Resolving Siemens IM151-8 PN-DP Modbus TCP Data Exchange Failures

Problem Overview

On a Siemens ET 200S station built around the IM151-8 PN/DP interface module, an Open Modbus/TCP link to a Honeywell controller (e.g., a Honeywell HC900 or Experion C300 with embedded Modbus TCP server) reaches the TCP three-way handshake but the application never exchanges process data. No Modbus Request/Response frames are observed on Wireshark, and the input/output image area of the S7 station stays frozen even though the partner reports an active connection.

This is a configuration problem in approximately 9 of 10 cases, not a licensing problem. The TCP connection will come up without the Open Modbus/TCP license installed, but a diagnostic LED on the IM 151-8 PN/DP and entries in the diagnostic buffer are activated until the license is installed. The most common reasons an active TCP socket does not produce working Modbus transactions are:

1. Wrong MB_UNIT background DB parameter block (wrong partner IP, port 502, or wrong connection ID).
2. MB_CLIENT triggered too early (before connection state = established) or with REQ never re-triggered after DONE.
3. Byte-swap or word-swap error when mapping Honeywell 32-bit floating-point registers (IEEE 754) into S7 REAL tags.
4. Modbus function code mismatch (FC 3/4 vs FC 16) and wrong starting address (1-based Honeywell vs 0-based Modbus specification in the Siemens FB).
5. Firewall on the Honeywell side closing port 502 / wrong unit ID when the Honeywell server expects a non-zero Unit Identifier.

Hardware Reference: IM 151-8 PN/DP

The IM 151-8 PN/DP is the PROFINET-capable head module of the SIMATIC ET 200S distributed I/O system. It combines a PROFINET IO controller/interface, a PROFIBUS DP master (Class 1) on the lower DP port, and an integrated Ethernet port that is also used for Open Modbus/TCP communication via the S7 program.

Reference: SIMATIC ET 200S IM 151-8 PN/DP Interface Module Manual (entry ID 13542688).

Open Modbus/TCP Library: Article Numbers and License

Modbus/TCP is not native to the S7-300 / IM 151-8 instruction set. Siemens ships a separate "Open Modbus/TCP" library that you must install into STEP 7 (or TIA Portal where supported) and that is licensed.

The license is a per-CPU/IM runtime license that is loaded via the SIMATIC Automation License Manager (ALM). It allows unlimited connections within the documented maximum (8 for the IM 151-8 PN/DP). Without the license:

• The TCP connection is still established by the FB at runtime.
• MB_CLIENT polls continue to be sent, but with a non-zero delay inserted by the firmware (one poll every 10 s is reduced/disabled, depending on firmware revision).
• The SF LED on the IM 151-8 PN/DP is lit and the diagnostic buffer holds a license-related entry.

Reference: Open Modbus/TCP PN/DP Function Manual (entry ID 30828737).

Root Cause Analysis Workflow

1. Read the IM 151-8 PN/DP diagnostic buffer (STEP 7 → PLC → Diagnostic Buffer). Filter on event IDs related to Modbus (E012, E013, E014 in the ET 200S firmware).
2. Check the SF / BF LED state on the head module. SF lit + BF dark = internal/configuration issue. BF lit = link or partner not reachable.
3. Run Wireshark on the PROFINET segment (mirror port on the managed switch) with filter tcp.port == 502. Confirm the request PDU and observe the response (or absence).
4. Read MB_CLIENT output parameters in the instance DB: DONE, ERROR, STATUS, MB_DATA_PTR, MB_DATA_LEN. STATUS values are documented in the Open Modbus/TCP manual entry ID 30828737.
5. Verify partner unit identifier. Honeywell servers typically expect Unit ID = 1 (or 255) - if the wrong identifier is sent, the server will discard the request silently.

Step-by-Step Configuration

Step 1 - Install and License the Open Modbus/TCP Library

1. Install the Open Modbus/TCP library from the install medium or from the Siemens Online Software Delivery portal.
2. Open SIMATIC Automation License Manager; drag and drop the license key to the IM 151-8 PN/DP node.
3. Power-cycle the IM 151-8 PN/DP; verify in the diagnostic buffer that the "license missing" entry is cleared.

Step 2 - Allocate the MB_UNIT Background Data Block

The MB_UNIT DB holds the static connection parameters. Create one DB per partner (Honeywell server) with the following structure (offsets match library V1.5):

DATA_BLOCK "DB_HW_MODBUS"
  STRUCT
    CON_ID      : INT  := 1;          // Connection ID, 1..8
    IP_REMOTE   : DWORD := DW#16#0A0A0A0A; // Honeywell IP, e.g. 10.10.10.10
    IP_LOCAL    : DWORD := DW#16#0A0A0A64; // Local IM 151 IP, e.g. 10.10.10.100
    TSAP_REMOTE : WORD  := W#16#0100;       // Port 502 high byte (always 0x01), low byte 0x00 = 502
    TSAP_LOCAL  : WORD  := W#16#0100;       // Local port 502 if fixed; usually dynamic
    UNIT_ID     : BYTE  := B#16#01;         // Honeywell unit identifier; verify on partner side
    TIMEOUT     : TIME  := T#5S;            // TCP connect/response timeout
    RESERVED    : ARRAY[1..6] OF BYTE := B#16#0;
  END_STRUCT;
END_DATA_BLOCK

Step 3 - Call MB_CLIENT in OB1

CALL "MB_CLIENT" , "DB_HW_CLIENT"
  REQ          := M 10.0          // Edge-triggered request
  DISCONNECT   := FALSE
  MB_UNIT_DB   := "DB_HW_MODBUS"  // Background DB with IP/port/unit
  READ_WRITE   := 0               // 0 = read (FC 3 holding or FC 4 input)
  FUNCTION     := 3               // FC 3 = read holding registers
  DATA_ADDR    := 40001           // 1-based starting address (Honeywell convention)
  DATA_LEN     := 8               // Number of 16-bit registers to read
  DATA_PTR     := P#DB100.DBX0.0 BYTE 16 // S7 destination (8 words = 16 bytes)
  DONE         := M 20.0          // Pulse: transaction complete
  BUSY         := M 20.1
  ERROR        := M 20.2
  STATUS       := MW 22

Step 4 - Map the Words into REAL (Float) Values

Honeywell process variables often come as IEEE 754 floats, occupying two consecutive 16-bit registers. If the byte order is high-word-first (Honeywell default for some HC900 firmware), swap the words before calling a block move into a S7 REAL tag.

// 8 registers (16 bytes) read into DB100.DBD0..DBD14
// Honeywell float is at registers 40003-40004 (DB100.DBW4..DB100.DBW7)
L  DB100.DBW 4    // high word
T  DB110.DBW 2    // high word in target
L  DB100.DBW 6    // low word
T  DB110.DBW 0    // low word in target
// DB110.DBD0 now contains the REAL value (verify in VAT)

Diagnostic Indicators and Status Codes

Reference: Open Modbus/TCP function manual - STATUS word description.

Common Configuration Errors and Their Signatures

Honeywell-Specific Considerations

Honeywell controllers expose process data through a Modbus server with a device-specific address map. Common entry points:

• HC900: Modbus TCP server on port 502. Holding registers at addresses 4xxxxx. The HC900 Workbench configuration determines the mapping.
• Experion C300 / C200: Modbus TCP exposed via the ELCN/TCP gateway. Each controller has a defined "Node ID" that is used as the Modbus Unit Identifier.
• Honeywell XYR 5000 / XYR 6000: Modbus TCP server; some firmware revisions support only FC 3 (not FC 4 or FC 16). Verify with the device-specific manual.

Reference: Honeywell HC900 Modbus Manual (Honeywell Process Solutions).

Network Topology and Diagnostic Capture

The recommended capture setup is to mirror the switch port that the IM 151-8 PN/DP is connected to, then filter Wireshark on tcp.port == 502 and ip.addr == 10.10.10.10. A healthy exchange looks like:

Frame 1: 10.10.10.100 → 10.10.10.10 [SYN]         (TCP open)
Frame 2: 10.10.10.10  → 10.10.10.100 [SYN, ACK]
Frame 3: 10.10.10.100 → 10.10.10.10 [ACK]
Frame 4: 10.10.10.100 → 10.10.10.10 [PSH, ACK] MB Request:  FC 3, addr 0, qty 8
Frame 5: 10.10.10.10  → 10.10.10.100 [PSH, ACK] MB Response: 16 bytes of data

If Frame 4 is missing, the S7 program is not polling. If Frame 5 is missing or arrives with a Modbus exception, the partner is rejecting the request and you must correct the FC, address, or Unit ID.

Sample Project Location in STEP 7

The Open Modbus/TCP library ships with a complete sample project for the IM 151-8 PN/DP. It is installed under:

FILE → OPEN → SAMPLE → BROWSE
Folder:  ...\Siemens\Automation\S7\S7libs\ModbusTcpPN\Example

The sample project includes:

• Two MB_UNIT DBs (one for partner 1, one for partner 2)
• One MB_CLIENT FB instance
• One MB_SERVER FB instance (if you also need to expose S7 data to other Modbus TCP clients)
• A watch table (VAT) for runtime monitoring

Verification Procedure

1. Open the online MB_CLIENT instance DB and confirm BUSY = 1 (transaction in progress) and DONE pulses each cycle.
2. Confirm ERROR = 0 and STATUS = 0x0000 0000 after each DONE pulse.
3. Verify in the watch table that DATA_PTR (e.g. DB100.DBW0..DB100.DBW14) updates each cycle to fresh values from the Honeywell server.
4. Cross-check by reading the same registers from a third-party Modbus master (e.g., Modbus Poll tool) to confirm the Honeywell server is producing the values you expect.
5. Read the IM 151-8 PN/DP diagnostic buffer. No license entry, no communication error entry, no parameter error entry. SF LED dark.

Troubleshooting Matrix

FAQ