Instrumentation · Communication Protocols · Modbus
Modbus Protocol Explained: RTU vs TCP, How It Works and When to Use Each
A clear, practical guide to Modbus: what it is, how master-slave communication works, what registers and function codes are, and the key differences between Modbus RTU and Modbus TCP with a selection guide.
If you work in industrial automation, instrumentation or process control, you will encounter Modbus every single day. It is the most widely installed industrial communication protocol in the world, running on tens of millions of devices across factories, power plants, oil and gas facilities, water treatment plants and buildings. Pressure transmitters, flow meters, variable speed drives, energy meters, gas analysers, PLCs and SCADA systems all speak Modbus.
Despite being over 45 years old, Modbus remains the universal fallback protocol in industrial automation. When two devices from different manufacturers need to exchange data and no other protocol is available, both almost certainly support Modbus. Understanding how it works is one of the most valuable skills an instrumentation or automation engineer can have.
This guide explains the Modbus protocol from the beginning: what it is, how master-slave communication works, what the four register types are, what function codes do, and most importantly, the real differences between Modbus RTU (serial) and Modbus TCP (Ethernet) and when to use each one.
What Is the Modbus Protocol?
Modbus is an open, royalty-free serial communication protocol originally developed by Modicon (now part of Schneider Electric) in 1979. It was created to allow programmable logic controllers to communicate with each other and with other devices in an industrial network.
The core idea behind Modbus is simple. One device (the master) asks for data. Another device (the slave) responds with the data. That is all Modbus does. The master always initiates communication. The slave only responds when asked. This simple request-response model is the foundation of everything Modbus does.
- Open and free: No licensing fee, no royalty. Any manufacturer can implement it in their device at zero cost.
- Simple: Very few rules to learn. A technician can understand Modbus in a day.
- Interoperable: Devices from Siemens, Schneider, ABB, Yokogawa, Emerson and hundreds of other manufacturers all speak the same Modbus language.
- Robust: Proven in harsh industrial environments over four decades.
- Universal fallback: When no other protocol matches, both devices almost certainly support Modbus.
Modbus variants in common use
| Variant | Physical layer | Most common use |
|---|---|---|
| Modbus RTU | RS485 or RS232 serial cable | Field instruments to PLC/DCS over twisted-pair cable. Most common in process plants. |
| Modbus TCP | Ethernet (Cat5/Cat6) | PLC to SCADA, device to device over plant Ethernet network. Fast and scalable. |
| Modbus ASCII | RS232 serial | Older systems. Same as RTU but data encoded as readable ASCII text. Rarely used today. |
| Modbus RTU over TCP | Ethernet | RTU frame wrapped in TCP/IP packet. Used for gateways bridging serial devices to Ethernet. |
Watch: How Modbus Protocol Works (Video)
This clear video from Teltonika explains how Modbus TCP/IP and Modbus RTU work in industrial IoT and M2M communication:
How Modbus Works: Master-Slave Communication
Every Modbus network has one master and one or more slaves. This is the fundamental rule of Modbus. The master controls all communication. Slaves never transmit data on their own. They only respond to requests from the master.
When a Modbus master wants to read data from a device, it sends a request message containing three key pieces of information:
- Slave address: Which device should respond (1 to 247 for RTU)
- Function code: What action to perform (read, write, etc.)
- Register address and quantity: Which data to read and how many registers
The addressed slave reads the function code, performs the action, and sends back a response containing the requested data. All other slaves on the network ignore the message because their address did not match.
The Four Modbus Register Types
Modbus organises data in a device into four types of memory areas called registers and coils. Understanding these four types is essential for reading and writing Modbus data correctly.
| Register type | Data size | Read/Write | Address range | What it holds | Example |
|---|---|---|---|---|---|
| Coils (Discrete Outputs) | 1 bit (ON/OFF) | Read and Write | 0xxxx (00001-09999) | Digital output states. Can be turned ON or OFF by the master. | Relay output, pump start/stop command |
| Discrete Inputs | 1 bit (ON/OFF) | Read only | 1xxxx (10001-19999) | Digital input states. The master can read them but not change them. | Limit switch status, alarm input, pushbutton state |
| Input Registers | 16 bits (word) | Read only | 3xxxx (30001-39999) | Analogue input measurement values. Read only by the master. | Process temperature, pressure, flow measurement value |
| Holding Registers | 16 bits (word) | Read and Write | 4xxxx (40001-49999) | The most commonly used register type. Stores configuration and setpoints that the master can both read and change. | Setpoint, scaling parameters, configuration settings, analogue output value |
Modbus Function Codes: What They Do
A function code tells the slave what action to perform. Every Modbus request contains one function code. The most commonly used function codes are:
| Function code | Name | What it does | Used for |
|---|---|---|---|
| 01 | Read Coils | Reads the ON/OFF status of one or more coils (digital outputs) | Reading relay states, digital output status |
| 02 | Read Discrete Inputs | Reads the ON/OFF status of one or more discrete inputs | Reading switch status, alarm inputs |
| 03 | Read Holding Registers | Reads the value of one or more holding registers (16-bit words) | Most common. Reading process values, configuration, setpoints |
| 04 | Read Input Registers | Reads the value of one or more input registers (read-only analogue values) | Reading analogue measurement values from field instruments |
| 05 | Write Single Coil | Forces a single coil ON (0xFF00) or OFF (0x0000) | Turning a relay or digital output ON or OFF |
| 06 | Write Single Register | Writes a value to a single holding register | Setting a setpoint, writing a configuration value |
| 16 | Write Multiple Registers | Writes values to a block of consecutive holding registers | Sending multiple setpoints or configuration values in one transaction |
Modbus RTU: How It Works
Modbus RTU (Remote Terminal Unit) is the serial version of Modbus. It sends binary data over a twisted-pair cable using the RS485 electrical standard. Modbus RTU was the original form of Modbus and remains the most widely installed version in process plants today.
The RS485 physical layer
Most Modbus RTU networks use RS485 as the physical layer. RS485 is a differential signalling standard that uses two wires (A and B, also labelled + and -) to carry the signal. The differential nature makes it very resistant to electrical noise, which is why it works well in industrial environments near motors, drives and transformers.
Key RS485 characteristics:
- Maximum cable length: up to 1,200 metres (4,000 feet) at low baud rates
- Maximum devices on one bus: 247 (with addresses 1 to 247)
- Topology: Daisy-chain (linear bus). NOT a star topology.
- Termination resistors: 120 ohm resistors required at BOTH ends of the cable
- Common baud rates: 9600, 19200, 38400, 57600, 115200 bps
- Use daisy-chain topology only. Never use a star topology (branching off to multiple directions). Star wiring causes signal reflections that corrupt Modbus messages.
- Terminate both ends. Install a 120 ohm resistor across the A and B terminals at BOTH ends of the RS485 cable. Missing termination causes communication errors.
- All devices must use identical communication settings. Baud rate, parity, stop bits and data bits must match on every device on the bus. A single mismatch will prevent all communication.
- Maximum 32 devices without a repeater on a standard RS485 bus. Use a repeater or signal booster if you need more than 32 devices or cables over 300 metres.
Modbus TCP: How It Works
Modbus TCP takes the same Modbus message structure and wraps it inside a standard TCP/IP Ethernet packet. Instead of sending the binary message over a two-wire serial cable, it sends it over a Cat5 or Cat6 Ethernet network using the same IP infrastructure your office network uses. Modbus TCP communicates on TCP port 502 by default.
The key change from RTU to TCP is the addition of the MBAP header (Modbus Application Protocol header) at the beginning of the message, which replaces the slave address byte and CRC of the RTU frame. The CRC is no longer needed because TCP/IP handles error detection at the network layer.
Modbus RTU vs Modbus TCP: Full Comparison
Modbus RTU
- Serial communication over RS485 or RS232
- Two-wire twisted pair cable, daisy-chain topology
- One master, up to 247 slaves per bus
- One conversation at a time on the bus
- CRC error checking in every frame
- Baud rates: 9600 to 115200 bps (slow)
- Cable up to 1,200 metres at low baud rates
- Low cost, simple wiring
- No built-in security
- Ideal for: field instruments, remote I/O, older devices
Modbus TCP
- Ethernet communication over TCP/IP
- Cat5/Cat6 cable, star topology via switches
- Multiple clients (masters) and multiple servers (slaves)
- Multiple simultaneous connections possible
- TCP/IP handles error detection (no CRC)
- Speed: 10/100/1000 Mbps (much faster)
- Standard IP networking infrastructure
- Higher cost per connection point
- Requires network security (firewall, VPN)
- Ideal for: PLC to SCADA, device to cloud, modern systems
| Criteria | Modbus RTU | Modbus TCP |
|---|---|---|
| Physical medium | RS485 / RS232 serial cable | Ethernet Cat5/Cat6 |
| Topology | Daisy-chain only (linear bus) | Star, tree, ring (via Ethernet switches) |
| Speed | 9,600 to 115,200 bps | 10 Mbps to 1 Gbps |
| Max devices per network | 247 per RS485 bus | Limited only by IP network capacity |
| Addressing | Device address 1 to 247 | IP address (192.168.x.x) plus Unit ID |
| Error detection | CRC in every frame | TCP/IP checksum (no application-level CRC) |
| Simultaneous connections | One conversation at a time | Multiple simultaneous clients supported |
| Default port | Not applicable (serial) | TCP port 502 |
| Cable distance | Up to 1,200 m per segment | 100 m per segment (extended via switches) |
| Security | None built in | None built in (use VPN and firewall) |
| Cost | Low (simple serial cable) | Higher (Ethernet switch and cabling) |
| Best for | Field instruments, remote I/O, legacy devices | SCADA integration, modern PLCs, cloud connectivity |
When to Use Modbus RTU vs Modbus TCP
| Your situation | Use Modbus RTU | Use Modbus TCP |
|---|---|---|
| Device type | Older field instruments, energy meters, analysers, drives with RS485 port only | Modern PLCs, SCADA systems, smart meters with Ethernet port |
| Communication distance | Under 1,200 metres, no network infrastructure | Long distance over existing plant Ethernet, or remote access over internet |
| Number of devices | Small network (under 32 devices per bus) | Large number of devices across multiple locations |
| Speed requirement | Slow process variables that update every few seconds | Fast data acquisition, historian integration, real-time dashboards |
| System architecture | Standalone field bus with no IT infrastructure | Connected to plant Ethernet, MES, cloud or corporate network |
| Budget | Lowest cost. Serial cable is cheap. | Higher cost but uses existing Ethernet infrastructure |
| Existing installation | Existing RS485 wiring already in place | New installation or plant with existing Ethernet infrastructure |
Common Modbus Problems and How to Fix Them
| Problem | Likely cause | Fix |
|---|---|---|
| No response from slave (RTU) | Wrong baud rate or parity. Wrong slave address. Missing termination resistor. Star topology used. | Verify all communication parameters match on master and slave. Check slave address configured on the device. Add 120 ohm termination at both ends of the cable. Convert to daisy-chain topology. |
| Intermittent communication errors (RTU) | Electrical noise from nearby motors or VFDs. Missing cable shielding. Too many stubs on the bus. Marginal cable length. | Check cable shield grounding (one end only). Add ferrite beads on cable near noise sources. Reduce stub lengths to under 1 metre. Add a signal repeater if bus is near maximum length. |
| Wrong data values read | Wrong register address. Wrong data type interpretation (signed vs unsigned, byte order). Wrong function code used. | Check the device manual for the exact register map. Verify whether the register uses a 16-bit or 32-bit value. Check byte order (big-endian vs little-endian). Confirm function code matches the register type. |
| Modbus TCP: no connection (TCP) | Wrong IP address. Port 502 blocked by firewall. Device not on same subnet. Device not in Modbus TCP server mode. | Ping the device IP address first. Check firewall rules for port 502. Verify subnet mask. Check device configuration for Modbus TCP server enable setting. |
| CRC error on every message (RTU) | Baud rate mismatch. Electrical noise. Cable too long. Wrong parity or stop bits setting. | Verify baud rate and parity match exactly. Reduce baud rate. Check cable for damage, proper shielding and correct termination. Verify all devices share the same communication settings. |
| Only some slaves respond | Duplicate slave addresses on the bus. Faulty device on the bus causing signal corruption. Bus length exceeded. | Verify each slave has a unique address. Disconnect devices one at a time to identify a faulty device causing collisions. Add a repeater if bus exceeds maximum recommended length. |
Further Reading and External Resources
- Modbus.org: Official Modbus Specifications. The official home of the Modbus standard. Free download of the complete Modbus protocol specification documents.
- Schneider Electric: Modbus Protocol Guide. Comprehensive Modbus reference from the company that created the protocol in 1979, covering RTU, ASCII and TCP variants.
- RealPars: How Modbus Communication Protocol Works. Clear, well-illustrated Modbus tutorial from a respected industrial automation education platform.
- Inst Tools: Industrial Communication Protocols. Reference guide on industrial field communication protocols used alongside Modbus in process plants.
Frequently Asked Questions: Modbus Protocol
- Communication Protocols in PLC: Types Explained
- HART Protocol: How It Works and How to Use a HART Communicator
- PLC vs RTU: Key Differences and When to Use Each
- What Is a PLC and How Does It Work?
- Distributed Control System (DCS): What It Is and How It Works
- Signals in Instrumentation: AI, AO, DI, DO Explained
- Ladder Logic for Beginners: A Complete Step-by-Step Guide
- How PLC Scan Cycle Works: Step-by-Step Guide
What we learn today
- Modbus is the most widely used industrial communication protocol in the world. It is open, free, simple and works across virtually every manufacturer's equipment.
- Modbus uses a master-slave model. The master always initiates requests. Slaves only respond when addressed. Only one conversation at a time on an RTU bus.
- There are four Modbus register types: Coils (digital output, read/write), Discrete Inputs (digital input, read only), Input Registers (analogue input, read only) and Holding Registers (read/write, most commonly used).
- Function Code 03 (Read Holding Registers) is the most used Modbus command. Master your understanding of FC03 and you understand 80% of Modbus communication.
- Modbus RTU sends binary data over RS485 serial cable. It is inexpensive, reliable and ideal for field instruments. Key rules: daisy-chain topology, 120 ohm termination at both ends, all devices must share identical baud rate and parity settings.
- Modbus TCP wraps the same Modbus message in a TCP/IP packet over Ethernet. It is faster, supports star topology, allows multiple simultaneous connections and uses TCP port 502.
- The function codes and register structure are identical in RTU and TCP. Only the transport layer and frame format differ.
- Modbus has no built-in security. Protect Modbus TCP networks with firewalls, VPNs and network segmentation, especially when connected to corporate networks or the internet.
- A Modbus RTU-to-TCP gateway lets you integrate legacy RS485 instruments into modern Ethernet-based SCADA and cloud systems without replacing the field devices.