The underlying protocol; for the data transaction is called Modbus Protocol. It uses a query-response cycle between a master and the slave devices. The query is normally initiated by the micro. Every query gets a response from the PLC. The request contains the address of a register, a function code and data items, if any. The basic function are Read or Write a single register or multiple registers. The response function code indicates whether the reply has valid data or an error code. The protocol used over the Ethernet is called Modbus TCP/IP. It basically inserts a Modbus frame into a TCP frame and sends it as a message. The information for packing messages is available in Modbus/TCP specification manual.
The PLC logic is responsible for data acquisition and control of the hardware in response to messages from the micro. It allocates a block of 16-bit wide registers (referred to as 4x registers in Modbus PLC language) for data exchange with micro. During the execution of its logic cycle, the digitized data are stored in the registers. All discrete inputs are packed into 16-bit words and stored. The micro can read a maximum of 125 registers in one message transaction. This reduces the network traffic considerably. To write set point data or on/off control commands to hardware the micro sends the data or command to a register assigned by the PLC logic. The PLC logic executes the commands, which can be setting a DAC or turning supply ON/OFF etc.