Modbus is a request and response protocol for reading and writing numbers in field devices. A client, such as a gateway, a PLC or a SCADA system, sends a request to one server, such as an energy meter. The request names a table, a start address and a quantity, and the server replies with the values or an error. Modicon published Modbus in 1979 for its PLCs, and the Modbus Organization now maintains the specifications free of charge. It runs on a serial line as Modbus RTU and on Ethernet as Modbus TCP, and it is still the most common way to read meters, inverters, drives and plant controllers.
How Modbus works at a glance
| Part | What it is | Example |
|---|---|---|
| Client (master) | The device that sends every request and polls in a loop | A Gateway, a PLC or a SCADA server |
| Server (slave) | The device that holds the data and answers when addressed | An energy meter or an inverter |
| Address | Which server the request is for | 1 to 247 on a serial line; an IP address and a unit identifier on TCP |
| Function code | What the request does | 04, read input registers |
| Data address and quantity | Which entries in the table, and how many | Start at 0, read 2 registers |
| Register map | The manufacturer's list of what each address means | Input register 0: L1 voltage, 32-bit float, volts |
| Error check | Proof that the frame arrived intact | A 16-bit CRC on RTU; the TCP checks on Modbus TCP |
The specification separates the protocol data unit (PDU), which is the function code and its data, from the application data unit (ADU), which adds the address and the error check for one transport. The PDU is the same on every transport, which is why a gateway can pass a request from Modbus TCP to Modbus RTU without changing its meaning. The Modbus TCP vs RTU guide compares the two transports in detail.
The Modbus data model: four tables
A Modbus server exposes four tables. Each entry has an address from 0 to 65,535, and each table has its own function codes:
| Table | Size of an entry | Access | Read with | Write with |
|---|---|---|---|---|
| Coils | 1 bit | Read and write | 01 | 05, 15 |
| Discrete inputs | 1 bit | Read only | 02 | None |
| Input registers | 16 bits | Read only | 04 | None |
| Holding registers | 16 bits | Read and write | 03 | 06, 16 |
A register holds one 16-bit word. Anything larger is spread over consecutive registers: a 32-bit float or integer takes two, a 64-bit energy counter takes four. The protocol does not say which word comes first, and meter manufacturers use both orders. Values are often scaled integers too, so a register that reads 2302 can mean 230.2 V. The register map guide explains how to read a map row, the 30001 and 40001 conventions and word order.
Manufacturers choose which table to use. Many meters put measurements in input registers and configuration in holding registers. Others put everything in holding registers, so function 03 reads the measurements as well. The register map for the exact model and firmware is the only reliable guide.
Modbus function codes
The function code is the first byte of every PDU. These are the ones you meet on meters and controllers:
| Code | Name | Typical use |
|---|---|---|
| 01 (0x01) | Read coils | Relay and output states |
| 02 (0x02) | Read discrete inputs | Contact and alarm states |
| 03 (0x03) | Read holding registers | Settings, and measurements on many meters |
| 04 (0x04) | Read input registers | Measurements on many meters |
| 05 (0x05) | Write single coil | Switch a relay on or off |
| 06 (0x06) | Write single register | Change one setpoint |
| 15 (0x0F) | Write multiple coils | Set several outputs at once |
| 16 (0x10) | Write multiple registers | Write a 32-bit setpoint or a block of settings |
| 23 (0x17) | Read/write multiple registers | Write and read back in one transaction |
| 43/14 (0x2B/0x0E) | Read device identification | Vendor name, product code and firmware revision |
One read can return up to 125 registers or 2,000 coils, and one write can carry up to 123 registers. These limits come from the 253-byte PDU. Reading a block of neighbouring registers in one request is much faster than reading them one at a time, but many meters reject a block that crosses a gap in their map.
When a server receives a valid frame that it cannot carry out, it replies with an exception: the function code with its top bit set (0x83 for a failed function 03) and one exception code. The Modbus function and exception codes tool lists them all.
| Exception | Meaning | Usual cause on site |
|---|---|---|
| 01 Illegal function | The server does not support this function code | Function 03 sent to a meter that uses 04 |
| 02 Illegal data address | The address or the block is outside the map | An off-by-one address, or a block across a gap |
| 03 Illegal data value | The quantity or the value is not allowed | Too many registers in one request |
| 04 Server device failure | The server failed while doing the request | A device fault |
| 0A, 0B Gateway path or target failed | A gateway could not reach the serial device | Wrong unit identifier or a dead serial bus |
No reply at all is different from an exception. A timeout means the request never reached the server or the reply never came back: wiring, serial settings, address or a network problem. The Modbus troubleshooting guide works through both cases.
Modbus RTU, ASCII and TCP
| Modbus RTU | Modbus ASCII | Modbus TCP | |
|---|---|---|---|
| Transport | Serial line, usually RS-485 | Serial line | Ethernet or any IP network |
| Encoding | Binary | Hexadecimal characters | Binary |
| Frame start and end | 3.5 character times of silence | A colon, then CR LF | Length field in the MBAP header |
| Error check | CRC-16 | LRC | None in Modbus; TCP and Ethernet check the data |
| Addressing | Server address 1 to 247 | Server address 1 to 247 | IP address, plus a unit identifier |
| Clients | One per bus | One per bus | Several, if the server accepts them |
| Default settings | 19,200 baud, even parity, 1 stop bit | 19,200 baud, 7 data bits, even parity | TCP port 502 |
Modbus RTU is by far the most common on meters. Modbus ASCII is rare in new equipment. Modbus TCP wraps the same PDU in a 7-byte MBAP header: a transaction identifier, a protocol identifier of 0, a length, and the unit identifier. On a device that is itself on Ethernet, the unit identifier is usually ignored or set to 1 or 255. On a TCP to RTU gateway, it selects the serial device. The RS-485 vs Modbus guide explains why RTU and RS-485 are two layers, not two names for one thing.
Worked example: reading voltage from a meter
The Eastron SDM630 register map puts phase 2 line-to-neutral voltage at input register 30003, a 32-bit float in volts. 30003 is the third input register, so the request carries address 2 and asks for two registers (one float). For a meter at address 1, the Modbus RTU request is eight bytes:
| Byte | Value | Meaning |
|---|---|---|
| 1 | 01 | Server address 1 |
| 2 | 04 | Function 04, read input registers |
| 3 and 4 | 00 02 | Start address 2 (register 30003) |
| 5 and 6 | 00 02 | Quantity: 2 registers |
| 7 and 8 | D0 0B | CRC-16, low byte first |
The meter replies 01 04 04 43 67 99 9A B5 E4: address 1, function 04, 4 data bytes, the two registers 0x4367 and 0x999A, and the CRC. Decoded as an IEEE 754 float with the high word first, 0x4367999A is 231.6 V. You can check the CRC of any frame with the CRC calculator:
The same read over Modbus TCP has no CRC. The client sends 00 01 00 00 00 06 01 04 00 02 00 02: transaction 1, protocol 0, 6 bytes to follow, unit identifier 1, and the same PDU. The meter replies 00 01 00 00 00 07 01 04 04 43 67 99 9A: the same transaction, 7 bytes to follow (the unit identifier and the 6-byte PDU) and the same data. If the meter had answered 01 84 02 instead, that is exception 02: the address is not in its map.
What Modbus does not do
Modbus moves numbers. It does not carry:
- Units or scaling. 2302 means nothing without the register map's "V × 0.1".
- Timestamps. A reading is as old as the poll that fetched it. The client has to record the time it received each value.
- Quality. A meter that has lost its voltage input may still return 0 V with no error. Some maps offer status words or "not available" values such as 0xFFFF or NaN; the client has to check them.
- Events. A server cannot send anything on its own. A change is seen only at the next poll, so the poll interval sets the latency.
- Security. Plain Modbus has no login and no encryption. Run it only on a network where every connected device is trusted, and separate it from office and internet traffic.
These gaps are why a gateway that reads Modbus usually adds the time, the unit and a quality flag before it sends the reading on, for example over MQTT or OPC UA. They also explain why the same devices often appear in a BACnet vs Modbus comparison: BACnet objects carry units and status flags that Modbus registers do not.
Polling and timing
On a serial bus, only one transaction can be in progress at a time. At 9,600 baud each 11-bit character takes about 1.15 ms. A request of 8 bytes and a 40-register reply of 85 bytes take about 106.6 ms on the wire, and the two silent intervals of 3.5 characters bring that to 114.6 ms. Add the meter's response time, typically 20 to 50 ms, and each transaction takes 135 to 165 ms. Ten meters with three blocks each take about 4 to 5 seconds per cycle. Higher baud rates and fewer, larger blocks make the cycle shorter. The Modbus RTU timing calculator gives the figures for any setting, and the commissioning guide works through a polling budget for a real bus.
Modbus TCP is faster per transaction, but a gateway in front of a serial bus still sends one request at a time on the serial side. Several TCP clients that poll the same gateway share its serial cycle.
Modbus with EpiSensor
Edge on the ZGW-20 Gateway is a Modbus client. It reads Modbus TCP devices on the site network, and Modbus RTU devices on the RS-485 input of the I/O board on the Industrial version of the Gateway, or a USB serial adapter. It records each value with its time, unit and status, and it can serve selected values to a BMS or SCADA system as Modbus TCP registers. Where a meter is far from the Gateway, the ZMB Modbus interface reads it on a short local RS-485 bus and sends the registers over the Zigbee mesh. The Device Directory lists meters and controllers with register maps and Edge templates, and the Modbus and BACnet gateways guide compares the Gateway with protocol converters.
Common questions
What is Modbus used for?
Modbus connects a controller, gateway or SCADA system to field devices such as energy meters, inverters, drives, PLCs and heat-pump controllers. The polling system reads values such as voltage, power and total kWh from the device's registers, and can write setpoints or commands where the device allows it.
Is Modbus a serial or an Ethernet protocol?
Both. Modbus RTU and Modbus ASCII run on a serial line, usually RS-485. Modbus TCP runs on Ethernet and IP networks on TCP port 502. The function codes and the data model are the same in all three; only the framing and the addressing change.
What are Modbus function codes?
A function code is the byte that says what the request does. The common ones are 01 read coils, 02 read discrete inputs, 03 read holding registers, 04 read input registers, 05 write a single coil, 06 write a single register, 15 write multiple coils and 16 write multiple registers. A server that cannot do the request replies with the function code plus 0x80 and an exception code.
What is the difference between a Modbus master and slave?
They are the old names for client and server. The master (client) sends every request, and a slave (server) only replies. The Modbus Organization now uses client and server, but many datasheets and configuration tools still say master and slave.
How many devices can be on a Modbus network?
On a serial line, a client can address servers 1 to 247. An RS-485 segment carries 32 unit loads without a repeater, or more with fractional-load transceivers. On Modbus TCP each device has its own IP address, and a gateway can reach up to 247 serial devices behind one IP address through the unit identifier.
Is Modbus secure?
Plain Modbus has no authentication or encryption: any client that can reach a device can read it and, where the device allows writes, change it. Keep Modbus TCP on a separated network or behind a gateway. The Modbus Organization also publishes Modbus/TCP Security, which adds TLS on port 802, but few field devices support it.