Modbus — Industrial Communication Protocol

Definition and History​

Modbus is an industrial communication protocol released in 1979 by Modicon (now Schneider Electric) to enable communication between its programmable logic controller and field devices. Having become an open, royalty-free standard in 2002, Modbus is now the most widely used protocol in the industry, found on hundreds of millions of devices worldwide.

Its popularity is based on three fundamental qualities: simplicity (easy to implement, well-documented), robustness (works over poor-quality connections), and interoperability (an open standard supported by virtually all industrial equipment—PLCs, variable-speed drives, energy meters, sensors, and controllers).

Despite its age, Modbus remains indispensable, particularly in existing (brownfield) installations and for low-cost equipment. Its main drawback is the lack of native security (no authentication, no encryption), which requires it to be protected behind a VPN when it travels over an uncontrolled network.

Modbus RTU vs. Modbus TCP​

There are two main variants of the Modbus protocol:

Modbus RTU (Serial)​

  • Physical layer: RS-232 (point-to-point) or RS-485 (multi-drop bus supporting up to 32 devices, maximum distance of 1,200 m at 9,600 baud).
  • Transmission: binary, compact. Each message contains the slave address, the function code, the data, and a CRC-16 integrity check.
  • Topology: master-slave (a single master, up to 247 slaves addressable from 1 to 247).
  • Applications: energy meters, variable frequency drives, industrial sensors with RS-485 output, legacy PLCs.

Modbus TCP (Ethernet)​

  • Physical layer: Ethernet (10/100/1000 Mbps), IP protocol, TCP port 502.
  • Encapsulation: The Modbus RTU frame is encapsulated in a 7-byte MBAP (Modbus Application Protocol) header that replaces the CRC (Ethernet ensures integrity on its own).
  • Topology: client-server (the client, formerly the master, queries the server, formerly the slave). Multiple clients can query the same server simultaneously.
  • Usage: PLCs with Ethernet ports (Siemens S7, Schneider M340/M580, Allen-Bradley), HMIs/SCADA systems, cloud gateways.
CriterionModbus RTUModbus TCP
Physical layerRS-232 / RS-485Ethernet / TCP-IP
Typical Speed9,600 to 115,200 baud10/100 Mbps
DistanceUp to 1,200 m (RS-485)Standard Ethernet network
Number of slaves1 to 247Unlimited (IP addressing)
Integrity checkCRC-16TCP checksum
Native securityNoneNone (use VPN)

Structure of a Modbus Message​

Modbus RTU — Frame​

| Slave address (1 byte) | Function code (1 byte) | Data (N bytes) | CRC-16 (2 bytes) |

Example of an FC03 request that reads 2 registers starting at address 0x0000 on slave 1:

01 03 00 00 00 02 C4 0B

Modbus TCP — Frame (with MBAP header)​

| Transaction ID (2 bytes) | Protocol ID (2 bytes, = 0x0000) | Length (2 bytes) | Unit ID (1 byte) | Function code | Data |

Modbus Registers​

Modbus organizes data into four types of registers, identified by their reference address:

TypeAddressAccessDescription
Coils0x0001–0xFFFF (base 1)Read/WriteDigital on/off outputs (bit) — status of a valve or relay
Discrete Inputs0x1001–0xFFFFRead-onlyDigital on/off (bit) inputs — status of an on/off sensor
Holding Registers0x4001–0xFFFFRead/Write16-bit read/write registers — setpoints, parameters, measured values
Input Registers0x3001–0xFFFFRead-only16-bit read-only registers — sensor measurements, process values

Note: Actual addressing in frames starts at 0 (an offset of -1 relative to the documented references). Thus, the Holding Register referenced as 40001 is addressed as 0x0000 in the frame.

Common Function Codes​

CodeHexNameDescription
FC010x01Read CoilsRead the status of N coils (digital outputs)
FC020x02Read Discrete InputsRead the status of N digital inputs
FC030x03Read Holding RegistersRead the status of N 16-bit read/write registers — most commonly used
FC040x04Read Input RegistersRead the status of N 16-bit read-only registers
FC050x05Write Single CoilWrite a single digital output (0x0000 = OFF, 0xFF00 = ON)
FC060x06Write Single RegisterWrite a single 16-bit holding register
FC160x10Write Multiple RegistersWrite multiple consecutive registers in a single transaction

FC03 is by far the most commonly used code for monitoring: it allows you to read measurements, statuses, and counters for a piece of equipment.

Slave Addressing (Unit ID)​

In Modbus RTU, each device on the RS-485 bus has a unique address ranging from 1 to 247. Address 0 is reserved for broadcasts—only write commands can be broadcast.

In Modbus TCP, the Unit ID field (formerly known as Slave ID) is included in the MBAP header. It is typically set to 1 or 255 for PLCs with a single device, but can be used to address different RS-485 buses behind the same Modbus TCP/RTU gateway.

Modbus Configuration on the Eziwan Gateway​

The Eziwan Gateway natively supports Modbus RTU (via RS-485) and Modbus TCP (via Ethernet). Configuration is performed through the gateway's web interface:

  1. Select the protocol: Choose "Modbus RTU" or "Modbus TCP" from the Data Source menu.
  2. Serial Settings (RTU only): baud rate (9,600, 19,200, 38,400, 57,600, or 115,200), parity (None/Even/Odd), stop bits (1 or 2).
  3. Slave address: Enter the device address (1 to 247).
  4. Define data points: For each value to be read, specify the function code (FC01 to FC04), the register address, and the data type (INT16, UINT16, INT32, FLOAT32, BOOL).
  5. Acquisition interval: polling frequency (from 1 second to several minutes, as needed).
  6. Test the connection: use the "Read Test" function to verify that data is being read correctly before enabling cloud data upload.

Frequently Asked Questions​

What is the difference between Modbus RTU and Modbus TCP?​

Modbus RTU operates over an RS-485 serial link (multi-slave bus, up to 1,200 m); Modbus TCP encapsulates the same requests in an Ethernet/IP frame on port 502. A gateway bridges the two systems.

What is a Modbus register?​

A 16-bit memory location identified by an address. The holding registers (FC03/FC06/FC16) store process values; 32-bit values (floating-point numbers, counters) occupy two consecutive registers.

Is Modbus secure?​

No: The protocol does not use authentication or encryption. It must never be exposed to the Internet—the rule is to confine it to the local network and transport data to the cloud through an encrypted VPN tunnel.

How many devices can be connected to a Modbus RTU bus?​

Up to 32 slaves without a repeater (247 possible logical addresses). Beyond that, or to mix different polling rates, the system is segmented into multiple buses on separate RS-485 ports.