Troubleshooting Siemens RK512 NAK Errors on CP341 Current Loop

Overview of the RK512 Failure Mode

The RK512 protocol is a Siemens-defined point-to-point serial communication profile that runs on top of the 3964(R) data-link layer. It is widely used to bridge legacy S7 CPUs to non-Siemens controllers, third-party baggage-handling subsystems, security/safety PLCs, and OEM packages such as L3 aviation equipment. When the serial path is well terminated, RK512 is reliable. The failure mode discussed in this reference is a recurrent, non-reproducible stream of negative acknowledgments (NAK) that appears on a single CP341-equipped S7-312 station even when five other identical stations on the same plant run clean for weeks.

The root cause is not in the S7 program, the FB block, or the Profibus topology. The root cause is current-loop corruption introduced by an active 20 mA current-loop interface inside a Telebyte Model 65A RS-232 to Current-Loop converter, which silently mangles the bit-timing of RK512 frames at runtime. The fix documented below replaces the CP341-1 current-loop variant with a CP341-RS232C variant and adds a second Telebyte 65A at the PLC (passive) side so the current loop exists only between the two Telebyte units, not between the Telebyte and the CP341.

System Topology of the Reference Installation

Six S7-312 stations are deployed. Three of them ride on one redundant S7-414H string through one Y-Link; the other three ride on a parallel S7-414H string. The hardware configuration (HW Config), the FB/DB logic, the RK512 parameters, and the firmware of the CP341 are identical across all six stations. Five stations are error-free; one station (call it station #3) generates NAKs in clusters lasting several hours, then goes silent for days.

How the 3964(R) Layer Reports Errors on a CP341

When you load the "3964(R)/RK512" driver into a CP341, the module performs the lower-layer handshake on its own. The CPU only sees an FB return value. The CP341 converts bit-level link errors into a status word that the FB returns to the user program. The codes you will see in your error OB or in the FB STATUS output are documented in the SIMATIC S7-3964(R)/RK512 driver manual.

The full error code list is reproduced in the "Maintenance / Troubleshooting" section of the SIMATIC S7 3964(R)/RK512 Driver Manual and applies verbatim to any S7-300 station using a CP341. A second, complementary document from the same manufacturer family is the S7 3964(R)/RK512 Driver Manual (legacy index), which lists the same code table for older CP341 firmware.

Step-by-Step Diagnostic Procedure

Use the following sequence to localize the problem before swapping hardware. Each step takes only minutes in a running plant and is non-destructive.

1. Capture STATUS on the FB return. In the cyclic OB1 call, copy the FB RET_VAL into a DB and bring the low byte to an HMI tag. Trend it for 24 hours. Cluster the codes that appear during the NAK window.
2. Compare stations side-by-side. Use the same FB code and DB layout on station #1 (good) and station #3 (bad). If only one station shows 0x0300 / 0x0D00, the partner is exonerated and the problem is local to that station or to its serial hardware path.
3. Tap the line with a serial analyzer. Use a notebook running a tool that can decode 3964(R) at the byte level. Capture for at least one NAK event. Check whether the STX/ETX are aligned, whether the BCC matches, and whether the inter-character gap violates the configured character timeout.
4. Measure the current loop on a good vs. a bad station. With both ends powered and idle, measure the 20 mA loop current. A healthy Telebyte 65A holds 20 mA ± 5%. A failing unit drifts, oscillates, or saturates the opto-isolator.
5. Hot-swap the CP341 between two stations. Move the suspect CP341 from station #3 to station #1 and run for 24 hours. If the NAKs travel with the module, the CP341 is the problem. If the NAKs stay at station #3, the converter, cable, or partner is the problem.
6. Hot-swap the Telebyte 65A on the partner side. Ask the partner to install a spare Telebyte 65A on their end and run the same 24-hour test. If the NAKs disappear, the partner-side converter was the problem.
7. Hot-swap the PLC-side Telebyte (the fix). If the fault remains on station #3 after both CP341 and partner Telebyte have been swapped, the residual path is the 20 mA link between the two Telebyte units. Apply the solution in the next section.

The Defect: Current-Loop Corruption Between Telebyte 65A and CP341-1

The CP341-1 was originally installed with the current-loop option. The CP341-1 current-loop interface uses an optically isolated 20 mA current source/receiver and was meant to receive the 20 mA signal coming from the partner's Telebyte 65A. In theory the link is correct. In practice, on this site, the 20 mA current loop intermittently corrupts the 11-bit character envelope of the 3964(R) frames. The CP341's UART sees a stretched or compressed bit cell and flags a parity or BCC error. The 3964(R) layer then sends NAK. The RK512 layer passes the NAK up to the FB as 0x0300.

Why does the corruption appear on station #3 and not on stations #1, #2, #4, #5, #6? In the original installation the Telebyte 65A on the partner side was the only converter. The PLC side was the CP341-1 current-loop interface directly. For five stations, the partner routed through different Telebyte 65A units with a 20 mA active source configured identically. Station #3 happened to be connected to a Telebyte 65A whose internal current regulator was beginning to fail. The drift was thermal: under sustained traffic the opto-isolator heated up, the loop current shifted by <1 mA, and the 11-bit character window was violated for some frames. When traffic stopped, the unit cooled and the corruption went away. Hence the "days clean, hours bad" symptom.

The Fix: Re-architect the Serial Path

The solution is to make the 20 mA current loop exist only between two Telebyte 65A converters, not between a Telebyte and a CP341-1. This means swapping the CP341-1 current-loop variant for a CP341-RS232C and adding a second Telebyte 65A at the PLC side. The full signal path becomes:

Active Partner (RS-232) → Telebyte 65A (RS-232 ↔ 20 mA) → Belden 2-pair cable → Telebyte 65A (20 mA ↔ RS-232) → CP341-RS232C (DB-9)

The two Telebyte 65A units are essentially back-to-back: one converts partner RS-232 to current loop, the other converts current loop to PLC RS-232. The CP341 sees clean RS-232 levels and the 3964(R) link runs at the configured baud rate with no thermal drift.

Hardware Required for the Fix

Telebyte 65A Wiring Reference

The Telebyte Model 65A exposes a 5-screw terminal block on its current-loop side. The screw labels are C+, C-, G, K+, K-. The pin meanings are:

• C+ / C-: data path one direction (typically receive at this end).
• K+ / K-: data path the other direction (typically transmit at this end).
• G: shield / ground reference for the opto-isolated loop.

DB-9 to DB-25 Cable Pinout (Telebyte RS-232 to CP341-RS232C)

The PLC-side Telebyte 65A uses a DB-25 female RS-232 port. The CP341-RS232C uses a DB-9 female front connector. Build or buy a DB-9 female / DB-25 female cable with the following pinout.

All signals pass straight through with the CP341 as DTE. Tie shields at one end only (DB-9 shell) to avoid ground loops through the Belden shield and the building ground.

CP341-RS232C Configuration in STEP 7 / TIA Portal

After swapping the module, configure the CP341-RS232C as follows. The values match the partner's existing configuration so no FB or partner program change is required.

RK512 Status Reporting via the FB

Wire the FB RET_VAL into a DB so the HMI can show the current status. A typical OB1 call uses the modern CP341 library block:

CALL "P_RCV_RK" , DB50
  EN         := TRUE
  LADDR      := 256           // Logical base address of CP341
  R_CPU      := FALSE
  R_ORA      := FALSE
  L_TYP      := 'RK512'
  L_DB       := 100           // Receive DB number (configured in CP341)
  L_OFFSET   := 0
  L_CF_BYT   := 16            // Receive frame length
  L_CF_REC   := 100           // Number of records to buffer
  NDR        := M10.0
  ERROR      := M10.1
  STATUS     := MW12          // Surfaces to HMI for diagnostics
  CP_STATUS  := MW14          // CP341 internal status, see error table

The STATUS word is the FB's view of the link. The CP_STATUS word is the CP341's internal error code, which matches the hex codes listed in the SIMATIC S7 3964(R)/RK512 Driver Manual error table. Persist both words to a UDT on every call so that post-mortem analysis of an NAK cluster is possible after the fact.

Why This Is a Class of Failure, Not a One-Off

The failure pattern described in the reference installation has been reported across multiple airports, refineries, and water-treatment sites where an S7-300 CPU with a CP341-1 current-loop interface is connected to a third-party OEM package through a Telebyte Model 65A converter. The OEM ships the active partner expecting a "current loop in, current loop out" interface. Siemens ships the CP341-1 in current-loop configuration as a way to talk to the OEM. The two pieces were never exercised together over a long cable run with the thermal envelope of a working plant. The thermal drift of the Telebyte 65A's opto-isolator introduces sub-millisecond timing jitter into the 20 mA ring, which is invisible at the byte level until a frame's BCC XOR fails.

The same failure mode has been observed with the SICK Flexi Soft RK512 safety controller on the partner side. The SICK Flexi Soft manual describes the same 3964(R) framing rules and the same vulnerability to inter-character timing. A Flexi Soft-based partner on a 20 mA current loop with a marginal Telebyte 65A exhibits the same "days clean, hours bad" pattern.

Alternate Workarounds (Plan B)

If the budget for a second Telebyte 65A per station is not available, the following workarounds have been used in the field:

1. Relocate the PLC next to the partner. If the active partner and the S7-312 can be co-located in the same cabinet, the entire 20 mA current loop can be eliminated. Use a direct RS-232 null-modem cable from the partner to the CP341-RS232C. This was the documented Plan B on the reference site and was not needed once the dual-Telebyte topology was installed.
2. Replace the Telebyte 65A with a higher-grade converter. Industrial-grade current-loop converters with active current regulation (e.g., Phoenix Contact PSI-REP-CLON or Weidmuller WAS5 PRO RS232/CL) have lower thermal drift than the Telebyte 65A. They cost roughly 4× to 6× a Telebyte 65A but eliminate the failure mode.
3. Add a fiber-optic current-loop extender. If the run length is the real noise source rather than the converter itself, a fiber-optic extender between the two current-loop segments galvanically isolates the loop. This works but adds a powered pair at the midway point.
4. Increase the FB retry count and tolerance. Set the P_SND_RK RETRY parameter to 3 and the response timeout to 3 s. The application will mask the NAKs for a while, but the underlying corruption is still happening and will eventually show up as data inconsistency, not just NAK. Not recommended as a permanent solution.

Verification Procedure After the Fix

After installing the CP341-RS232C and the second Telebyte 65A, perform the following verification to confirm the fault is gone.

1. Visual inspection of the screw terminals. Confirm C+, C-, K+, K-, and G are landed per the table above on both Telebyte 65A units.
2. Loop current check. With both Telebyte 65A units powered, break the C+/C- loop and insert a milliamp meter. Read 20 mA ± 1 mA in idle and during sustained traffic. Any deviation > 2 mA between idle and active is a defect.
3. Loop voltage check. Measure the voltage across C+/C-. A healthy 20 mA loop sits at 4 V to 6 V with the standard 5 V supply and 100 Ω sense. A reading > 8 V indicates the opto-isolator is reaching saturation and will fail under thermal load.
4. 72-hour run with logging. Force the FB to log every STATUS, CP_STATUS, and frame count to a ring buffer DB. Run for 72 hours of normal plant activity. A successful fix produces zero 0x0300 and zero 0x0D00 entries in the buffer.
5. Partner round-trip test. From the partner's HMI, write a value to a defined DBW in the S7-312, then read it back. Confirm end-to-end latency matches the configured character timeout budget. A successful round-trip with stable latency on a long cable (50 m +) confirms the link is clean.

Troubleshooting Matrix

Long-Term Prevention

For new deployments on the same architecture, specify the dual-Telebyte + CP341-RS232C topology from the outset. Document the exact screw terminal assignments and the DB-9 to DB-25 pinout in the project's wiring standard. The cost of the second Telebyte 65A per station is trivial compared to a single airport-scale outage caused by an NAK storm. Where possible, specify industrial-grade current-loop converters with active regulation rather than the Telebyte 65A. Finally, persist the CP341's STATUS and CP_STATUS words to a ring buffer DB on every call so that a future intermittent fault can be analyzed in 24 hours of data, not 24 hours of in-person trace capture.

FAQ