Rapid SCADA to Schneider PLC: Modbus Addressing & Configuration

Overview

Connecting Rapid SCADA to a Schneider Electric PLC requires a precise understanding of Modbus addressing conventions. A frequently encountered configuration error stems from misinterpreting a Modbus address such as 400001 — users type the full five-digit identifier into a field that expects only the offset, or vice versa. The result is a polling failure that presents as no response from device or illegal data address.

This reference consolidates the addressing logic, the Schneider PLC Modbus server model, and the Rapid SCADA 6 driver configuration parameters into a single procedure. Engineers deploying M340, M580, Modicon Momentum, or any Modbus TCP/RTU-compatible Schneider controller against a Rapid SCADA front end should be able to bring the link online in under an hour by following the steps and verification checks below.

Modbus Addressing Fundamentals

The Modbus application protocol defines four primary data tables. Each table uses a five-digit reference where the leading digit identifies the table and the remaining four digits specify the element offset.

The classic Modicon convention (still used by Schneider controllers) numbers elements starting at 1. A holding register reference of 400001 therefore means holding register table, element #1, which maps to a zero-based offset of 0 on the wire. Element 400010 corresponds to offset 9.

Schneider PLC Modbus Server Model

Schneider Electric Modicon controllers expose Modbus data through the following server modes:

• Modbus TCP server — default port 502, configurable to any unused port.
• Modbus RTU over RS-485 — slave mode on a multi-drop serial bus.
• Modbus RTU over TCP — RTU framing tunneled inside a TCP connection.
• Modbus ASCII — legacy mode, rarely used in new deployments.

The native Modbus address space on a Schneider PLC is the same regardless of transport. On Modicon M340 and M580 controllers, the legacy Modbus request addresses map onto the %MW (memory word) area according to a fixed mapping table defined in the controller's programming help. For EcoStruxure Control Expert (Unity Pro) and EcoStruxure Process Expert, this mapping is configurable per project.

For Modicon M340 specifically, holding register 400001 typically resolves to %MW0. Holding register 400100 resolves to %MW99. The mapping remains one-to-one (Modicon index = offset + 1) so the offset arithmetic in the SCADA always matches the controller's %MW layout.

Rapid SCADA 6 Architecture

Rapid SCADA 6 is the open-source SCADA platform hosted at github.com/RapidScada/scada-v6. The platform targets large distributed industrial automation systems and runs on Windows or Linux servers, embedded computers, and cloud instances.

The logical structure is hierarchical:

A channel represents a physical/logical communication line and groups devices sharing that line. A device is one addressable PLC on the channel. Tags are the individual data points polled from or written to a device. Channels and devices are configured in ScadaComm/config/ as XML files; the web-based Administrator application generates the XML from a guided form.

Prerequisites

1. Rapid SCADA 6 server installed and licensed (community edition is free for non-commercial use).
2. Schneider PLC with a known IP address (Modbus TCP) or COM port settings (Modbus RTU):
   • IP, subnet mask, gateway configured in Control Expert / Unity Pro.
   • Modbus TCP server enabled on port 502 (default).
   • Read/Write access enabled in the controller's Modbus server configuration.
3. Ethernet connectivity verified from the SCADA host — ping and a Modbus TCP probe (e.g., mbpoll -m tcp -t 4 -r 1 -c 1 10.0.0.10 on Linux) both succeed.
4. Project variable list (PVL) exported from Control Expert showing the %MW address of each tag to be polled.

Installing the Modbus Driver in Rapid SCADA

Rapid SCADA 6 ships Modbus drivers as separate modules. For Schneider PLCs, the Modbus TCP driver or the Modbus RTU driver is required depending on transport.

1. Open the Rapid SCADA Administrator web interface (default: https://localhost/scada).
2. Navigate to Modules and confirm the driver is listed. If absent, download the appropriate package from the official repository at github.com/RapidScada and copy the .dll into the ScadaComm/Mod folder.
3. Restart the ScadaComm service so the new module is loaded. Verify the service log shows the driver initialized without errors.

Configuring the Communication Channel

1. In the Administrator interface, select Configuration → Communication Lines.
2. Click New Communication Line. Assign a descriptive name (e.g., Schneider_ModbusTCP_Line1).
3. Choose the driver — Modbus TCP for Ethernet, Modbus RTU for serial.
4. For TCP, leave Port at 502 and set Connection Timeout to

   3000 ms, Polling Period to 1000 ms as a safe starting point.

5. For RTU, configure COM port, Baud (typically 19200 for Schneider), Parity (Even), Data bits (8), and Stop bits (1).
6. Save the configuration. The line must be enabled before devices can poll.

Configuring the Device

1. Select Configuration → Devices and add a new device under the channel.
2. Set the device name (e.g., M340_Unit1), identifier, and Modbus address: for Modbus TCP this is the Unit ID / Slave ID. Schneider controllers typically default to 1 when no bridging is configured.
3. Enter the device address. For Modbus TCP: 10.0.0.10:502. For Modbus RTU: the COM port defined on the channel.
4. Set Request Timeout to

   1000 ms and Time Before Retry to 5000 ms.

5. Save and apply configuration.

Address Mapping: Schneider PLC to Rapid SCADA Tag

This is the section that resolves the original question. A Schneider %MW address translates to a Modbus holding register reference and finally to a Rapid SCADA tag entry.

The Rapid SCADA Modbus driver typically accepts either the raw Modicon reference (e.g., 400001) or the zero-based offset. In the tag editor, the convention is documented in the driver's help text. When the field is labeled Address and the column header is Offset, enter only the numeric offset (e.g., 0 for %MW0). When the field is labeled Modbus Address, you may enter the full reference.

Step-by-Step Tag Configuration

1. Open Configuration → Inputs (or Outputs for control tags).
2. Click New Input. Set the device to M340_Unit1.
3. Choose the signal type: Analog for register values, Discrete for coils.
4. Enter the Modbus offset. For %MW0 as a 16-bit unsigned integer, offset = 0.
5. Set Quantity = 1 for a single tag, or use group tags to read consecutive registers in one request.
6. Configure engineering units, scaling, deadband, and archiving.
7. Save. The tag becomes active on the next poll cycle.

For batch reads of contiguous %MW registers, configure a group tag with the start offset and quantity equal to the number of words. This reduces Modbus request count and improves throughput on slow serial links.

Verification

1. Open the Rapid SCADA web interface and navigate to Data → Real-time Data.
2. Confirm the new tag shows a value consistent with the controller (cross-check with Control Expert online watch table).
3. Inspect Communication → Device Status — the device should display Online with zero CRC or timeout errors.
4. Force a value in the controller and verify it appears in the SCADA within one polling period.
5. From the SCADA, write a value (write tag) and verify the controller accepts it (Control Expert live values update).
6. Check Server → Log for any ExceptionCode entries. Common exceptions and their meaning:

Troubleshooting Matrix

Performance Tuning

For a Schneider Modicon M340 polled at 1000 ms with 200 tags spread across two Modicon references, plan for approximately 4–8 Modbus TCP requests per second. Optimization levers include:

• Group tags — read up to 125 holding registers per FC03 request (Modbus spec limit).
• Stagger polls — split devices across channels with offset poll times to balance load.
• Deadband filtering — suppress archival of values that have not changed by more than the engineering-unit deadband.
• Redundancy — Rapid SCADA 6 supports a redundant Communicator; pair two SCADA hosts with a virtual IP failover for the Schneider PLC connection.

Security Considerations

Modbus TCP has no built-in authentication or encryption. On plant networks, isolate the SCADA-to-PLC link on a dedicated VLAN and apply ingress ACLs at the managed switch. For new deployments, evaluate M580 controllers with Modbus/TCP security extensions or migrate to OPC UA over a Schneider M580 CPU with the appropriate firmware module.