FieldKit
EN
Get the app

Modbus Unit ID: when it matters, and why 0, 1 and 255 all turn up

· By Vladimir Chemeris, developer of Modbus TCP FieldKit

Short answer: behind a TCP to RS-485 gateway, the Unit ID is the serial address of the device, 1 to 247. On a device with no gateway in front of it, the field has no routing job: the guide recommends 0xFF and accepts 0, yet many devices expect 1. If a device connects and then says nothing, the Unit ID is the first thing to check.

What the guide says

The Modbus TCP implementation guide calls the field “useless” for direct devices and sets the rule in one line: “On TCP/IP, the MODBUS server is addressed using its IP address; therefore, the MODBUS Unit Identifier is useless. The value 0xFF has to be used.” A remark then adds that 0 is also accepted.

It explains why not to use a real address such as 1 on a direct device: if that IP later moves to a gateway, the request gets forwarded to whichever device has that address. With 0xFF, the gateway discards it.

For a gateway, the field carries the serial address, and “the bridge uses the MODBUS Unit identifier to forward the request to the right slave device”. Serial addresses run from 1 to 247, and 0 means broadcast.

What devices do

In practice, you will meet these:

  • Devices that answer whichever Unit ID you send.
  • Devices that answer only their configured ID, often 1, and stay silent otherwise.
  • Gateways that answer 0B for an empty address.
  • Gateways that let the client time out.
  • Servers that answer an exception.

A pymodbus 3.16.1 server with only unit 1 defined answered unit 2, unit 0 and unit 255 with exception 04:

TX 00 10 00 00 00 06 02 03 00 00 00 01
RX 00 10 00 00 00 03 02 83 04

A spec-minded reader might expect 0xFF to work here. It didn’t, so don’t assume. Test against the device in front of you.

Finding the right ID

  1. Try 1, then 255, then 0.
  2. If you’re behind a gateway, check the device’s serial address on its display or DIP switches.
  3. Scan. Send one read of a single register at address 0 to each candidate. At 300 ms per silent unit, all 247 take about 75 seconds.
  4. Count an exception as success. Illegal Data Address proves a unit answered, and you only need to pick a different register.
  5. Don’t count 0A or 0B. They come from the gateway and say nothing about the device behind it.

FieldKit’s Scan Unit IDs works this way: Quick tries 1 to 10 plus 0 and 255, and All tries 1 to 247. It sends FC 03 reads only, one after another, with a timeout of about 300 ms.

Before you scan a gateway

Close other pollers first, because many gateways allow one client at a time. On a shared RS-485 line, a long scan also adds traffic for other masters, so run it during commissioning rather than on a busy production bus.

Unit ID in RTU over TCP

In transparent RTU over TCP, the Unit ID becomes the first byte of the RTU frame, and the device on the line checks it. A wrong value gets no answer, and no gateway reports it. Broadcast 0 gets no response by design. RTU over TCP vs Modbus TCP.

Sources

FAQ

What Unit ID should I use for Modbus TCP?

For a device on TCP with no gateway, the implementation guide recommends 0xFF and also accepts 0. In practice many devices are set up to answer 1, so check the manual. Behind a gateway, use the serial address of the target device, from 1 to 247.

Is the Unit ID the same as the slave address?

Behind a gateway, yes: the gateway forwards it as the RTU address. On a device on TCP with no gateway, the IP address identifies the server, so the field has no routing job.

How do I find an unknown Unit ID?

Scan. Send one harmless read to each candidate and see who answers, or who answers with an exception. An exception such as Illegal Data Address still proves the unit exists.