Hello,

I am experiencing a persistent Modbus TCP communication issue between a Siemens S7-1500 PLC and a MOXA MGate MB3180 gateway, and I would appreciate any advice or confirmation from users who have a similar setup.

My setup:

• PLC: Siemens CPU 1512SP-1 PN (6ES7 512-1DM03-0AB0)
  Firmware: V4.0
• Modbus function: Siemens MB_CLIENT v6.0
• Gateway: MOXA MGate MB3180
  Firmware: 2.6 Build 24061210
  Mode: RTU Slave
• RTU Slave ID (Unit ID): 10 (0x0A)
• Modbus TCP port: 502

Observed behavior:

• TCP connection is established correctly.
• The gateway responds immediately (no timeout).
• However, MB_CLIENT always ends with:
  • ERROR = TRUE
  • STATUS = 16#80A3 (Modbus exception / illegal data address)

I have tested multiple configurations:

• Function codes FC03, FC04
• FC23 (Siemens MB_MODE = 0) with RD/WR parameters set correctly
• 0-based and 1-based addressing
• Unit ID = 10, 1, and 255
• New instance DBs, non-optimized data blocks, correct MB_DATA_PTR

None of these combinations changed the result: the PLC always receives exception 0x80A3.

Important comparison:

• Using Modbus Poll and ModScan, I can successfully read changing values from the same gateway and RTU device via Modbus TCP.
• This indicates that:
  • The MOXA gateway is reachable and working
  • The RTU device responds correctly
  • Standard Modbus TCP requests are accepted by the gateway

Therefore, the issue seems to be a specific incompatibility between Siemens MB_CLIENT and the MOXA MGate MB3180, not a wiring or addressing problem.

My question:
Has anyone successfully used Siemens S7-1500 MB_CLIENT with MGate MB3180 (FW 2.6) in RTU Slave mode?

• Is there a specific MB_CLIENT configuration required?
• Or is this a known limitation of the MB3180 with Siemens PLCs?

Any confirmation, workaround, or official statement from Siemens or MOXA would be very helpful.

Thank you in advance.

EDIT: 

Update with packet-level evidence

I would like to add an important observation based on Wireshark analysis.

As shown in the attached capture, the Modbus TCP communication is technically correct:

• The Siemens PLC sends a valid Modbus TCP request (FC03, Unit ID = 10).
• The MOXA MGate MB3180 replies with a valid Modbus TCP response.
• The response contains valid register data (no Modbus exception, correct byte count, correct transaction ID).

Despite this, the Siemens MB_CLIENT (V6.0) always ends with:

• ERROR = TRUE
• STATUS = 16#80A3

This indicates that the TCP response is received on the network level, but is rejected internally by MB_CLIENT.
The same gateway and registers can be read successfully using Modbus Poll / ModScan from a PC.

PLC used: CPU 1512SP-1 PN (ET200SP), FW V4.0
This suggests a possible limitation or incompatibility of MB_CLIENT V6.0 on ET200SP CPUs when communicating with third-party Modbus TCP gateways (RTU–TCP encapsulation), rather than an addressing or gateway configuration issue.

------------------------------------------------------------------------------------------ 
Split from Problem Communication : s7 1200 Modbus Client to Moxa Mgate MB3180.

Update – current findings and status

After further systematic testing, I would like to share the current state and new findings.

Environment (confirmed):

• PLC: Siemens CPU 1512SP-1 PN, FW V4.0
• Modbus block: MB_CLIENT V6.0
• Gateway: MOXA MGate MB3180, FW 2.6 Build 24061210
• Mode: Modbus TCP ↔ RTU Slave
• RTU Unit ID: 10 (0x0A)
• TCP port: 502

Key observations:

• Modbus TCP communication itself is working.
• Wireshark clearly shows valid Modbus TCP responses (FC03) from the MOXA gateway with correct register values.
• Third-party clients (Modbus Poll, ModScan, mobile Modbus apps) successfully read live data from the same gateway and RTU device.
• Therefore, the gateway, RTU device, addressing, and network are confirmed to be correct.

MB_CLIENT behavior:

• With MB_MODE = 3 (FC03), BUSY never becomes active and requests fail.
• With MB_MODE = 0 (Siemens combined read mode), BUSY becomes active and STATUS cycles through:
  • 7001, 7002, 7003, 7004, 7005, 0001
  • occasional errors: 80A1, 80C4
• This indicates that the MB_CLIENT state machine is running and transactions are initiated.
• However, no received data are ever written to MB_DATA_PTR / RD_MB_DATA_PTR – data buffers remain all zeros.
• DONE is never set.

Important detail:

• Changing the TCON_IP_v4.ID from 10 to 1 caused a clear change in MB_CLIENT behavior (state transitions started to occur), which suggests that the connection layer is active and sensitive to configuration.
• Nevertheless, even with correct BUSY behavior and valid responses visible in Wireshark, data are not transferred into the PLC.

Conclusion so far:

• This does not appear to be an addressing issue, data type issue (REAL/INT), endianess problem, or Modbus server issue.
• The same Modbus TCP responses are correctly parsed by multiple third-party clients.
• The issue appears to be a compatibility or implementation problem between Siemens MB_CLIENT V6.0 and MOXA MGate MB3180, where valid Modbus TCP responses are received but not processed into the PLC data area.

Open question:

• If anyone has encountered a similar setup or has any idea, workaround, or configuration detail that could be worth testing, I would greatly appreciate any suggestions.