A simple factory story with PLC, registers, and real data flow

If you have ever worked in a factory or an industrial software project, you must have heard one word again and again: Modbus.
Everyone uses it, but very few people actually explain it in a simple way.

So let’s do that — slowly, clearly, and with a real factory story.

Our Factory Story

Imagine a factory that uses Cloud Software to monitor machines.

Each machine has a temperature sensor attached to it.
That sensor is connected to a PLC.
Inside the factory, there is an Edge Gateway that collects data from many PLCs and sends it to Cloud.

The important part is this:

The Edge Gateway has a Modbus Client,
The PLC has a Modbus Server,
And the sensor does not know anything about Modbus.

What Modbus Really Is

Modbus is nothing more than a question–answer system.

One device asks a question.
The other device answers.

In our case, the Edge Gateway asks:

“PLC, what is the current temperature?”

And the PLC answers:

“The temperature is 48°C.”

This question–answer happens again and again, every few seconds.

Why PLC Uses Registers

Inside the PLC, data is not stored as tables or JSON.
It is stored in registers.

A register is just a small memory box that stores a number.

So when the temperature sensor reads 48°C, the PLC puts that value into one of its memory boxes.

For example:
The PLC stores the temperature value 48 in a holding register.

Types of Registers: Where the Data Lives 📦

Registers are like little boxes in the PLC’s memory. But there are different kinds of boxes, depending on what they store:

Coils (0xxxx)
- Stores ON/OFF values.
- Example: Motor ON or OFF.
- Can be read and written.
Discrete Inputs (1xxxx)
- Stores ON/OFF values too, but read-only.
- Example: A limit switch tells if a door is closed.
Input Registers (3xxxx)
- Read-only numbers.
- Example: Temperature sensor, pressure sensor.
Holding Registers (4xxxx)
- Read/write numbers.
- Example: Current temperature, motor speed, voltage.

Fun Fact: When you hear someone say register 40001, they are talking about Holding Register 0 inside the PLC. The “40001” is just a friendly name for humans — the PLC sees it as address 0.

The Truth About 40001, 40002 (This Confuses Everyone)

People always say:

“Temperature is stored in register 40001”

But here is the truth:

The PLC does not know what 40001 is.

40001 is only a human naming style.

Inside the PLC, registers are counted like this:


0, 1, 2, 3, 4...

So when we say:

“Holding register 40001”

What we really mean is:

“Holding register at address 0”

This mapping is very important:

40001 → address 0
40002 → address 1
40003 → address 2

When the Edge Gateway sends a Modbus request, it sends address 0, not 40001.

Function Codes: The “Commands” of Modbus 😎

In Modbus, every request does something. And every action has a function code, which is like a command the Edge Gateway gives the PLC.

For example, the Edge Gateway might say:

“PLC, give me the temperature!”

Behind the scenes, it sends a function code. The most common ones are:

0x01 – Read Coils: Asks for simple ON/OFF values. Think of lights or relays.
0x02 – Read Discrete Inputs: Reads read-only ON/OFF values. For example, a sensor switch.
0x03 – Read Holding Registers: The most used one! Reads values stored in registers that can be read and written. Like our temperature example.
0x04 – Read Input Registers: Reads read-only values like sensor readings.
0x06 – Write Single Register: Sets a value in one register, for example turning a motor speed to 1000 RPM.
0x10 – Write Multiple Registers: Changes several values at once, like a batch update.

So function codes are basically Modbus verbs — they tell the PLC what kind of action you want.

Now Let’s Talk About 16-bit Data

Every Modbus register is 16 bits.

That means one register can store numbers from:


0 to 65535

This is perfectly fine for many values like:

Temperature
Speed
Pressure

So if the temperature is 48°C, it fits easily into one register.

The PLC simply stores:


Register address 0 = 48

What If the Value Is Big? (32-bit Data)

Now imagine a different case.

Let’s say you want to store:

Energy consumption
Flow meter reading
Total production count

These numbers can be very large.
They cannot fit into 16 bits.

So the PLC uses two registers together.

This is called 32-bit data.

Example:


Register 0 → first half
Register 1 → second half

Together, these two registers represent one big number.

The Edge Gateway already knows this, so it:

Reads two registers
Combines them
Converts them into one 32-bit value

How the Modbus Request Actually Looks

Now let’s see what really happens on the wire.

The Edge Gateway opens a TCP connection to the PLC on port 502.

Then it sends a request that basically says:

“I want to read holding registers
starting from address 0
and I want 1 register”

Lets see how the Request Frame Structure looks like
now here we want to read the values stored at 0 address register
so the starting address is 1 (1 which is human readable which will map to 0 th register in PLC) and the number of register has to be read is 1,

so the Request Frame is

Direction: Edge Gateway → PLC
Label: "Read Holding Registers, Start Address = 0, Quantity = 1"

MODBUS TCP REQUEST FRAME STRUCTURE:


Transaction ID:     1           (0x0001)    - Unique identifier for this request
Protocol ID:        0           (0x0000)    - Always 0 for Modbus
Length:             6 bytes     (0x0006)    - Number of following bytes
Unit ID:            1           (0x01)      - Slave device identifier
Function Code:      3           (0x03)      - Read Holding Registers
Start Address:      0           (0x0000)    - Register address (temperature sensor)
Quantity:           1 register  (0x0001)    - Number of registers to read

COMPLETE REQUEST BYTES (Hexadecimal):


00 01 00 00 00 06 01 03 00 00 00 01

BREAKDOWN:


00 01       - Transaction ID
00 00       - Protocol ID
00 06       - Length
01          - Unit ID
03          - Function Code
00 00       - Start Address 
00 01       - Quantity

How the PLC Responds

The PLC receives the request, looks into its memory, and finds:


Register 0 = 48

Then it sends back a response that says:

“Here is the value you asked for: 48”

This is the Modbus response frame.

So the Response Frame is

Direction: PLC → Edge Gateway
Label: "Register 0 = 48 → returning temperature value"

MODBUS TCP RESPONSE FRAME STRUCTURE:


Transaction ID:     1           (0x0001)    - Matches request Transaction ID
Protocol ID:        0           (0x0000)    - Always 0 for Modbus
Length:             5 bytes     (0x0005)    - Number of following bytes
Unit ID:            1           (0x01)      - Same as request
Function Code:      3           (0x03)      - Echoes request function code
Byte Count:         2 bytes     (0x02)      - Number of data bytes following
Register 0 Value:   48          (0x0030)    - Temperature reading

COMPLETE RESPONSE BYTES (Hexadecimal):


00 01 00 00 00 05 01 03 02 00 30

BREAKDOWN:


00 01       - Transaction ID
00 00       - Protocol ID
00 05       - Length
01          - Unit ID
03          - Function Code
02          - Byte Count
00 30       - Register Value (48 decimal)

INTERPRETATION OF TEMPERATURE VALUE


Register 0 Value: 48 (0x0030)

Possible Interpretations:
1. 48°C      - Direct value (if no scaling)
2. 4.8°C     - If using 0.1 scaling factor
3. 0.48°C    - If using 0.01 scaling factor
4. 480°C     - If using 10x scaling factor

Important Key Points

TRANSACTION ID
- Matches requests with responses
- Client increments this for each new request
- Server echoes it back in the response
PROTOCOL ID
- Always 0x0000 for Modbus TCP
- Distinguishes Modbus from other protocols on the same connection
LENGTH FIELD
- Specifies number of bytes following this field
- Request: 6 bytes (Unit ID + Function Code + Address + Quantity)
- Response: 5 bytes (Unit ID + Function Code + Byte Count + Data)
UNIT ID
- Identifies which slave device to communicate with
- Useful when a gateway connects to multiple devices
- Often set to 1 for single device setups
FUNCTION CODE 3
- Read Holding Registers
- Most common for reading sensor data
- Other common codes:
  - 1 → Read Coils
  - 4 → Read Input Registers
  - 16 → Write Multiple Registers
START ADDRESS
- Register address to begin reading from
- 0-based addressing (Register 0 = Address 0)
- Some devices use 1-based addressing (check device documentation)
QUANTITY
- Number of consecutive registers to read
- Each register is 2 bytes (16 bits)
- Maximum: 125 registers in a single request
BYTE COUNT
- Only present in the response
- Tells client how many data bytes follow
- Formula: Quantity × 2
TCP PORT 502
- Standard Modbus TCP port
- Must be open in firewall
- Some systems use custom ports for security

Why This Simple Protocol Still Rules Factories

Modbus is old, but it is trusted.

It is:

Easy to debug
Easy to implement
Stable in harsh environments
Perfect for Edge Gateways

That is why modern platforms like Any Cloud still rely on Modbus at the factory level.

Final Thought

Modbus looks scary only because people explain it badly.

Once you understand:

Registers are memory boxes
40001 is just a name
Data is 16-bit or combined into 32-bit
Client asks, server answers

Modbus becomes very simple 😄

Structured Engineering Courses

Available Courses (1)

Free System Design