PLC Simulator
Runnable Modbus integration example

Read 16 Remote-I/O Inputs With Modbus Function 02

A coupler maps sixteen field input states as discrete inputs beginning at protocol address 0. The linked sandbox opens the exact unit, function, address, quantity and value so the reader can verify the PDU rather than copy an unexplained hex string.

10 minutes PLC programmers, commissioning technicians and system integrators

Follow the workflow

Learn one step, use the product, inspect the evidence.

01

Identify the data model and access direction

This Remote-I/O digital-input module example uses Modbus function 02. Select the function from the documented object type and whether the operation is a read or write—not because two register names look similar.

Do this in the product

Open the preconfigured request and confirm the function-code label before running it.

Open the exercise
02

Translate the documented address

The request transmits protocol address 0. Human-facing 0xxxx, 1xxxx, 3xxxx and 4xxxx references are notation, not values to paste blindly into the 16-bit address field.

Do this in the product

Compare the address field with the expected PDU 02 00 00 00 10.

Open the exercise
03

Check quantity, value and scaling

The request quantity is 16 and the training value is 0. Multiword data, signed values, enums and decimal scales remain application-map concerns beyond the core Modbus frame.

Do this in the product

Run the server grader and read each function-specific limit check before copying the request.

Open the exercise
04

Keep the response separate from physical proof

A normal Modbus response proves that a server accepted the request format. It does not by itself prove that a motor moved, a valve reached position or a process value is correctly scaled.

Do this in the product

Save the known-good request, then use a paid project to retain later fault and commissioning evidence.

Open the exercise

Core concepts

Know what the evidence means.

The simulator creates a repeatable result; these concepts make that result transferable to real vendor software and supervised practical work.

Protocol address

The transmitted address is a zero-based 16-bit field unless the specific device manual states a different table convention.

PDU evidence

The expected request begins 02 00 00 00 10; TCP adds MBAP framing while RTU adds unit address, timing and CRC.

Application semantics

Function, address and response can be valid while units, signedness, scale or machine permissions remain wrong.

Common mistakes to avoid

  • × Coils and discrete inputs are both bits but use different function codes and access rules.
  • × Changing network, serial and register settings simultaneously instead of keeping one known-good control.
  • × Treating an echoed write as proof that the physical output changed.
  • × Reusing this fictional training map as though it were the manufacturer’s production register map.

Continue in the workspace

Turn this tutorial into retained training evidence.

Run the foundation exercise publicly, then use a subscription for advanced challenges, saved configurations, full attempt history, sharing, assigned paths and team reporting.

Technical reference questions

Questions before you continue.

The registered request begins 02 00 00 00 10. The sandbox builds the complete supported PDU from the preloaded fields and checks function-specific limits.

Competency and practice field guide

Remote-I/O digital-input exercise: practice plan

Direct answer

The learner can separate field state, channel indication, adapter health, connection state, mapped data and program use, then identify the first missing transition.

Written for controls learners proving a field contact through a remote input island, industrial network connection and controller tag.

an industrial Ethernet, remote-I/O and IO-Link diagnostics bench with an inspectable controller-to-device signal path while studying remote digital-input ownership, network status and PLC image-table evidence
System map / 02

NODE 01observable

Scope

Field device, input type, supply and common, channel, adapter identity, assembly or module mapping, connection status, controller tag and data quality.

NODE 02observable

Signal path

Physical contact through wiring, remote module electronics, adapter data, network transport, controller input image, alias or mapped tag and program condition.

NODE 03observable

Baseline practice

A known open-to-closed change appears once at every declared boundary with coherent quality and timing.

NODE 04observable

Edge cases

Loss of field power, wrong common, duplicate address, adapter restart, stale connection, inhibited module, mismatched assembly, forcing and controller restart.

NODE 05observable

Fault practice

A device, conductor, channel, adapter, network, connection, mapping, tag or program-ownership mismatch.

NODE 06observable

Transfer to the job

The path commissioned with current module manuals, approved topology, cybersecurity controls and target-controller diagnostics.

Answer surface / 07

How do you prove a remote PLC input?

Create a known safe field change and compare device, channel, adapter, network connection, controller tag and logic state in order, retaining the first boundary that fails to agree.

What is the difference between an input value and connection health?

The input is process data; connection health indicates whether that data is current and trustworthy. Logic should not silently treat stale data as confirmed field state.