Siemens RF680R: Diagnosing EPC Tags Not Transmitted via OPC UA

David Krause12 min read
OPC / OPC UASiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Overview

The SIMATIC RF680R (firmware V4.0) reports EPC tag reads in its diagnostic web pages and TIA Portal trace, but a subset of those tags never propagate to the downstream consumer. The downstream consumer in the reported case is a geolocation service that subscribes to the reader's OPC UA server and uses tag IDs to assign physical positions.

This is a data-flow symptom, not a read symptom. The reader's air-interface layer is working: it can decode the EPC and report it. The fault is downstream of the air interface, in the pipeline that converts an air-interface event into an OPC UA notification. The pipeline involves read-point triggering, event filtering, observable-condition evaluation, and OPC UA publish.

Symptom signature. A contiguous range of EPC IDs (in the field case, the 184.77 and 184.12 EPC variants) is reliably detected by the RF680R antenna but is invisible to the OPC UA client, while neighbouring EPCs in the same physical space and at similar RSSI levels are forwarded normally. This is the diagnostic fingerprint of a filter or trigger condition, not a hardware fault.

System Architecture

The RF680R is a UHF RFID reader in the SIMATIC Ident RF600 family. It integrates a UHF air interface (860–960 MHz, EPC Class 1 Gen 2 / ISO/IEC 18000-63), an internal antenna, and an industrial Ethernet interface. With the OPC UA server option enabled, the reader exposes the standard SIMATIC Ident OPC UA address space over TCP port 4840 (default) and publishes tag presence, tag loss, and read-result events to subscribed clients.

Component Role Relevant configuration
RF680R (6GT2811-0AA0x) Air interface + OPC UA server WBM, TIA Portal Ident profile, FW V4.0
Antenna 1 (internal) UHF read field Radiated power, RSSI threshold
OPC UA client (geolocation service) Subscriber of tag events Subscription filter, keep-alive
EPC tags (UHF Class 1 Gen 2) Transponders in field EPC memory bank, TID, user memory

Root Cause Analysis

When the air interface sees a tag, the reader's event pipeline runs the tag data through four filter layers before it is published. A failure at any one of these layers will produce exactly the symptom reported: tag detected in trace, not delivered to OPC UA.

Layer 1 — Read-point trigger conditions

The read point in the RF680R can be configured to require a trigger source (digital input, PROFINET command, presence of a specific tag, or a cyclic scanner) before evaluating air-interface reads. If the trigger is permissive, the read point is always active and every read propagates. If the trigger is conditional (for example, a digital input rising edge or a PROFINET record from a controller), reads that occur outside the trigger window are discarded before event generation.

Diagnostic check: in WBM under Read points → Configuration → Trigger, set the trigger source to none temporarily and observe whether the missing tags now appear. If they do, the trigger condition is the cause.

Layer 2 — RSSI and antenna selection

The reader compares the measured RSSI of each tag against the configured RSSI threshold and the per-antenna RSSI delta. The RSSI delta is the minimum RSSI improvement required to consider a new read of an already-known tag as a "new" event. A tag whose RSSI varies by less than the delta during the dwell time will be filtered as a duplicate and will not produce a fresh observable event.

In the reported case, the affected tags (184.77, 184.12) and the working tag (184.76) are at similar RSSI levels, so the threshold is unlikely to be the cause unless the threshold is set very close to the measured RSSI of the failing tags.

Layer 3 — Observable / presence event evaluation

The RF680R exposes two event types: TagPresence and TagObserved. TagObserved is fired for every successful read; TagPresence is fired only on state transitions (tag enters or leaves the field). If the OPC UA client is subscribed to TagPresence and a tag is already in a "present" state, repeated reads will not generate events until the tag leaves and re-enters.

This is the single most common cause of "tag is detected but not sent" reports. A reader that is parked over a stationary tag with the OPC UA client subscribed to TagPresence will deliver the tag exactly once, when the tag first enters the field, and never again until it leaves.

Layer 4 — OPC UA server filters and blacklists

The RF680R OPC UA server supports a filter list (EPC prefixes, mask-based) and an optional blacklist. A misconfigured filter that matches the EPC prefix of the failing tags will silently drop them at the server. The blacklist takes priority over the whitelist.

Diagnostic Procedure

Use the following ordered procedure to isolate the failing layer. Each step is non-destructive and reversible.

  1. Capture a WBM read trace. Open the RF680R Web-Based Management (WBM) at https://<reader-ip>/, navigate to Diagnostics → Read points, enable the trace log, and read 50–100 samples of the failing tag. Confirm the EPC, RSSI, antenna, and timestamp are present. If the trace shows the tag, the air interface and Layer 1 are working.
  2. Verify OPC UA server is enabled. In WBM, go to Interfaces → OPC UA and confirm the server is enabled and the endpoint is bound to the correct network interface. Note the port (default 4840) and the security policy.
  3. Confirm the OPC UA client connection. Use a generic OPC UA client (Siemens OPC UA Scout, UaExpert, or the reader's own WBM test page) to browse the Objects → DeviceSet → RF680R → ReadPoint node. If the failing tag does not appear under the reader's LastObservedEpc or CurrentPresence node, the fault is in the event pipeline, not in OPC UA transport.
  4. Switch the subscription to TagObserved. If the client only sees TagPresence, change the monitored item to TagObserved. The failing tag should appear on the next read cycle.
  5. Disable the read-point trigger. Set the read-point trigger to none and repeat the read. If the failing tag now appears in the OPC UA stream, the trigger condition is the root cause and must be reconfigured for the production sequencing.
  6. Clear the OPC UA filter list. In WBM, Interfaces → OPC UA → Filter, export the current filter, then disable it. Re-test. If the failing tag appears, the filter is misconfigured.
  7. Verify the EPC length and memory bank. Some tags are programmed with EPC lengths that differ from the reader's expected bank. Read the tag's PC (Protocol Control) word and the EPC length. A PC word indicating an EPC length of zero or a non-standard bank will be parsed as a read failure at the application layer even though the air interface succeeded.

Configuration Parameters

The following parameters control the event pipeline. Values are entered either in TIA Portal (Ident profile → RF680R → Configuration) or in the WBM.

Parameter Path (WBM) Effect Default
Trigger source Read points → Trigger Defines when the read point is active none (always active)
RSSI threshold (dBm) Read points → Air interface Minimum RSSI to accept a read −65 dBm
RSSI delta (dB) Read points → Air interface Min. RSSI change to re-fire an event 0 dB (off)
Event type OPC UA → Subscription TagPresence or TagObserved TagPresence
Filter list OPC UA → Filter EPC prefixes that are forwarded empty (all)
Blacklist OPC UA → Filter EPC prefixes that are dropped empty
Dwell time (ms) Read points → Timing Min. time a tag must be present 100 ms
Duplicate suppression Read points → Timing Suppression window for repeated EPCs 0 ms (off)
Configuration mismatch between read points. When multiple read points are defined on a single RF680R (for example, one per virtual antenna port), each read point has its own trigger, RSSI threshold, and event-type settings. The "missing" tags may simply be assigned to a read point that is configured to drop them. Verify the read point assignment under Read points → Tags → Mapping.

OPC UA Event Model

The SIMATIC Ident OPC UA server on the RF680R follows the OPC UA for SIMATIC Ident companion specification. The relevant nodes are:

  • ns=1;s=DeviceSet/<DeviceName>/ReadPoint/<RP>/CurrentPresence — boolean, true while the tag is in the field.
  • ns=1;s=DeviceSet/<DeviceName>/ReadPoint/<RP>/LastObservedEpc — string, the most recent EPC read.
  • ns=1;s=DeviceSet/<DeviceName>/ReadPoint/<RP>/LastObservedRssi — int16, RSSI in dBm.
  • TagPresenceEventType — fired on enter and leave transitions.
  • TagObservedEventType — fired on every successful read that passes the filter chain.

Confirm the address space against the official SIMATIC Ident OPC UA documentation before scripting the client. The exact node IDs depend on the device name and read-point name assigned in TIA Portal.

EPC Data and Tag Compatibility

The reader is indifferent to the tag vendor, but the tag's programmed EPC must conform to the EPC Class 1 Gen 2 / ISO/IEC 18000-63 specification. Common reasons a particular tag EPC is silently dropped even though it is read cleanly:

  1. Non-standard PC word. The Protocol Control word bits 0x0003 specify the EPC length in words. A value of 0 indicates "no EPC" to the reader, even if the tag returns a payload.
  2. Reserved or private EPC identifiers. Some vendors programme EPCs that start with a vendor-specific prefix. If the OPC UA filter is configured with a wildcard prefix that excludes the vendor prefix, the tag is dropped.
  3. Tag orientation and antenna polarisation. A tag that is consistently read at RSSI = threshold is a statistical read. The RF680R will report it intermittently. If the OPC UA client expects a deterministic stream, the intermittent tag appears to "not be sent" even though it is sent approximately once per second.
  4. Collision handling. When multiple tags are in the field simultaneously, the reader's anti-collision algorithm (Q algorithm) may defer reads of weaker tags. A tag that is consistently the weakest in the field can be read less often than its neighbours and may appear to be dropped when the OPC UA client is polling instead of subscribing to events.

Firmware and Compatibility Notes

Firmware V4.0 on the RF680R introduced changes to the OPC UA event model and to the filter list semantics. Earlier firmware (V2.x, V3.x) used a single filter; V4.0 added the explicit blacklist/whitelist structure. When upgrading from V3.x to V4.0, a filter that was previously permissive may become restrictive if the import process did not migrate the filter list correctly.

Before any firmware change, export the full WBM configuration and the TIA Portal Ident profile. After the upgrade, diff the filter list and trigger settings against the pre-upgrade export.

Verification

After applying a fix, run the following verification sequence:

  1. Place the previously failing tag in the read field. Capture 60 seconds of WBM trace. Confirm at least 50 reads with valid EPC, RSSI, and timestamp.
  2. Subscribe the OPC UA client to TagObservedEventType. Confirm the failing tag's EPC appears in the event stream within 2 seconds of the read.
  3. If the production design requires TagPresence, confirm the transition (enter) event fires once on field entry and the transition (leave) event fires within the configured absence timeout (default 2 s) on field exit.
  4. Repeat for 10 tag cycles (enter / leave). All 10 cycles must produce a clean enter and leave event pair.
  5. Capture a packet capture on the OPC UA port (default 4840) and confirm the publisher is sending Publish responses within the client's requested publishing interval (default 100 ms). No retransmission storm should be visible.

Troubleshooting Matrix

Symptom Likely layer Verification Fix
Tag in WBM trace, not in OPC UA stream Layer 3 or 4 Check event type, filter list Switch to TagObserved, clear filter
Tag in WBM trace intermittently, not at all in OPC UA Layer 2 Check RSSI threshold vs measured RSSI Lower threshold by 3 dB
Tag missing from WBM trace and OPC UA Air interface or trigger Disable trigger, raise power, check antenna cable Hardware or trigger config
All tags missing from OPC UA, WBM fine OPC UA server / client Browse with UaExpert, check endpoint Re-enable OPC UA server, check firewall
Tags in same EPC prefix all missing, others fine Layer 4 (filter) Export and inspect filter list Remove or correct the prefix mask

Safety and Operational Notes

UHF RFID readers radiate electromagnetic energy in the 860–960 MHz band. Local radio regulations (ETSI EN 302 208 in the EU, FCC Part 15 in the US) limit the effective radiated power. Do not increase the radiated power above the regulatory limit when trying to recover marginal reads. If the failing tag cannot be read at the regulatory limit, the tag is the problem, not the reader. Use a different tag inlay, reposition the tag, or reorient the antenna.

When the OPC UA client is a safety-relevant consumer (for example, a position service that drives a vehicle or a guard interlock), subscribe to TagObserved rather than TagPresence, and apply a client-side confirmation timeout that requires N consecutive reads of the same EPC before the position is accepted. This prevents a single dropped event from causing a safety incident.

FAQ

Why does the RF680R detect a tag in the WBM trace but not send it over OPC UA?

The reader's event pipeline applies four filters (trigger, RSSI/threshold, observable-vs-presence, OPC UA filter/blacklist) between the air-interface read and the OPC UA publish. A tag can pass the air interface and fail one of the downstream filters. Most often, the OPC UA client is subscribed to TagPresenceEventType and the tag is already in a present state; switch the monitored item to TagObservedEventType to receive every read.

How do I check the OPC UA filter and blacklist on a Siemens RF680R?

Open the WBM at https://<reader-ip>/, navigate to Interfaces → OPC UA → Filter. The whitelist and blacklist are listed separately. Export the configuration before any change so you can restore it if the change is incorrect.

What is the default OPC UA port on the RF680R?

The default port is 4840. The endpoint URL is opc.tcp://<reader-ip>:4840. The endpoint, port, and security policy are all configurable in the WBM under Interfaces → OPC UA.

Can a specific EPC value cause the reader to silently drop the tag?

Yes. A non-zero OPC UA filter list with an EPC mask that matches the failing tag's prefix will drop those tags at the server. A PC word of 0 in the tag's EPC memory bank is interpreted by the reader as "no EPC" and the read is discarded. Confirm both via the WBM filter page and by reading the tag's PC word with a separate UHF interrogator.

How do I verify that OPC UA events are reaching the downstream geolocation service?

Subscribe a generic OPC UA client (UaExpert, Siemens OPC UA Scout) to the same endpoint the geolocation service uses, and monitor TagObservedEventType and TagPresenceEventType. If the events appear in the test client but not in the geolocation service, the fault is in the geolocation client (subscription, keep-alive, filter), not in the reader.

Back to blog