Read Modbus TCP data with a bot, read-only

1. Get the register map from the manual

Never let the bot guess addresses. Put the vendor register map in a CSV the bot can cite: name,address,type,scale,units,lo_alarm,hi_alarm. Note whether the manual numbers are 0-based or 1-based (40001 style); this is the most common Modbus mistake.

2. Enforce read-only on the wire

Permit only function codes 01-04 (read coils, discrete inputs, holding registers, input registers) from the bot box to the device, via an industrial firewall or Modbus-aware gateway. Drop 05, 06, 15, 16, 22, 23 and everything else.

3. Poll with Python (pymodbus)

Install pymodbus from your offline wheel cache. This script only reads and writes CSV:

import csv, time, datetime
from pymodbus.client import ModbusTcpClient

MAP = list(csv.DictReader(open("regmap.csv")))  # name,address,scale,units,lo_alarm,hi_alarm
c = ModbusTcpClient("10.20.30.40", port=502, timeout=3)
c.connect()
with open("readings.csv", "a", newline="") as f:
    w = csv.writer(f)
    for r in MAP:
        rr = c.read_holding_registers(int(r["address"]), count=1, device_id=1)
        # pymodbus < 3.10 uses slave=1 instead of device_id=1
        if rr.isError():
            w.writerow([datetime.datetime.now().isoformat(), r["name"], "ERROR", ""]); continue
        val = rr.registers[0] * float(r["scale"])
        w.writerow([datetime.datetime.now().isoformat(), r["name"], val, r["units"]])
c.close()

The script contains no write calls. Keep it that way and review any change to it like a PLC change.

4. Let the local model explain, with citations

Send a slice of readings plus the register map to your local model:

Here are the last 60 minutes of readings (CSV) and the register map (CSV).
1. List any value outside lo_alarm/hi_alarm, with tag name and timestamp.
2. Describe trends in plain English. Cite tag names for every statement.
3. Do not recommend control actions. If something looks unsafe, say "notify operator" and why.

Bad: "Is pump 3 OK? Fix it if not."

Good: "Summarize P3_DISCH_PSI and P3_AMPS for the last hour against their alarm limits. Cite timestamps."

5. Poll gently

Old PLCs and serial gateways can be overwhelmed. Start at one read every few seconds per device, batch contiguous registers, and confirm with the controls engineer that comms load is acceptable.

Where these facts come from

• ISA/IEC 62443 series: zones, conduits and security levels for industrial automation
• NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) security
• CISA: Industrial Control Systems: advisories and recommended practices
• Modbus Organization specifications: function codes and the TCP transport
• OPC Foundation: OPC UA specifications and security modes
• llama.cpp on GitHub: building and running local GGUF models on Linux

Checked Oct 29, 2026. Tutorials are educational. Follow your site's safety procedures, management-of-change process and the equipment maker's manual. Never test against live production equipment without authorization.