Can I connect the browser directly to a real PLC?

No. Browsers cannot safely open arbitrary raw TCP or serial sockets. This is a deterministic training sandbox for request design and diagnosis, not a replacement for a commissioned gateway or vendor engineering tool.

Why does register 40001 use address 0?

40001 is a human-facing reference convention. The protocol data unit uses a zero-based 16-bit data address, so the first holding register is commonly transmitted as address 0. Always verify the device manual’s convention.

Can I connect the browser directly to a real PLC?

No. Browsers cannot safely open arbitrary raw TCP or serial sockets. This is a deterministic training sandbox for request design and diagnosis, not a replacement for a commissioned gateway or vendor engineering tool.

Why does register 40001 use address 0?

40001 is a human-facing reference convention. The protocol data unit uses a zero-based 16-bit data address, so the first holding register is commonly transmitted as address 0. Always verify the device manual’s convention.

PLC Simulator

Protocol workbench

Modbus Simulator

Run real Modbus request exercises before you connect a PLC, drive or meter.

Run before signup Server-graded Save, share and fork

Open the workbench

industrial-lab / modbus

MODETRAINING

GRADERSERVER AUTHORITY

EVIDENCECHECKS + SCORE

First challenge

Read two holding registers

Poll unit 1 for the first two holding registers using the protocol data address.

Reusable lab resources

Interactive request lab

Configure. Run. Read the evidence.

Foundation

Read two holding registers

Poll unit 1 for the first two holding registers using the protocol data address.

Unit IDFunction codeProtocol addressRegister quantity

Evidence appears here

The backend calculates the expected result and returns individual checks, a score and reproducible evidence. Client-supplied scores are ignored.

Your run is free. Keep the evidence when it matters.

Create an account only when you want saved attempts, projects, sharing and progress.

Save this result

Training outcomes

More than a calculator.

Each run teaches a transferable industrial workflow and produces evidence you can inspect, repeat and discuss.

Translate 4xxxx register notation into the zero-based address carried on the wire.

Choose function 03, 06 and exception responses without vendor-specific software.

Save a register-map fixture, share it with a class and fork a colleague’s setup.

Build evidence from graded attempts instead of relying on a self-marked worksheet.

Field method

How to reason through the lab

STEP 01

Register notation is not the wire address

A manual may label a holding register 40001, but the Modbus application data unit normally carries address 0. Confirm whether a vendor table is one-based or zero-based before blaming the network.

STEP 02

Start with one known-good request

Prove the unit ID, function, address and quantity with the smallest possible poll. Expand the block only after the device returns a normal response.

STEP 03

Read the exception byte

An exception response is useful evidence. Function 83 with code 02 means the device understood a function-03 request but the requested address range was not mapped.

Continue from a single exercise to a complete training record.

Guided scenarios, saved progress, fault diagnosis and instructor reporting are built into the main platform.

Compare training plans

Technical practice library

Load a real job, not an empty calculator.

Each reference explains a distinct industrial task and links back to an exact grader preset with server-owned acceptance evidence.

Browse all training exercises

Variable-frequency drive

Read VFD Output Frequency With Modbus Function 03

Compose a Modbus request for a VFD output-frequency holding register and verify the zero-based address and quantity.

Method Load preset →

Energy meter

Read an Energy Meter With Modbus Function 04

Build a two-register input-register poll for a 32-bit energy-meter value and retain word-order evidence.

Method Load preset →

Panel temperature controller

Read a Temperature Controller Process Value Over Modbus

Compose a function-03 poll for a scaled temperature process value at protocol address 200.

Method Load preset →

Remote-I/O coupler

Read 16 Remote-I/O Coils With Modbus Function 01

Build a packed 16-coil function-01 poll and verify the bit quantity and zero-based start address.

Method Load preset →

Remote-I/O digital-input module

Read 16 Remote-I/O Inputs With Modbus Function 02

Compose a Modbus function-02 request for 16 read-only remote-I/O inputs and verify the address, quantity and packed-bit evidence.

Method Load preset →

Pump controller

Write a Pump Run Coil With Modbus Function 05

Encode an ON command as FF00 for a documented pump run coil and verify the function-05 request.

Method Load preset →

Temperature controller

Write a Temperature Setpoint With Modbus Function 06

Compose a single-register setpoint write and preserve the distinction between engineering units and the scaled register value.

Method Load preset →

Alarm annunciator

Write an Alarm Reset Block With Modbus Function 15

Build a packed eight-coil function-15 write and check quantity, byte count and ownership boundaries.

Method Load preset →

Modbus Simulator questions

What learners and instructors ask.

The exercises teach the shared Modbus application protocol used by both. The request grader covers unit IDs, function codes, data addresses, quantities, values and exceptions; the tutorials explain TCP transaction framing and RTU serial timing separately.