Learn Automation with MINATA #44: Modbus TCP — Familiar Ethernet Still Needs Industrial Discipline
Modbus TCP: Familiar Ethernet Still Needs Industrial Discipline
Modbus TCP carries Modbus onto ordinary Ethernet, which makes it easy to deploy and easy to run over distance. That familiarity is also the trap: IP addressing, switches, timeouts and access control remain part of the control system. Plugging in a network cable is not the end of the job.
How Modbus TCP differs from Modbus RTU
The register model and the function codes are the same, but Modbus TCP wraps the data in a TCP/IP packet and drops the CRC, because Ethernet already carries its own error checking. Instead of a node address from 1 to 247, a device is identified by its IP address and the default port 502. One device can serve several client connections at once, within whatever limit it declares.
The IP plan is part of the machine record
Give every device a static IP on the same subnet, with no duplicates, and record it in the machine file. When the line is extended later, that plan is what stops two devices claiming the same address. Avoid dynamic addressing for control equipment unless there is a clear reason for it — an address that changes is a connection that drops.
Segmentation and basic security
Keep the machine network separate from the office network wherever you can, through a VLAN or a dedicated switch. Modbus TCP has no authentication of its own, so do not expose it on a shared network. Control which devices are allowed to talk to the PLC, and keep a log of what connects.
Timeouts, retries and stale data
Networks have latency and they lose packets. Set controlled timeouts and retries: one slow reply should not hang the whole program, and one lost packet should not make a value jump about. And as on the HMI, when the link is lost, show the last value with the time it was updated, or mark it invalid — never let an old number look fresh.
A worked engineering situation
A PLC reads energy data from a meter over Modbus TCP, to display and to log. When the network is interrupted, the HMI holds the last value with an "updated at …" label instead of blanking it or showing zero. That is what lets an operator tell "the network is down" apart from "consumption is zero".
The IP plan, the network segmentation and the register mapping all have to follow the machine record and the device documentation.
Common mistakes
- Plugging machine devices into the office network with no separation.
- Dynamic addressing on control equipment, so the link drops when the address changes.
- No timeout or retry policy, so one lost packet hangs the program or scrambles a number.
- Blanking a value when the link drops, instead of holding it with a timestamp.
- Copying a register map between different models.
Modbus TCP checklist
- [ ] Static IPs, one subnet, no duplicates, all recorded.
- [ ] The machine network is separated from the office network where required.
- [ ] Timeouts and retries are controlled and cannot hang the program.
- [ ] Data is marked when the link drops, and carries its update time.
- [ ] The register map matches model and firmware; connections are controlled.
Ethernet is convenient, but the discipline still has to be industrial. #45 turns to machine safety and the emergency stop, where that discipline stops being optional.
Read more automation knowledge at MINATA: https://minatavn.com/en/blog/industrial-automation
Previous — #43: Modbus RTU on RS-485: https://minatavn.com/en/blog/automation-43-modbus-rtu
Next — #45: Machine safety and the emergency stop: https://minatavn.com/en/blog/automation-45-machine-safety-estop
View all MINATA technical articles