RF260R — the user program issues the standard IdentProfile INIT command from OB1. The STATUS output of the Ident function block returns 0xE6FE03 within one or two OB1 cycles and the reader never comes online. The link LED on the RF185C is steady green, eliminating a layer-1 RS422 wiring problem; the diagnostic buffer of the S7-300 CPU shows the IdentProfile FB terminating in error.

The Siemens Ident Profile documentation lists 0xE6FE03 under two related conditions:

• Bad parameter assignment of the Ident instruction (mismatch between user-program data block, HW Config, and the selected reader family).
• Length of the input/output areas too small for the cyclic I/O word (the LEN parameter at the block input does not match the actual I/O address space allocated to the RF185C in HW Config).

Both interpretations point in the same direction: the data sent to the reader on the WRITE-CONFIG telegram is inconsistent with the physical reader that is wired to the RF185C. In 90 % of field cases reported to Siemens support, the root cause is the air-interface byte at the end of the 16-byte WRITE-CONFIG payload being set to the RF300 default when the actual hardware is RF200. The same sample project that ships with the Ident Profile manual entry ID 109978379 is built against RF300 hardware and will fault against an RF260R unless byte 16 is corrected.

2. Hardware Topology

The reference setup for this error consists of three logical blocks: the S7-300 station, the RF185C communications module, and the RF260R reader. They are linked by two different bus systems, both of which have to be configured correctly for the IdentProfile to initialize.

2.1 Component references

3. Error Code 0xE6FE03 — Definition and STATUS Handling

In the Siemens Ident Profile, every FB exposes a STATUS output word of data type WORD. The high byte is the error class and the low byte is the sub-code, allowing 65 535 distinct error states. 0xE6FE is the error class for parameter or configuration problems, and 0x03 is the sub-code that covers both bad parameter assignment and cyclic I/O area too small. The full 16-bit value 0xE6FE03 has bit 15 set, which the Ident Profile defines as "this is an error; clear and re-initialize before re-issuing REQ."

The general rules for evaluating STATUS on S7-300 / S7-400 IdentProfile blocks are described in the Siemens S7-300/S7-400 error-messages documentation:

• Inspect STATUS immediately after every REQ rising edge.
• If STATUS = 16#0000, the command was accepted and DONE is set within one cycle.
• If STATUS has bit 15 set (any value ≥ 16#8000), it is an error; clear or re-initialize the command path before re-issuing REQ.
• Bits 0–7 of the low byte are the sub-code; always log the full 16-bit value, not just the high byte.
• After an error, the FB enters a fault state and remains in it until a fresh INIT = TRUE pulse is applied.

4. Root Cause — Air-Interface Mismatch in WRITE-CONFIG

The IdentProfile WRITE-CONFIG command is sent once during the INIT phase to inform the reader family which air interface it should use. For RF260R (RF200 family), byte 16 of the 16-byte payload must be set to 0x01. For RF300 readers, the default from the standard sample is a different value (the value copied from the RF300 example in the project template); for RF600, a different value applies. Re-using an RF300 sample project against an RF260R leaves byte 16 at the RF300 default, and the RF185C rejects the telegram with 0xE6FE03 as soon as the reader NACKs the configuration request.

The Siemens manual "Ident profile and Ident blocks, FB 45 / FB 55 / FB 56 / FB 79–82 with S7-300 / S7-400 / ET 200S / ET 200pro" — support entry ID 109978379 — covers the WRITE-CONFIG layout on page 79 and the air-interface byte on page 85. The exact statement: byte 16 of the WRITE-CONFIG payload must be set to 0x01 for the RF200 family.

4.1 Step-by-step logical breakdown

1. CPU powers up; OB1 calls the Ident FB with INIT = TRUE.
2. FB composes the WRITE-CONFIG telegram from the user DB (16 payload bytes plus 8-byte Ident header) and posts it to the RF185C over the backplane.
3. RF185C forwards the telegram to the RF260R over RS422 at 19.2 kbit/s or 57.6 kbit/s, depending on the module DIP switch.
4. RF260R reads byte 16 of the payload, expects 0x01 (RF200), receives the RF300 default value, replies NACK.
5. RF185C sets STATUS = 16#E6FE03 on the FB and clears DONE / BUSY.
6. The PLC stays offline for the reader; the user sees the error in VAT, HMI, or webserver diagnostics.
7. Until byte 16 is corrected, every subsequent REQ returns the same status because the FB never progresses past the configuration step.

5. IdentProfile Block and WRITE-CONFIG Data Structure

The Ident FB family in the S7-300 environment is documented in the Siemens Ident Profile manual. The relevant command for the air interface is WRITE-CONFIG, which is sent as a 16-byte payload following the standard Ident header. The byte that the RF200 family checks is the last byte of the payload, byte 16 (1-indexed) at offset 15 (0-indexed).

The 16-byte payload is part of a larger command frame, but the byte that determines which physical reader family is being addressed is byte 16 (1-indexed), offset 15 (0-indexed). In STL, the assignment looks like this:

// User DB that backs the Ident FB (e.g., DB 200)
DATA_BLOCK DB200 "IdentConfig"
  STRUCT
    abConfig : ARRAY[0..15] OF BYTE;   // 16-byte WRITE-CONFIG payload
  END_STRUCT;
BEGIN
  abConfig[0..14]  := 16#00;           // 15 reserved bytes
  abConfig[15]     := 16#01;           // byte 16 = 0x01 selects the RF200 air interface
END_DATA_BLOCK

After the DB has been loaded into the S7-300, the FB reads from DB200.abConfig via its DATA / LEN inputs and forwards the array to the RF185C. The LEN input must equal 16 (the full payload length); a smaller value causes the FB to truncate the telegram and the RF260R receives a malformed WRITE-CONFIG — another path to the same 0xE6FE03.

6. Resolution Procedure

The fix has three components: (a) correct the air-interface byte in the user DB, (b) verify the I/O length in HW Config matches the FB LEN input, and (c) re-issue the Init with a clean STATUS. The first two are the parameter side; the third is the verification.

6.1 Prerequisites

• STEP 7 V5.5 / V5.6 (or TIA Portal V16+) with the SIMATIC Ident library installed.
• The IdentProfile manual downloaded for offline reference (support entry ID 109978379).
• Online connection to the S7-300 station (MPI, PROFIBUS, or PROFINET).
• Wiring of the RF260R to the RF185C already verified — link LED on the RF185C green, 24 V measured at the reader terminals between 22 V and 26 V.
• Write permission for the user DB that backs the Ident FB.

6.2 Step-by-step

1. Open the user DB that holds the WRITE-CONFIG payload (in the failing project this is the DB referenced by the DATA input of the Ident FB; commonly DB200 or a project-specific DB).
2. Set byte 16 to 0x01. In the Data View, navigate to the last byte of the 16-byte array and change the value to 16#01. Save the DB and download it to the CPU (target system → download).
3. Cross-check the I/O length. In HW Config, select the RF185C and read its input and output start/end addresses. The default after inserting the module is typically 4 input bytes / 4 output bytes. For a 16-byte WRITE-CONFIG the FB expects at least 16 bytes in each direction. Either widen the HW Config I/O area to 16 bytes per direction or — if the FB allows it — set the LEN input to 4 and accept that 16-byte commands are not supported on this slot. In practice, always widen the I/O area to 16 bytes.
4. Reset the Ident FB. Drive INIT high for one OB1 cycle, then low; this re-arms the STATUS register and clears any latched fault state from the previous Init attempt.
5. Re-issue Init. Set INIT = TRUE for one OB1 cycle. If using a one-shot REQ on a flag (recommended), make sure the rising edge fires after the STATUS register has been cleared.
6. Monitor STATUS and DONE. With the corrected payload, STATUS should drop to 16#0000 within 1–2 OB1 cycles and DONE should rise for one cycle.
7. Run a sanity READ. Issue a simple READ command with a known MDS tag (e.g., MDS D324, 6GT2600-0AD10) in the antenna field. The FB should report tag presence in the user buffer; if it does, the RF200 air interface is fully operational.

6.3 STL example for the user program

// OB1 — cyclic Ident handling
CALL "IdentProfile_FB", DB100
  REQ    := M10.0          // rising edge triggers Init or read/write
  INIT   := M10.1          // TRUE for the first cycle, then FALSE
  DATA   := P#DB200.DBX0.0 BYTE 16
  LEN    := 16             // must match array length; do not truncate
  // ... other inputs ...
  STATUS := MW12
  DONE   := M10.2
  ERROR  := M10.3

Where DB200 holds the 16-byte WRITE-CONFIG payload with byte 16 (offset 15) = 16#01 (RF200 air interface). For a READ or WRITE command, change REQ to drive the same FB with a different command code; the DATA pointer and LEN must match the new command's payload length, and the byte-16 air-interface selector must remain 0x01 because the reader was initialized with the RF200 air interface during the INIT step.

7. Verification and Commissioning Checks

After the corrected payload is in place, the following checks confirm the fix and isolate any remaining issue:

1. STATUS = 16#0000 after Init — the most important indicator. A non-zero value here means the parameter assignment is still wrong or the reader family mismatch persists. Log the full 16-bit value and decode it against the error-class table in section 3.
2. Link LED on RF185C steady green — confirms RS422 physical layer is healthy. A flashing LED indicates telegram errors that may have a different cause (wiring, termination, baud-rate DIP switch on the back of the module).
3. Presence of a transponder detected on the first READ — place an ISO 15693 tag (e.g., MDS D324, 6GT2600-0AD10) in the antenna field at no more than 0.20 m from the RF260R face. The FB should report presence in the user buffer within 50–150 ms.
4. Online > Monitor > I/O on the RF185C — verify the cyclic I/O words toggle in response to commands, indicating end-to-end data flow. A static I/O area with all zeros is a strong hint that the FB has never written to it, often a symptom of a wider LEN mismatch.
5. Diagnostic buffer of the RF185C — should be empty after a clean Init. Any diagnostic entry here suggests a layer-1 or layer-2 issue (RS422 wiring, termination, or EMC) that has to be cleared before revisiting 0xE6FE03.
6. S7-300 diagnostic buffer — should not contain "I/O access error" or "module not reachable" entries. If it does, the RF185C slot addressing in HW Config does not match the physical slot.
7. Webserver of the CPU (CPU 315-2 PN/DP, CPU 317-2 PN/DP) — the diagnostic pages mirror the FB status and provide a remote view when no MPI/PROFIBUS is available at the panel.

8. The "Cyclic I/O Length Too Small" Interpretation

The same 0xE6FE03 can also be raised when the I/O area configured in HW Config is too narrow. This is more often seen on S7-300 stations where the RF185C was placed with default I/O length (e.g., 4 bytes in / 4 bytes out) and the user code later expanded to a 16-byte payload command. The FB composes a longer telegram than the I/O area can carry, and the RF185C truncates the request — the reader receives a malformed WRITE-CONFIG and rejects it.

Recommended values for a single RF185C handling a 16-byte WRITE-CONFIG plus the standard Ident header:

If the station has multiple Ident slaves sharing a single RF185C, the I/O length must be sized for the largest command in the program; truncation of the largest command will raise 0xE6FE03 on every Init until the area is widened. If the slot is already at the maximum supported by the RF185C (32 bytes in / 32 bytes out), split the configuration into multiple RF185C modules or shorten the largest command by re-architecting the user DB to use acyclic READ / WRITE commands instead of the 16-byte WRITE-CONFIG.

9. Related Error Codes and Diagnostic Matrix

Always refer to the S7-300 / S7-400 error-messages documentation for the general STATUS-handling rules, and to the Ident Profile manual (109978379) for the 0xE6FE family sub-codes. Do not interpret 0xE6FE sub-codes as hardware faults unless the parameter assignment has been verified first — most 0xE6FE* errors are configuration issues, not defective readers.

10. RF200 vs RF300 Air Interface Selection Reference

11. FAQ