Modbus protocol for SCADA in SCADA systems - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Modbus Function Codes

Which Modbus function code is used to read multiple holding registers from a device?

A 0x01

B 0x03

C 0x05

D 0x10

💡 Hint

Holding registers are typically read with a function code starting with 0x0.

Function code 0x03 is used to read holding registers in Modbus protocol.

💻 Command Output

intermediate

Modbus TCP Packet Analysis

Given a Modbus TCP request packet to read 4 coils starting at address 0, what is the expected byte count in the response?

A 1 byte

B 4 bytes

C 2 bytes

D 8 bytes

💡 Hint

Each coil is represented by 1 bit; 8 bits make 1 byte.

4 coils require 4 bits, which fit into 1 byte of data. The byte count field in the response PDU is 1.

❓ Configuration

advanced

Configuring Modbus RTU Serial Settings

Which serial port configuration is correct for a Modbus RTU device operating at 19200 baud, 8 data bits, even parity, and 1 stop bit?

A 19200 8E1

B 19200 7E1

C 9600 8E1

D 19200 8N1

💡 Hint

Parity 'E' means even parity; 'N' means no parity.

The correct configuration is 19200 baud, 8 data bits, even parity (E), and 1 stop bit (1), which is '19200 8E1'.

❓ Troubleshoot

advanced

Diagnosing Modbus Communication Failure

A SCADA system using Modbus TCP cannot read data from a slave device. The network is confirmed working. Which issue is most likely causing the failure?

A Wrong baud rate setting on the SCADA system

B Missing stop bits in the TCP packet

C Incorrect slave ID in the request packet

D Using UDP instead of TCP for Modbus communication

💡 Hint

Modbus TCP still requires correct slave addressing.

Modbus TCP uses unit identifiers (slave IDs) to address devices. An incorrect slave ID causes no response despite network connectivity.

🔀 Workflow

expert

Modbus Polling Sequence for Multiple Devices

Arrange the correct sequence of steps a SCADA master should follow to poll multiple Modbus RTU slave devices on a serial line.

A 1,3,2,4

B 1,2,4,3

C 2,1,3,4

D 1,2,3,4

💡 Hint

Polling requires sending request, waiting for response, processing data, then moving to next device.

The correct order is to send the request, wait for the response or timeout, process the data, then repeat for the next slave device.

Practice

1. What is the primary purpose of the Modbus protocol in SCADA systems?

easy

A. To store large amounts of historical data

B. To provide a graphical user interface for SCADA

C. To encrypt data transmissions for security

D. To enable communication between SCADA and industrial devices

Solution

1. Step 1: Understand Modbus role in SCADA

   Modbus is designed to allow SCADA systems to communicate with devices like sensors and controllers.

2. Step 2: Identify the main function

   It is not for UI, data storage, or encryption but for communication.

3. Final Answer:

   To enable communication between SCADA and industrial devices -> Option D

4. Quick Check:

   Modbus = communication protocol [OK]

Hint: Modbus connects SCADA to devices, not UI or storage [OK]

Common Mistakes:

• Confusing Modbus with data storage systems
• Thinking Modbus provides user interfaces
• Assuming Modbus encrypts data by default

2. Which of the following is the correct Modbus function code to read holding registers?

easy

A. 0x03

B. 0x06

C. 0x10

D. 0x01

Solution

1. Step 1: Recall Modbus function codes

   Function code 0x03 is used to read holding registers in Modbus.

2. Step 2: Verify other codes

   0x06 is for writing a single register, 0x10 for multiple registers, 0x01 for reading coils.

3. Final Answer:

   0x03 -> Option A

4. Quick Check:

   Read holding registers = 0x03 [OK]

Hint: 0x03 always reads holding registers in Modbus [OK]

Common Mistakes:

• Mixing read and write function codes
• Confusing coil read (0x01) with register read
• Using write codes for reading operations

3. Given the following Modbus request frame in hexadecimal: 01 03 00 0A 00 02 C5 CD, what does it represent?

medium

A. Write 2 registers starting at address 10 to device 1

B. Read 2 holding registers starting at address 10 from device 1

C. Read 2 coils starting at address 10 from device 1

D. Read 10 holding registers starting at address 2 from device 1

Solution

1. Step 1: Decode the Modbus frame parts

   01 = device address, 03 = read holding registers, 00 0A = start address 10, 00 02 = read 2 registers.

2. Step 2: Confirm the meaning

   This frame requests reading 2 holding registers starting at address 10 from device 1.

3. Final Answer:

   Read 2 holding registers starting at address 10 from device 1 -> Option B

4. Quick Check:

   Function 03 + address 10 + count 2 = Read 2 holding registers starting at address 10 from device 1 [OK]

Hint: Function code 03 + count 2 means read 2 registers [OK]

Common Mistakes:

• Misreading address and count bytes
• Confusing read and write function codes
• Mixing coil and register addresses

4. A Modbus RTU message is sent but the SCADA system reports a CRC error. What is the most likely cause?

medium

A. Using function code 0x10 instead of 0x03

B. Wrong device address used in the message

C. Incorrect calculation of the CRC checksum

D. Message length is too short

Solution

1. Step 1: Understand CRC role in Modbus RTU

   CRC checksum verifies message integrity; an error means checksum mismatch.

2. Step 2: Identify common CRC error cause

   Incorrect CRC calculation or corruption causes CRC errors, not device address or function code choice.

3. Final Answer:

   Incorrect calculation of the CRC checksum -> Option C

4. Quick Check:

   CRC error = bad checksum calculation [OK]

Hint: CRC errors usually mean checksum miscalculation [OK]

Common Mistakes:

• Assuming wrong device address causes CRC error
• Confusing function code errors with CRC errors
• Ignoring message corruption possibilities

5. You need to configure a SCADA system to write multiple registers starting at address 20 on device 5 using Modbus. Which function code and message structure should you use?

hard

A. Function code 0x10 with device 5 address, start address 20, number of registers, and data bytes

B. Function code 0x06 with device 5 address and single register data

C. Function code 0x03 with device 5 address and read parameters

D. Function code 0x01 with device 5 address and coil data

Solution

1. Step 1: Identify correct function code for writing multiple registers

   Function code 0x10 is used to write multiple holding registers in Modbus.

2. Step 2: Confirm message structure

   The message must include device address (5), start address (20), number of registers, and data bytes to write.

3. Final Answer:

   Function code 0x10 with device 5 address, start address 20, number of registers, and data bytes -> Option A

4. Quick Check:

   Write multiple registers = 0x10 + address + data [OK]

Hint: Use 0x10 for multiple register writes, not 0x06 or 0x03 [OK]

Common Mistakes:

• Using 0x06 which writes only one register
• Confusing read (0x03) with write operations
• Using coil function codes for register writes