Modbus protocol for SCADA in SCADA systems - Step-by-Step Execution

Process Flow - Modbus protocol for SCADA

Start: SCADA Master sends request

↓

Request: Read/Write command + Address + Data

↓

Modbus Slave receives request

↓

Slave processes command

↓

Slave sends response with data or status

↓

SCADA Master receives response

↓

Process data or handle error

↓

End

The SCADA master sends a Modbus request to a slave device, which processes it and replies with data or status, completing the communication cycle.

Execution Sample

SCADA systems

Master -> Slave: Read Holding Registers (Address 40001, Count 2)
Slave -> Master: Data [123, 456]

SCADA master requests two holding registers from slave; slave replies with the register values.

Process Table

Step	Action	Message Content	Device	Result
1	Master sends request	Function: Read Holding Registers, Address: 40001, Count: 2	Master	Request sent to Slave
2	Slave receives request	Same as above	Slave	Request received and parsed
3	Slave processes request	Reads registers 40001 and 40002	Slave	Registers read: [123, 456]
4	Slave sends response	Data: [123, 456]	Slave	Response sent to Master
5	Master receives response	Data: [123, 456]	Master	Data received and ready for processing
6	Master processes data	Values: 123, 456	Master	Data used for monitoring/control
7	End	-	-	Communication cycle complete

💡 Communication ends after master processes the slave's response.

Status Tracker

Variable	Start	After Step 1	After Step 3	After Step 5	Final
Request Message	None	Read Holding Registers (40001, 2)	Same	Same	None (sent)
Slave Registers	[Unknown]	[Unknown]	[123, 456]	[123, 456]	[123, 456]
Response Message	None	None	Data [123, 456]	Data [123, 456]	None (received)
Master Data	None	None	None	[123, 456]	[123, 456]

Key Moments - 3 Insights

Why does the master send an address like 40001 in the request?

Because in Modbus, addresses starting with 4xxxx refer to holding registers, which the master wants to read or write. This is shown in execution_table step 1 where the master specifies address 40001.

What happens if the slave cannot read the requested registers?

The slave would send an error response instead of data. This is not shown in the current table but would replace step 4's normal data response with an error code.

Why does the master process data only after receiving the response?

Because the master must wait for the slave's reply to get the requested data. This is clear in steps 5 and 6 where the master receives and then uses the data.

Visual Quiz - 3 Questions

Look at the execution table, what data does the slave send back at step 4?

A Request message

B Data: [123, 456]

C Error code

D No data

💡 Hint

Check the 'Message Content' column at step 4 in the execution_table.

At which step does the master receive the data from the slave?

A Step 5

B Step 3

C Step 2

D Step 6

💡 Hint

Look at the 'Action' column for when the master gets the response.

If the master requested 3 registers instead of 2, how would the slave's response change?

A Slave would send 2 register values

B Slave would send an error immediately

C Slave would send 3 register values

D Slave would ignore the request

💡 Hint

Refer to the 'Count' in the request message and the corresponding data sent by the slave.

Concept Snapshot

Modbus protocol in SCADA:
- Master sends request with function code, address, and count
- Slave receives and processes request
- Slave replies with data or error
- Master receives and processes response
- Communication uses simple request-response cycle
- Addresses like 40001 refer to holding registers

Full Transcript

In Modbus protocol for SCADA, the master device initiates communication by sending a request message to a slave device. This request includes a function code (like reading holding registers), the starting address (e.g., 40001), and how many registers to read. The slave receives this request, reads the requested registers, and sends back the data. The master then receives this response and processes the data for monitoring or control. This cycle repeats for each communication. If the slave cannot fulfill the request, it sends an error response instead. The key is the simple request-response pattern that allows SCADA systems to read or write data from field devices reliably.

Practice

1. What is the primary purpose of the Modbus protocol in SCADA systems?

easy

A. To store large amounts of historical data

B. To provide a graphical user interface for SCADA

C. To encrypt data transmissions for security

D. To enable communication between SCADA and industrial devices

Solution

1. Step 1: Understand Modbus role in SCADA

   Modbus is designed to allow SCADA systems to communicate with devices like sensors and controllers.

2. Step 2: Identify the main function

   It is not for UI, data storage, or encryption but for communication.

3. Final Answer:

   To enable communication between SCADA and industrial devices -> Option D

4. Quick Check:

   Modbus = communication protocol [OK]

Hint: Modbus connects SCADA to devices, not UI or storage [OK]

Common Mistakes:

• Confusing Modbus with data storage systems
• Thinking Modbus provides user interfaces
• Assuming Modbus encrypts data by default

2. Which of the following is the correct Modbus function code to read holding registers?

easy

A. 0x03

B. 0x06

C. 0x10

D. 0x01

Solution

1. Step 1: Recall Modbus function codes

   Function code 0x03 is used to read holding registers in Modbus.

2. Step 2: Verify other codes

   0x06 is for writing a single register, 0x10 for multiple registers, 0x01 for reading coils.

3. Final Answer:

   0x03 -> Option A

4. Quick Check:

   Read holding registers = 0x03 [OK]

Hint: 0x03 always reads holding registers in Modbus [OK]

Common Mistakes:

• Mixing read and write function codes
• Confusing coil read (0x01) with register read
• Using write codes for reading operations

3. Given the following Modbus request frame in hexadecimal: 01 03 00 0A 00 02 C5 CD, what does it represent?

medium

A. Write 2 registers starting at address 10 to device 1

B. Read 2 holding registers starting at address 10 from device 1

C. Read 2 coils starting at address 10 from device 1

D. Read 10 holding registers starting at address 2 from device 1

Solution

1. Step 1: Decode the Modbus frame parts

   01 = device address, 03 = read holding registers, 00 0A = start address 10, 00 02 = read 2 registers.

2. Step 2: Confirm the meaning

   This frame requests reading 2 holding registers starting at address 10 from device 1.

3. Final Answer:

   Read 2 holding registers starting at address 10 from device 1 -> Option B

4. Quick Check:

   Function 03 + address 10 + count 2 = Read 2 holding registers starting at address 10 from device 1 [OK]

Hint: Function code 03 + count 2 means read 2 registers [OK]

Common Mistakes:

• Misreading address and count bytes
• Confusing read and write function codes
• Mixing coil and register addresses

4. A Modbus RTU message is sent but the SCADA system reports a CRC error. What is the most likely cause?

medium

A. Using function code 0x10 instead of 0x03

B. Wrong device address used in the message

C. Incorrect calculation of the CRC checksum

D. Message length is too short

Solution

1. Step 1: Understand CRC role in Modbus RTU

   CRC checksum verifies message integrity; an error means checksum mismatch.

2. Step 2: Identify common CRC error cause

   Incorrect CRC calculation or corruption causes CRC errors, not device address or function code choice.

3. Final Answer:

   Incorrect calculation of the CRC checksum -> Option C

4. Quick Check:

   CRC error = bad checksum calculation [OK]

Hint: CRC errors usually mean checksum miscalculation [OK]

Common Mistakes:

• Assuming wrong device address causes CRC error
• Confusing function code errors with CRC errors
• Ignoring message corruption possibilities

5. You need to configure a SCADA system to write multiple registers starting at address 20 on device 5 using Modbus. Which function code and message structure should you use?

hard

A. Function code 0x10 with device 5 address, start address 20, number of registers, and data bytes

B. Function code 0x06 with device 5 address and single register data

C. Function code 0x03 with device 5 address and read parameters

D. Function code 0x01 with device 5 address and coil data

Solution

1. Step 1: Identify correct function code for writing multiple registers

   Function code 0x10 is used to write multiple holding registers in Modbus.

2. Step 2: Confirm message structure

   The message must include device address (5), start address (20), number of registers, and data bytes to write.

3. Final Answer:

   Function code 0x10 with device 5 address, start address 20, number of registers, and data bytes -> Option A

4. Quick Check:

   Write multiple registers = 0x10 + address + data [OK]

Hint: Use 0x10 for multiple register writes, not 0x06 or 0x03 [OK]

Common Mistakes:

• Using 0x06 which writes only one register
• Confusing read (0x03) with write operations
• Using coil function codes for register writes