A Modbus RTU HMI panel runs on a legacy PLC's RS-232 Modbus port once three things match: the port mode (RTU, not ASCII), the serial framing (baud, parity, data bits, stop bits, slave address) and the address convention. The one that trips most installs is the reference math: reference 40101 and wire address 100 are the same register, so a tag entered one digit off reads the neighbouring register.
Yes. A Modbus RTU operator panel runs on the RS-232 Modbus port of a legacy compact PLC, with no gateway, no custom driver and no PLC code change. The whole job is making three things match. First, the PLC port must actually be in RTU mode, because an ASCII-mode port discards every RTU frame. Second, the serial framing must be identical at both ends: baud, parity, data bits, stop bits and slave address. Third, the tags must use the same address convention as the PLC's reference table, and this is the one that catches people: reference 40101 and wire address 100 are the same register. Set the port, build the cable, enter the addresses in the convention the panel documents, then prove the link with one register you can change from the PLC.
Will any Modbus RTU panel talk to a legacy PLC serial port?
Yes: any panel whose driver list includes a plain Modbus RTU master can talk to the PLC's RS-232 port, because the port is a native Modbus RTU slave, valid slave addresses run from 1 to 247, and no brand-specific card or converter is needed on either side.
Modbus has no discovery step. The panel never asks the PLC what it is; it sends frames and either gets answers or errors. The entire compatibility test is a panel speaking Modbus RTU on its serial port, and a PLC port configured to answer Modbus RTU with the same framing and the same address. The PLC stays the slave, the panel is the master, and RS-232 keeps those roles fixed. If the panel's driver list has no entry named for your PLC, that is expected on a legacy machine: the generic Modbus RTU driver is the correct pick.
What do you need before you start?
You need five things: the PLC manual that documents its Modbus port, the panel's serial-port documentation, cable parts for a three-conductor crossover lead, a spare register the ladder never touches, and a note of the port's configured framing taken from the PLC and not assumed from a default.
- The PLC manual page for the Modbus port: how the mode is set, where the framing lives, where the slave address is stored, and the connector wiring diagram.
- The panel's serial documentation: its Modbus RTU driver fields and the address-entry convention its tags expect.
- Cable parts for the crossover lead, and a continuity tester.
- One spare register in the PLC data table for the write test.
- The panel on its own power supply, wired and ready.
How do you configure the PLC port for Modbus RTU?
Set the port to RTU mode and read its configured framing from the PLC itself. On legacy compact PLCs the settings live either in hardware switches or in the programming software, and typical configured speeds are 9600, 19200 or 38400 baud (typical values for ports of this generation).
- Read the port's present configuration before you open the panel project: mode, baud, parity, data bits, stop bits and slave address. The article on checking the PLC serial protocol before replacing a legacy HMI walks through that read.
- Set the mode to Modbus RTU. An ASCII port frames messages with a colon start character and its own checksum, so it discards RTU frames and the panel sees timeouts.
- Apply the RTU framing rule: characters of 8 data bits, with one stop bit when a parity bit is sent and two stop bits when parity is off. The Modbus serial-line specification sets that rule, and the PLC systems manual prints it for its own ports.
- Write down the slave address and keep the connector wiring diagram open for the wiring step.
How do you wire the RS-232 cable between panel and PLC?
RS-232 joins two data-terminal devices with a crossed cable: the panel's transmit line goes to the PLC's receive line, the panel's receive line to the PLC's transmit line, and signal ground runs through end to end, three conductors minimum.
- Take the pin numbers for transmit, receive and signal ground from the two manuals. Connector styles and terminal conventions differ between makers, and a ready-made programming cable is wired for a PC.
- Cross the data pair and run signal ground through. Continuity-test the crossover before anything is powered.
- Jumper any handshake lines the PLC manual requires, at the connector and exactly as it specifies, and leave handshake lines unconnected when the manual asks for none.
- Keep the run inside the EIA-232 limit of 15 m at 20 kbit/s and route the cable away from drive output cables; RS-232 is single-ended and reads noise readily.
- Power the panel from its own supply. A PLC serial port carries signals, not panel power, and the article on an HMI panel not powering from a PLC serial port cable covers the case where the panel stays dead.
RS-232 is point to point, so one panel takes one PLC port. A second panel needs the PLC's other serial port, or a converter pair over to RS-485; the article on two HMI panels failing on one PLC serial port shows what sharing the line does to the traffic.
How do you set up the panel side?
Set the panel's serial port to the plain Modbus RTU master driver, enter the PLC port's framing and slave address exactly as read from the PLC, and give the device a 1000 ms timeout, well above the 17 ms a one-register exchange needs at 9600 baud.
- Assign the port to the generic Modbus RTU master driver. When no driver is named for the PLC, that generic driver is the correct choice, and the article on connecting an HMI to a PLC with Modbus RTU when no driver fits gives the reasoning.
- Enter the framing from the PLC port: RTU mode, the port's baud, its parity and stop-bit combination, and the slave address as the device number.
- Set the response timeout to 1000 ms, and set the poll rate for the tags you actually show, because every added tag lengthens the scan.
- Build the tags against the PLC's reference table, using the address convention the panel's documentation states.
Why does the tag read the register next to the one you wanted?
Because the two address conventions differ by one: the classic five-digit reference 40101 and the zero-based wire address 100 point at the same holding register, so a tag entered with the wrong convention reads the neighbouring register every time.
Legacy PLC manuals print references in four families:
| Reference family | What it reaches | Access |
|---|---|---|
| 0xxxx | Coils, the discrete outputs | Read and write |
| 1xxxx | Discrete inputs | Read only |
| 3xxxx | Input registers | Read only |
| 4xxxx | Holding registers | Read and write |
The wire address is the reference minus the family base: 40101 − 40001 = 100, so reference 40101 is holding register 100 on the wire. Panels handle this two ways. One type wants the full five-digit reference and subtracts the base itself; the other wants the zero-based offset, and you enter 100. Use the convention the panel's documentation states, then prove it with a known value. The signature of the wrong convention is a plausible-looking value that belongs to the neighbouring register. The same one-based rule holds across all four families. Ask only for references the PLC has configured; a reference beyond the configured table comes back as a Modbus exception instead of data.
What does a worked example look like end to end?
Take a legacy compact PLC whose second serial port is configured as a Modbus RTU slave at address 2, 9600 baud, even parity, 8 data bits and 1 stop bit, and a panel that must show one run-hours register the ladder program keeps at reference 40101.
The address math: 40101 − 40001 = 100, so in a zero-based panel the tag reads holding register 100. The wire-time check: a one-register read exchange is 8 bytes out and 7 bytes back, 15 bytes total. Each RTU character is 11 bits (start, 8 data, parity, stop), so 15 × 11 = 165 bits and 165 ÷ 9600 bit/s = 17 ms on the wire, against the 1000 ms timeout, roughly 59 times the wire time. The RTU silent gap between frames is 3.5 character times: 3.5 × 11 ÷ 9600 bit/s = 4.0 ms.
The cable is a 3 m crossover lead, ground through, panel on its own supply. At commissioning the ladder writes 1234 into 40101 and the tag shows 1234; the value moves to 4321 and the tag follows. The panel then writes 7 to spare reference 40201, wire address 200, and the PLC watch table shows 7 at 40201, which proves the convention. Had the tag been entered as 101, it would have displayed the contents of reference 40102, the neighbouring register: the off-by-one signature on a live screen.
How do you check the link before you go live?
The link is ready when a tag shows a live value, the value follows a change made from the PLC side, a test write lands on the exact reference you aimed at, and a pulled cable raises an error that clears on reconnect without a power cycle.
One safety note: keep every panel write on the spare register until the convention is confirmed by the read tests, because a write aimed one reference off can reach a register the ladder acts on and start or stop a live output.
- Let the port take its settings: legacy PLC ports apply framing at power-up or on a program transfer, so power-cycle or re-download, then power the panel.
- Bring the panel online and confirm the tag shows a live value with no communication-error flag.
- Change the register from the PLC side, 1234 to 4321, and watch the tag follow.
- Write the test value to the spare register from the panel and confirm it lands on the reference you aimed at, one register neither up nor down.
- Pull the cable and confirm the tag raises a communication error; reconnect and confirm the link recovers without a power cycle.
- Grade any failure before you change anything: no reply at all points to mode, slave address or cable, while CRC and framing errors point to baud or parity. The article on Modbus RTU master no-reply and address errors works that list fault by fault.
Recommendation: put the panel on the PLC's second serial port as a Modbus RTU master running the port's own framing, build the crossover cable yourself and continuity-test it, keep the run at or under 15 m, enter tag addresses in the convention the panel documents, and prove the link on a register you can change from the PLC before any tag writes near a live output. If the port offers ASCII only, with no RTU option in its configuration, put an ASCII-to-RTU converter in the cable instead of swapping the panel.
Questions
Can two operator panels share one RS-232 Modbus port?
No. RS-232 is a point-to-point electrical standard: two transmitters driving one receive line corrupt each other's frames. Give each panel its own serial port, or move the link to RS-485 through a converter at each end, which carries several panels on one twisted pair. Every device on the RS-485 segment still needs a distinct slave address, and all the framing rules in this article apply unchanged.
How many registers can one read request return at 9600 baud?
The Modbus specification caps a read at 125 registers per request. At 9600 baud a full 125-register response is 255 bytes, which is 2805 bits at 11 bits per character, or 292 ms of wire time, plus about 9 ms for the request itself. Keep the tags that refresh fastest down to a handful of registers and put slow values such as run-hours on a longer scan.
Does the off-by-one also apply to coils and input registers?
Yes. Every reference family is one-based while the wire address is zero-based: coil reference 00001 is wire address 0, discrete input 10001 is wire address 0, input register 30001 is wire address 0 and holding register 40001 is wire address 0. Panel documentation differs on what its address fields take, so five-digit references and zero-based offsets both exist in common panels.
Can the panel talk to the PLC if the port only runs Modbus ASCII?
Not directly. ASCII frames begin with a colon character, carry the data as hexadecimal text and end with an LRC checksum, so an RTU master's binary frame is discarded unread. The options are: switch the PLC port to RTU if its configuration offers the mode, fit a converter that translates ASCII to RTU in the cable, or choose a panel whose driver list includes Modbus ASCII.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.