Modbus TCP/IP in PLC Programming - Step-by-Step Execution

Concept Flow - Modbus TCP/IP

Start

↓

PLC sends Modbus TCP request

↓

Request travels over Ethernet

↓

Modbus Server (Slave) receives request

↓

Server processes request

↓

Server sends Modbus TCP response

↓

Response travels back over Ethernet

↓

PLC receives response

↓

End

This flow shows how a PLC sends a Modbus TCP request over Ethernet to a server, which processes it and sends back a response.

Execution Sample

PLC Programming

PLC sends Read Holding Registers request to IP 192.168.1.10
Server receives request and reads registers 40001-40005
Server sends register values back
PLC receives and processes values

This example shows a PLC reading 5 holding registers from a Modbus TCP server.

Execution Table

Step	Action	Details	Data Sent/Received	Result
1	PLC sends request	Read Holding Registers 40001-40005	Request packet with function code 03 and address range	Request sent to 192.168.1.10:502
2	Request travels	Over Ethernet network	TCP/IP packet with Modbus payload	Request arrives at server
3	Server receives	Parse Modbus TCP request	Extract function code and addresses	Valid request confirmed
4	Server processes	Read registers 40001-40005	Access data in server memory	Register values retrieved
5	Server sends response	Include register values	Response packet with data	Response sent to PLC
6	Response travels	Back over Ethernet	TCP/IP packet with Modbus response	Response arrives at PLC
7	PLC receives	Parse response	Extract register values	Values ready for use
8	End	Communication complete		PLC has register data

💡 Communication ends after PLC receives and processes the response.

Variable Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	After Step 5	After Step 7	Final
Request Packet	None	Created with function 03 and addresses 40001-40005	Parsed by server	N/A	N/A	N/A	N/A
Register Values	None	None	None	[100, 200, 300, 400, 500]	Included in response	Extracted by PLC	[100, 200, 300, 400, 500]
Response Packet	None	None	None	None	Created with register values	Received by PLC	Parsed and stored

Key Moments - 3 Insights

Why does the PLC wait after sending the request?

The PLC waits because it needs to receive the server's response with the requested data before continuing. This is shown in execution_table steps 5 to 7.

What happens if the server does not understand the request?

If the server cannot process the request, it sends an error response instead of data. This would be detected in step 7 when the PLC parses the response.

Why is the IP address and port important in Modbus TCP/IP?

The IP address and port (usually 502) tell the network where to send the request and response. Without these, communication cannot happen, as shown in step 1 and 2.

Visual Quiz - 3 Questions

Look at the execution_table, what data does the server send back in step 5?

A An error message only

B The original request packet

C Register values in the response packet

D No data is sent back

💡 Hint

Check the 'Data Sent/Received' and 'Result' columns in step 5.

At which step does the PLC parse the response to get register values?

A Step 7

B Step 3

C Step 1

D Step 5

💡 Hint

Look for when the PLC receives and processes data in the execution_table.

If the PLC requested registers 40010-40015 instead, how would the execution_table change?

A The server would ignore the request

B The request and response addresses would change to 40010-40015

C The PLC would not send any request

D The response would contain no data

💡 Hint

Focus on the 'Action' and 'Details' columns in steps 1 and 4.

Concept Snapshot

Modbus TCP/IP lets PLCs talk over Ethernet using TCP port 502.
PLC sends a request with function code and register addresses.
Server reads registers and sends back values.
Communication uses TCP/IP packets with Modbus payload.
PLC waits for response before continuing.
IP address and port direct the communication.

Full Transcript

Modbus TCP/IP is a way for PLCs to communicate over Ethernet networks. The PLC sends a request to a server using TCP port 502. This request includes a function code, like reading holding registers, and the addresses to read. The request travels over the network to the server, which parses it and reads the requested registers from its memory. The server then sends a response back with the register values. The PLC receives this response, parses it, and uses the data. This process ensures reliable communication between devices using standard network protocols.

Practice

1. What is the main purpose of Modbus TCP/IP in PLC programming?

easy

A. To convert analog signals to digital

B. To program PLCs using ladder logic

C. To allow devices to communicate over Ethernet using simple commands

D. To create graphical user interfaces for PLCs

Solution

1. Step 1: Understand Modbus TCP/IP function

   Modbus TCP/IP is a communication protocol that enables devices to exchange data over Ethernet networks.

2. Step 2: Identify the main use

   It uses simple commands to read and write data between devices, facilitating communication.

3. Final Answer:

   To allow devices to communicate over Ethernet using simple commands -> Option C

4. Quick Check:

   Modbus TCP/IP = Ethernet communication protocol [OK]

Hint: Modbus TCP/IP is about device communication over Ethernet [OK]

Common Mistakes:

• Confusing Modbus TCP/IP with PLC programming languages
• Thinking it converts signals instead of communicating data
• Assuming it creates user interfaces

2. Which of the following is the correct syntax to read holding registers using Modbus TCP/IP function code in a PLC script?

easy

A. ReadHoldingRegisters(address, quantity)

B. WriteCoils(address, quantity)

C. ReadInputStatus(address, quantity)

D. WriteHoldingRegisters(address, quantity)

Solution

1. Step 1: Identify function codes for reading registers

   Modbus function code 03 reads holding registers, typically called ReadHoldingRegisters.

2. Step 2: Match syntax to function

   ReadHoldingRegisters(address, quantity) correctly represents reading holding registers by specifying start address and number of registers.

3. Final Answer:

   ReadHoldingRegisters(address, quantity) -> Option A

4. Quick Check:

   Read holding registers = ReadHoldingRegisters() [OK]

Hint: Read holding registers uses ReadHoldingRegisters() function [OK]

Common Mistakes:

• Using Write functions instead of Read
• Confusing coils with registers
• Using incorrect function names

3. Given the following PLC script snippet using Modbus TCP/IP:

response = ReadCoils(10, 5)
print(response)

What is the expected output if coils 10 to 14 are ON, OFF, ON, OFF, ON respectively?

medium

A. [1, 0, 1, 0, 1]

B. Error: Invalid function

C. [ON, OFF, ON, OFF, ON]

D. [True, False, True, False, True]

Solution

1. Step 1: Understand ReadCoils function output

   ReadCoils returns a list of boolean values representing coil states: True for ON, False for OFF.

2. Step 2: Map coil states to boolean list

   Coils 10 to 14 states ON, OFF, ON, OFF, ON map to [True, False, True, False, True].

3. Final Answer:

   [True, False, True, False, True] -> Option D

4. Quick Check:

   Coil states as booleans = [True, False, True, False, True] [OK]

Hint: ReadCoils returns booleans True/False, not strings or numbers [OK]

Common Mistakes:

• Expecting numeric 1/0 instead of True/False
• Using string 'ON'/'OFF' instead of booleans
• Assuming function returns error

4. A PLC script using Modbus TCP/IP to write to coils is:

WriteCoils(5, [True, False, True])

Which of the following correctly describes the WriteCoils function?

medium

A. The function WriteCoils requires a starting address and a list of boolean values

B. The list should contain integers 1 and 0 instead of booleans

C. The function WriteCoils only writes single coil, not multiple

D. The address 5 is out of range for coils

Solution

1. Step 1: Check WriteCoils function parameters

   WriteCoils expects a starting address and a list of boolean values to write multiple coils.

2. Step 2: Verify parameter usage

   The given call correctly provides the starting address and list of boolean values.

3. Step 3: Analyze options

   The accurate statement is that the function requires a starting address and a list of boolean values. Other statements are incorrect: address range is not specified as invalid, booleans are appropriate (not integers), and the function supports multiple coils.

4. Final Answer:

   The function WriteCoils requires a starting address and a list of boolean values -> Option A

5. Quick Check:

   WriteCoils(address, bool list) is correct syntax [OK]

Hint: WriteCoils needs address plus boolean list, not integers [OK]

Common Mistakes:

• Using integers instead of booleans
• Assuming WriteCoils writes only one coil
• Ignoring address range validity

5. You want to read 10 holding registers starting at address 100 and write the sum of their values to register 200 using Modbus TCP/IP in a PLC script. Which approach correctly combines reading, summing, and writing?

hard

A. values = ReadCoils(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, sum_val)

B. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, [sum_val])

C. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteCoils(200, sum_val)

D. values = ReadHoldingRegisters(100, 10)
sum_val = sum(values)
WriteHoldingRegisters(200, sum_val[0])

Solution

1. Step 1: Read holding registers correctly

   Use ReadHoldingRegisters(100, 10) to get 10 registers starting at 100.

2. Step 2: Sum the values and write properly

   Sum the list with sum(values), then write the sum as a list [sum_val] to register 200 using WriteHoldingRegisters.

3. Step 3: Check other options for errors

   values = ReadCoils(100, 10)
   sum_val = sum(values)
   WriteHoldingRegisters(200, sum_val)

   reads coils instead of registers;

   values = ReadHoldingRegisters(100, 10)
   sum_val = sum(values)
   WriteCoils(200, sum_val)

   writes to coils instead of registers;

   values = ReadHoldingRegisters(100, 10)
   sum_val = sum(values)
   WriteHoldingRegisters(200, sum_val[0])

   incorrectly indexes sum_val which is an int, causing error.

4. Final Answer:

   values = ReadHoldingRegisters(100, 10) sum_val = sum(values) WriteHoldingRegisters(200, [sum_val]) -> Option B

5. Quick Check:

   Read registers, sum list, write list with sum [OK]

Hint: Read registers, sum list, write sum as single-item list [OK]

Common Mistakes:

• Reading coils instead of registers
• Writing to coils instead of registers
• Passing integer instead of list to WriteHoldingRegisters