Modbus TCP
Modbus is the oldest and most widely used industrial communication protocol. Nearly every instrument, inverter, and general-purpose industrial device supports Modbus.
This gateway supports Modbus TCP (Ethernet) and Modbus UDP. Devices that only have serial (RS-485) must go through a Modbus gateway (RS-485 → Ethernet).
Registration form fields
| Field | What to enter | Example |
|---|---|---|
| IP address | IP of the Modbus slave | 192.168.0.50 |
| Port | Modbus port | 502 (standard) |
| Response timeout (request-timeout) | Maximum time to wait for a slave response (ms) | 5000 (5 seconds) |
Modbus has no concept of user accounts or passwords. Anyone who can reach the IP can read the values.
PLC address notation for tags
Modbus has the following 4 types of memory areas.
| Area | Notation prefix | Meaning |
|---|---|---|
| Holding Register | holding-register:N | 16-bit, read/write — most common |
| Input Register | input-register:N | 16-bit, read-only |
| Coil | coil:N | 1 bit, read/write |
| Discrete Input | discrete-input:N | 1 bit, read-only |
N is the address number listed in the slave's manual (usually starting from 1).
Notation including the data type
Even within the same memory area, the interpretation can differ — 16-bit, 32-bit, floating point, string, and so on — so you can specify the data type alongside the address.
| Notation | Meaning |
|---|---|
holding-register:1 | Plain 16-bit integer (signed) |
holding-register:1:UINT | 16-bit unsigned integer |
holding-register:1:DINT | 32-bit integer (occupies two registers) |
holding-register:1:REAL | 32-bit float (occupies two registers) |
holding-register:1:LREAL | 64-bit float (occupies four registers) |
holding-register:100:STRING[10] | ASCII string from 100 to 109 |
coil:1 | Coil 1 (1 bit) |
If no data type is specified, the value is interpreted as a 16-bit integer. Always specify the type for values of 32 bits or more.
Data format / format option
The [Data format] and [Format option] fields in Tag registration are easiest to match as follows.
| Value in the PLC | Data format | Format option | PLC address example |
|---|---|---|---|
| Coil / discrete input | Boolean | (leave empty) | coil:1 or discrete-input:1 |
| 16-bit integer | Integer | (leave empty) | holding-register:1 |
| 16-bit unsigned integer | Integer | UI | holding-register:1:UINT |
| 32-bit integer | Integer | DW | holding-register:1:DINT |
| 32-bit float (most common) | Float | REAL | holding-register:1:REAL |
| 64-bit float | Double | LREAL | holding-register:1:LREAL |
| String of N characters | String | STR[N] | holding-register:10:STRING[N] |
Common problems and fixes
| Symptom / message | Possible cause | Fix |
|---|---|---|
| "Read timeout" / slow response | Slave response delay; cable, firewall, or port (502) blocked | Check reachability with ping and telnet <ip> 502. Try increasing the response timeout |
| Invalid address | Typo in the notation | Get the colon exactly right, as in holding-register:1 |
Value is always 0 | Area type mismatch (e.g. reading a holding register as an input register) | Check the slave manual for which of "FC 03 / 04 / 01 / 02" applies |
| 32-bit float comes out corrupted | The slave uses a different byte / word order | If the slave is little-endian, change the data type to :UDINT_LSWORD_FIRST or similar |
Byte order issues vary by slave manufacturer, so the fastest approach is to consult the manual or cross-check with another tool (Modbus Poll, etc.).
Testing with the simulator
You can verify operation with a Modbus simulator even without a PLC.
- When you click [Add connection] and select Simulator → Modbus Simulator from the card list, the gateway automatically starts a simulator process and connects to it.
- Dummy values appear in the holding registers right away, with no external tools required.
More detailed examples / automated registration
See the Modbus examples in Advanced — REST API.