Resolving MB_UNIT_ID 16#FF Error on S7-1500 CPU 1513-1 PN Modbus

1. Problem Description

The failure mode reported in the field is consistent across multiple vendors (Schneider Electric PAC3200, generic Modbus simulators, Moxa gateways, ET 200MP stations with IM 155-5 MF/HF acting as Modbus devices). The MB_CLIENT block is called cyclically with REQ, the BUSY output toggles for a fraction of a second, then ERROR rises and STATUS returns an error code indicating "no response from partner" or "connection aborted". A Wireshark trace shows the CPU transmitting a SYN to port 502, the server responding with SYN-ACK, the client transmitting a Modbus request with Unit Identifier = 0xFF, and the server closing the socket with RST immediately after receiving that request.

The diagnostic sequence that confirms the root cause is straightforward:

1. Open the MB_CLIENT instance DB (default name MB_CLIENT_DB or user-defined) in TIA Portal online.
2. Inspect the MB_UNIT_ID input.
3. Confirm the value is the TIA Portal default of 16#FF (255 decimal).

2. Root Cause: MB_UNIT_ID Default Value

The MB_UNIT_ID parameter of MB_CLIENT maps directly to the Unit Identifier byte (offset 6) of the Modbus Application Protocol (MBAP) header as defined by the Modbus Organization specification. According to the Modbus Messaging on TCP/IP Implementation Guide (v1.0b), this byte is used for routing on composite or serial-bridged networks. On a pure Modbus TCP network without a serial bridge, the recommended value is 0xFF when the target is a Modbus TCP device, but it is not mandatory — many devices simply hard-code 1 and ignore any other value.

The MB_CLIENT instruction in the "MODBUS TCP" library was originally developed for the ET 200S serial module and carried over to S7-1500. Its default instance DB therefore contains MB_UNIT_ID = 16#FF. The TIA Portal does not flag this default as a configuration error, which is why the symptom appears only at runtime.

2.1 Typical Server Behavior

3. Affected Hardware and Firmware

The MB_CLIENT instruction requires TIA Portal V14 SP1 or later. The current TIA Portal V18 (released 2023) ships the latest revision of the MODBUS TCP library under Instructions → Communication → MODBUS TCP. Refer to the TIA Portal Modbus TCP documentation for the master reference on supported function codes and address ranges.

4. MB_CLIENT Parameter Reference

The block is configured through a single instance DB and through a connection description of type TCON_IP_V4. The full input/output set is listed below.

5. Connection Description: TCON_IP_V4

The CONNECT input of MB_CLIENT is a structure of type TCON_IP_V4. The fields that the integrator must populate manually are shown below.

6. Step-by-Step Resolution Procedure

The corrective action takes about 60 seconds once the offending parameter is identified.

6.1 Prerequisites

• Project is loaded on the CPU 1513-1 PN with read/write access from TIA Portal (online → Go online).
• MB_CLIENT block exists in the project, with its instance DB compiled and downloaded.
• The PC station is reachable from the CPU (e.g. PC 192.168.0.241, PLC 192.168.0.2, subnet mask 255.255.255.0).

6.2 Procedure

1. In the project tree, open Program blocks → System blocks → MB_CLIENT_DB (or the user-defined instance DB).
2. Switch to the Data view (Monitor/Modify view offline).
3. Locate the static tag MB_UNIT_ID of type Byte.
4. Change the initial value from 16#FF to 1 (decimal) for a pure Modbus TCP server, or to the RTU slave address if the server is bridging to a serial network.
5. Recompile the block (right-click → Compile → Software).
6. Download to the CPU (online → Download to device).
7. Trigger REQ and monitor DONE / ERROR / STATUS.

6.3 Verify the Connect Path in DB5

If the project uses an external connection DB (a common practice in TIA Portal V14/V15), open that DB and confirm:

• RemoteAddress matches the IP of the slave device.
• RemotePort = 502.
• ConnectionType = 16#0B.
• LocalPort = 0 (auto-assign).

7. Verification

Confirm communication is established by any of the following methods.

7.1 Online STATUS = 16#0000

When DONE pulses TRUE for one scan and STATUS returns 16#0000, the request was successful. The MB_CLIENT block retains its connection after the first successful call, so subsequent calls with the same ID and CONNECT do not re-establish the TCP session.

7.2 Wireshark Capture

Filter on the slave IP and inspect the Modbus/TCP stream. The Unit Identifier byte at offset 6 of the MBAP header should now read 0x01 instead of 0xFF:

7.3 Read Coils / Holding Registers Test

Issue a Function Code 03 read against a known address (for instance, register 40001 on a PAC3200 returns the line-to-line voltage V_LL in tenths of a volt). Confirm the value returned matches the simulator or the meter's display.

8. STATUS and Error Code Reference

MB_CLIENT STATUS values for the most common Modbus TCP errors. Refer to the TIA Portal online help for the complete table.

9. Troubleshooting Matrix

10. Best Practices and Field-Proven Notes

• Always set MB_UNIT_ID = 1 for a pure Modbus TCP server. The 16#FF default is a heritage from the ET 200S serial era and is rejected by a majority of third-party slaves.
• Allocate a unique CONNECT.ID per MB_CLIENT instance. Reusing IDs across instances causes 16#80A1 at runtime, not at compile time.
• Use a single global MB_CLIENT_DB shared by all calls when polling multiple registers on the same device. The Siemens FAQ on this topic is explicit: a single MB_CLIENT can perform multiple function codes by re-triggering REQ; multiple MB_CLIENT instances targeting the same server should be consolidated to avoid wasted connections.
• Address convention differs by function code. FC 1/2/3/4 use 0-based coil/register numbers in MB_DATA_ADDR; FC 5/6/15/16/23 use 1-based. Mapping a holding register of address 40001 requires MB_DATA_ADDR = 0 (or 40001 depending on the documentation; cross-check with the device's register map).
• Disable any third-party firewall on the engineering PC during commissioning. Windows Defender silently drops outgoing TCP to port 502 on some patch levels.
• Document the slave device's required Unit ID in the project comments. MB_UNIT_ID is not visible in the project tree, only in the instance DB. Without an explicit comment, a future maintainer will reset it to the default.

11. Related Configuration: CPU Side

The CPU 1513-1 PN uses its first PROFINET interface (X1) for Modbus TCP. Configuration steps on the device side:

1. Device view → CPU 1513-1 PN → PROFINET interface [X1] → Properties → Ethernet addresses.
2. Set IP address (e.g. 192.168.0.2), subnet mask (255.255.255.0), and ensure no router is configured for a flat network.
3. Under Connection resources, verify the CPU is configured for S7 connections, TCP connections, and ISO-on-TCP as required. The default allows all three.
4. Under Security → Connection mechanisms, ensure the Permit access with PUT/GET option is enabled if you also need S7 communication, although this is independent of Modbus TCP.

12. Quick Reference Card