Resolving W#16#7002 Status in S7-300 Modbus TCP PN CPU

Resolving W#16#7002 Status in S7-300 Modbus TCP PN CPU

The MODBUS_TCP_PN_CPU library for the SIMATIC S7-300 PN/DP CPU returns W#16#7002 in the Status_CONN word when the active TCP connection has not yet been established. When this status persists indefinitely or cycles between W#16#7002, W#16#80A1 (TRCV error), and W#16#A100 (TCON error), the project is typically running the wrong sample project (server instead of client), the partner device is not a true Modbus server, or the ISO-on-TCP/TCP connection parameters do not match the partner.

Problem Description

An S7-300 CPU with integrated PROFINET interface (e.g., CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP) is configured using the sample project SIMATIC 300 (Client) from the Modbus TCP PN CPU library. After loading the program and triggering the request, the operator observes:

• Status_CONN = W#16#7002 continuously
• Occasional transition to W#16#80A1 from the TRCV block
• Occasional transition to W#16#A100 from the TCON block
• Count_Done and Count_Error both at 0, or Count_Done rising while no data lands in the data DB

A separate tool (e.g., Fenix 2.5.1 acting as a Modbus master) confirms that the partner (Siemens PAC 4200 or Ananas virtual Modbus server) responds correctly to Modbus TCP requests. The PROFINET IP configuration is:

• CPU IP: 192.168.1.30
• Partner IP: 192.168.1.70
• Subnet: 255.255.255.0

Modbus TCP Client/Server Architecture

Modbus TCP is strictly a client/server model on top of TCP/IP port 502. The client opens the socket, sends a request PDU, and waits for the server response.

Status Word Reference: W#16#7002

The Status_CONN output reflects the state of the underlying TCON/TSEND/TRCV sequence. Values for the MODBUS_TCP_PN_CPU library:

A persistent W#16#7002 together with the appearance of W#16#80A1 and W#16#A100 is the classic signature of either (a) wrong sample project, (b) blocked TCP port, or (c) partner device not reachable on port 502.

Root Cause: Wrong Sample Project

The Modbus TCP PN CPU library for the S7-300 is delivered in two sample projects:

1. SIMATIC 300 (Client) — CPU acts as Modbus master and polls the partner. This is the project required for the PAC 4200 scenario.
2. SIMATIC 300 (Server) — CPU listens on port 502 and replies to inbound requests from a Modbus master. This project is unusable when the partner is a fixed server like the PAC 4200.

If Status_CONN stays at W#16#7002 and the connection-establishment counter (Count_Done) does not rise, the active sample is almost certainly the server variant. The library calls TCON with the local CPU's IP and port 502 as the passive endpoint, but no client ever connects.

TCON / TRCV Error Decoding

The two transient errors seen in the variable table map to specific failures:

Pre-Commissioning Checklist

Before opening the TCON connection in OB1, validate the following:

1. Subnet reachability: From the PG connected to the same PROFINET subnet, PING 192.168.1.70 returns a reply in < 5 ms.
2. Port 502 reachable: From the PG, telnet 192.168.1.70 502 opens a blank screen. Press Ctrl+] and quit to exit.
3. Partner role confirmed: PAC 4200 parameter P795 (Modbus) must be enabled and the unit number must match the unit ID sent in the Modbus request (typically 255 for PAC 4200 gateway mode, or 1 for unit-specific addressing).
4. Ananas server role: The Ananas virtual Modbus server must be configured in server mode with at least one listening interface bound to 192.168.1.70 on TCP/502. Firewall rules must allow inbound TCP/502 from 192.168.1.30.
5. CPU time and project version: The CPU's online clock must be current and the project must not be in STOP. TCON aborts with internal errors if the CPU transitions to STOP while the connection is held.

Step-by-Step Resolution

Step 1 — Confirm the active sample

In STEP 7 V5.5 (or TIA Portal with S7-300 compatibility), open the project and inspect the Control_DATA DB (commonly DB1) and the program blocks folder:

• If the project name contains Server, swap to the client project from the library.
• If unsure, check ENQ_ENR trigger: in a server project, no outbound request is issued.

Step 2 — Verify TCON configuration in the client sample

The MODBUS_TCP_PN_CPU library uses an internal FB that calls TCON with a TCON_PARAM data structure. The active connection parameters must look like:

BlockParam := TC_CON_PAR
TC_CON_PAR.BlockID    := W#16#00
TC_CON_PAR.BlockLen   := 64  (Dec)
TC_CON_PAR.LocalPort  := 0   (any)
TC_CON_PAR.RemotePort := 502 (Dec)
TC_CON_PAR.ActiveEst  := TRUE  // CLIENT
TC_CON_PAR.RemoteAddr := 192.168.1.70 (via DB_STRUCT)

If ActiveEst = FALSE, the CPU waits for an inbound connection — this is the server configuration and the cause of the persistent W#16#7002.

Step 3 — Call TCON before TSEND/TRCV

The library FB internally sequences TCON → TSEND → TRCV. Do not call TSEND until Status_CONN = W#16#0000 (established) or W#16#7001 (started). Pre-TSEND calls before connection establishment generate TRCV errors because no socket exists yet.

Step 4 — Trigger polling from OB1 or OB35

The client sample uses the DONE_NDR or ERROR outputs to retrigger the next request. A clock bit on M0.5 is not recommended because it can overrun an in-flight request. Use the pattern below:

// OB1 (or OB35 for cyclic 100 ms)
A     #REQ                          // first request trigger
S     "DB_Control".ENQ_ENR          // set request flag

// Self-retrigger on completion
A     "DB_Control".DONE_NDR         // job completed without error
FP    "DB_Control".DONE_FP
S     "DB_Control".ENQ_ENR          // queue next request

// Error handling
A     "DB_Control".ERROR
R     "DB_Control".ENQ_ENR          // reset to allow retry

Step 5 — Monitor the data DB

After connection is established (conn_established = 1), the response PDU populates the data DB (e.g., DB11). Open the data DB online to verify word values are updating on each DONE_NDR edge. If conn_established = 1 but data does not change, the request function code is wrong (e.g., reading holding registers FC03 vs input registers FC04), or the start address is outside the partner's register map.

Verification Matrix

PAC 4200 Specific Configuration

The Siemens PAC 4200 multifunction meter is a Modbus TCP server on port 502 by default. Verify on the meter's display or via the Web server that:

• Modbus is enabled (parameter P795 = On)
• Port 502 is the Modbus TCP port (P796)
• Unit ID matches the request (P797)

Reading from the PAC 4200 requires function code FC03 (Read Holding Registers) for most measurement values. The voltage L1-N register, for example, is at address 1. The MODBUS_TCP_PN_CPU client sample uses a configurable function code and start address in DB1 — set FC = 3 and StartAddr = 1 for the first test.

Ananas Virtual Server Configuration

When using Ananas as a test server on the PG:

1. Bind the listening socket to the Ethernet adapter carrying 192.168.1.70, not the loopback address.
2. Disable Windows Defender Firewall on the private network profile, or add an inbound rule for TCP/502.
3. Confirm the Ananas process is in Listening state with netstat -ano | findstr 502 on the PG.
4. Set the data DB to a known pattern so the S7-300 can detect updates.

Field-Proven Diagnostic Sequence

1. Open STEP 7 → PLC → Online → Accessible Nodes. Confirm the CPU at 192.168.1.30 reports ONLINE.
2. Open the VAT table and force ENQ_ENR = 1 for one scan, then monitor Status_CONN.
3. Capture a Wireshark trace on 192.168.1.70 filtered to tcp.port == 502. Look for SYN from the CPU.
4. If no SYN appears, the CPU's TCON is not reaching the network — check the IP routing in NetPro and confirm the PROFINET interface is enabled.
5. If SYN arrives but no response, the partner service is not bound to port 502 — restart Ananas or PAC 4200.

Standards and Reference

Modbus TCP is defined by the Modbus Organization as the Modbus Messaging on TCP/IP Implementation Guide (v1.0b, 2006). The relevant status word semantics for the S7-300 PN CPU are documented in the Siemens SIMATIC S7-300 Communication Function Manual and the Modbus TCP PN CPU library readme.

For the S7-1200/S7-1500 counterpart (MB_CLIENT/MB_SERVER), the same W#16#7002 status word semantic is documented in the TIA Portal help:

SIMATIC S7-1200 Manual Collection — MB_SERVER Modbus TCP Server Instruction