Troubleshooting S7-1200 MB_CLIENT Modbus TCP Status 7006 and 8188 Errors

A recurring field issue with the SIMATIC S7-1200 CPU (for example CPU 1211C, DC/DC/DC or DC/DC/Rly variants, article number 6ES7211-1AE31-0XB0 and related 6ES7211-1xE40-0XB0 firmware V4.x units) is the inability of the MB_CLIENT instruction to extract register data from a downstream energy meter that is reachable only through an RS-485 to Modbus TCP/IP converter. The PLC establishes the TCP connection successfully and reports STATUS = 16#7006 on the MB_CLIENT block, while external tools such as ModScan32 read the same slave transparently. The fault is almost always in the way the client block is parameterized against the gateway, not in the physical link. This reference walks through root cause, parameter remediation, and verification for the most common symptom set: STATUS 7006 returning continuously, ERROR latching with STATUS = 16#8188 when the user changes the mode, and zero data in the receive buffer DB even though Modscan reads valid values.

1. Problem Statement and Symptom Matrix

The failure pattern reported in the field is consistent and reproducible:

2. Hardware and Software Prerequisites

Before opening TIA Portal, validate the stack so the troubleshooting logic only addresses the PLC side.

2.1 PLC and Firmware

• SIMATIC S7-1200 CPU 1211C, 1212C, 1214C, 1215C, or 1217C.
• Firmware V4.0 or later. The MB_CLIENT and MB_SERVER instructions are part of the standard library for V4.x; on V3.x they must be added manually and the connection count is restricted. The official Siemens application example "NET_S7-1200_MODBUS_TCP" (file ID 83130159) targets V4.x.
• TIA Portal V13 SP1 Update 9 or later. V15.1 / V16 / V17 is recommended for current engineering baselines.

2.2 Modbus TCP/IP Gateway (e.g., Elpro 105U, Moxa MGate, Phoenix Contact GW)

• Unit operates as a Modbus TCP server on the LAN side, Modbus RTU master on the RS-485 side.
• Static IP address reserved (avoid DHCP on automation cells).
• Port 502 left at default unless a port-forward rule demands otherwise.
• Slave ID of the energy meter on the RTU side is mapped to the Unit ID presented to the PLC. This is where most field engineers introduce the MB_UNIT_ID confusion.

2.3 Energy Meter

• RS-485 half-duplex, 9600 / 8N1 is the most common profile (Schneider PM5100, ABB M2M, Selec MFM384, Eastron SDM630 series). Always confirm against the meter's datasheet.
• Modbus register map documented. For input registers (function code 04), the start address is typically 30001 in Modbus notation. For holding registers (function code 03), 40001.

2.4 Reference Documentation

• Siemens application "Modbus/TCP with MB_CLIENT and MB_SERVER" (entry ID 102020340) - the canonical PDF covering parameter assignment for both S7-1200 and S7-1500.
• Siemens application "MODBUS-TCP using MB_CLIENT and MB_SERVER between two S7-1200 CPUs" (entry ID 83130159).
• TIA Portal S7-1200 manual collection - Modbus TCP examples.
• SIMATIC S7-1200 Programmable Controller System Manual (entry ID 109747168) - section on Modbus TCP communication.

3. MB_CLIENT Instruction Architecture and Parameters

The MB_CLIENT block is found under "Communication > Modbus TCP" in the Instructions task card of TIA Portal. It is invoked as a multi-instance DB or as a single-instance DB created by the project compiler. Each call initiates one Modbus transaction.

3.1 Formal Parameter List

3.2 TCON Connection DB (Connection Type 11)

The MB_CLIENT does not handle the TCP socket directly. It calls a connection DB built by the TCON wizard. The block parameter Connection Type on the configuration dialog is the field that frequently causes the 7006 loop. The legal value for Modbus TCP is 16#0B (decimal 11) in the Connection Type attribute of the TCON configuration; older projects that were imported from a V13 template sometimes leave it at 16#0C (12) or 16#0A (10), neither of which Modbus TCP uses. Set it explicitly to 11.

4. Modbus Register Addressing Model (30001 vs 40001)

Modbus addressing is the single most common source of "connection OK, no data" behavior. Modicon legacy notation prepends a digit to the offset:

For the energy-meter case, two addressing decisions must be made and aligned with the meter vendor's manual:

1. Are the values I want to read exposed as Input Registers (3xxxxx) or Holding Registers (4xxxxx)? Most multi-function meters put instantaneous V/I/kW in input registers and total kWh / demand in holding registers.
2. If the address is in the 3xxxxx range, MB_DATA_ADDR = 30001 with MB_MODE = 4 is the correct pairing in current TIA Portal releases. Some legacy examples used MB_MODE = 103 (a non-standard extension of FC 04). Modern MB_CLIENT firmware rejects MB_MODE = 103 with STATUS = 16#8188. Use MB_MODE = 4.

5. Status Code 7006: Root Cause Analysis

The block continuously reports STATUS = 16#7006. According to the Siemens S7-1200 Modbus TCP reference and the application example PDF (entry ID 102020340), the transient STATUS codes are:

In a correctly executing read of input registers, the user should see a one-cycle burst of 7001 -> 7002 -> 7003 followed by DONE = TRUE. The "stuck on 7006" symptom in the field is normally caused by one of:

• The application logic evaluates BUSY only, not DONE, and never re-arms REQ, so the block settles into a no-job state with the connection still open.
• A previous request errored out (e.g., 8188) and the block returned to "no fresh job" without the application noticing ERROR and STATUS.
• The Modbus response is arriving but the DATA_PTR DB is not large enough to hold MB_DATA_LEN elements of the target type, in which case the response is silently dropped.

6. Error Code 16#8188: MB_MODE Validation

When the user attempts to force the read by changing the mode (for example to 103, which is the FC04 variant from older Siemens libraries), the block returns ERROR = TRUE and STATUS = 16#8188 with the message text "The MB_MODE parameter has an invalid value." Modern S7-1200 MB_CLIENT firmware (V4.1 and later) accepts only the canonical function code selectors:

7. Connection Type and MB_UNIT_ID Configuration

7.1 Connection Type = 11

The TCP connection used by MB_CLIENT is described by a TCON data block. In the configuration editor of that DB, the Connection Type field accepts several values for S7-1200:

When the connection type is left at 16#0A or 16#0C, the MB_CLIENT still opens the socket in some firmware versions, but the keep-alive semantics are wrong, leading to the 7006 "stuck open" behavior described above. Force the value to 16#0B and re-download the project.

7.2 MB_UNIT_ID = 1 (or the actual RTU slave ID)

For a Modbus TCP gateway that proxies to a single RTU slave, MB_UNIT_ID = 1 is almost always the right starting value. The gateway will typically expose a "Unit ID pass-through" mode, in which the ID from the PLC's Modbus PDU is forwarded to the RTU bus. If the meter is the only RTU device on the bus, leave MB_UNIT_ID = 1; if the gateway has a fixed mapping table, fill the correct slave ID in MB_UNIT_ID and disable pass-through.

A common commissioning shortcut: open Modscan, set Slave ID = 1, confirm data. If Modscan works with Slave ID = 1 and the PLC does not, MB_UNIT_ID is by definition the wrong value or is set to 255 (broadcast, which the meter usually ignores for read FC 04). Hard-code MB_UNIT_ID = 1 in the instance DB or in the call site.

8. Buffer Data Block Sizing and Data Length

Even when the Modbus PDU is correctly received, the data is not written to the application area unless the DATA_PTR Variant points to a block large enough for MB_DATA_LEN elements of the configured type. For 16-bit register reads (FC 03, FC 04), the data block must contain at least MB_DATA_LEN words; for 32-bit register reads (e.g., IEEE 754 floating-point values from the meter, packed as two 16-bit registers per float), the block must contain at least MB_DATA_LEN / 2 DWord elements, or MB_DATA_LEN Word elements and the application combines them in code.

8.1 Recommended Buffer DB Template

Create a global DB named BUFF_DATA with the following structure (Word array, generous headroom for IEEE 754 float and signed/unsigned reads):

DATA_BLOCK "BUFF_DATA"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
   STRUCT
      Volt_L1_N   : ARRAY[1..20] OF WORD;   // Holding 30001..30010
      Volt_L2_N   : ARRAY[1..20] OF WORD;   // Holding 30011..30020
      Volt_L3_N   : ARRAY[1..20] OF WORD;   // Holding 30021..30030
      Current_Tot : ARRAY[1..20] OF WORD;   // Holding 30031..30040
      Active_Pow  : ARRAY[1..20] OF WORD;   // Holding 30041..30050
      kWh_Tot     : ARRAY[1..20] OF WORD;   // Holding 30051..30060
      Active_En   : ARRAY[1..20] OF WORD;   // Holding 30061..30070
      Reactive_En : ARRAY[1..20] OF WORD;   // Holding 30071..30080
   END_STRUCT;
END_DATA_BLOCK

This block is non-optimized (so MB_CLIENT can address it via standard-access VARIANT pointer) and provides 20 words per logical measurement, which is more than enough for any 1-10 register read of typical input registers.

8.2 Setting MB_DATA_LEN

For a single value (one register, e.g., voltage on 30001) use MB_DATA_LEN = 1. For a packed float pair (high word at 30001, low word at 30002) use MB_DATA_LEN = 2. The default block parameter of 20 is harmless but wasteful of MB_CLIENT call time and Modbus bandwidth. Start with MB_DATA_LEN = 2 and grow only as the meter documentation requires.

9. Step-by-Step TIA Portal Configuration Procedure

Follow this sequence to rebuild the MB_CLIENT call from a clean state.

Step 1 - Verify network reachability

From the TIA Portal engineering station or a laptop, ping the gateway IP. If the ping fails, fix the addressing before touching the PLC. If Modscan works from the same engineering station, ping will also work.

Step 2 - Insert MB_CLIENT

In the project tree, open the OB1 (or the cyclic OB) and drag MB_CLIENT from the Instructions task card, Communication > Modbus TCP. Choose a single-instance DB or multi-instance.

Step 3 - Generate the TCON connection

Open the instance DB and click the Configuration button next to the CONNECT_ID field. In the TCON wizard, set:

• Connection type: TCP/IP
• Partner: unspecified / by IP address
• Active connection establishment: checked
• Local port: 0 (auto-assign)
• Partner port: 502
• Partner IP: 192.168.0.50 (or your gateway IP)

Confirm in the generated DB that the Connection Type attribute is 16#0B (11 decimal). Save and compile.

Step 4 - Bind MB_CLIENT parameters

On the call site, assign:

// MB_CLIENT instance call
"MB_CLIENT_DB".REQ         := "Poll_Trigger";            // BOOL, edge from timer or scan logic
"MB_CLIENT_DB".DISCONNECT  := FALSE;
"MB_CLIENT_DB".CONNECT_ID  := 1;                          // UINT, matches TCON ID
"MB_CLIENT_DB".IP_OCTET_1  := 192;
"MB_CLIENT_DB".IP_OCTET_2  := 168;
"MB_CLIENT_DB".IP_OCTET_3  := 0;
"MB_CLIENT_DB".IP_OCTET_4  := 50;
"MB_CLIENT_DB".IP_PORT     := 502;                        // UINT
"MB_CLIENT_DB".MB_MODE     := 4;                          // FC04 = read input registers
"MB_CLIENT_DB".MB_DATA_ADDR:= 30001;                      // start at 30001
"MB_CLIENT_DB".MB_DATA_LEN := 2;                          // two registers = 1 float
"MB_CLIENT_DB".MB_UNIT_ID  := 1;                          // RTU slave ID 1
"MB_CLIENT_DB".DATA_PTR    := "BUFF_DATA".Volt_L1_N;      // ARRAY[1..20] OF WORD

"DONE_BIT"        := "MB_CLIENT_DB".DONE;
"BUSY_BIT"        := "MB_CLIENT_DB".BUSY;
"ERROR_BIT"       := "MB_CLIENT_DB".ERROR;
"STATUS_WORD"     := "MB_CLIENT_DB".STATUS;

Step 5 - Implement the REQ trigger logic

REQ must be edge-triggered. A 100 ms clock from a TON / IEC timer driving REQ, with a 1 s pulse, is a standard commissioning pattern:

// Edge-triggered REQ using a clock generator
"Poll_Clock_Clock" (TP := TRUE, PT := T#100ms);    // IEC timer pulse
IF "Poll_Clock_Clock".Q THEN
    "Poll_Trigger" := TRUE;        // rising edge each cycle
ELSE
    "Poll_Trigger" := FALSE;
END_IF;

Step 6 - Build, download, and go online

Compile the project, download to the CPU, and connect an online watch table on MB_CLIENT_DB. STATUS should pulse 7001 -> 7002 -> 7003, then DONE = TRUE for one cycle, with STATUS = 0 in the idle phase. If STATUS = 7006 persists without DONE pulsing, revisit the address class and MB_UNIT_ID.

10. Verification with Modscan and Online Watch

Cross-check the live data against Modscan32 (or Modbus Poll) running on the engineering station.

10.1 Watch Table Layout

10.2 Float Reassembly

Most energy meters return IEEE 754 floats as two 16-bit words, big-endian: high word first, low word second. To reassemble in SCL:

// Combine WORD[1] (high) and WORD[2] (low) into a 32-bit IEEE 754 float
"BUFF_DATA".Volt_L1_N_Float := DWORD_TO_REAL(
    (WORD_TO_DWORD("BUFF_DATA".Volt_L1_N[1]) * 16#10000)
    OR WORD_TO_DWORD("BUFF_DATA".Volt_L1_N[2])
);

For little-endian meters (rare, but some Schneider PM5xxx variants), reverse the order. Always verify against the meter's Modbus register map and the value Modscan shows for the same address.

11. Field-Proven Diagnostics and Common Pitfalls

11.1 Diagnostic Ladder

1. Confirm external tool reads. Modscan with Slave ID = 1, FC = 04, Addr = 30001, Len = 2. If Modscan fails, the issue is upstream of the PLC and the MB_CLIENT cannot be expected to read either.
2. Check the connection type in the TCON DB. Confirm 16#0B, not 16#0A or 16#0C.
3. Check MB_UNIT_ID. Default of 255 is almost never correct. Set to 1.
4. Check MB_MODE / MB_DATA_ADDR pairing. 30001 -> MB_MODE = 4 (FC 04). 40001 -> MB_MODE = 3 (FC 03). 103 / 104 -> reject (8188).
5. Check DATA_PTR type and size. Non-optimized DB, type matches the read operation, length >= MB_DATA_LEN.
6. Check REQ edge triggering. Stuck TRUE prevents re-issue. Stuck FALSE prevents any issue. Edge once per cycle.
7. Watch STATUS online. If STATUS = 8188 persists, an input parameter is illegal. If STATUS = 80C8, the gateway refused (timeout / IP / port). If STATUS = 7006, fix the read or the address; the connection is fine.

11.2 Common Pitfall Matrix

11.3 MB_CLIENT STATUS Code Quick Reference

12. Frequently Asked Questions