Resolving Siemens LMQTT Error 16#8601 in PLCSIM Advanced

Overview

Engineers commissioning MQTT publishers and brokers on a SIMATIC S7-1500 frequently encounter the status code 16#8601 returned at the status output of the LMQTT_Client function block (FB) shipped with the Siemens LMQTT library. In a PLCSIM Advanced simulation environment the same code is almost always a wrapper around the internal TSEND_C instruction, which in turn reports 16#8089. The root cause is structural: the secure connection description types TCON_QDN_SEC and TCON_IP_V4_SEC that the LMQTT block instantiates are not supported by PLCSIM Advanced prior to V4.0. This reference describes the chain of errors, the platforms and firmware versions affected, and the three field-proven workarounds that bring the MQTT link online without rewriting application logic.

Problem Details

The reported failure pattern is reproducible with the following configuration:

• Controller role: MQTT client on a SIMATIC S7-1500 CPU (e.g., 1516-3 PN/DP)
• Broker role: SIMATIC S7-1500 CPU (e.g., 1513-1 PN/DP) acting as MQTT server or external broker such as Mosquitto
• Library: LMQTT for S7-1500 (TIA Portal add-in)
• Firmware on the simulated CPUs: V2.8
• Simulator: PLCSIM Advanced V3.0 (two instances, one per CPU)
• TIA Portal: V16 Update 3 or higher

Symptoms observed in the watch table and online diagnostics:

• LMQTT_Client.status = 16#8601 immediately after connect = TRUE is set
• LMQTT_Client.subfunctionStatus = 16#8005 or 16#83D0
• When the block is expanded in the call environment, the internal TSEND_C instance returns DONE = FALSE, ERROR = TRUE, STATUS = 16#8089
• The LMQTT_Client never reaches the connected state
• No TCP connection is established in Wireshark captures between the PLCSIM Advanced virtual Ethernet adapter and the broker

Root Cause Analysis

The LMQTT documentation, section 2.1.4 of the library manual, defines the wrapper error 16#8601 as "Error during connect (internal TSEND_C)". The block does not surface the original TSEND_C status to its public output without further inspection; instead it consolidates the failure under the generic connect-error code. Engineers must drill into the multi-instance DB to recover the underlying error.

The most common underlying code is 16#8089, which according to the SIMATIC S7-1500 communication manual indicates that the TSEND_C instruction was called with a connection description that is not valid for the runtime in use. In the LMQTT block the connection description is built from one of two structures:

PLCSIM Advanced V3.0 rejects the _SEC variants when the LMQTT block populates them with TLS parameters. The simulator returns 16#8089 to the user program, which the LMQTT FB repackages as 16#8601 with sub-status 16#8005 (parameter error) or 16#83D0 (resource error) depending on which field the simulator rejects first.

Affected Versions and Compatibility Matrix

Distinguishing Sub-Status Codes

The sub-status reported alongside 16#8601 is diagnostic and should always be logged:

Solution Path 1: Upgrade PLCSIM Advanced to V4.0 or Later

The cleanest remediation. PLCSIM Advanced V4.0 introduced full TCON_QDN_SEC and TCON_IP_V4_SEC support, including TLS 1.2 / 1.3, X.509 certificate validation, and proper multi-instance connection handling.

1. Download the latest PLCSIM Advanced package from the Siemens Industry Online Support (entry ID 109769329).
2. Uninstall the existing PLCSIM Advanced V3.0 instance. Use the Windows Apps & Features control panel and remove the virtual Ethernet adapter driver through Device Manager.
3. Install PLCSIM Advanced V4.0 SP2 (or current) and reboot. The installer registers the new virtual adapter automatically.
4. Re-create the two CPU instances: one for the client, one for the server. The instance names must be unique on the host.
5. Reload the TIA Portal project; no program changes are required. The LMQTT block will instantiate the _SEC structures as before and PLCSIM Advanced V4.0 will accept them.
6. Go online and observe LMQTT_Client.status = 16#0000 when the broker is reachable.

Verification: capture traffic on the PLCSIM Advanced virtual Ethernet adapter with Wireshark. You should observe a TCP SYN to port 8883 (TLS) followed by a ClientHello, certificate exchange, and application data with MQTT CONNECT packets.

Solution Path 2: Replace Secure Structures with Non-Secure Variants

If the project cannot upgrade the simulator (for example, a CI/CD pipeline pinned to PLCSIM Advanced V3.0), the LMQTT connection description can be temporarily downgraded to plain TCP. The block exposes its connection parameters in the instance DB; the application code may swap them at runtime, or the block can be re-instantiated against a non-secure MQTT broker.

Direct edits to the shipped LMQTT library are not recommended because the block is regenerated on library update. Instead, use one of the following approaches:

1. Spin up an unencrypted Mosquitto broker on the same PLCSIM Advanced host. Default listener 0.0.0.0:1883 with allow_anonymous true for offline simulation.
2. Modify the LMQTT client call to use TCON_IP_V4 instead of TCON_IP_V4_SEC. In TIA Portal, open the LMQTT instance DB, locate the connectionData structure, and change the data type reference from TCON_IP_V4_SEC to TCON_IP_V4.
3. Set the tlsEnable input of the LMQTT FB to FALSE to prevent the block from repopulating the secure structure at runtime.
4. Recompile and download. The TSEND_C inner instance should now complete without 16#8089.

Solution Path 3: Move the MQTT Broker to a Physical CPU

When the engineering team is willing to commit one real S7-1500 to the simulation rig, the simulator gap is sidestepped entirely. Real CPU firmware from V2.0 onward supports the secure connection structures without restriction.

1. Use a real CPU 1511-1 PN or 1513-1 PN as the MQTT broker (or connect to Mosquitto on a host with a routable IP).
2. Keep the client CPU simulated in PLCSIM Advanced V3.0; it can still initiate plain TCP connections to external hosts.
3. Switch the LMQTT connection description to TCON_QDN (non-secure) since the cross-boundary link is now simulator-to-real-CPU, not simulator-to-simulator. Simulator-to-real-CPU TLS is also possible on PLCSIM Advanced V4.0+; on V3.0 use plain TCP.
4. Configure the host file or DNS so the broker FQDN resolves on the Windows host running PLCSIM Advanced.

This pattern is common in lab acceptance tests where one production representative CPU is used and the rest of the plant is simulated.

Step-by-Step Diagnostic Procedure

1. Add the LMQTT instance DB to a watch table. Force connect = TRUE and monitor status and subfunctionStatus.
2. If status = 16#8601, open the call environment of the LMQTT FB and locate the multi-instance iTSEND_C (or equivalent name). Read its STATUS output.
3. Compare the inner status to the table above. If it is 16#8089, the cause is structural (PLCSIM Advanced V3.0 + SEC).
4. Confirm the PLCSIM Advanced version with Control Panel > Programs and Features > SIMATIC S7-PLCSIM Advanced and the build number under Help > About.
5. Decide between Path 1 (upgrade), Path 2 (non-secure simulation), or Path 3 (physical broker CPU).
6. Apply the fix and re-trigger the connect sequence.

Verification Checklist

• LMQTT_Client.status = 16#0000 within 5 seconds of connect = TRUE
• LMQTT_Client.connected = TRUE
• Wireshark capture shows the MQTT CONNECT packet followed by CONNACK with return code 0
• Published payloads on the LMQTT client reach the broker; subscribed topics surface in the LMQTT receivedData interface
• Cycle-time impact: an idle LMQTT client should consume < 2 ms of OB1 time on a CPU 1516-3

Common Adjacent Errors and Misdiagnoses

Engineers frequently misread 16#8601 as an OPC UA error. The OPC UA standard uses the same code in the SFB OPC_UA_Connect for an invalid server endpoint URL, which is unrelated to MQTT. Always confirm the failing FB by reading the call stack in the online diagnostics. The OPC UA FB lives in the OPC UA Client library, not in the LMQTT library. The two share no code path, and the wrapper number is a coincidence of the OPC UA spec rather than a defect in LMQTT.

Another common confusion is between 16#8601 (connect) and 16#8602 (publish) in the LMQTT documentation. Section 2.1.5 defines 16#8602 as "Error during publish". If the connect succeeds and the publish fails, the diagnostic focus shifts to broker authorization, topic ACLs, and the QoS / retain flag settings of the publish call.

Troubleshooting Matrix

References Within the Siemens Ecosystem

Engineers reproducing this fault typically start from the official LMQTT example project hosted on Siemens Industry Online Support at entry ID 109762770. The example is wired for two CPUs communicating over PLCSIM Advanced and is the canonical test bed. For the PLCSIM Advanced V4.0 release notes that document the addition of TCON_*_SEC support, refer to entry ID 109769329. The LMQTT library itself, including the section 2.1.4 status-code table, is shipped as a global library in TIA Portal and is also available on the Siemens support portal.