Resolving Siemens MB_CLIENT Error 80C5 with Modbus TCP Simulator

Resolving Siemens MB_CLIENT Error 80C5 with a Modbus TCP Slave Simulator (ModRSsim2 / Modbus Poll)

Symptom. TIA Portal V15.1 project on S7-1200/S7-1500 calls MB_CLIENT against a Modbus TCP slave simulator (ModRSsim2, Modbus Poll in slave mode, or similar) and the instance DB status word reports 16#80C5 ("Modbus communication failure" / "no remote partner"). Status words 16#7001 and 16#7002 may also appear in the same scan cycle. No holding/input register values are written to the configured tags.

This reference walks through the exact commissioning sequence that eliminates 80C5, explains what each status word means, and documents the IP, port 502, and instance-DB parameters that are commonly mis-configured when a Siemens CPU is the Modbus TCP client and a third-party PC application is the Modbus TCP server.

1. Required Toolchain and Software Versions

ModRSsim2 is published on SourceForge (ModRSsim2 download page) and exposes both Modbus RTU and Modbus TCP/IP server functions on the standard port 502.

2. Understanding the MB_CLIENT STATUS Output

The MB_CLIENT instruction writes the following tags in the instance DB:

• STATUS – 16-bit WORD, hex status of the TCP/Modbus transaction.
• MB_STATUS – 16-bit WORD, Modbus-protocol-level exception code.
• MB_DATA_PTR – ANY pointer to the data buffer for read/write transactions.
• DONE, BUSY, ERROR – Boolean handshake flags.

3. Root-Cause Matrix for 80C5

4. Prerequisites

1. Windows 10/11 host with a fixed IPv4 address (e.g. 192.168.0.10/24). Disable Wi-Fi or assign a unique metric so Modbus TCP is bound to the wired NIC.
2. ModRSsim2 installed and verified. Test that the simulator accepts a connection by opening Modbus Poll on the same PC, configuring Connection → Modbus TCP/IP, IP = 127.0.0.1, port = 502. If Modbus Poll reads register 40001, the simulator is functional.
3. S7-1200 (or PLCSIM V15.1 instance) with a fixed IPv4 in the same /24 (e.g. 192.168.0.20/24
4. TIA Portal V15.1 project with a MB_CLIENT call in OB1 (or a cyclic OB) and a single instance DB.
5. One unmanaged switch or a crossover cable between PC and PLC.

5. Step-by-Step Configuration

5.1 Configure ModRSsim2 as a Modbus TCP Server (Slave)

1. Launch ModRSsim2. From the menu bar select Connection → Modbus/TCP IP → Modbus Server (this is the default on first launch).
2. Confirm the listening port is 502. Open Settings → TCP/IP Server Port if a different value appears.
3. Pre-load a few registers so the MB_CLIENT transaction has a defined response. In the main grid set:
   • Address 0 (40001) = 16#0001 (Function code 03 read returns 0x0001).
   • Address 1 (40002) = 16#0002.
4. From the Windows host, open a second cmd window and run netstat -an | findstr :502. The line 0.0.0.0:502 LISTENING confirms the simulator is bound to all interfaces.

5.2 Configure the S7 CPU Network Interface

1. In TIA Portal, open Device Configuration → PROFINET interface → Ethernet addresses.
2. Set IP address = 192.168.0.20, Subnet mask = 255.255.255.0. Do not enable a router unless one is required.
3. Download the hardware configuration to the CPU. Verify with Online → Accessible Nodes that the CPU is reachable from the PC.
4. From the PC run ping 192.168.0.20. A reply confirms Layer-3 reachability.

5.3 Configure the MB_CLIENT Instance DB

Drop MB_CLIENT from Instructions → Communication → Modbus TCP into OB1. TIA Portal auto-generates the instance DB (e.g. MB_CLIENT_DB). Open the DB and inspect the CONNECT parameter, which is itself a TCON_IP_V4 structure:

Minimum call interface on the FC/FB block:

MB_CLIENT_DB(
  REQ       := %M0.0,        // 1-Hz blink, triggers a transaction
  DISCONNECT := FALSE,         // keep the TCP connection open
  CONNECT   := 'MB_CLIENT_CONNECT',
  MB_MODE   := 0,              // 0 = read, 1 = write
  MB_DATA_ADDR := 40001,       // Modbus address (function-code-aware)
  MB_DATA_LEN  := 10,          // 10 holding registers
  DONE      => %M10.0,
  BUSY      => %M10.1,
  ERROR     => %M10.2,
  STATUS    => %MW12,
  MB_STATUS => %MW14,
  MB_DATA_PTR := P#DB20.DBX0.0 WORD 10
);

For the S7-1500 family the equivalent block is also MB_CLIENT (TIA V15.1+). For S7-300/400 the legacy FB100 / FB101 / FB102 Modbus TCP package from Siemens is used instead and the STATUS mapping differs – do not mix the two.

5.4 Watch Table for Live Diagnosis

1. Create a watch table with the instance DB tags: MB_CLIENT_DB.STATUS, MB_CLIENT_DB.MB_STATUS, MB_CLIENT_DB.BUSY, MB_CLIENT_DB.ERROR, MB_CLIENT_DB.DONE.
2. Trigger REQ with a 1-Hz clock bit. Observe the state sequence:

• Pattern A (healthy): STATUS 16#7001 → 16#7002 → 16#0000, DONE=TRUE on each REQ edge.
• Pattern B (no partner): STATUS 16#7001 → 16#80C5, ERROR=TRUE, DONE=FALSE. This is the fault described in the source case.
• Pattern C (TCP socket drop): STATUS 16#7001 → 16#7002 → 16#80C4, ERROR=TRUE. Indicates slave is alive but disconnects – check simulator stability and function code.

6. Eliminating 80C5 in the Source Case (Checklist)

1. Confirm the role. In the source case the S7 CPU is the Modbus TCP client/master and ModRSsim2 is the server/slave. Ensure the simulator is in Modbus Server mode, not Modbus Client – ModRSsim2 supports both.
2. Match the IP address. Re-read the four octets of the PC's wired IPv4. Do not type the loopback 127.0.0.1.
3. Match the subnet. PC and PLC must share the first three octets (default /24). If a 169.254.x.x APIPA address is showing, fix the link first.
4. Open Windows Firewall for TCP/502. netsh advfirewall firewall add rule name="ModRSsim2 502" dir=in action=allow protocol=TCP localport=502 (run elevated).
5. Force REQ to pulse. 80C5 is also reported on the first call if the connection is opened and never used. Generate a clean REQ edge at least every 1 s to keep the link active.
6. Verify with Modbus Poll. From the same PC, point Modbus Poll to 127.0.0.1:502. If Poll cannot read, the simulator is mis-configured. If Poll can read, the simulator is fine and 80C5 is on the PLC path.
7. Capture a packet trace. Start Wireshark on the PC with the filter tcp.port == 502. With the CPU connected you should see SYNs from the PLC's IP, SYN-ACKs from the PC, then Modbus ADUs. If SYNs appear with no reply, the firewall or wrong IP is the cause.

7. Verification Procedure

1. Download the project to the CPU (or PLCSIM) and go online.
2. Open the MB_CLIENT watch table. Toggle REQ once with a 1-second pulse.
3. Confirm STATUS goes 16#7001 → 16#7002 → 16#0000, and DONE pulses TRUE.
4. Confirm the target data buffer (e.g. DB20.DBW0) contains the value that ModRSsim2 is publishing at address 40001.
5. Change a value in ModRSsim2 and re-trigger REQ. The buffer must update within one cycle.
6. Stop ModRSsim2. The next transaction should report STATUS = 16#80C5, ERROR = TRUE. This confirms the fault path is wired correctly – if 80C5 never appears with the slave down, the diagnostic chain is broken.
7. Restart ModRSsim2 and re-trigger. STATUS should return to 16#0000 on the next successful transaction.

8. Common Pitfalls When Using ModRSsim2 with a Siemens CPU

9. Alternate Roles and Cross-Simulator Setups

9.1 Siemens CPU as Modbus TCP Server (Slave)

If the role is reversed and the S7 is the Modbus TCP server/slave, use MB_SERVER in TIA Portal. The PC simulator in this case must be a Modbus TCP client/master such as Modbus Poll. The MB_SERVER block binds the CPU to port 502 and waits for an incoming connection. STATUS = 16#80C5 on the PC side is then reported as "No response from slave" and has the same root-cause set (IP, port, firewall).

9.2 Using Modbus Poll as the Slave for Re-Testing

Modbus Poll can be put in "Slave" mode through the Display → Slave Mode menu in older builds or via the "Modbus Slave" companion tool. A free Modbus slave simulator that pairs well with Modbus Poll is "Modbus Slave" by WinTech. Configuration is the same as ModRSsim2: IP = the host running the slave, port = 502, function codes 03/06/16 supported by default.

10. Field-Proven Diagnostics Flow

11. Quick-Reference Parameter Set for the Source Case

12. Extending the Pattern to Other Siemens CPUs

The same MB_CLIENT block exists on S7-1500 in TIA Portal V15.1 and later. For S7-300 / S7-400 the legacy Modbus TCP library (FB100 "MB_CLIENT" / FB101 "MB_SERVER" / FB102 "MB_RED_CLIENT") is shipped as part of the "Modbus_TCP_CP" example project in the Siemens Industry Online Support. STATUS code mapping is similar but 80C5 is reported as 16#C085 in some legacy builds – consult the CPU-specific manual before reusing the same watch table.

13. Frequently Asked Questions