PLC Simulator
Runnable Modbus integration example

Read a Temperature Controller Process Value Over Modbus

A controller publishes its process value as one signed, scaled holding register at protocol address 200. The linked sandbox opens the exact unit, function, address, quantity and value so the reader can verify the PDU rather than copy an unexplained hex string.

10 minutes PLC programmers, commissioning technicians and system integrators

Follow the workflow

Learn one step, use the product, inspect the evidence.

01

Identify the data model and access direction

This Panel temperature controller example uses Modbus function 03. Select the function from the documented object type and whether the operation is a read or write—not because two register names look similar.

Do this in the product

Open the preconfigured request and confirm the function-code label before running it.

Open the exercise
02

Translate the documented address

The request transmits protocol address 200. Human-facing 0xxxx, 1xxxx, 3xxxx and 4xxxx references are notation, not values to paste blindly into the 16-bit address field.

Do this in the product

Compare the address field with the expected PDU 03 00 C8 00 01.

Open the exercise
03

Check quantity, value and scaling

The request quantity is 1 and the training value is 0. Multiword data, signed values, enums and decimal scales remain application-map concerns beyond the core Modbus frame.

Do this in the product

Run the server grader and read each function-specific limit check before copying the request.

Open the exercise
04

Keep the response separate from physical proof

A normal Modbus response proves that a server accepted the request format. It does not by itself prove that a motor moved, a valve reached position or a process value is correctly scaled.

Do this in the product

Save the known-good request, then use a paid project to retain later fault and commissioning evidence.

Open the exercise

Core concepts

Know what the evidence means.

The simulator creates a repeatable result; these concepts make that result transferable to real vendor software and supervised practical work.

Protocol address

The transmitted address is a zero-based 16-bit field unless the specific device manual states a different table convention.

PDU evidence

The expected request begins 03 00 C8 00 01; TCP adds MBAP framing while RTU adds unit address, timing and CRC.

Application semantics

Function, address and response can be valid while units, signedness, scale or machine permissions remain wrong.

Common mistakes to avoid

  • × Correct transport does not prove the signedness or scale used by the application value.
  • × Changing network, serial and register settings simultaneously instead of keeping one known-good control.
  • × Treating an echoed write as proof that the physical output changed.
  • × Reusing this fictional training map as though it were the manufacturer’s production register map.

Continue in the workspace

Turn this tutorial into retained training evidence.

Run the foundation exercise publicly, then use a subscription for advanced challenges, saved configurations, full attempt history, sharing, assigned paths and team reporting.

Technical reference questions

Questions before you continue.

The registered request begins 03 00 C8 00 01. The sandbox builds the complete supported PDU from the preloaded fields and checks function-specific limits.