Modbus TCP vs Modbus RTU

The difference between Modbus RTU and Modbus TCP is the network under the same Modbus requests. Modbus RTU is for a serial bus: one master polls addressed devices in turn on an RS-485 pair, and every frame ends in a 16-bit CRC. Modbus TCP is for an IP network: a client connects to the device's IP address on port 502, and a 7-byte MBAP header takes the place of the serial address and the CRC. For an existing site, the choice usually follows the interface that the equipment already has.

This guide is part of the Modbus and RS-485 series.

Modbus TCP vs RTU: the differences

The RS-485 vs Modbus guide explains the serial layer under Modbus RTU, and how RS-232 differs. The function codes (03 read holding registers, 04 read input registers, 06 and 16 write) are the same in both. So are the data types, word order and scaling. The register map guide covers those.

How the Modbus TCP protocol works

Modbus TCP carries the Modbus application protocol in TCP/IP packets. A client, such as a SCADA system, a BMS or a gateway, opens a TCP connection to a server, such as a meter or a PLC, and sends requests over it. The server answers each request and never sends data unasked. Older documents call the client the master and the server the slave.

A server listens on TCP port 502, which IANA registers for Modbus. Some devices let you change the port, and some serial gateways use a different port for each serial line. A client can keep one connection open for many requests. A server accepts connections from several clients, up to its own limit.

Data tables and function codes

Every Modbus device, on TCP or RTU, presents its data in four tables:

Energy meters publish their readings in input registers or holding registers. A 32-bit value, such as a floating-point voltage or an energy counter, uses two consecutive registers, and the register map gives the order of the two. The frame carries a zero-based address, so the holding register that a manual calls 40108 is address 107 (0x006B). The Modbus address converter converts between the two notations.

Frames compared

A request to read three holding registers from address 0x006B, on device 17, looks like this in each variant:

In the TCP frame, the first seven bytes are the MBAP header: a transaction identifier (0x0001), the protocol identifier (always 0 for Modbus), the length of what follows (6 bytes) and the unit identifier (0x11). The protocol data unit after the header is identical. The Modbus CRC and LRC calculator computes the RTU check bytes:

The server's reply repeats the MBAP header with its own length, then the function code, a byte count and the register values. If the three registers hold 555, 0 and 100, the Modbus TCP reply is:

00 01 00 00 00 09 11 03 06 02 2B 00 00 00 64

The length is now 9 bytes: the unit identifier, the function code, the byte count and 6 bytes of data. When a device cannot carry out a request, it returns an exception: the function code with its highest bit set (0x83 for function 03), then an exception code. Code 02, illegal data address, usually means a wrong address or a read that runs past the end of a block:

00 01 00 00 00 03 11 83 02

The Modbus function and exception codes explains each code.

One meter reading over RTU and over TCP

Eastron sells its SDM630 three-phase meter with RS-485, as the SDM630-Modbus, and with Ethernet, as the SDM630-TCP. Both protocol documents give phase 1 line-to-neutral voltage at input register reference 30001, protocol address 0, as a 32-bit float in two registers read with function 04. The protocol data unit is 04 00 00 00 02 on both:

A reply of 43 66 00 00 in the data is 230.0 V when the high word comes first; the Modbus register decoder shows the other word orders. Eastron publishes a separate register table for each model, so check every point against the table for the model on site rather than assuming the serial map carries over.

Timing and throughput

On an RTU bus, one request is in progress at a time. The time per request is the time on the wire for the request and the response, plus the device's response time, plus the gap between frames. At 9,600 baud with even parity, each character takes 11 bits, so one byte takes about 1.15 ms. The Modbus serial guide fixes the frame gap at 1.75 ms above 19,200 baud. The Modbus RTU timing calculator adds it up for a whole bus:

The polling and retries guide shows what one offline device does to that cycle. On Modbus TCP, the network is rarely the limit. The device's own processing time and its limit on simultaneous connections usually are. Many meters accept only a few TCP connections at once, and some accept one. Check the limit before several systems poll the same meter.

Test a Modbus TCP connection

Check the connection one layer at a time, so that each failure points to one cause:

1. Read the device's IP address, subnet mask and default gateway on its display or in its configuration tool. Check that the client is on the same subnet, or that a router and the firewall allow the traffic.
2. From a computer on that network, check that TCP port 502 accepts a connection. On macOS or Linux, nc -vz 192.0.2.10 502 reports whether the port is open (use the device's own address).
3. With a Modbus client, read one register whose value you can see on the device display, such as a phase voltage. Use the unit identifier given in the manual.
4. Compare the value, its scaling and its unit with the display. Then add the rest of the register map.
5. If the port opens but every read times out, check the unit identifier, and check whether another client holds the only connection that the device accepts.

Modbus RTU to TCP: gateways and unit identifiers

A serial-to-Ethernet gateway lets Modbus TCP clients reach RTU devices. The client sends a TCP request to the gateway's IP address, with the serial device's address in the unit identifier. The gateway sends the request on the bus, waits for the response and returns it over TCP.

Three points need care:

• Unit identifier for direct TCP devices. The Modbus TCP guide says that the unit identifier is not used when the server is addressed by its IP address, and recommends 0xFF. Many devices ignore it; some require 1 or their own serial address. Use the value in the device manual.
• Timeouts. The client's TCP timeout must be longer than the gateway's serial timeout plus the time the gateway waits for other requests on the bus. Otherwise the client gives up while the gateway is still waiting.
• RTU over TCP. Some converters pass RTU frames, with the CRC and without the MBAP header, straight through a TCP connection. This is not Modbus TCP, and the client must be set for it. The protocol gateway guide explains the difference between a bridge and a translating gateway, and the Modbus and BACnet gateway guide how to choose one.

Record, for each point, the IP address, port, unit identifier and the physical device that answers. After a gateway is replaced, the routing is the first thing to check.

Modbus TCP or RTU: choosing for a site

Choose the transport that the equipment already has:

For both variants, get the register map for the exact model and firmware before you choose hardware. "Modbus supported" does not tell you which values the device publishes.

Security

Modbus TCP and Modbus RTU have no authentication and no encryption. Any client that can reach port 502 can read and, where the device allows it, write. Protect them with the network design: a separate network or VLAN for control equipment, firewall rules that allow only the systems that need access, and no exposure to the internet.

The Modbus Organization publishes a separate Modbus Security protocol, which wraps Modbus in TLS with X.509 certificates on port 802. Both ends must support it. A gateway in front of a plain Modbus device does not make the device secure; it only moves the boundary.

Test reads before any write. Treat writes as a separate, approved step with the equipment owner.

Modbus TCP and RTU with Edge

Edge on the ZGW-20 Gateway is a Modbus client for both variants. It polls Modbus TCP devices on the site network, including RTU-over-TCP converters, and Modbus RTU devices on a serial port: the RS-485 input of the I/O board on the Industrial version, or a USB serial adapter. Each connection has its own queue, timeouts and polling rate. For a meter where no data cable can reach the Gateway, a ZMB Modbus interface reads it over RS-485 and sends the registers over the Zigbee mesh. Edge also includes a Modbus server, so a BMS or SCADA system can read the site's data from the Gateway as Modbus TCP registers on port 10502. The Modbus and BACnet gateway guide compares this with a dedicated protocol converter. To try Edge with one meter first, a Raspberry Pi set up with System Manager runs it with one Modbus device of up to 32 registers licensed free; see evaluate Edge on a Raspberry Pi. The Modbus RS-485 commissioning guide covers the serial side in detail.