meta data for this page
Simatic Modbus S7 error- and statuscodes
lamaPLC Simatic know-how contents
Simatic S7-1500 / S7-1200: Simatic S7-1500 / S7-1200
Simatic TIA portal (and classic) type-definitions: TIA Data-types
Simatic TIA SCL commands: SCL commands
Simatic TIA Basic know-hows: TIA Portal know-how
Simatic (TIA and classic) Modbus error- and statuscodes: Simatic Modbus S7 error- and statuscodes
Simatic S7 PLC types: S7 PLC types
Simatic TIA lamaLibrary:Simatic LamaLibrary
Simatic TIA Diagnose generator: TIA Diagnose generator
List of error codes related to Simatic communication (especially Modbus communication). I added a little to the list based on my own experience (red entries).
If you have more information about Modbus error signals, or if you found any error in the table, let me know!
I am constantly expanding and improving the table based on my own experience.
| Status codes | Text | notes and example call functions |
|---|---|---|
| 0000 | ok - No error / Instruction executed without errors | |
| 0001 | Connection established | |
| 0003 | Connection terminated | |
| 7000 | #no job active AND no connection established (REQ=0, DISCONNECT=1) | |
| 7001 | Start of job processing / Connection establishment triggered, BUSY = 1, DONE = 0. |
|
| 7002 | Intermediate call. Connection is being established, BUSY has the value “1”. |
|
| 7003 | Connection is being terminated | |
| 7004 | Connection established AND monitored. No job processing active. | |
| 7005 | data is being sent. | |
| 7006 | data is being received. If this status “freezes”, i.e. the #busy signal is not followed by #done, the unit does not respond, but is technically available. In the case of Modbus communication, it is worth checking the unit address and setting it. This is especially valid if the TCP/RTU converter is used, in this case “MB_CLIENT_DB”.MB_Unit_ID := address; may be important. It is worth testing the operation of the converter beforehand on a PC with the modbus client test program. - vamsan |
|
| 00 .. 7Fxx | CPU Kein Fehler oder keine Warnung | |
| 8x3A | Invalid pointer at parameter x. | |
| 8070 | All internal instance memories are in use. | |
| 8080 | The identifier entered for the communications port is invalid. | |
| 8081 | Timeout, module error, internal error. The system data type used must match the organization block in the user program. |
|
| 8082 | Parameter assignment failed because parameter assignment is currently being performed in the background. | |
| 8083 | Buffer overflow: The CM or CB has returned a receipt message with a length that is greater than permitted by the length parameter. | |
| 8085 | Error specifying the length at the LENGHT parameter. The specified length is “0” or greater than the maximum permitted value. The connection ID (ID parameter) is already in use by a configured connection. LEN parameter is greater than the largest allowable value (For S7-1200: 8192; for S7-1500 (TCP): 65536; with S7-1500 (FDL): 240 / 236) - Parameter DATA and LEN both have the value “0”. - The value of the LEN or DATA parameter was changed after the first call. |
|
| 8086 | The ID parameter is out of range (1 .. 0x0FFF). | |
| 8087 | Maximum number of connections reached, no further connection possible. | |
| 8088 | - LEN parameter is larger than the range specified in DATA. - Receive area is too small. |
|
| 8089 | The CONNECT parameter does not point to a connection description or the connection description was created manually. | |
| 8090 | Message length invalid, module invalid, message invalid. Logical start address not valid. |
|
| 8091 | Incorrect version in parameterization message. Path does not exist or is invalid. (FileWriteC) |
|
| 8092 | Invalid record length in parameterization message. Illegal type for VARIANT pointer The source or target area is only available in the load memory. The “Name” parameter is not of the data type “STRING”, is too long or contains invalid characters. (FileWriteC) |
|
| 8093 | The DP component addressed using ID or F_ID is not configured. The “Offset” parameter points past the end of the file to be written. (FileWriteC) The creation of the file is rejected because “Offset” is greater than zero. (FileWriteC) |
|
| 8094 | “Length” is greater than the maximum permitted value. For an S7-1500 CPU, for example, the maximum value permitted is 16 MB, i.e. 16,777,216 bytes. (FileWriteC) “Length” + “Offset” is greater than the maximum permitted value. (FileWriteC) |
|
| 809A | The structure at the CONNECT parameter is not supported on an integrated interface or the length is invalid. | |
| 809B | The InterfaceId element within the TCON_xxx structure does not reference a hardware ID of a CPU or CM/CP interface or has the value “0”. | |
| 80A0 | Negative acknowledgment when reading from the module | |
| 80A1 | The specified connection or port is already in use. Communication error: - The specified connection has not yet been established. - The specified connection is being terminated. Transmission via this connection is not possible. - The interface is reinitialized. - Negative acknowledgment when writing to the module - Write error; the data in the file on the memory card may be partly overwritten. (FileWriteC) This error is often due to a conflict of IDs (CONN_OUC). In case of this error, it is worth recompiling the entire program (compile → software (rebuild all) and downloading it (PLC newstart!)) - vamsan |
|
| 80A2 | Local or remote port is used by the system. The following ports are reserved locally: 20, 21, 80, 102, 135, 161, 162, 443, 34962, 34963, 34964 and the range 49152 to 65535. DP protocol error at layer 2 (e.g. slave failure or bus faults) |
|
| 80A3 | ID is used by a connection created by the user program that also uses the same connection description at the CONNECT parameter. | |
| 80A3 | An attempt is being made to terminate a non-existent connection or the connection has already been terminated. General communication error or IO device / DP slave cannot be reached |
|
| 80A4 | IP address of the remote endpoint of the connection is invalid or it matches the IP address of the local partner. | |
| 80A4 | Temporary communication error: The interface is being reconfigured or the connection is being set up. | |
| 80A7 | Communication error: You executed “TDISCON” before “TCON” was completed. DP slave or module is busy (temporary error) |
|
| 80A8 | DP slave or module reports inappropriate versions | |
| 80A9 | Feature not supported Function is not supported by the DP slave or the module |
|
| 80AA .. 80AF | DP slave or module reports a manufacturer-specific error in its application. Please refer to the documentation provided by the manufacturer of the DP slave or module. | |
| 80B0 | Invalid index Module does not recognize the data set Data set number ≥ 256 is not permitted |
|
| 80B1 | Write length error Error in length specification. You changed the DATA parameter before the current job ended. The source area specified by the “Data” parameter is shorter than the length required at the “Length” parameter. (FileWriteC) |
|
| 80B2 | Invalid slot The configured slot is not occupied. |
|
| 80B3 | Type conflict Actual assembly type not equal to target assembly type The parameterized protocol variant (parameter ConnectionType in the connection description) is UDP. Please use the “TUSEND” / “TURCV” instruction for a UDP connection. There is not enough space on the memory card or in the internal load memory. (FileWriteC) |
|
| 80B4 | Invalid area DP slave or module reports access to an illegal area Only with TCON_IP_RFC: The local T-Selector was not specified or the first byte does not contain the value 0x0E (only with a length of T-Selector = 2) or the local T-Selector begins with “SIMATIC-”. The memory card or file is write-protected. (FileWriteC) |
|
| 80B5 | State conflict DP slave or module is not ready With connection type 13 = UDP, only passive connection establishment is permitted (ActiveEstablished parameter of the TCON_IP_v4 / TCON_PARAM structure has the value TRUE). |
|
| 80B6 | Invalid connection type / access denied only TCP connections are supported. DP slave or module denies access Parameterization error in the ConnectionType parameter of the data block for the connection description. - Only valid for TCON_IP_v4: 0x11, 0x0B and 0x13. - Only valid for TCON_IP_RFC: 0x0C and 0x12 |
|
| 80B7 | Invalid range DP slave or module reports an invalid range of a parameter or a value For TCON_IP_v4: - TCP (active connection establishment): Remote port is “0”. - TCP (passive connection establishment): Local port is “0”. - UDP: Local port is “0”. - Partner endpoint IP address was set to 0.0.0.0. For TCON_IP_RFC: - Local (LocalTSelector) or remote (RemoteTSelector) T-selector specified with a length greater than 32 bytes. - A length greater than 32 was entered for TSelLength of the T-selector (local or remote). - Error in the length of the IP address of the respective connection partner. - Partner endpoint IP address was set to 0.0.0.0. |
|
| 80B8 | Invalid parameter DP slave or module reports an invalid parameter The ID parameter in the local connection description (structure at the CONNECT parameter) and the ID parameter of the statement are different. |
|
| 80B9 | DP slave or module reports an invalid type, eg buffer too small | |
| 80BA | S7-1500-R/H-CPU: The primary CPU fails while reading or writing a data record. | |
| 80BB | Invalid type Invalid value at ActiveEstablished parameter. |
|
| 80C0 | Read constrain conflict The data is only written when the CPU is in STOP mode. Note: This means that the user program cannot write. The data is only written online with PG/PC. The file cannot be accessed. (FileWriteC) |
|
| 80C1 | Write constrain conflict The module has not yet processed the data from the previous write request for the same data set on the module. |
|
| 80C2 | Resource busy The module is currently processing the maximum possible number of jobs for a CPU. |
|
| 80C3 | Resource unavailable All connection resources are in use or ports may be in dynamic use by other applications or connections. |
|
| 80C3 | - A block with this ID is already being processed in another priority group. - Internal lack of resources. The maximum number of simultaneously active FileWriteC instructions has already been reached. |
|
| 80C4 | Temporary communication error: - The connection cannot be established at the moment. - The connection cannot be established because firewalls on the connection path are not enabled for the required ports. - The interface is receiving new parameters. - The configured connection is currently being removed by a “TDISCON” instruction. Most often, the solution to this error is to recompile the entire program (compile → software (rebuild all) and download it (PLC newstart!) - vamsan |
|
| 80C5 | DP slave or module not available. The connection partner refuses to establish the connection, cleared down the connection or actively ended it. - Connection terminated by the communication partner. - LSAP of the remote connection partner not released |
|
| 80C6 | Network error - The connection partner cannot be reached. Record transfer aborted due to priority class abort. |
|
| 80C7 | Execution timed out. Job aborted due to restart (warm start) or cold start of the DP master. |
|
| 80C8..80CF | DP slave or module reports a manufacturer-specific error regarding its resources. Please refer to the documentation provided by the manufacturer of the DP slave or module. | |
| 80C8 | No response OF the server in the defined period. Value at the ID parameter is already being used by a connection that was created via the user program. The connection uses the same ID but different connection settings on the CONNECT parameter. |
|
| 80C8 | The slave does not respond within the set time Solution: Check the data transmission rate, parity and wiring of the slave. |
|
| 80C9 | Connection partner validation failed. The connection partner who wants to establish a connection does not correspond to the partner defined in the structure at the CONNECT parameter. | |
| 80C9 | The length of the receive area is smaller than the length of the sent data. | |
| 80C9 | The slave does not respond within the time set by Blocked_Proc_Timeout. Solution: Check the setting for Blocked_Proc_Timeout. Check if the module has been configured with the Modbus_Comm_Load instruction. The module may possibly need to be reconfigured using Modbus_Comm_Load after a pull/plug or after voltage recovery. |
|
| 80CE | The IP address of the local interface is 0.0.0.0 | |
| 80D0 | Related to TCP and the active connection endpoint: The remote_qdn parameter is an empty string. In this case no connection can be established. | |
| 80D1 | The remote_qdn parameter is not a fully qualified domain name. Possibly the dot is missing at the end. | |
| 80D1 | The wait time for XON or CTS = ON has expired. Solution: The communication partner has a fault, is too slow or is offline. Check the communication partner or change the parameters, if necessary. |
|
| 80D2 | There is no DNS server address configured. | |
| 80D2 | “Hardware RTS always ON”: Send job canceled due to change from DSR = ON to OFF Solution: Check the communication partner. Make sure that DSR is ON for the entire duration of transmission. |
|
| 80D3 | The fully qualified domain name could not be resolved. Possible causes: - The DNS server cannot be reached, e.g. B. because it is down or the remote port is unreachable. - An error occurred while communicating with the DNS server. - The DNS server returned a valid DNS response, but the response did not contain an IPv4 address. |
|
| 80E0 | Inappropriate or bad message was received. | |
| 80E0 | Frame aborted: Send buffer overflow / send frame too long Solution: In the user program call the instruction more often or configure a communication with data flow control. |
|
| 80E1 | Error during handshake. Possible causes: - Canceled by user - Security not high enough - Renegotiation is not supported - SSL/TLS version is not supported - Hostname validation failed |
|
| 80E1 | Frame aborted: Parity error Solution: Check the connection line of the communication partners, or verify that the same data transmission rate, parity and stop bit number are configured for both devices. |
|
| 80E2 | Unsupported / Invalid Certificate - Possible cause: The time of the module concerned has not been set or the module is not synchronized. |
|
| 80E2 | Frame aborted: Character frame error Solution: Check the settings for start bit, data bits, parity bit, data transmission rate, and stop bit(s). |
|
| 80E3 | Certificate has been discarded. | |
| 80E3 | Frame aborted: Character overflow error Solution: Check the number of data in the frame of the communication partner. |
|
| 80E4 | No valid certificate authority was found. | |
| 80E4 | Frame aborted: Maximum frame length reached Solution: Select a shorter frame length at the communication partner. The following are valid (depending on the module): 1-1024/2048/4096 (bytes) |
|
| 80E5 | Certificate expired. | |
| 80E6 | Integrity error in transport layer security protocol. | |
| 80E7 | Unsupported extension in X.509 V3 certificate. | |
| 80E9 | TLS server without server certificate is not supported. | |
| 80EA | DTLS (UDP) protocol is not supported. | |
| 80EB | A client cannot request a client certificate. | |
| 80EC | The server cannot validate against the subjectAlternateName (Only clients can do that.) | |
| 80ED | TLSServerCertRef_m ID not valid | |
| 80EE | Handshake not finished yet | |
| 8100 | Invalid operating mode | |
| 8100..81FF | Error in the 1st call parameter | |
| 8152 | The WSTRING, WCHAR, BOOL, ARRAY of STRING, ARRAY of WSTRING and ARRAY of WCHAR data types are not supported at the SRCBLK parameter. (Error in the 1st call parameter) | |
| 8180 | Invalid value for MB_DB parameter Solution: The value configured for MB_DB (instance data DB) at the Modbus_Comm_Load instruction is not valid. Check the interconnection of the Modbus_Comm_Load instruction and its error messages. |
|
| 8181 | The module does not support this data transmission rate. Solution: Select a valid data transmission rate for the module at the BAUD parameter. |
|
| 8182 | The module does not support this parity setting. Solution: Select a suitable value for “Parity” at the PARITY parameter. The following are valid: • None (1) • Even (2) • Odd (3) • Mark (4) • Space (5) • Any (6) |
|
| 8183 | The module does not support this type of data flow control. Solution: Select a valid data flow control for the module at the FLOW_CTRL parameter. |
|
| 8184 | Invalid value for “Response timeout” Solution: Select a suitable value for “Response timeout” at the RESP_TO parameter. Valid range of values: 1 to 65535 (ms) |
|
| 8185 | Diagnostics code NOT supported. (Error in the 1st call parameter) | |
| 8186 | Invalid slave address Solution: Select a suitable slave address at the MB_ADDR parameter. The following are valid: 1-247 at standard address area; 1-65535 at extended address area (0 is reserved for Broadcast) |
|
| 8187 | Invalid value at MB_HOLD_REG parameter Solution: Select a suitable value for the hold register at the MB_HOLD_REG parameter. |
|
| 8188 | Invalid operating mode or broadcast (MB_ADDR = 0) and MODE parameter ≠ 1 Solution: Select the value 1 for MODE in Broadcast mode or select a different operating mode. |
|
| 8189 | Invalid data address Solution: Select a suitable value for the data address at the DATA_ADDR parameter. |
|
| 818A | Invalid length Solution: Select a suitable data length at the DATA_LEN parameter. |
|
| 818B | Invalid value for DATA_PTR Solution: Select a suitable value for the data pointer at the DATA_PTR parameter (M or DB address). |
|
| 818C | The pointer to a MB_HOLD_REG area must be a data block or a bit memory address area. Solution: Select a suitable value for the pointer to the MB_HOLD_REG area. |
|
| 818C | Interconnection error of the DATA_PTR parameter Solution: Check the interconnection of the instruction. |
|
| 818D | The area addressed by DATA_PTR is longer than the DB, or the area addressed is too small for the number of data bytes to be read or written. Solution: Check the DATA_PTR pointer |
|
| 8189 | Invalid addressing OF data at the MB_DATA_ADDR parameter. (Error in the 1st call parameter) | |
| 8200..82FF | Error in the 2nd call parameter | |
| 8200 | The interface is busy with an ongoing request. Solution: Repeat the command later. Make sure that there are no commands still running before you start a new one. |
|
| 8280 | Negative acknowledgment when reading module Solution: Check the input at the PORT parameter. You can find more detailed information on error causes in the Send_Config.RDREC.STATUS or Receive_Config.RDREC.STATUS static parameters or RDREC.STATUS and in the description of the SFB RDREC. |
|
| 8281 | Negative acknowledgment when writing module Solution: Check the input at the PORT parameter. You can find more detailed information on error causes in the Send_Config.WRREC.STATUS or Receive_Config.WRREC.STATUS static parameters or WRREC.STATUS and in the description of the SFB WRREC. |
|
| 8282 | Module not available Solution: Check the input at the PORT parameter and ensure that the module can be reached. |
|
| 8283 | #error reading OR writing data OR access outside the address area. (Error in the 2nd call parameter) | |
| 8284 | Invalid exception code received. (Error in the 2nd call parameter) | |
| 8285 | Diagnostics code NOT supported. (Error in the 2nd call parameter) | |
| 8286 | received function code does NOT match the one sent originally. (Error in the 2nd call parameter) | |
| 8300..83FF | Error in the 3st call parameter | |
| 8352 | The WSTRING, WCHAR, BOOL, ARRAY of STRING, ARRAY of WSTRING and ARRAY of WCHAR data types are not supported at the DSTBLK parameter. (Error in the 3st call parameter) | |
| 8380 | received Modbus frame has incorrect format OR too few bytes were received.(Error in the 3st call parameter) | |
| 8380 | CRC error Solution: Checksum error of the Modbus frame. Check the communication partner. |
|
| 8381 | The function code is not supported or is not supported for broadcast. Solution: Check the communication partner and make sure that a valid function code is sent. |
|
| 8382 | Invalid length information in the request frame Solution: Select a suitable data length at the DATA_LEN parameter. |
|
| 8383 | Invalid data address in the request frame Solution: Select a suitable value for the data address at the DATA_ADDR parameter. |
|
| 8384 | Invalid data value error in the request frame Solution: Check the data value in the request frame of the Modbus master |
|
| 8385 | The diagnostic value is not supported by the Modbus slave (function code 08) Solution: The Modbus slave only supports the diagnostic values 16#0000 and 16#000A. |
|
| 8386 | The returned function code does not match the requested function code. Solution: Check the response frame and the addressing of the slave. |
|
| 8387 | A slave that was not requested answers Solution: Check the response frame of the device. Check the address settings of the slave. |
|
| 8388 | Error in the response of the slave to a write request. Solution: Check the response frame of the slave. |
|
| 8389 | Invalid data area definition: • Illegal value of data_type • DB number not permitted or not available:– Invalid value of db– DB number does not exist–DB number is already being used by another data area– DB with optimized access– DB is not in work memory • Illegal valid for length • Overlapping of MODBUS address areas that belong to the same MODBUS data type Solution: Check the definition of the data areas. |
|
| 8400..84FF | Error in the 4st call parameter | |
| 8452 | MB_HOLD_REG is not a pointer to a DB or a bit memory area Solution: Check the MB_HOLD_REG pointer |
|
| 8453 | MB_HOLD_REG is not a pointer of type BOOL or WORD Solution: Check the MB_HOLD_REG pointer |
|
| 8454 | The area addressed by MB_HOLD_REG is longer than the DB, or the area addressed is too small for the number of data bytes to be read or written. Solution: Check the MB_HOLD_REG pointer |
|
| 8455 | MB_HOLD_REG points to a write-protected DB Solution: Check the MB_HOLD_REG pointer |
|
| 8456 | Error during instruction execution. The cause of the error is shown in the STATUS parameter Solution: Determine the value of the SFCSTATUS parameter. Check what this means in the description for SFC51, STATUS parameter. |
|
| 8852 | Error in the 5st call parameter | |
| 8600..86FF | Error in the 6st call parameter | |
| 8700..87FF | Error in the 7st call parameter | |
| 8800..88FF | Error in the 8st call parameter | |
| 8828 | DATA_PTR points to a bit address that is not equal to n * 8 Solution: Check the DATA_PTR pointer |
|
| 8852 | DATA_PTR is not a pointer to a DB or a bit memory area Solution: Check the DATA_PTR pointer |
|
| 8853 | DATA_PTR is not a pointer of type BOOL or WORD Solution: Check the DATA_PTR pointer |
|
| 8855 | DATA_PTR points to a write-protected DB Solution: Check the DATA_PTR pointer |
|
| 8856 | Error during call of SFC51 Solution: Call the Modbus_Master instruction again |
|
| 8900..89FF | Error in the 9st call parameter | |
| 8A24 | The “Data” points to an impermissible area, for example to the load memory or the local data. (FileWriteC) | |
| 8A51 | Invalid data type of the “Data” parameter. (FileWriteC) | |
| 8A52 | The tag at the Data parameter is insufficient. A part of the source area data may have been written. (FileWriteC) | |
| 8FFF | The module is not ready temporarily due to a reset. Solution: Repeat the request. |
|
This error log is my own “collection”. It may contain errors and inaccuracies, Sandor Vamos, 12.05.2023.
Modbus topics on lamaPLC
This page has been accessed for: Today: 17, Until now: 2033