Troubleshooting

Modbus TCP Timeout or No Response: A Diagnosis Order That Works

Your Modbus client times out, or connects but reads nonsense. Work from the cable up to the register map and the fault reveals itself.

· 9 min read · By TryPLC Team

  • Modbus TCP
  • Communication
  • Troubleshooting
  • Networking

The symptom

A PLC polls an energy meter (or a drive, or a gateway) over Modbus TCP. The status shows timeout, connection refused, or the connection works but values are zero or garbage.

Diagnose from the bottom up. Each layer must work before the next one matters.

Layer 1 — Can you reach the device?

From an engineering laptop in the same subnet, ping the device. No reply:

  • Check link LEDs on both ends and the switch port.
  • Confirm IP address and subnet mask on both devices. A device at 192.168.1.50/24 cannot be reached from 192.168.0.10/24 without a router.
  • Look for duplicate IPs: unplug the device and ping again. A reply means something else owns that address.

    • Some devices block ping. If ping fails but you are confident in the address, go to Layer 2.

    Layer 2 — Is port 502 open?

    Use a Modbus test client (or Test-NetConnection -Port 502 in PowerShell). Connection refused means the device is reachable but nothing listens on 502 — Modbus TCP may be disabled in its settings, or it uses a different port. A gateway may also limit simultaneous connections; an old SCADA session can occupy the only slot.

    Layer 3 — Unit ID

    A native Modbus TCP device often ignores the Unit ID, but a TCP-to-RTU gateway uses it to pick the serial slave. Wrong Unit ID usually produces a timeout or exception 0x0B (gateway target failed to respond). Set it to the serial slave address of the device behind the gateway.

    Layer 4 — Function code and address

    Now the request reaches the device. Errors come back as exception codes:

    ExceptionMeaningUsual cause
    01 Illegal functionFunction not supportedReading input registers (FC04) from a device that only has holding registers (FC03)
    02 Illegal data addressRegister does not existOff-by-one, or reading past the end of a block
    03 Illegal data valueRequest malformedAsking for too many registers in one read (limit is 125)
    The off-by-one: documentation listing "40001" usually means holding register 0 on the wire. Many clients want the zero-based offset; some want 40001. Try both — if one gives exception 02 and the other works, you have found the convention. Use the Modbus address calculator to convert.

    Layer 5 — Value interpretation

    Connection good, values wrong:

  • 32-bit values span two registers. If 230.1 V shows as an absurd number, swap the word order (many meters are "big-endian words", many PLCs default to the other).
  • Scaling: a register may hold volts × 10. 2301 means 230.1 V.
  • Signed vs unsigned: 65535 might be -1.

    • When to open Wireshark

    Mirror the switch port, filter on tcp.port == 502, and compare request and response. You will see the exact function code, start address, quantity and any exception — the end of all argument between "the PLC is wrong" and "the meter is wrong".

    Practise the full protocol in the Modbus TCP module.

    Frequently asked questions

    What does Modbus exception 02 mean?

    Illegal data address: the register you requested does not exist on the device. Most often this is the 40001 versus 0 offset confusion, or reading past the end of a register block.

    Why does my Modbus gateway time out?

    Check the Unit ID matches the serial slave address behind the gateway, the serial settings (baud, parity) match the slave, and the gateway is not out of TCP connection slots.