In short: Modbus is a 1979 request-response protocol in which one master polls slaves that expose four simple tables (coils, discrete inputs, input registers, holding registers), and it dominates industrial automation because it is tiny, open, royalty-free and trivially implemented on anything from an 8-bit MCU to a PLC.
Why a 1979 protocol still runs the factory floor
Modicon introduced Modbus to let its PLCs talk over serial lines. The specification is only a few dozen pages, was published openly, and carries no licence fee. That combination matters more than technical elegance: a firmware engineer can implement a working slave in a weekend, a drive, energy meter, flow meter and VFD from five different vendors will all speak it, and a laptop with a USB-RS485 dongle can debug any of them. Newer fieldbuses such as PROFIBUS, EtherCAT or PROFINET are faster and deterministic, but they need certified stacks and often dedicated silicon. Modbus needs a UART and a CRC routine.
Interviewers like this question because it exposes whether you understand the trade: Modbus gives up everything fancy (no discovery, no data typing, no events) in exchange for universality. If you also work on SoC or MCU design, think of it as the protocol equivalent of a memory-mapped register file: simple, flat and everywhere. For the serial framing details see our companion piece on Modbus RTU.
The master-slave (client-server) model
Only one device initiates a transaction. The master sends a request addressed to a single slave; that slave executes it and returns a response. Slaves never speak unless spoken to. On a serial RS-485 multidrop bus the slave ID is a single byte: 1 to 247 are valid unit addresses, 0 is broadcast (write-only, nobody answers), and 248 to 255 are reserved. On Modbus TCP the same roles are renamed client and server, the server listens on TCP port 502, and the unit ID is mostly a routing hint for gateways that bridge to serial lines.
Key fact: a Modbus slave can never raise an alarm on its own. If a tank level crosses a limit, the master finds out only at its next poll, so poll period equals worst-case alarm latency.
The four address spaces
Modbus defines its data model as four tables inside each slave. Two hold single bits, two hold 16-bit words, and each has a different access right:
| Table | Size | Access | Read FC | Write FC | Classic range |
|---|---|---|---|---|---|
| Coils | 1 bit | Read/write | 01 | 05, 15 | 00001-09999 |
| Discrete inputs | 1 bit | Read-only | 02 | none | 10001-19999 |
| Input registers | 16 bit | Read-only | 04 | none | 30001-39999 |
| Holding registers | 16 bit | Read/write | 03 | 06, 16 | 40001-49999 |
Think of coils as relay outputs you can command (start motor, open valve) and discrete inputs as physical digital inputs (limit switch, door contact). Input registers carry measurements such as a 12-bit ADC result, while holding registers carry setpoints and configuration, such as a PID setpoint or a drive's acceleration time. The tables may overlap in a real device or be wholly separate; the function code, not the number, chooses the table.
Key fact: the "4xxxx" numbers are a documentation convention only. On the wire, holding register 40001 is sent as address 0x0000. Mixing up this off-by-one is the most common field bug.
Anatomy of a transaction
The unit that matters is the PDU (protocol data unit): one function-code byte plus data, at most 253 bytes. Wrapping it for the wire gives the ADU. On RTU you add a slave address in front and a CRC-16 at the back (max 256 bytes). On TCP you prepend a 7-byte MBAP header containing a transaction ID, protocol ID (0), length and unit ID, and drop the CRC because TCP already guarantees integrity.
Example: read two holding registers starting at 40101 from slave 17. The request PDU is 03 00 64 00 02: function 3, start address 100 (0x0064), quantity 2. A valid response is 03 04 xx xx yy yy: function, byte count 4, then the two words, high byte first (big-endian). Limits are fixed by the PDU size: at most 125 registers per FC03/04 read and 2000 bits per FC01/02 read.
Watch it poll
The animation below shows the rhythm of a poll cycle: the master sends a request, the addressed slave answers, then the master moves on to the next device.
Errors, data types and real-world gotchas
When a slave cannot satisfy a request it replies with the function code OR'd with 0x80 plus an exception code. The common ones: 01 illegal function, 02 illegal data address (outside the slave's table), 03 illegal data value, 04 slave device failure. Exception 02 is what you see when you request address 40101 on a device that exposes only 100 registers. No response at all means a timeout: wrong baud rate, parity mismatch, missing RS-485 termination or a duplicate slave ID.
Modbus has no data types, only 16-bit words. A 32-bit float, such as a power-meter reading, spans two consecutive registers, and vendors disagree on word order: ABCD, CDAB and so on. Read the vendor register map carefully and confirm with a known value. Scaling is by convention too: 235 may mean 23.5 degrees C. Security is absent as well; Modbus TCP has no authentication, so keep it behind firewalls or use the TLS-wrapped variant defined by the Modbus Organization.
- Poll fast data (drive speed) more often than slow data (energy totals) and group adjacent registers into one block read to save turnaround time.
- At 9600 baud a character takes about 1.15 ms, so a 100-register read response is roughly 205 bytes, near 235 ms. Throughput, not CPU, is the bottleneck.
- Prefer TCP when you need many devices and speed; prefer RTU over RS-485 for cheap, long (up to about 1200 m) runs.
Key fact: a typical RS-485 segment supports 32 unit loads, extended to 256 nodes with modern low-load transceivers, although 247 addresses is the protocol ceiling.
Why it dominates, and where it fits
Modbus wins on ecosystem. Every HMI, SCADA package, gateway and open-source library speaks it, so it becomes the lowest common denominator for integration. Engineers building embedded products often add a Modbus slave to a custom board so customers can connect it to existing PLCs; if you need help with the board or firmware, the design team at Avecas does exactly this kind of silicon-to-system work. It is not suited to high-speed motion control, where deterministic protocols take over. For a comparison with another simple serial scheme, read our overview of UART, which sits underneath Modbus RTU.
Want to go deeper into industrial and embedded communication? Explore the hands-on CourseTron protocol courses and build your own Modbus slave from scratch.
FAQ
What is the difference between a coil and a discrete input?
Both are single bits, but a coil is read/write (an output you can command) while a discrete input is read-only (a physical input state).
What is the difference between input and holding registers?
Input registers are 16-bit read-only values, typically measurements. Holding registers are 16-bit read/write values, typically setpoints and configuration.
Can a Modbus slave send data without being asked?
No. Only the master initiates transactions, so slaves must be polled to report any change.
Is Modbus TCP the same as Modbus RTU?
The PDU is identical, but TCP replaces the slave address and CRC with a 7-byte MBAP header and relies on TCP for error detection.