Runnable simulator field guide
Modbus register-read PLC scenario: test checklist
Direct answer
The learner can separate transport, device identity, data object and interpretation, then diagnose silence, exception, implausible value and stale data.
Written for pLC and communications learners building a bounded read transaction and tracing the result into an engineering tag.
Scenario setup
Client and server identity, TCP or RTU transport, unit identifier, function, documented label, protocol offset, quantity, data type, byte and word order, scale, unit and freshness.
I/O and state map
Known server value through request, response, raw registers, conversion, engineering tag, timestamp, quality and consuming logic.
Normal run
One documented point returns the expected words and converts to a plausible current value under a controlled reference condition.
Boundary run
Timeout, wrong unit, illegal function, illegal address, quantity overflow, signed value, swapped words, server restart, stale cache and reconnect.
Injected fault
A physical, transport, identity, function, address, quantity, type, order, scale, unit, quality or freshness mismatch.
Target check
The transaction checked against current device documentation, captured frames and production application behavior.
How do you read a Modbus register in a PLC?
Define server identity, supported read function, zero-based offset, quantity, type, order, scale and unit, then verify the result against a known condition.
Why can a Modbus register read succeed but show the wrong number?
The transport can succeed while signedness, word order, scale, unit or point mapping is incorrect.