Resolving Siemens CPU414-3 Modbus TCP A100h Error to Modsim

1. Problem Summary

A SIMATIC S7-400 station running CPU 414-3 PN/DP with order number 6ES7414-3EM07-0AB0 (firmware V7.0.x or later) is configured as a Modbus TCP client using its integrated PROFINET interface. The client block reports diagnostic error W#16#A100 and the connection never enters CONNECTED state on the first startup cycle. The remote endpoint is the Modsim Modbus TCP server emulator running on an engineering laptop at 192.168.10.1; the CPU is at 192.168.10.111. Standard Modbus polling (FC03 / FC04 / FC06 / FC16) never reaches the server, and the STATUS output of the Modbus block continuously holds A100h.

The symptom is platform-agnostic across all SIMATIC CPUs that use the Modbus/TCP PN library for S7-300/S7-400: nothing visible happens on the wire (no SYN sent to port 502, no Modbus/TCP MBAP frame ever transmitted), and STEP 7 remains in Run because the failure is reported as a status code from the FB rather than a CPU stop.

2. Hardware and Software Stack

3. Decoding Error Code W#16#A100

The W#16#A100 value originates in the STATUS output of the Modbus TCP function block and maps to the Siemens SIMATIC diagnostic range used by the Modbus/TCP PN library for connection-layer and IP-stack failures. The high-byte A0xxh block is reserved for runtime errors that are recoverable by the client (no CPU stop). Breaking down the reported code:

• A000h–A0FFh – IP/TDP layer problems (route, ARP, TCP three-way handshake).
• A100h–A1FFh – Connection-establishment problems (passive server unreachable, SYN blocked, no SYN-ACK received).
• A200h–A2FFh – Connection-loss / socket-reset problems (RST/Fin received from remote).
• A300h+ – Modbus PDU-level problems (function code reject, illegal address, exception code 02/03).

For a first connection attempt that never even exchanges a Modbus MBAP header, the cycle most often stops inside the A100h–A1FFh window. W#16#A100 specifically indicates that the client's TCP send buffer was rejected before the first byte could reach the remote IP stack. In practice this is observed when outbound packets on TCP/502 are being dropped or filtered before leaving the host on which the Modbus server is running – typically a Windows host with a software firewall rule applied to the private or public profile of the NIC that connects to 192.168.10.0/24.

4. Root Cause Matrix

5. Pre-Commissioning Checklist

1. CPU firmware ≥ V7.0.5 recommended for stable Modbus/TCP PN multi-instance behaviour on the integrated PN port. Confirm via PLC > Online > Accessible Nodes in STEP 7 / TIA Portal.
2. Laptop NIC must have IP 192.168.10.1 / 255.255.255.0 – verify with ipconfig on Windows or ip addr show on Linux.
3. CPU PROFINET port IP must be 192.168.10.111 / 255.255.255.0 – set in HW Config > Properties > Ethernet Interface > IP Protocol.
4. Verify L1/L2 cabling: Link LED on CPU PROFINET port and on the laptop NIC must be lit (green).
5. From the laptop, ping 192.168.10.111 -t should return ICMP replies with time < 1 ms on a direct cable.
6. Modsim must be running in Server mode and listening on TCP/502; do not use Serial in this scenario.
7. STEP 7 project must have the Modbus/TCP PN library (e.g. LModbusTCP for S7-300/400 with PN CPU) installed and the function block instances compiled cleanly.

6. Step-by-Step Firewall Resolution (Most Common Root Cause)

The Windows host that runs Modsim is the active Modbus server. Even though the laptop acts as the server, Windows Firewall profiles (especially Public and Domain) drop unsolicited inbound TCP segments, which is exactly what the S7-400 CPU's first SYN to port 502 looks like to the OS.

6.1 – Verify the firewall is the cause

1. From the laptop, open Settings > Network & Internet > Ethernet and confirm the connected network is set to Private profile. Public profile blocks inbound by default.
2. Open Windows Defender Firewall with Advanced Security: wf.msc.
3. Navigate to Inbound Rules. If any rule named Modbus Simulator or referencing %ProgramFiles%\Modsim\Modsim.exe is missing, the inbound traffic to TCP/502 is dropped silently.

6.2 – Create a permanent inbound rule

1. In wf.msc, select Inbound Rules > New Rule….
2. Rule type: Program.
3. Program path: C:\Path\To\Modsim.exe (or the executable you use for the simulator).
4. Action: Allow the connection.
5. Profile: tick Private only (avoid opening the plant network for everyone).
6. Name: Modbus TCP Server – 192.168.10.0/24 (Modsim).
7. Repeat for Outbound Rules if a corporate host firewall blocks egress.

6.3 – PowerShell alternative (single command)

New-NetFirewallRule -DisplayName "Modsim TCP 502" `
  -Direction Inbound `
  -Program "C:\Tools\Modsim\Modsim.exe" `
  -Action Allow `
  -Protocol TCP `
  -LocalPort 502 `
  -Profile Private

6.4 – Validate the rule is live

1. From a second host on the same subnet run Test-NetConnection 192.168.10.1 -Port 502 -InformationLevel Detailed.
2. Expected output: TcpTestSucceeded : True. If false, the inbound rule is not yet active or the port is bound to a different IP.
3. Confirm the listening socket: netstat -ano -p tcp | findstr :502. The PID must point to Modsim.exe.

6.5 – Cold-restart the CPU to retry

Stop and start the CPU (or set RESTART on the FB), then monitor STATUS. The status must transition from A100h to 0000h within 2–5 s of the next call. If it persists, jump to Section 9 – Verification Procedure.

7. Modbus TCP Connection Parameter Configuration

The Modbus/TCP PN library on S7-400 expects an instance DB that carries the static connection parameters. A typical offline portion of the IDB looks like:

DATA_BLOCK DB401 "Modbus_Instance_DB"
  STRUCT
    ID              : WORD := W#16#0001;       (* Unique connection ID *)
    ROLE            : BOOL := FALSE;           (* FALSE = Client / Active *)
    REMOTE_IP_ADDR  : ARRAY[1..4] OF BYTE := 192,168,10,1;
    REMOTE_PORT     : WORD := W#16#01F2;        (* 502 decimal *)
    LOCAL_PORT      : WORD := W#16#0000;        (* 0 = any *)
    UNIT_ID         : BYTE := B#16#01;         (* Modbus unit / slave address *)
    CONN_TIMEOUT    : WORD := W#16#003C;       (* 60 s *)
    CYCLE_TIME      : WORD := W#16#0064;       (* 100 ms polling *)
    DATA_PTR        : POINTER;
    DATA_LEN        : WORD;
    STATUS          : WORD;                    (* FB diagnostic word *)
  END_STRUCT;
END_DATA_BLOCK

Critical parameter semantics

• ID – must be unique across all open Modbus TCP connections handled by the CPU. Reusing the same ID on two blocks produces A100h on the second instance.
• REMOTE_PORT – W#16#01F2 = 502 decimal. Off-by-one is a common typo (writing 0x01F3 = 503). Modsim default may be modified by the user.
• UNIT_ID – 1 for a single simulator instance; higher for simulated multi-drop RS-485.
• ROLE – 0 = client (active), 1 = server (passive). Modsim is the server (passive), the CPU is the client (active).
• CONN_TIMEOUT – keep above 30 s for first connect. Some Windows firewalls intentionally delay the SYN-ACK processing on first hit.

8. Modsim Simulator Configuration

1. Launch Modsim with elevated rights (administator). Right-click > Run as administrator on Windows.
2. Top menu > File > New; select Modbus TCP/IP Server; confirm port 502.
3. Define at least one register map: e.g. Holdings Registers at address 40001, quantity 100. This gives the client something to read.
4. Bind to the Ethernet NIC that owns 192.168.10.1. Connection > Network Adapter. Disable Wi-Fi to force binding to the wired NIC.
5. Confirm the listening socket by opening another terminal: netstat -an | findstr LISTEN | findstr :502.
6. Select Connection > Slave Address = 1 to match the CPU FB UNIT_ID.

9. Verification Procedure

1. In STEP 7, monitor the IDB online and confirm STATUS = W#16#0000 within 5 s of CPU restart.
2. Monitor STATUS of the user data block. Any non-zero value indicates a fault condition.
3. Open the Modsim window and confirm the master list now shows the CPU's IP 192.168.10.111 as an active client.
4. Read Modsim registers 40001..40100 from the CPU side via a watch table or a dedicated read FB call. The returned data must match the values configured in Modsim.
5. Use the SFC13 diagnostic on the PN port: verify the connection-state word moves from establishing to established.
6. Run a continuous traffic capture on the laptop (Wireshark, filter tcp.port == 502) and confirm periodic MBAP frames every CYCLE_TIME.

10. Inline Diagnostic State Machine

11. Common Pitfalls in Field Commissioning

• Running Modsim on a corporate-joined laptop: Group Policy will re-enable the firewall rule every gpupdate /force. Hard-code the rule into a startup script.
• CPU and laptop on different subnets: 192.168.10.111/24 vs 192.168.10.1/16 – the mask mismatch silently breaks ARP resolution. Always align netmask.
• Gateway IP set on the CPU PROFINET interface: when no real gateway exists, the TCP layer may queue outgoing SYN packets to a non-existent router and time out, producing A100h on long cycle poll but passing for ICMP ping (which is connectionless). Remove the gateway setting unless one is present.
• Modsim binding to all interfaces while Wi-Fi is connected: many corporate Wi-Fi profiles deploy AP-isolation that prevents the wired traffic from reaching the Wi-Fi clients. Disable Wi-Fi before commissioning.
• Library version mismatch: STEP 7 V5.7 ships Modbus/TCP PN library V5.1; older V3.x libraries on a CPU FW V7 can return A100h on first connection. Re-import the latest FB family from Siemens Industry Online Support.
• Connection ID zero: ID = 0 is reserved by some library versions and silently rejected. Use IDs ≥ 1.

12. Preventive Checklist and Standards Reference

The Modbus protocol layer semantics are governed by the MODBUS Application Protocol Specification V1.1b3 and the MODBUS Messaging on TCP/IP Implementation Guide V1.0b. The TCP/IP guide specifies that the server (slave) listens on a registered port 502 and that the client (master) is responsible for opening and maintaining the connection. Always cross-check the Modbus PDU mapping against these documents when verifying simulator behaviour.

For Siemens-specific behaviour refer to the SIMATIC Modbus/TCP PN manual and the S7-400 CPU 414-3 PN/DP manual – both are linked from Siemens Industry Online Support. The block STATUS range and the error-recovery state machine are documented in the library reference.

Quick hand-off checklist before resuming production

• Status word = 0 sustained for ≥ 5 minutes.
• At least one read FC03 and one write FC06 round-trip verified end-to-end.
• Modsim Master List shows the CPU as Active.
• Wireshark capture saved as project artifact.
• Firewall rule documented in IT change-management system.
• CPU diagnostic buffer cleared of transient OB85 / OB86 entries.

FAQ