PLC Simulator
Runnable Modbus integration example

Read 16 Remote-I/O Coils With Modbus Function 01

A remote-I/O station maps its first 16 commanded digital outputs as coils starting at protocol address 0. The linked sandbox opens the exact unit, function, address, quantity and value so the reader can verify the PDU rather than copy an unexplained hex string.

10 minutes PLC programmers, commissioning technicians and system integrators

Follow the workflow

Learn one step, use the product, inspect the evidence.

01

Identify the data model and access direction

This Remote-I/O coupler example uses Modbus function 01. Select the function from the documented object type and whether the operation is a read or write—not because two register names look similar.

Do this in the product

Open the preconfigured request and confirm the function-code label before running it.

Open the exercise
02

Translate the documented address

The request transmits protocol address 0. Human-facing 0xxxx, 1xxxx, 3xxxx and 4xxxx references are notation, not values to paste blindly into the 16-bit address field.

Do this in the product

Compare the address field with the expected PDU 01 00 00 00 10.

Open the exercise
03

Check quantity, value and scaling

The request quantity is 16 and the training value is 0. Multiword data, signed values, enums and decimal scales remain application-map concerns beyond the core Modbus frame.

Do this in the product

Run the server grader and read each function-specific limit check before copying the request.

Open the exercise
04

Keep the response separate from physical proof

A normal Modbus response proves that a server accepted the request format. It does not by itself prove that a motor moved, a valve reached position or a process value is correctly scaled.

Do this in the product

Save the known-good request, then use a paid project to retain later fault and commissioning evidence.

Open the exercise

Core concepts

Know what the evidence means.

The simulator creates a repeatable result; these concepts make that result transferable to real vendor software and supervised practical work.

Protocol address

The transmitted address is a zero-based 16-bit field unless the specific device manual states a different table convention.

PDU evidence

The expected request begins 01 00 00 00 10; TCP adds MBAP framing while RTU adds unit address, timing and CRC.

Application semantics

Function, address and response can be valid while units, signedness, scale or machine permissions remain wrong.

Common mistakes to avoid

  • × A 16-coil response contains two data bytes; bit order within each byte is not a left-to-right drawing.
  • × Changing network, serial and register settings simultaneously instead of keeping one known-good control.
  • × Treating an echoed write as proof that the physical output changed.
  • × Reusing this fictional training map as though it were the manufacturer’s production register map.

Continue in the workspace

Turn this tutorial into retained training evidence.

Run the foundation exercise publicly, then use a subscription for advanced challenges, saved configurations, full attempt history, sharing, assigned paths and team reporting.

Technical reference questions

Questions before you continue.

The registered request begins 01 00 00 00 10. The sandbox builds the complete supported PDU from the preloaded fields and checks function-specific limits.

Competency and practice field guide

Remote-I/O digital-output exercise: practice plan

Direct answer

The learner can distinguish program request, output image, connection state, remote channel, field voltage and independent load feedback.

Written for controls learners proving a controller request through a remote output adapter to an interface device and observable load response.

an industrial Ethernet, remote-I/O and IO-Link diagnostics bench with an inspectable controller-to-device signal path while studying remote output command, network ownership, channel state and load feedback
System map / 02

NODE 01observable

Scope

Command owner, output tag, interlock, adapter identity, connection health, mapped data, channel type, field supply, interface load and feedback.

NODE 02observable

Signal path

Program decision through output image, network connection, adapter data, output electronics, field conductor, interface device, load and return feedback.

NODE 03observable

Baseline practice

A bounded command changes once at the controller, adapter and channel and produces the expected independently observed load state.

NODE 04observable

Edge cases

Connection loss, inhibited module, stale command, adapter restart, missing field power, shorted channel, wrong common, local override and controller restart.

NODE 05observable

Fault practice

A logic, output-image, connection, mapping, adapter, channel, supply, conductor, load or feedback mismatch.

NODE 06observable

Transfer to the job

The path commissioned with current module manuals, approved network behavior and target-machine fail-state tests.

Answer surface / 07

What should happen to remote outputs during network loss?

The required fail state must be declared and verified for the exact adapter, connection and machine risk; do not assume every device clears outputs identically.

Does a remote output LED prove the load operated?

No. It indicates one channel boundary. Verify suitable electrical, actuator or process feedback when the physical result matters.