Modbus TCP/IP in PLC Programming

Introduction

Modbus TCP/IP helps devices talk to each other over a network using a simple language. It makes controlling machines easier and faster.

You want to read sensor data from a machine remotely.

You need to control a motor or valve from a computer.

You want to connect multiple devices in a factory to share information.

You need a simple way to monitor equipment status over Ethernet.

You want to automate data collection from different machines.

Syntax

PLC Programming

Client connects to Server IP and Port (usually 502)
Client sends a request with:
  - Function code (e.g., read coils, write registers)
  - Address of data
  - Number of items to read or write
Server replies with requested data or confirmation

Modbus TCP/IP uses port 502 by default.

Function codes tell what action to do, like read or write.

Examples

This reads simple ON/OFF values like switches.

PLC Programming

Read Coils (Function code 1):
Client requests status of 10 coils starting at address 0
Server replies with ON/OFF status of those coils

This changes a setting or value in the device.

PLC Programming

Write Single Register (Function code 6):
Client writes value 123 to register at address 40001
Server confirms the write was successful

Registers hold numbers like temperature or speed.

PLC Programming

Read Holding Registers (Function code 3):
Client requests 5 registers starting at address 0
Server sends back the values stored there

Sample Program

This script connects to a Modbus TCP server and asks for two holding registers starting at address 0. It then prints the raw response in hexadecimal.

PLC Programming

import socket

# Connect to Modbus TCP server
server_ip = '192.168.1.100'
server_port = 502

# Create a TCP socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((server_ip, server_port))

# Build a Modbus TCP request to read 2 holding registers starting at address 0
# Transaction ID: 1, Protocol ID: 0, Length: 6, Unit ID: 1
# Function code: 3 (read holding registers)
# Starting address: 0, Quantity: 2
request = bytes([
    0x00, 0x01,       # Transaction ID
    0x00, 0x00,       # Protocol ID
    0x00, 0x06,       # Length
    0x01,             # Unit ID
    0x03,             # Function code
    0x00, 0x00,       # Starting address high, low
    0x00, 0x02        # Quantity high, low
])

sock.sendall(request)

# Receive response (expected 13 bytes)
response = sock.recv(13)

sock.close()

# Print response in hex format
print('Response:', ' '.join(f'{b:02X}' for b in response))

Important Notes

Modbus TCP/IP messages have a header and data part.

Always check the server IP and port before connecting.

Function codes define what action the client wants.

Summary

Modbus TCP/IP lets devices communicate over Ethernet using simple commands.

It uses function codes to read or write data like coils and registers.

Clients send requests; servers reply with data or confirmations.

Practice

1. What is the main purpose of Modbus TCP/IP in PLC programming?

easy

A. To convert analog signals to digital

B. To program PLCs using ladder logic

C. To allow devices to communicate over Ethernet using simple commands

D. To create graphical user interfaces for PLCs

Solution

1. Step 1: Understand Modbus TCP/IP function

   Modbus TCP/IP is a communication protocol that enables devices to exchange data over Ethernet networks.

2. Step 2: Identify the main use

   It uses simple commands to read and write data between devices, facilitating communication.

3. Final Answer:

   To allow devices to communicate over Ethernet using simple commands -> Option C

4. Quick Check:

   Modbus TCP/IP = Ethernet communication protocol [OK]

Hint: Modbus TCP/IP is about device communication over Ethernet [OK]

Common Mistakes:

• Confusing Modbus TCP/IP with PLC programming languages
• Thinking it converts signals instead of communicating data
• Assuming it creates user interfaces

2. Which of the following is the correct syntax to read holding registers using Modbus TCP/IP function code in a PLC script?

easy

A. ReadHoldingRegisters(address, quantity)

B. WriteCoils(address, quantity)

C. ReadInputStatus(address, quantity)

D. WriteHoldingRegisters(address, quantity)

Solution

1. Step 1: Identify function codes for reading registers

   Modbus function code 03 reads holding registers, typically called ReadHoldingRegisters.

2. Step 2: Match syntax to function

   ReadHoldingRegisters(address, quantity) correctly represents reading holding registers by specifying start address and number of registers.

3. Final Answer:

   ReadHoldingRegisters(address, quantity) -> Option A

4. Quick Check:

   Read holding registers = ReadHoldingRegisters() [OK]

Hint: Read holding registers uses ReadHoldingRegisters() function [OK]

Common Mistakes:

• Using Write functions instead of Read
• Confusing coils with registers
• Using incorrect function names

3. Given the following PLC script snippet using Modbus TCP/IP:

response = ReadCoils(10, 5)
print(response)

What is the expected output if coils 10 to 14 are ON, OFF, ON, OFF, ON respectively?

medium

A. [1, 0, 1, 0, 1]

B. Error: Invalid function

C. [ON, OFF, ON, OFF, ON]

D. [True, False, True, False, True]

Solution

1. Step 1: Understand ReadCoils function output

   ReadCoils returns a list of boolean values representing coil states: True for ON, False for OFF.

2. Step 2: Map coil states to boolean list

   Coils 10 to 14 states ON, OFF, ON, OFF, ON map to [True, False, True, False, True].

3. Final Answer:

   [True, False, True, False, True] -> Option D

4. Quick Check:

   Coil states as booleans = [True, False, True, False, True] [OK]

Hint: ReadCoils returns booleans True/False, not strings or numbers [OK]

Common Mistakes:

• Expecting numeric 1/0 instead of True/False
• Using string 'ON'/'OFF' instead of booleans
• Assuming function returns error

4. A PLC script using Modbus TCP/IP to write to coils is:

WriteCoils(5, [True, False, True])

Which of the following correctly describes the WriteCoils function?

medium

A. The function WriteCoils requires a starting address and a list of boolean values

B. The list should contain integers 1 and 0 instead of booleans

C. The function WriteCoils only writes single coil, not multiple

D. The address 5 is out of range for coils

Solution

1. Step 1: Check WriteCoils function parameters

   WriteCoils expects a starting address and a list of boolean values to write multiple coils.

2. Step 2: Verify parameter usage

   The given call correctly provides the starting address and list of boolean values.

3. Step 3: Analyze options

   The accurate statement is that the function requires a starting address and a list of boolean values. Other statements are incorrect: address range is not specified as invalid, booleans are appropriate (not integers), and the function supports multiple coils.

4. Final Answer:

   The function WriteCoils requires a starting address and a list of boolean values -> Option A

5. Quick Check:

   WriteCoils(address, bool list) is correct syntax [OK]

Hint: WriteCoils needs address plus boolean list, not integers [OK]

Common Mistakes:

• Using integers instead of booleans
• Assuming WriteCoils writes only one coil
• Ignoring address range validity

5. You want to read 10 holding registers starting at address 100 and write the sum of their values to register 200 using Modbus TCP/IP in a PLC script. Which approach correctly combines reading, summing, and writing?

hard

A. values = ReadCoils(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, sum_val)

B. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, [sum_val])

C. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteCoils(200, sum_val)

D. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, sum_val[0])

Solution

1. Step 1: Read holding registers correctly

   Use ReadHoldingRegisters(100, 10) to get 10 registers starting at 100.

2. Step 2: Sum the values and write properly

   Sum the list with sum(values), then write the sum as a list [sum_val] to register 200 using WriteHoldingRegisters.

3. Step 3: Check other options for errors

   values = ReadCoils(100, 10)
   sum_val = sum(values)
   WriteHoldingRegisters(200, sum_val)

   reads coils instead of registers;

   values = ReadHoldingRegisters(100, 10)
   sum_val = sum(values)
   WriteCoils(200, sum_val)

   writes to coils instead of registers;

   values = ReadHoldingRegisters(100, 10)
   sum_val = sum(values)
   WriteHoldingRegisters(200, sum_val[0])

   incorrectly indexes sum_val which is an int, causing error.

4. Final Answer:

   values = ReadHoldingRegisters(100, 10) sum_val = sum(values) WriteHoldingRegisters(200, [sum_val]) -> Option B

5. Quick Check:

   Read registers, sum list, write list with sum [OK]

Hint: Read registers, sum list, write sum as single-item list [OK]

Common Mistakes:

• Reading coils instead of registers
• Writing to coils instead of registers
• Passing integer instead of list to WriteHoldingRegisters