Troubleshooting

Modbus TCP Timeout or No Response: A Diagnosis Order That Works

Your Modbus client times out, or connects but reads nonsense. Work from the cable up to the register map and the fault reveals itself.

· 9 min read · By TryPLC Team

  • Modbus TCP
  • Communication
  • Troubleshooting
  • Networking

The symptom

A PLC polls an energy meter (or a drive, or a gateway) over Modbus TCP. The status shows timeout, connection refused, or the connection works but values are zero or garbage.

Diagnose from the bottom up. Each layer has to work before the one above it can, so there is no point checking register addresses until the device answers on the network.

Layer 1: can you reach the device?

From an engineering laptop in the same subnet, ping the device. No reply:

  • Check link LEDs on both ends and the switch port.
  • Confirm IP address and subnet mask on both devices. A device at 192.168.1.50/24 cannot be reached from 192.168.0.10/24 without a router.
  • Look for duplicate IPs: unplug the device and ping again. A reply means something else owns that address.

    • Some devices block ping. If ping fails but you are confident in the address, go to Layer 2.

    Layer 2: is port 502 open?

    Use a Modbus test client (or Test-NetConnection <ip> -Port 502 in PowerShell). Connection refused means the device is reachable but nothing is listening on 502. Modbus TCP may be disabled in its settings, or the device may use a different port. A gateway may also limit the number of simultaneous connections, and an old SCADA session can be sitting in the only slot.

    Layer 3: Unit ID

    A native Modbus TCP device often ignores the Unit ID, but a TCP-to-RTU gateway uses it to pick the serial slave. Wrong Unit ID usually produces a timeout or exception 0x0B (gateway target failed to respond). Set it to the serial slave address of the device behind the gateway.

    Layer 4: function code and address

    At this point the request reaches the device, and errors come back as exception codes:

    ExceptionMeaningUsual cause
    01 Illegal functionFunction not supportedReading input registers (FC04) from a device that only has holding registers (FC03)
    02 Illegal data addressRegister does not existOff-by-one, or reading past the end of a block
    03 Illegal data valueRequest malformedAsking for too many registers in one read (limit is 125)
    Exception 02 is very often the off-by-one. Documentation that lists "40001" usually means holding register 0 on the wire. Many clients want the zero-based offset; some want 40001. Try both. If one gives exception 02 and the other works, you have found the convention. Use the Modbus address calculator to convert.

    Layer 5: value interpretation

    If the connection is good but the values are wrong, check three things:

  • A 32-bit value spans two registers. If 230.1 V shows up as an absurd number, swap the word order (many meters are "big-endian words", and many PLCs default to the other order).
  • The register may be scaled, for example holding volts × 10, so 2301 means 230.1 V.
  • The value may be signed where you read it as unsigned: 65535 might be -1.

    • When to open Wireshark

    Mirror the switch port, filter on tcp.port == 502, and compare request and response. You will see the exact function code, start address, quantity and any exception, which settles the argument between "the PLC is wrong" and "the meter is wrong".

    Practise the full protocol in the Modbus TCP module.

    Frequently asked questions

    What does Modbus exception 02 mean?

    Illegal data address: the register you requested does not exist on the device. Most often this is the 40001 versus 0 offset confusion, or reading past the end of a register block.

    Why does my Modbus gateway time out?

    Check the Unit ID matches the serial slave address behind the gateway, the serial settings (baud, parity) match the slave, and the gateway is not out of TCP connection slots.