Connect an HMI to a Modbus temperature controller over RS-485

Does a panel HMI talk straight to a temperature controller?

Yes, a panel with an RS-485 port talks Modbus RTU to a temperature controller over two wires: A to A, B to B, a common reference wire, and 120 ohm of termination at each end.

Nothing sits between them. The panel is the Modbus RTU master, the controller is a slave with its own bus address, and the two exchange register reads and writes. This is the same job as wiring an HMI to a VFD over Modbus RTU, with the controller as one more slave on a shared pair.

Check the panel side first. Small panels, the 3-inch class especially, often have no serial port on the base unit: RS-485 comes from an add-on communications module. Confirm from the panel's specification sheet which module your panel size takes and that it is fitted; some ship without one.

Check the breakout hardware next. The breakout terminal block sold for one port of a panel family often will not mate with the add-on RS-485 module: on some small panels its connector is reversed and will not seat. Read the module's own manual for the mating connector and which contact carries which signal, and build a short pigtail cable yourself. A block that fights the connector is telling you the same thing; forcing it damages the module.

The controller side is simpler. RS-485 terminals sit on the rear terminal strip or behind the front fascia, usually three screws for the two data lines and a signal common.

If your serial experience is all RS-232, break one habit early: RS-232 links two devices, RS-485 is a bus several devices share. That difference is why a Modbus RTU HMI on a legacy PLC RS-232 port stays a two-device link.

While you plan, set one boundary: the device on this bus is an HMI. A notice board or oven schedule display next to the machine is a different job, better suited to a shop-floor signage display playing pages you publish to it; it does not read the controller.

What do you need before you start?

Gather five things: the panel with its RS-485 module fitted, the controller manual's serial settings page and register list, twisted shielded pair cable, two 120 ohm terminations, and the panel software with its driver list on your PC.

• Panel with the RS-485 module fitted, plus that module's manual for its connector and which contact carries which signal.
• Controller manual, specifically the communication settings page and the register list, often titled the Modbus map.
• Twisted shielded pair cable: one pair for the two data lines, a spare conductor for the signal common.
• 120 ohm termination: resistors, or the built-in jumpers and DIP switches the devices carry.
• Panel project software on your PC with its driver list.

Land wires with both devices powered down and isolated under your site's electrical procedure.

How do you wire the RS-485 cable?

Connect the panel's A terminal to the controller's A terminal and B to B, add the signal common wire both manuals call for, and fit a 120 ohm terminator across the pair at each end of the run.

1. Run one twisted pair from the panel to the controller and keep it a daisy chain: device to device along the route, no star branches. The classic RS-485 application figure is about 1,200 m at low baud rates, so any panel-to-machine distance sits well inside the cable's reach.
2. Land the data lines by name. The RS-485 standard calls the negative, inverting line A and the positive line B; manuals often print + and − or D+ and D- instead, and a few makers swap the letters. Follow each device's terminal diagram: minus to minus, plus to plus, names taken from the diagram, never from terminal position.
3. Run the signal common wire between the panel module's common and the controller's common or SG terminal when either manual calls for one.
4. Terminate with 120 ohm across A and B at each physical end. On a two-device link both devices are ends: enable the controller's built-in terminator and fit a 120 ohm resistor across the panel module's terminals.
5. Earth the cable shield at one point only, normally the control cabinet's earth bar.
6. Where the stock breakout block will not seat on the panel's add-on module, build the pigtail from the module manual's connector details; do not trim or force the block.

The resistors do real work: they match the pair's roughly 120 ohm characteristic impedance, so a reflection from the far end dies there. An unterminated link often behaves on the bench and drops characters on the machine floor next to drive cables and contactors.

Which serial settings have to match at both ends?

Set the same baud rate, data bits, parity and stop bits, plus the same protocol mode and one unique unit address, in the panel driver and the controller, beginning from the controller manual's values, commonly 9600 baud, 8 data bits, no parity, 1 stop bit.

Copy the controller's communication page into the driver. The Modbus over serial line specification's own default frame is 8 data bits, even parity, 1 stop bit; temperature controllers commonly ship at 9600 baud with 8 data bits, no parity and 1 stop bit. The controller manual decides: enter its values once in the driver and once on the controller's own setting menu.

Give the controller its bus address. Valid Modbus RTU slave addresses run from 1 to 247; address 0 is broadcast, which no slave answers as itself. Leave the controller at its documented default, usually address 1, and point the driver at the same number.

Confirm the driver exists before tuning anything: search the panel software's help for the controller family name, and check the panel driver list before tuning serial settings if the entry you expected is missing.

A mismatch announces itself as response timeouts on a physically perfect cable. When reads time out after wiring and termination have checked out, go through the HMI serial settings mismatch checks: baud, parity, stop bits, address, and the driver's protocol selection.

How do you pick the driver and map the tags?

Pick the panel driver the controller documentation names, usually a generic Modbus RTU master or a controller-specific driver, then type each tag from the controller's published register list: process value, setpoint, output percentage, alarm bits, with the address, function code and decimal position each line states.

Two register kinds exist. Holding registers are read with function code 03 and written with 06 or 16; input registers are read with function code 04 and are read-only. The register list names the kind for each value, and the driver tag needs the matching function code.

Watch the numbering convention. Lists that print 40001-style references mean 40001 is the first holding register, whose address on the wire is 0; other lists print raw addresses whose first value is 0 or 1. Use the convention your list states; an off-by-one here is the most common cause of a wrong value or an exception.

Mind the decimal position. Most temperature controller values are 16-bit integers, and the register list states the decimal position: one decimal digit means the panel divides the word by 10, two digits by 100. A word of 1500 with one decimal digit displays as 150.0 °C; with the decimal unset, the same tag shows 1500.

Typing tags by hand is slow, so look for a tag-table import in the panel software, usually a CSV file or an export from the controller's own configuration tools. Where there is no import, build one tag, confirm its live read, then duplicate it and edit each copy's address.

When the controller family has no dedicated driver, a generic Modbus RTU master driver still connects it; connect an HMI to a PLC with Modbus RTU when no driver fits walks that path. A value with no line in the register list has no documented address; display what the list documents.

How do you check the connection works?

Read the process value first and accept nothing else until it matches the controller's own front display: the same digits, updating at the poll rate you set, with a healthy communications status on both devices.

1. Watch the exchange counter. The panel driver reports timeouts and errors, and the module's diagnostic page counts good exchanges; confirm the count climbs at the poll rate you set.
2. Poll sensibly. Twice a second is plenty for a temperature controller; the process value moves slowly and faster polling only loads the bus.
3. Compare digits. The panel's process value and the controller's front display must show the same number, to the decimal, and both must move together through a natural warm-up or cool-down.
4. Test one write. With the change authorized, send a small setpoint step, 5 °C on a curing oven is a sensible size, with function code 06 to the setpoint register. The controller's own display must follow; then restore the original setpoint.
5. Recheck after an hour of normal running. Intermittent drops point at termination or shielding. A link that stays silent on sound wiring usually has the data pair swapped; swapping A and B at one end is safe to try, because reversed lines do not damage RS-485 transceivers.

Keep the controller's own over-temperature protection and any independent high-limit cutout in service through all of this: the HMI link is for viewing and setpoint trims, and it is not a safety function.

Why does the panel show a number that is not the temperature?

A live but wrong number is a mapping or scaling problem, and you check the address, the function code, the word count and the decimal position, in that order, against the register list.

• An exception or a permanent zero: the tag points at a register the controller does not use. Recheck the list line and the numbering convention, 40001-style against raw address.
• Right digits, wrong size: the panel shows 1500 where the controller shows 150.0. The decimal position is missing; set the tag to divide by 10.
• Scrambled values: the tag reads an input register with function 03, or a 32-bit value arrives with the word order swapped. The list names the register kind; word order rarely enters on temperature controllers, whose values are usually 16-bit.
• A value frozen at one number: the poll has stalled. Confirm the exchange counter still climbs before touching the tag.
• Correct when cold, drifting when hot: that is the process and its sensor, not the link. Compare against the controller display and follow the controller's own sensor diagnostics.

Worked example: when is a curing oven link ready for setpoint writes?

A 15 m run at 9600 baud, 8N1, address 1, with 120 ohm termination at both ends, is ready for setpoint writes when a two-register read returns 1500 and 1650 while the controller's own display shows 150.0 and 165.0 at the same moment.

The setup: a 3-inch panel with its add-on RS-485 module and a hand-built pigtail, because the stock breakout block will not seat on the module; a Modbus RTU process controller on a curing oven; 15 m of twisted shielded pair; both ends at 9600 baud, 8 data bits, no parity, 1 stop bit; controller at address 1; the controller's built-in terminator enabled and a 120 ohm resistor across the panel module's terminals. The register numbers below are this example's illustrative inputs; your controller's manual prints the ones that count.

The read check: the driver sends function code 03 for 2 words from address 0, which is 40001. Words return as 1500 and 1650. Process value: 1500 / 10 = 150.0 °C, matching the controller display. Setpoint: 1650 / 10 = 165.0 °C, also matching.

The write check: an authorized 5 °C step to 170.0 °C needs the value 170.0 × 10 = 1700 sent with function code 06 to 40002. The controller display reads 170.0, the panel tag follows, and the setpoint goes back to 165.0 with a readback of 1650.

With both checks passed, the link is ready: save the project copy and enable the operator setpoint trim.

Recommendation: For a single temperature controller inside a normal panel-to-machine run, use the controller's documented serial defaults, usually 9600 baud, 8 data bits, no parity, 1 stop bit at address 1; terminate with 120 ohm at each physical end of one twisted shielded pair plus its common wire; and hold off enabling writes until a read has matched the controller's own display through an hour of running.

Questions