What is Modbus? RTU vs TCP, registers and function codes

Modbus is an open communication protocol for industrial devices; Modbus RTU runs on serial lines such as RS-485 with a CRC check, while Modbus TCP runs on Ethernet TCP/IP on port 502. The Modbus Organization describes it as the serial de facto standard of the industry since 1979, in the Modbus Application Protocol Specification V1.1b3.

At a fuel terminal, Modbus carries readings from automatic tank gauges (ATG), flow meters, motor-operated valves (MOV) and power meters into PLC, SCADA and tank management software. Modbus moves numbers, not meaning. The register map published by each device maker says what every number is, in which unit and in which format.

Modbus stays common because it is simple to implement, the specifications are free to download, and almost every PLC, gateway and SCADA package can speak it. The price of that simplicity is that Modbus knows nothing about units, quality flags or security. Those gaps are filled by documentation, network design and, where needed, newer protocols such as OPC UA or MQTT on top.

For a terminal team, understanding Modbus means being able to read vendor documents, check gateway settings and tell a cable fault from a configuration error. That basic skill shortens fault finding when tank data or valve status suddenly freezes on the operator screen.

Modbus works like a roll call: one device asks a question and only the addressed device answers.

The specification places Modbus at the application layer (layer 7 of the OSI model) as a request/reply protocol. The device that asks is the client, called the master on a serial line. The device that answers is the server, called the slave on a serial line. A server never sends data on its own, which keeps the protocol small and the polling cycle predictable.

Each request carries a function code that says what to do, such as read registers or write a coil, and a data field that says where and how much. The server returns the data or an exception response. That response repeats the function code plus 0x80 and adds a one-byte exception code that explains the refusal.

In a typical terminal, a SCADA server or an industrial gateway is the client. It polls each device in turn: tank gauges, flow computers, valve actuators, power meters. Poll time grows with the number of devices and registers, so the polling list deserves the same design attention as the cabling.

On a serial line the client may also send a broadcast with address 0. Every server acts on it and none replies, so broadcasts suit writing commands only. After a broadcast the client waits a turnaround delay before the next request. The serial specification gives 100 to 200 ms as typical for that delay, and a response timeout of one to several seconds at 9600 baud for normal requests.

Modbus RTU and Modbus TCP carry the same requests; the difference is the cable underneath and the way each frame is wrapped.

Modbus RTU sends binary frames over a serial line, usually two-wire RS-485. A frame starts with the server address, then the function code, the data and a 16-bit CRC. The Modbus over Serial Line specification V1.02 sets addresses 1 to 247 for servers and reserves 0 for broadcast. Frames are separated by a silence of at least 3.5 character times, and the default format is 8 data bits with even parity.

Modbus TCP puts the same protocol data unit (PDU) inside a TCP/IP packet. The serial address and the CRC disappear. A 7-byte MBAP header takes their place, with a transaction identifier, a protocol identifier, a length field and a unit identifier. The Messaging on TCP/IP Implementation Guide reserves port 502, and IANA registers that port as mbap.

Choose by topology, not by habit. RS-485 suits a string of field devices spread over hundreds of metres on one pair of wires. Ethernet suits panels and servers that already share a network, and lets several clients read the same device if the device accepts more than one connection.

Every device on one RTU line must share the same baud rate, parity and stop bits. The serial specification requires 9600 and 19200 baud, with 19200 as the default, and requires 2 stop bits when no parity is used. A third serial form, Modbus ASCII, sends readable characters with an LRC check; it still exists on older equipment but is rare in new terminals.

A register map is the dictionary of a device: it lists which address holds which value, in which format and unit.

Two conventions cause most first-day confusion. Many manuals write holding registers as 40001, 40002 and so on, a numbering inherited from Modicon controllers. The frame itself carries a zero-based address, so 40001 travels as 0. The example in the Application Protocol Specification reads registers 108 to 110 by sending a starting address of 107 (0x006B).

The second trap is the data type. A level sent as FLOAT32 needs both registers read in one request and decoded in the right word order. Read them in two requests and the halves may come from different scans. Integer registers often carry a scale factor that the client must apply before the value reaches the operator screen.

Ask the vendor for the map that matches the installed firmware, not the brand brochure. INTEGRA TMS reads ATGs from Honeywell, Endress+Hauser and Tokyo Keiso, and two gauges from the same maker can still expose different maps.

A usable register map settles four points before anyone opens a laptop on site:

• Addressing: zero-based or one-based, and the table each address belongs to.
• Data type: INT16, UINT16, INT32 or FLOAT32, and the word order of every 32-bit value.
• Unit and scale: the engineering unit, the scale factor, and the value that means "no reading" or "gauge fault".
• Write access: which registers may be written, and what the device does when they are.

A function code is the verb of a Modbus request: one byte that tells the server whether to read or write, and which table to use.

Eight public codes cover almost all field integration work. Other codes, such as serial diagnostics or file record access, are rarely needed for tanks, meters and valves. The Application Protocol Specification limits each read: up to 2000 coils or discrete inputs, and up to 125 registers with function codes 03 and 04. Function code 16 writes up to 123 registers in one frame.

When a device refuses a request, it answers with the function code plus 0x80. Exception 01 means the function is not supported and 02 means the address does not exist. Exception 03 means a value in the request is invalid, and 04 means the device failed while executing it. Gateways add 0A and 0B when the path or the device behind them does not answer.

Treat write codes with care on a live plant. Function codes 05, 06, 15 and 16 change outputs and setpoints immediately, with no confirmation step inside the protocol. Agree in the design which registers a client may write, test writes during a work window, and keep commands for valves and pumps behind the interlocks of the control system.

A Modbus gateway is a translator that lets a TCP client on the network read RTU devices on a serial line.

The gateway receives a Modbus TCP request, uses the unit identifier to pick the serial device, sends the RTU frame on RS-485, waits for the reply and returns it over TCP. Common reasons to add one: the SCADA server has no serial port, several systems need the same field data, or the serial line ends far from the control room. At fuel terminals the gateway usually sits in a field panel near the devices or in the server room, depending on the serial cable length and the network available.

A gateway brings its own settings and its own failure point. Timeouts on the TCP side must be longer than the serial response time, or the client gives up while the gateway is still waiting. Exception 0A (path unavailable) and 0B (target failed to respond) come from the gateway itself, which helps separate a network fault from a dead field device.

Not every serial-to-Ethernet box is a Modbus gateway. A serial device server in transparent mode only tunnels bytes, so the client still speaks Modbus RTU, CRC included, through a virtual COM port or a raw TCP socket. A Modbus gateway converts between RTU and TCP framing. Check which mode the box runs in before blaming the field device.