Resolving Siemens S7 Modbus TCP Error 8183H on Ethernet CP

Overview of Modbus TCP Error 8183H

Error code 8183H (hex) = 33155 (decimal) is raised by the SIMATIC S7 communication firmware when a Modbus TCP request reaches an S7 CPU but no usable transport path is available. The Siemens error text for 8183H is: "No configuration or the ISO/TCP service has not yet started on the Ethernet CP." In practical terms, this error is generated by the FB MB_CLIENT / MB_SERVER block wrapper or by the legacy MODBUSPN / MODBUSTCP library on a CP 343-1 / CP 443-1 when either:

• the Ethernet CP has not been configured as a Modbus server in the STEP 7 / NetPro project, or
• the ISO/TCP transport (RFC 1006 / port 102) has not yet finished initialisation after CP startup, or
• the active/passive partner relationship is reversed (the S7 is configured as server but the external client has not yet issued a connect request, or vice-versa).

The error is therefore not a programming fault in the user's Modbus function block, but a project / commissioning fault at the connection or transport layer below the Modbus application layer.

Technical Background: Modbus TCP on the Ethernet CP

Modbus TCP (IEC 61158 / IETF draft) rides on top of TCP port 502. On a SIMATIC S7-300/400 station, Modbus TCP is realised by one of three mechanisms:

1. CP 343-1 / CP 443-1 with the MODBUSTCP block library – the CP handles TCP/IP; the S7 CPU exchanges raw Modbus Application Data Units (ADU) via the CP using the FBs AG_SEND / AG_RECV on configured ISO/TCP connections.
2. Integrated PN interface of the CPU (e.g. CPU 31x PN/DP) – the S7-CPU itself owns the TCP/IP stack; the application directly uses the Open Communication services (FB 65 – FB 68) or the older TCP_CONNECT from the standard library.
3. External Modbus gateway (e.g. SIMATIC NET IE/PB LINK PN IO) – the gateway terminates Modbus TCP on the field side and exposes it to the S7 as a PROFIBUS or PN slave.

The error 8183H is most commonly seen in path (1) – a CP-based station where the user has put the Modbus master/client logic in the CPU but the underlying S7 connection from AG_SEND / AG_RECV has not been configured or has not been established at runtime. The same hex code also appears in pure CPU-PN path (2) when the Open Communication TCON / TDISCON job has not yet produced a DONE status.

Connection states that produce 8183H

Root Cause Analysis

Diagnose 8183H by eliminating the four primary causes in this order. Each cause has a distinct observable symptom.

Cause 1 – Connection not configured in NetPro

The CPU has a Modbus application block (FB for the master or the ModbusTCP server FB) compiled into it, but the project contains no S7 connection pointing at the Ethernet CP or CPU-PN interface. NetPro will show the CP/cpu with zero connection rows. Until the connection is added, compiled, and downloaded to the CPU, any attempt to send triggers 8183H immediately.

Cause 2 – ISO/TCP transport not yet started on the CP

On CP 343-1 / CP 443-1, ISO/TCP is a service that is started by the CP firmware. On a freshly powered-up CP, the service typically becomes available 10 to 30 seconds after the CP's RUN LED goes solid green. During that window any client request to the CP is rejected, and the client receives 8183H. If the CP firmware crashes (e.g. a fatal diagnostic or a configuration mismatch) the service may never come up and 8183H is permanent.

Cause 3 – S7 is server but the client has not connected

If the S7 is the passive end of the Modbus TCP connection (server), the connection state remains "establishing" until the external client issues a TCP SYN to port 502. From the CPU's perspective the connection is not yet "established" so any read/write via the application block returns 8183H. This is the situation described in the source incident.

Cause 4 – Wrong connection endpoint / partner IP

NetPro was compiled with the wrong IP, wrong rack/slot, or wrong connection type (e.g. ISO-on-TCP selected instead of TCP native, or vice versa). The CP rejects the local endpoint and the S7 connection stays in DOWN state. 8183H is the resulting client-side status.

Affected Hardware and Firmware

Error 8183H is documented across the following Ethernet CP and CPU-PN product lines running STEP 7 V5.x (the error code is in the legacy S7 communication firmware, not in TIA Portal):

Always cross-check the order number and firmware version against the SIMATIC NET manual set on the Siemens Industry Online Support portal before assuming the CP supports the connection type you configured.

Diagnostic Procedure

Use the following sequence to localise the root cause of 8183H. The procedure is the same on STEP 7 V5.5 / V5.6 and works for both the S7-300 and S7-400 Ethernet CP families.

Step 1 – Open NetPro and select the PLC

1. Launch SIMATIC Manager and open the S7 project.
2. Open NetPro (Options → Configure Network).
3. Click on the S7 station (CPU icon). The right-hand pane lists the configured connections.
4. Check that a connection row exists. If the list is empty, the connection was never added — go straight to the resolution section.

Step 2 – Go online to view the connection status

1. In NetPro click the glasses icon (Online → View) to open the online view.
2. The status column shows one of three icons for each connection:
   • Red square – connection is DOWN.
   • Green play triangle – connection is ESTABLISHED.
   • Yellow clock – connection is in the process of being established.
3. Press F5 in NetPro to force a refresh of the online status; the view does not auto-poll.

Step 3 – Read the CP diagnostic buffer

1. In SIMATIC Manager select the CP (e.g. CP 343-1) in the hardware configuration (HW Config).
2. Right-click → PLC → Diagnostic Buffer (or press Ctrl+D directly inside HW Config to open the CP diagnostics dialog).
3. In the diagnostics dialog, click Special Diagnostics → TCP. The TCP tab lists the local and remote IP, the local and remote port, the connection state, and the byte counters. A state of "LISTENING" for an S7 server means the CP is ready and waiting for a client — 8183H on the client side will clear the moment the client opens a TCP connection.

Step 4 – Verify ISO/TCP service state on the CP

In the same Special Diagnostics dialog select the Services tab. The row ISO/TCP (port 102) must show status Active. If the row is absent or shows Inactive, the CP firmware has not yet started the ISO/TCP transport, which is one direct cause of 8183H.

Step 5 – Test from the client side

From a Windows PC on the same subnet, run a quick telnet test against the S7's IP and port 502:

If the connection opens (the cursor goes blank), the CP is accepting TCP on port 502 and the issue is application-side (FB call, connection type, or active/passive role). If the connection is refused, the CP is either not configured for Modbus or the ISO/TCP service is not up.

Step-by-Step Resolution

Apply the fix that matches the diagnosed cause. Most incidents are resolved by Cause 1 or Cause 3 below.

Resolution A – Add the missing S7 connection in NetPro

1. In NetPro right-click the S7 station → Insert New Connection.
2. Choose partner Unspecified and connection type TCP connection (or ISO-on-TCP connection, depending on what your application block expects).
3. Set the local endpoint to the CP and the remote endpoint to the partner IP / port (port 502 for Modbus TCP).
4. Set the Active connection establishment checkbox on the partner that should issue the connect. For a Modbus server S7, leave the local S7 as passive.
5. Save and compile the connection (NetPro → Network → Save and Compile).
6. Download the connection data to the CPU (PLC → Download → Connections).

Resolution B – Cycle the CP to bring up ISO/TCP

1. Open HW Config, select the CP.
2. Right-click → PLC → Operating Mode → STOP. Wait until the CP's RUN LED goes off.
3. Right-click → Operating Mode → RUN. Wait 15–30 s for the CP to re-initialise its services.
4. Re-check the Special Diagnostics → Services tab; the ISO/TCP row should now read Active.

Resolution C – Make sure the client side is opening the connection

1. Confirm that the external Modbus client (SCADA, HMI, third-party device) is configured with the S7's IP and port 502.
2. Confirm the client is online, has network reachability, and is not blocked by a managed switch port (VLAN / ACL) or a stateful firewall.
3. Issue a single register read from the client. Observe the CP's Special Diagnostics → TCP tab — the connection row should transition from LISTENING to ESTABLISHED.

Resolution D – Correct a wrong connection endpoint

1. Open the connection properties in NetPro.
2. Verify the local interface points to the physical CP / PN port you actually wired.
3. Verify the partner IP, rack, and slot. The CP slot for CP 343-1 is typically 4; the CPU slot is 2 or 3 depending on the S7-300 configuration.
4. Verify the connection type matches the application: TCP for native TCP, ISO-on-TCP for RFC1006, UDP for the small Modbus UDP variant.
5. Recompile and re-download the connection.

Server vs Client Configuration

The S7's role in the Modbus TCP exchange must match what is configured in NetPro. The general rule:

• S7 is Server (passive): NetPro → Connection → Local end passive. The external client must issue the OPEN. Until the client connects, the S7 will not see an established connection and any application attempt to read/write may return 8183H. This is the situation in the source incident.
• S7 is Client (active): NetPro → Connection → Local end active. The S7 application block (e.g. MODBUSPN, FB 65 TCP_CONNECT) issues the CONNECT request. If the partner is unreachable, 8183H indicates a network or partner-configuration fault, not a missing connection.

For the scenario in the source ("My S7 is server"), the corrective action is to verify that the external Modbus client is configured to open a TCP connection to the S7's IP on port 502, and that the firewall / switch fabric permits that traffic. Once the client opens the socket, the CP transitions the connection to ESTABLISHED and 8183H disappears.

Verification

Use this checklist to confirm that 8183H is gone and the Modbus TCP path is healthy.

1. In NetPro online view, the connection row shows the green play triangle (ESTABLISHED). Press F5 to force a refresh.
2. In the CP Special Diagnostics → TCP tab, the state is ESTABLISHED and the byte counters are incrementing in both directions.
3. From the application side, the Modbus block returns status 0 (DONE) and a valid error byte of 0 on a test read of holding register 40001.
4. From the external client, a poll of holding register 40001 returns the expected value and the TCP socket stays open between polls (typical Modbus behaviour — no automatic disconnect).

Continuous health monitoring

Insert a cyclic OB1 call to the STATUS or AG_STATUS output of your Modbus block and forward the result to an HMI tag. Any return to 8183H will be visible in real time. On a passive S7 server, the status will briefly go through LISTENING on startup before flipping to ESTABLISHED the first time a client connects — this is normal.

Related Error Codes on the S7 Ethernet CP

Common Pitfalls

• Downloading only the S7 program, not the connection data. STEP 7 separates "Download to Target System → Hardware Configuration" from "Download to Target System → Connections." If you only do the first, the CPU has the program but the CP has no S7 connections and 8183H is guaranteed.
• Mistaking 8183H for a programming error. The error comes from the S7 communication firmware, not from a logic error in your Modbus FB. Adding more error handling to the FB will not fix it.
• Forgetting that NetPro does not auto-refresh. A status of "connection down" may be cached. Always press F5 in the NetPro online view before drawing conclusions.
• Assuming a green SF LED on the CP means everything is fine. A CP with no SF but with no connection data still returns 8183H on the client side.
• Modifying the connection in NetPro but not recompiling. After any change, use Network → Save and Compile to push the new connection data to the S7 station's system data. Without this step, the offline project and the online CPU diverge.
• Mixing ISO-on-TCP (port 102) with Modbus TCP (port 502) in the same connection. Modbus TCP uses native TCP on port 502. ISO-on-TCP (RFC 1006) uses port 102. They are different protocols; the CP cannot inter-convert them.

Diagnostic Flowchart

Documentation References

• Siemens TIA Portal Help – Modbus Error Messages (S7-1200 / S7-1500) — defines error code 16#8183 for the current TIA generation. Useful for comparison; the S7-300/400 meaning differs.
• Siemens Industry Online Support — official portal for SIMATIC NET manuals, firmware downloads, and product notifications.

FAQ