Modbus TCP/IP in PLC Programming - Deep Dive

Overview - Modbus TCP/IP

What is it?

Modbus TCP/IP is a communication protocol used to connect industrial devices over Ethernet networks. It allows devices like sensors, controllers, and computers to exchange data in a simple and standardized way. The protocol uses a client-server model where one device requests data and another responds. It is widely used in automation to monitor and control equipment.

Why it matters

Without Modbus TCP/IP, industrial devices would struggle to communicate efficiently over modern networks, leading to complex, incompatible systems. This protocol solves the problem of device interoperability and real-time data exchange, making automation systems easier to build, maintain, and scale. It helps factories run smoothly and safely by enabling reliable control and monitoring.

Where it fits

Before learning Modbus TCP/IP, you should understand basic networking concepts like IP addresses and Ethernet. Knowledge of serial Modbus (RTU/ASCII) helps but is not required. After mastering Modbus TCP/IP, you can explore advanced industrial protocols like OPC UA or MQTT for IoT integration.

Mental Model

Core Idea

Modbus TCP/IP is a simple question-and-answer system where one device asks for data and another device replies over an Ethernet network.

Think of it like...

Imagine a librarian (server) and a visitor (client) in a library. The visitor asks for a specific book (data), and the librarian finds it and hands it over. The visitor cannot take books without asking, and the librarian only responds to requests.

┌─────────────┐       Request       ┌─────────────┐
│   Client    │────────────────────>│   Server    │
│ (Master)    │                     │ (Slave)     │
└─────────────┘       Response      └─────────────┘

Network: Ethernet TCP/IP

Data Flow:
Client sends function code + address → Server processes → Server sends data back

Build-Up - 8 Steps

1

Foundation

Basics of Modbus Protocol

Concept: Introduction to the Modbus protocol as a communication method between devices.

Modbus is a protocol that defines how devices talk to each other. It uses simple commands called function codes to read or write data. Originally designed for serial communication, it has been adapted to work over TCP/IP networks. The protocol organizes data into registers and coils, which represent different types of information.

Result

You understand that Modbus is a set of rules for devices to exchange data using commands and addresses.

Understanding the basic structure of Modbus commands and data types is essential before adding the complexity of TCP/IP networking.

2

Foundation

Understanding TCP/IP Networking

Concept: Basic knowledge of how devices communicate over Ethernet using TCP/IP.

TCP/IP is the language of the internet and local networks. Devices have IP addresses to identify them. TCP ensures data is sent reliably by establishing a connection between devices. Modbus TCP/IP uses this network layer to send Modbus messages inside TCP packets, allowing devices to communicate over Ethernet cables or Wi-Fi.

Result

You can explain how devices find each other and send messages reliably over a network.

Knowing how TCP/IP works helps you understand how Modbus messages travel and why network settings matter.

3

Intermediate

Modbus TCP/IP Message Structure

🤔Before reading on: do you think Modbus TCP/IP messages include the same fields as serial Modbus messages? Commit to your answer.

Concept: How Modbus messages are packaged inside TCP packets with additional headers.

Modbus TCP/IP messages include a special header called the MBAP (Modbus Application Protocol) header. This header has fields like transaction ID, protocol ID, length, and unit ID. After the header comes the original Modbus function code and data. This structure helps devices manage multiple requests and responses over the network.

Result

You can identify the parts of a Modbus TCP/IP message and understand their roles.

Recognizing the MBAP header explains how Modbus TCP/IP supports multiple simultaneous conversations and device addressing on a network.

4

Intermediate

Client-Server Communication Model

🤔Before reading on: do you think Modbus TCP/IP clients can send data without waiting for a response? Commit to your answer.

Concept: Modbus TCP/IP uses a strict client-server model where clients request and servers respond.

In Modbus TCP/IP, the client (master) initiates communication by sending a request to the server (slave). The server processes the request and sends back a response. The client waits for the response before sending another request. This ensures clear, organized communication without collisions or confusion.

Result

You understand the flow of requests and responses and why clients must wait for replies.

Knowing this model prevents errors like sending multiple requests at once or expecting unsolicited data from servers.

5

Intermediate

Common Function Codes and Data Types

Concept: Learn the most used Modbus function codes and how data is organized.

Modbus uses function codes like 01 (Read Coils), 03 (Read Holding Registers), 05 (Write Single Coil), and 16 (Write Multiple Registers). Data is stored in coils (single bits) and registers (16-bit values). Understanding these helps you read sensor values or control actuators using Modbus TCP/IP.

Result

You can interpret and create Modbus requests to read or write common data types.

Familiarity with function codes and data types is key to building effective Modbus TCP/IP applications.

6

Advanced

Handling Multiple Devices and Unit IDs

🤔Before reading on: do you think the IP address alone identifies the Modbus device on the network? Commit to your answer.

Concept: Modbus TCP/IP can address multiple devices behind one IP using unit IDs.

The MBAP header includes a unit ID field that identifies the target device when multiple devices share one IP, such as through gateways or bridges. This allows a single IP address to manage several Modbus devices. Proper use of unit IDs is essential in complex networks to avoid communication errors.

Result

You can configure and troubleshoot networks with multiple Modbus devices behind one IP.

Understanding unit IDs prevents confusion in multi-device setups and helps maintain clear communication paths.

7

Advanced

Error Handling and Exception Codes

Concept: How Modbus TCP/IP reports errors and how clients should respond.

When a server cannot process a request, it sends an exception response with an error code. Common errors include illegal function, illegal data address, or server device failure. Clients must check for these exceptions and handle them gracefully, such as retrying or alerting operators.

Result

You can detect and respond to communication errors in Modbus TCP/IP systems.

Proper error handling improves system reliability and helps diagnose problems quickly.

8

Expert

Optimizing Performance and Security

🤔Before reading on: do you think Modbus TCP/IP includes built-in encryption or authentication? Commit to your answer.

Concept: Advanced techniques to improve Modbus TCP/IP speed and secure communication.

Modbus TCP/IP does not include encryption or authentication by default, making it vulnerable to attacks. Experts add security layers like VPNs, firewalls, or use secure protocols alongside Modbus. Performance can be optimized by minimizing polling frequency, using function code 16 for batch writes, and managing TCP connections efficiently.

Result

You know how to secure and speed up Modbus TCP/IP in real industrial environments.

Recognizing Modbus TCP/IP's limitations in security and performance helps you design safer and more efficient automation systems.

Under the Hood

Modbus TCP/IP wraps traditional Modbus messages inside TCP packets with an MBAP header. The TCP layer manages connection setup, data integrity, and retransmission. The MBAP header includes transaction IDs to match requests and responses, allowing multiple simultaneous queries. The server listens on port 502 and processes requests sequentially, ensuring ordered communication.

Why designed this way?

Modbus was originally a simple serial protocol. Adapting it to TCP/IP allowed use of existing Ethernet infrastructure without redesigning the protocol. The MBAP header was added to handle multiple transactions and device addressing over networks. This design balances simplicity with network capabilities, avoiding complex overhead.

┌───────────────┐
│ TCP/IP Layer  │
│ (Connection)  │
└──────┬────────┘
       │
┌──────▼────────┐
│ MBAP Header   │
│ (Transaction, │
│ Protocol ID,  │
│ Length, Unit) │
└──────┬────────┘
       │
┌──────▼────────┐
│ Modbus PDU    │
│ (Function +   │
│ Data)         │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does Modbus TCP/IP automatically encrypt data? Commit to yes or no.

Common Belief: Modbus TCP/IP is secure because it uses TCP/IP networks.

Reality: Modbus TCP/IP does not include encryption or authentication; data is sent in plain text.

Why it matters: Assuming security leads to vulnerabilities where attackers can intercept or manipulate control commands, risking safety and operations.

Quick: Can a Modbus TCP/IP client send multiple requests without waiting for responses? Commit to yes or no.

Common Belief: Clients can send many requests at once to speed up communication.

Reality: Modbus TCP/IP clients must wait for each response before sending the next request to avoid confusion and errors.

Why it matters: Ignoring this causes communication collisions and corrupted data, leading to unreliable system behavior.

Quick: Does the IP address alone identify a Modbus device in all cases? Commit to yes or no.

Common Belief: Each Modbus device has a unique IP address, so unit IDs are unnecessary.

Reality: Unit IDs are needed when multiple devices share one IP, such as behind gateways.

Why it matters: Neglecting unit IDs causes messages to reach the wrong device or be ignored, breaking communication.

Quick: Is Modbus TCP/IP a complex protocol requiring heavy resources? Commit to yes or no.

Common Belief: Modbus TCP/IP is complex and resource-heavy because it uses TCP/IP.

Reality: Modbus TCP/IP is designed to be simple and lightweight, suitable for devices with limited resources.

Why it matters: Overestimating complexity may discourage use or lead to unnecessary hardware upgrades.

Expert Zone

1

Modbus TCP/IP's transaction ID allows multiple outstanding requests, but many devices only support one at a time, requiring careful client design.

2

Some devices use unit IDs not only for addressing but also to indicate different protocols or functions behind a gateway.

3

Network latency and packet loss can cause subtle timing issues; experts use retries and timeouts tuned to the specific environment.

When NOT to use

Modbus TCP/IP is not suitable for high-speed or complex data structures; protocols like OPC UA or MQTT are better for those cases. Also, in highly secure environments, Modbus TCP/IP should be combined with VPNs or replaced by protocols with built-in security.

Production Patterns

In real systems, Modbus TCP/IP is often combined with SCADA software for monitoring, uses gateways to connect serial devices, and employs polling strategies optimized to reduce network load. Experts also implement watchdog timers and error logging to maintain system health.

Connections

Client-Server Networking

Modbus TCP/IP uses the client-server model common in networking.

Understanding client-server basics helps grasp how Modbus devices coordinate requests and responses over networks.

Industrial Automation Protocols

Modbus TCP/IP is one of many protocols used in automation, alongside OPC UA and Profibus.

Knowing Modbus TCP/IP provides a foundation to learn more advanced or specialized industrial communication methods.

Human Conversation

Modbus TCP/IP communication mimics a polite conversation where one person asks a question and waits for an answer.

Recognizing this pattern clarifies why devices wait for responses and do not talk over each other.

Common Pitfalls

#1 Trying to communicate with multiple devices using the same IP without setting unit IDs.

Wrong approach:

Sending Modbus TCP/IP requests with unit ID always set to 0 or ignored.

Correct approach:

Set the correct unit ID in the MBAP header to target each device behind a gateway.

Root cause:

Misunderstanding that IP addresses alone identify devices in all network setups.

#2 Ignoring error responses from the server and assuming all requests succeed.

Wrong approach:

Client code processes all responses as valid data without checking for exception codes.

Correct approach:

Client checks for exception codes in responses and handles errors appropriately.

Root cause:

Assuming communication errors are rare or irrelevant to system operation.

#3 Sending multiple requests without waiting for responses to speed up data collection.

Wrong approach:

Client sends several Modbus requests back-to-back without waiting.

Correct approach:

Client waits for each response before sending the next request.

Root cause:

Misunderstanding the synchronous nature of Modbus TCP/IP communication.

Key Takeaways

Modbus TCP/IP is a simple and widely used protocol that enables industrial devices to communicate over Ethernet networks using a client-server model.

It wraps traditional Modbus messages inside TCP packets with an MBAP header to manage multiple transactions and device addressing.

Clients must wait for server responses before sending new requests to maintain clear communication.

Modbus TCP/IP lacks built-in security, so additional measures are necessary to protect industrial networks.

Understanding function codes, data types, and error handling is essential for building reliable Modbus TCP/IP applications.

Practice

1. What is the main purpose of Modbus TCP/IP in PLC programming?

easy

A. To convert analog signals to digital

B. To program PLCs using ladder logic

C. To allow devices to communicate over Ethernet using simple commands

D. To create graphical user interfaces for PLCs

Solution

1. Step 1: Understand Modbus TCP/IP function

   Modbus TCP/IP is a communication protocol that enables devices to exchange data over Ethernet networks.

2. Step 2: Identify the main use

   It uses simple commands to read and write data between devices, facilitating communication.

3. Final Answer:

   To allow devices to communicate over Ethernet using simple commands -> Option C

4. Quick Check:

   Modbus TCP/IP = Ethernet communication protocol [OK]

Hint: Modbus TCP/IP is about device communication over Ethernet [OK]

Common Mistakes:

• Confusing Modbus TCP/IP with PLC programming languages
• Thinking it converts signals instead of communicating data
• Assuming it creates user interfaces

2. Which of the following is the correct syntax to read holding registers using Modbus TCP/IP function code in a PLC script?

easy

A. ReadHoldingRegisters(address, quantity)

B. WriteCoils(address, quantity)

C. ReadInputStatus(address, quantity)

D. WriteHoldingRegisters(address, quantity)

Solution

1. Step 1: Identify function codes for reading registers

   Modbus function code 03 reads holding registers, typically called ReadHoldingRegisters.

2. Step 2: Match syntax to function

   ReadHoldingRegisters(address, quantity) correctly represents reading holding registers by specifying start address and number of registers.

3. Final Answer:

   ReadHoldingRegisters(address, quantity) -> Option A

4. Quick Check:

   Read holding registers = ReadHoldingRegisters() [OK]

Hint: Read holding registers uses ReadHoldingRegisters() function [OK]

Common Mistakes:

• Using Write functions instead of Read
• Confusing coils with registers
• Using incorrect function names

3. Given the following PLC script snippet using Modbus TCP/IP:

response = ReadCoils(10, 5)
print(response)

What is the expected output if coils 10 to 14 are ON, OFF, ON, OFF, ON respectively?

medium

A. [1, 0, 1, 0, 1]

B. Error: Invalid function

C. [ON, OFF, ON, OFF, ON]

D. [True, False, True, False, True]

Solution

1. Step 1: Understand ReadCoils function output

   ReadCoils returns a list of boolean values representing coil states: True for ON, False for OFF.

2. Step 2: Map coil states to boolean list

   Coils 10 to 14 states ON, OFF, ON, OFF, ON map to [True, False, True, False, True].

3. Final Answer:

   [True, False, True, False, True] -> Option D

4. Quick Check:

   Coil states as booleans = [True, False, True, False, True] [OK]

Hint: ReadCoils returns booleans True/False, not strings or numbers [OK]

Common Mistakes:

• Expecting numeric 1/0 instead of True/False
• Using string 'ON'/'OFF' instead of booleans
• Assuming function returns error

4. A PLC script using Modbus TCP/IP to write to coils is:

WriteCoils(5, [True, False, True])

Which of the following correctly describes the WriteCoils function?

medium

A. The function WriteCoils requires a starting address and a list of boolean values

B. The list should contain integers 1 and 0 instead of booleans

C. The function WriteCoils only writes single coil, not multiple

D. The address 5 is out of range for coils

Solution

1. Step 1: Check WriteCoils function parameters

   WriteCoils expects a starting address and a list of boolean values to write multiple coils.

2. Step 2: Verify parameter usage

   The given call correctly provides the starting address and list of boolean values.

3. Step 3: Analyze options

   The accurate statement is that the function requires a starting address and a list of boolean values. Other statements are incorrect: address range is not specified as invalid, booleans are appropriate (not integers), and the function supports multiple coils.

4. Final Answer:

   The function WriteCoils requires a starting address and a list of boolean values -> Option A

5. Quick Check:

   WriteCoils(address, bool list) is correct syntax [OK]

Hint: WriteCoils needs address plus boolean list, not integers [OK]

Common Mistakes:

• Using integers instead of booleans
• Assuming WriteCoils writes only one coil
• Ignoring address range validity

5. You want to read 10 holding registers starting at address 100 and write the sum of their values to register 200 using Modbus TCP/IP in a PLC script. Which approach correctly combines reading, summing, and writing?

hard

A. values = ReadCoils(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, sum_val)

B. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, [sum_val])

C. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteCoils(200, sum_val)

D. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, sum_val[0])

Solution

1. Step 1: Read holding registers correctly

   Use ReadHoldingRegisters(100, 10) to get 10 registers starting at 100.

2. Step 2: Sum the values and write properly

   Sum the list with sum(values), then write the sum as a list [sum_val] to register 200 using WriteHoldingRegisters.

3. Step 3: Check other options for errors

   values = ReadCoils(100, 10)
   sum_val = sum(values)
   WriteHoldingRegisters(200, sum_val)

   reads coils instead of registers;

   values = ReadHoldingRegisters(100, 10)
   sum_val = sum(values)
   WriteCoils(200, sum_val)

   writes to coils instead of registers;

   values = ReadHoldingRegisters(100, 10)
   sum_val = sum(values)
   WriteHoldingRegisters(200, sum_val[0])

   incorrectly indexes sum_val which is an int, causing error.

4. Final Answer:

   values = ReadHoldingRegisters(100, 10) sum_val = sum(values) WriteHoldingRegisters(200, [sum_val]) -> Option B

5. Quick Check:

   Read registers, sum list, write list with sum [OK]

Hint: Read registers, sum list, write sum as single-item list [OK]

Common Mistakes:

• Reading coils instead of registers
• Writing to coils instead of registers
• Passing integer instead of list to WriteHoldingRegisters