Resolving AG_LRECV Error 8186H on Siemens CP443-1 TCP Connections

1. Problem Statement

An S7-400 station equipped with a CP 443-1 communications processor is connected to a third-party PC application over an ISO-on-TCP or TCP connection configured in NetPro. The connection is established and reported active by NetPro, and the first received telegram from the PC is processed correctly by AG_LRECV. Immediately after that first successful receive, the function's STATUS output switches from 8181H (job active) to 8186H, indicating a "wrong ID number" condition. No further telegrams are processed; the receive job must be re-triggered to recover.

Initial online diagnosis on the CP 443-1 shows no connection errors. The PLC program appears correct. The visible smoking gun in this scenario is a mismatch between the CP 443-1 module physically installed in the rack and the module version configured in the STEP 7 hardware configuration (HW Config). This article documents the field-recommended procedure to identify, correct, and verify the fix.

2. CP 443-1 Hardware Variants and Identification

The CP 443-1 has been produced in several order numbers. Each order number carries a defined firmware range and a STEP 7 hardware catalog entry. The two variants frequently encountered in legacy S7-400 installations are:

The physical order number is printed on the front label of the module and is also returned by the online diagnostics under Module Information > Order Number. The firmware version is visible under Module Information > Firmware. Both must match the entry used in HW Config. STEP 7 refuses to download a configuration that points to a module number that is older than what is physically present only if the catalog is missing the variant; the reverse (configuring for an older EX10 when an EX11 is installed) is permitted and is the most common cause of the symptom described in this article.

3. AG_LRECV / AG_SEND Architecture

AG_LRECV and AG_SEND are the legacy function blocks used to exchange data over Industrial Ethernet CPs in S7-300/S7-400 systems programmed with classic STEP 7 (V5.x). They are part of the SIMATIC NET function block library and operate on top of the connection configured in NetPro. The official reference documentation for these blocks is published in the SIMATIC NET S7-300/S7-400 manual: AG_LRECV / AG_RECV / AG_SRECV (S7-300, S7-400) – TIA Siemens Cloud Documentation.

The standard input/output interface of AG_LRECV (FB 67 in the SIMATIC NET library, version 3.0) is:

The block is called cyclically (typically in OB1) with ACT controlled as a one-shot. The receive job is asynchronous: STATUS = 8181H means the job is currently running on the CP and the user is not allowed to retrigger the same ID until it completes.

4. Status Code 8181H and Error Code 8186H Decoded

The STATUS output of AG_LRECV reports hex-coded job states. The two values relevant to this fault are:

Per the SIMATIC NET documentation, 8186H is raised by the CP firmware when the block presents an ID for which the CP has no matching open receive job, or when the local resource table associated with ID is in an inconsistent state. The most common engineering causes are:

1. Module variant mismatch (CP 443-1 EX10 configured in HW Config while an EX11 is installed, or vice versa) — the firmware inside the physical CP does not recognize the connection/ID binding compiled into the EX10 description.
2. Dynamic modification of ID, LADDR, RECV, or LEN while AG_LRECV is already running a job on the same ID.
3. Connection in NetPro deleted or replaced after the first telegram; the CP tears down the receive resource and the next call gets 8186H.
4. STEP 7 project rebuild changed the connection ID numbering compared to the running program.

5. Root Cause: Module Variant and Firmware Mismatch

In the reported case, the field inventory shows the following situation:

STEP 7 V5.4 SP3 and later catalog entries include the EX11 variant. Configuring an EX10 against an EX11 hardware means the CP boots with the EX11 firmware image, but STEP 7 compiled the connection/ID table assuming the EX10 firmware layout. After the first telegram is acknowledged, the CP's internal connection resource table and the compiled PLC program diverge; the next call to AG_LRECV with the same ID is rejected with 8186H.

The CP 443-1 special online diagnostics does not flag this condition as a fault because from the CP's point of view the link is healthy. The mismatch only manifests at the user-program interface when the ID binding is queried. This is why online diagnosis returns "everything OK" while the receive side fails.

6. Connection Type Compatibility for AG_LRECV

AG_LRECV is the receive counterpart of AG_SEND and operates only on the connection types supported by the S7-400 Industrial Ethernet CPs. The matrix is:

Confirm in NetPro that the connection in question is one of the supported types. If the PC is talking plain TCP, the PLC must have a TCP connection (not an ISO-on-TCP connection) configured against the same ID.

7. Pre-conditions Before Modifying the Configuration

Apply the following checks before changing HW Config or replacing modules:

1. Verify the STEP 7 version. STEP 7 V5.4 SP3 or later is required to see the CP 443-1 EX11 V2.6 entry in the HW Config catalog. Older versions only know the EX10 entry.
2. Install the latest Service Pack for STEP 7, and the corresponding HSP (Hardware Support Package) if the catalog does not list the EX11.
3. Back up the STEP 7 project (S7 program + NetPro) before any change.
4. Stop the CPU and put it in STOP before downloading a new hardware configuration that changes the CP's order number.
5. Confirm that the PC application will reconnect automatically after the PLC transitions to RUN.

8. Solution Procedure: Aligning Hardware Configuration

The recommended corrective action is to make the STEP 7 hardware configuration match the physical module. The procedure is:

1. Open the S7 project in SIMATIC Manager and double-click Hardware to launch HW Config.
2. Locate the CP 443-1 in rack 0 (slot typically 3 or 4 of the S7-400 CPU rack).
3. Right-click the CP and select Replace Object, or delete the existing CP 443-1 EX10 and insert the correct CP 443-1 EX11 from the catalog at SIMATIC 400 > CP 400 > Industrial Ethernet > CP 443-1 > 6GK7 443-1EX11-0XE0.
4. Double-click the CP and set the firmware version to V2.6 (or the firmware actually running on the module). STEP 7 will then compile a configuration consistent with the EX11 firmware.
5. Open NetPro, open the TCP/ISO-on-TCP connection, and verify that the local ID and remote endpoint are unchanged. The connection should still be valid; the same ID may now be used by the AG_LRECV block.
6. Save and compile the hardware configuration (Station > Save and Compile).
7. Download the new hardware configuration to the S7-400 station with the CPU in STOP.
8. Switch the CPU to RUN and observe AG_LRECV.STATUS for at least three receive cycles. The first frame should set STATUS = 0000H and NDR = TRUE; subsequent frames should follow the same pattern. The 8186H code should no longer appear.

9. Alternative Solution: Replacing the CP to Match Configuration

If the project documentation requires the EX10 variant and the EX11 was installed by mistake, the reverse procedure is equally valid:

1. Power down the S7-400 rack.
2. Remove the 6GK7 443-1EX11-0XE0 module and replace it with a 6GK7 443-1EX10-0XE0 module with firmware V2.3 (or matching the EX10 catalog entry).
3. Insert the module into the same slot; verify the IM/IMR cabling is unchanged.
4. Power the rack up; STEP 7 will recognize the EX10 module online without any change to HW Config.

This route is only practical when spare EX10 hardware is available. In modern S7-400 fleets, the EX10 has been out of production for many years, so aligning HW Config to the physical EX11 is the field-preferred action.

10. Parameter Handling Rules for AG_LRECV

Even after the variant mismatch is corrected, the following rules must be observed to prevent recurrence of 8186H:

11. Verification and Online Diagnostics

After the corrective download, validate the fix with the following checks:

1. In HW Config, right-click the CP 443-1 and select Module Information. Confirm that the reported Order Number is 6GK7 443-1EX11-0XE0 and the Firmware is V2.6.
2. Open Special Diagnostics on the CP. Verify that the connection in question is listed in Connections and that its state is Established.
3. Open the Connection Diagnostics view. Confirm zero CRC errors, zero overruns, and zero reset counts.
4. Open the VAT or a watch table on the instance DB of AG_LRECV. Verify that STATUS cycles through 0000H (job complete) and 8181H (next job active), with no appearance of 8186H.
5. Send at least 50 telegrams from the PC and verify that all 50 are visible in the receive DB with monotonically increasing NDR edges.

12. Preventive Measures

To avoid re-introducing the same fault during future project work:

1. Maintain a single source of truth for the CP 443-1 part number and firmware, mirrored in the project header and on the cabinet label.
2. Use the STEP 7 Compare function (online vs. offline) before every download to catch order-number and firmware differences.
3. Keep STEP 7 V5.4 SPx and the latest HSPs installed in the engineering environment so that EX11 catalog entries are present.
4. Restrict HW Config edits to a small set of trained engineers; document every change in a project change log.
5. Add a STATUS = 16#8186 check in the program logic that raises an operator alarm with the text "Wrong ID number – check CP variant" so the symptom can be diagnosed quickly if it recurs.

13. FAQ