Modbus TCP vs Modbus RTU

A meter on an RS-485 trunk and the same meter with an Ethernet port answer the same Modbus requests from the same register map. Only the transport differs: Modbus RTU on the serial line, Modbus TCP on the IP network. For an existing site, the choice usually follows the interface that the equipment already has.

This guide is part of the Modbus and RS-485 series.

Side by side

The RS-485 vs Modbus guide explains the serial layer under Modbus RTU, and how RS-232 differs. The function codes (03 read holding registers, 04 read input registers, 06 and 16 write) are the same in both. So are the data types, word order and scaling. The register map guide covers those.

Frames compared

A request to read three holding registers from address 0x006B, on device 17, looks like this in each variant:

In the TCP frame, the first seven bytes are the MBAP header: a transaction identifier (0x0001), the protocol identifier (always 0 for Modbus), the length of what follows (6 bytes) and the unit identifier (0x11). The protocol data unit after the header is identical. The Modbus CRC and LRC calculator computes the RTU check bytes:

Timing and throughput

On an RTU bus, one request is in progress at a time. The time per request is the time on the wire for the request and the response, plus the device's response time, plus the gap between frames. At 9,600 baud with even parity, each character takes 11 bits, so one byte takes about 1.15 ms. The Modbus serial guide fixes the frame gap at 1.75 ms above 19,200 baud. The Modbus RTU timing calculator adds it up for a whole bus:

The polling and retries guide shows what one offline device does to that cycle. On Modbus TCP, the network is rarely the limit. The device's own processing time and its limit on simultaneous connections usually are. Many meters accept only a few TCP connections at once, and some accept one. Check the limit before several systems poll the same meter.

Unit identifiers and gateways

A serial-to-Ethernet gateway lets Modbus TCP clients reach RTU devices. The client sends a TCP request to the gateway's IP address, with the serial device's address in the unit identifier. The gateway sends the request on the bus, waits for the response and returns it over TCP.

Three points need care:

• Unit identifier for direct TCP devices. The Modbus TCP guide says that the unit identifier is not used when the server is addressed by its IP address, and recommends 0xFF. Many devices ignore it; some require 1 or their own serial address. Use the value in the device manual.
• Timeouts. The client's TCP timeout must be longer than the gateway's serial timeout plus the time the gateway waits for other requests on the bus. Otherwise the client gives up while the gateway is still waiting.
• RTU over TCP. Some converters pass RTU frames, with the CRC and without the MBAP header, straight through a TCP connection. This is not Modbus TCP, and the client must be set for it. The protocol gateway guide explains the difference between a bridge and a translating gateway.

Record, for each point, the IP address, port, unit identifier and the physical device that answers. After a gateway is replaced, the routing is the first thing to check.

Choosing for a site

Choose the transport that the equipment already has:

For both variants, get the register map for the exact model and firmware before you choose hardware. "Modbus supported" does not tell you which values the device publishes.

Security

Modbus TCP and Modbus RTU have no authentication and no encryption. Any client that can reach port 502 can read and, where the device allows it, write. Protect them with the network design: a separate network or VLAN for control equipment, firewall rules that allow only the systems that need access, and no exposure to the internet.

The Modbus Organization publishes a separate Modbus Security protocol, which wraps Modbus in TLS with X.509 certificates on port 802. Both ends must support it. A gateway in front of a plain Modbus device does not make the device secure; it only moves the boundary.

Test reads before any write. Treat writes as a separate, approved step with the equipment owner.

Modbus TCP and RTU with Edge

Edge on the ZGW-20 Gateway is a Modbus client for both variants. It polls Modbus TCP devices on the site network, including RTU-over-TCP converters, and Modbus RTU devices on a serial port of the Gateway. Each connection has its own queue, timeouts and polling rate. For a meter where no data cable can reach the Gateway, a ZMB Modbus interface reads it over RS-485 and sends the registers over the Zigbee mesh. Edge also includes a Modbus server, so a BMS or SCADA system can read the site's data from the Gateway as Modbus TCP registers. The Modbus RS-485 commissioning guide covers the serial side in detail.