Modbus RTU (RS-485/RS-232) vs. Modbus TCP/IP (Ethernet)
| Criterion | Modbus RTU (RS-485) | Modbus TCP (Ethernet) |
|---|---|---|
| Physical medium | RS-485 / RS-232 (serial) | Ethernet / Wi-Fi (TCP/IP) |
| Maximum speed | ✗ 115,200 baud (≈ 10 kB/s) | ✓ 100 Mbps to 1 Gbps |
| Maximum distance | ✓ 1,200 m (standard RS-485) | ✗ 100 m (Cat. 5e Ethernet) |
| Number of slaves | 32 without a repeater (247 max) | ✓ Unlimited (standard network) |
| Topologie | Daisy-chain bus (two-wire) | ✓ Star or bus (IP network) |
| Cabling Cost | ✓ Very low (RS-485 cable) | Moderate (Ethernet cable) |
| Error Handling | 16-bit CRC (detection) | ✓ TCP/IP Checksum + Retransmission |
| Real-Time Determinism | ✓ Okay (predictable sequential scan) | Variable (network latency) |
| Multi-teacher | ✗ No (only one master per bus) | ✓ Yes (several master's degrees) |
| Native Security | ✗ None (physical access required) | ✗ None (but can be isolated via VLAN) |
| Routing / Gateway | ✗ No (local bus only) | ✓ Yes (standard IP routing) |
| SCADA Integration | Via RS-485/Ethernet gateway | ✓ Natively (port 502) |
| Diagnostic Tools | Oscilloscope, Serial Analyzer | ✓ Wireshark, standard network tools |
| Robustesse CEM | ✓ Excellent (differential RS-485) | Compatible with FTP/STP cable |
| Secure variant | ✗ Not available | ✓ Modbus over TLS (RFC 8144) |
8 Technical Considerations for Choosing the Right Modbus Protocol
RS-485 is a two-wire differential bus: two twisted wires (A/B) that are resistant to the electromagnetic interference that is ubiquitous in industrial environments (frequency inverters, motors, welding). Its range of 1,200 meters without a repeater makes it ideal for connecting sensors in a factory or industrial building. A shielded twisted-pair cable costing just a few cents per meter is sufficient, with 120-ohm bus terminators at both ends. Modbus RTU over RS-485 remains the most widely used protocol in entry-level industrial equipment: energy meters, level sensors, variable-frequency drives, and temperature controllers.
Modbus TCP/IP encapsulates Modbus PDUs (Protocol Data Units) into TCP segments on port 502. It takes full advantage of the Ethernet infrastructure: manageable switches, VLANs, routing, redundancy (RSTP), and Wireshark diagnostics. Its speed (100 Mbps to 1 Gbps) allows hundreds of data points to be queried in milliseconds. Simultaneous multi-master connections allow a SCADA system, an MES, and an IIoT gateway to read the same registers in parallel without conflict. It is the protocol of choice for connections between PLCs and supervisory systems on industrial Ethernet networks.
In Modbus RTU, the timing is determined by the serial bus speed. At 9,600 baud, a 20-byte frame takes 20 ms. The inter-frame gap (3.5 character times) separates the frames. This behavior is entirely predictable. In Modbus TCP, network latency introduces variability ranging from a few to several tens of milliseconds, depending on network congestion. For monitoring (data reading), this variability is acceptable. For real-time control (writing to actuators with strict time constraints), the dedicated RS-485 bus remains more deterministic. Modern SCADA systems typically configure Modbus TCP timeouts ranging from 500 ms to 2 seconds.
Major SCADA software packages (WinCC, Ignition, iFIX, Wonderware InTouch) natively support Modbus TCP on port 502. Integrating Modbus RTU devices into a SCADA system requires either an RS-485/Ethernet converter or a gateway such as Eziwan, which exposes the RTU devices over Modbus TCP. The configuration within the SCADA system is identical whether the device is native TCP or an RTU device bridged by Eziwan. OPC-UA, the next-generation industrial communication standard, interfaces with Modbus TCP via OPC-UA Modbus servers, enabling integration into modern Industry 4.0 architectures.
In Modbus RTU, CRC-16 detects transmission errors. If an error occurs, the master can request the frame again. This mechanism is effective but adds latency on noisy links. In a harsh electromagnetic environment with poor cabling, error rates can reach 1 to 5%. In Modbus TCP, error checking is delegated to the TCP protocol (automatic retransmission). Modbus TCP is less deterministic than RTU over a dedicated bus, as network delays are variable. For critical real-time applications (PID control), Modbus RTU over a dedicated RS-485 bus remains the preferred choice.
Neither Modbus RTU nor Modbus TCP provides for authentication or encryption. Anyone who can inject frames onto the RS-485 bus or the Ethernet network can read and write registers. For Modbus TCP, unprotected exposure to the Internet is disastrous: automated scanners can find open port 502 within minutes. The Modbus over TLS standard (RFC 8144) provides native encryption for Modbus TCP but is not yet widely supported. In the meantime, protection requires network segmentation, industrial VLANs, and—for remote access—an encrypted VPN such as OpenVPN.
The brownfield migration is carried out without interrupting production. Phase 1 (days 1–30): Install Eziwan as a transparent bridge between the existing RS-485 bus and the Ethernet network. The RTU devices continue to operate normally. Phase 2 (months 2–6): Connect the new devices directly via Modbus TCP. Phase 3 (months 6–18): Replace the old RTU devices during preventive maintenance. Phase 4: Remove the RS-485 bridges when they are no longer needed. This approach minimizes risks and preserves the investment in existing equipment.
Eziwan physically incorporates an RS-485 Modbus RTU port and a Modbus TCP Ethernet interface. The gateway acts as a transparent bridge: it reads the Modbus RTU registers from field sensors and exposes them as Modbus TCP for monitoring systems, while simultaneously transmitting the data to the cloud via an OpenVPN/IPSec VPN tunnel. A single device replaces the RS-485/Ethernet converter, the 4G modem, and the VPN client—mounted on a DIN rail inside the industrial control cabinet. The RTU diagnostic log (CRC errors, timeouts, invalid responses) is accessible remotely via the Eziwan cloud interface.
4 Typical Industrial Scenarios and the Appropriate Modbus Protocol
Background: A 15,000 m² factory with 45 Schneider iEM3000 energy meters distributed across 8 electrical cabinets
A single daisy-chained RS-485 bus connects the 45 meters to the Eziwan gateway using less than 600 meters of cable. Scanning all the meters (active power, voltage, current, harmonics) takes 4.5 seconds at 9,600 baud. The Eziwan gateway transmits the data to an energy consumption monitoring platform (ISO 50001) via 4G and OpenVPN. Cost of RS-485 cabling vs. Ethernet infrastructure: estimated savings of 12,000 euros.
Background: Pharmaceutical packaging line with 12 pieces of equipment (filling machines, labelers, sealers) in a cleanroom
The industrial Ethernet infrastructure made of stainless steel is already in place for the quality control cameras. Each piece of equipment has an isolated RJ45 Ethernet port. Modbus TCP monitoring enables remote diagnostics from the production office without physical access to the cleanroom. An OPC-UA server on each machine exposes the data to the MES traceability system.
Background: Wastewater treatment plant with 80 legacy RTU devices on an RS-485 bus and a 10-year-old SCADA system in need of modernization
Phase 1: Eziwan is installed in parallel with the existing SCADA system as an RTU/TCP bridge. Phase 2: The new Ignition SCADA system connects to Eziwan via Modbus TCP—no modifications to field equipment required. Phase 3: Gradual replacement of sensors during maintenance. Phase 4: Expansion of monitoring to new equipment directly via TCP. Complete migration in 18 months with no service interruption.
Background: 150 cold storage units across 12 warehouses, with temperature sensors and refrigeration units to be monitored
In each warehouse, the 12 to 15 temperature sensors and Carrier cooling units are connected via an RS-485 bus. The Eziwan gateway reads the RTU data and transmits it to the cloud via 4G/OpenVPN. The cloud dashboard consolidates data from all 150 cells in real time. Alerts for temperature exceedances (HACCP compliance) are sent via SMS and email in less than 60 seconds.
The 5 Most Costly Mistakes in Modbus Deployment
RS-485 is a linear bus: each slave connects to the bus sequentially (A→B→C→D). A star-topology wiring configuration causes signal reflections and significant CRC errors, especially at speeds above 19,200 baud. The only solution is to use a dedicated RS-485 hub or reconfigure the wiring to a daisy-chain topology.
An RS-485 bus that is not terminated at both ends generates signal reflections that corrupt the frames, especially over long distances. Termination resistors (120 ohms) must be physically installed on the two devices at the ends of the bus—not in the middle, and not on every device.
Thousands of industrial control systems are directly accessible on the Internet via port 502 without any protection. Shodan.io lists hundreds of thousands of publicly accessible Modbus devices. All external Modbus TCP access must go through an encrypted VPN (OpenVPN Eziwan) without ever exposing port 502.
All devices on a Modbus RTU bus must use the same baud rate and the same serial parameters (data bits, parity, stop bits). A device operating at 19,200 baud on a bus configured for 9,600 baud causes errors throughout the entire network and can be difficult to diagnose.
Each Modbus RTU slave on an RS-485 bus must have a unique address between 1 and 247. If two slaves share the same address, both will respond simultaneously to the master’s requests, causing collisions and incomprehensible errors. Always verify that addresses are unique before connecting new equipment to the bus.
Which Modbus protocol is most widely used in each industry?
Field sensors (flow meters, level probes) use Modbus RTU over RS-485 because of their durability in humid environments. The station controllers communicate with the central SCADA system via Modbus TCP. Eziwan acts as a bridge between the two layers.
Hygiene requirements prohibit complex wiring. Industrial Ethernet in stainless steel and Modbus TCP simplify the cleaning of control cabinets. Wireshark diagnostics facilitate maintenance. Modern equipment (IO-Link sensors, drives) natively supports Modbus TCP.
The long distances between wells and collection stations (up to 500 m to 1 km) make RS-485 the preferred choice. EMC robustness in noisy environments (pump motors, inductive couplers) is a key advantage of the differential bus.
Ethernet infrastructure is already in place in commercial buildings. Modern building management systems (Belimo controllers, Schneider PM series energy meters) all feature an Ethernet Modbus TCP interface. Monitoring via a BMS over an IP network is the standard.
Production meters and substation sensors use Modbus RTU because of its robustness. High-availability substation monitoring, on the other hand, uses IEC 61850 or IEC 60870-5-104. The Eziwan gateway bridges Modbus RTU to the cloud.
Modbus remains the most widely used protocol in the industry, but RTU (serial) and TCP (Ethernet) have different topologies, electrical requirements, and security features. Here are the guidelines for wiring, addressing, and securing your system without errors.
Core protocol specification (modbus.org): PDU, function codes (0x01–0x2B), register addressing scheme. Common to both RTU and TCP.
Defines RTU and ASCII over RS-485/RS-232: binary frame, CRC-16, 3.5-character inter-frame silence, master/slave mode.
Encapsulation in TCP/IP, MBAP header, reserved port 502. The TCP integrity check replaces the serial CRC.
RS-485 physical layer: differential signaling, 32 unit loads per segment, polarization, and 120 Ω termination required on long lines.
Regulatory framework for industrial fieldbuses; lists Modbus among the standardized shop-floor communication protocols.
Modbus has no built-in security: encryption and access control must be handled at the gateway (VPN, OT/IT segmentation).
The gateway polls the RTU slaves (master polling), converts the data to Modbus TCP, or publishes it via MQTT/JSON. There is only one master per RS-485 bus; over TCP, multiple clients can poll the same slave simultaneously.
| Parameter | Benchmark value | Interpretation |
|---|---|---|
| Maximum RS-485 Length | 1,200 m @ 9,600 bps | The usable data rate decreases with distance; 115,200 bps is stable only at distances of less than 50 m. |
| Slaves per segment | 32 (without repeater) | Up to 247 logical addresses, but an electrical limit of 32 individual loads. |
| Termination / Polarization | 120 Ω + pull-up/pull-down | Essential at the end of a bus to prevent reflections and signal fluctuation. |
| Modbus PDU Size | 253 bytes max | ≈ 125 16-bit registers per read request (0x03). |
| Modbus TCP Port | 502 (TCP) | Must be strictly filtered: never exposed on the WAN side without a VPN. |
| Slave timeout | 500-1000 ms | Sufficient margin on a loaded serial bus or a 4G link with variable jitter. |
Addressing: Note the 1-offset between the protocol address (0-based) and the documented address (1-based, e.g., register 40001).
Modbus RTU meters distributed across 6 RS-485 buses, consolidated via serial-to-Ethernet gateways, and transmitted to the cloud via a 4G gateway.
Additional Resources on Industrial Protocols
Built-in RS-485 port for Modbus RTU, Ethernet interface for Modbus TCP. Automatic bridging and cloud data upload via 4G/LTE OpenVPN.