In short: Modbus is a 1979 request/response protocol from Modicon in which one master polls slaves that expose numbered coils and registers, and it survives today in three flavours: compact binary RTU and readable ASCII over serial lines, and TCP over Ethernet on port 502.
Where Modbus came from
In 1979 Modicon, the company behind the first commercial PLC, needed a way for its 84-series controllers to talk to each other and to programming terminals over an ordinary serial line. The result was Modbus. Its design goals were modest: be trivial to implement on an 8-bit microcontroller, need no special silicon, and describe every device in the same simple way. Modicon later passed to Schneider Electric, which transferred the specification to the independent Modbus Organization in 2004 and published it royalty-free. That openness is the main reason a protocol older than most of its users still ships on energy meters, VFDs, flow computers, BMS controllers and solar inverters.
Key fact: Modbus does not define a physical layer. The spec describes the application protocol; RS-485 and RS-232 serial lines and Ethernet are carried underneath it. This is why you will see "Modbus over RS-485" so often.
The master/slave idea
Modbus is strictly request/response. A single master (the newer spec says "client") initiates every transaction; slaves ("servers") never speak unless spoken to. On a serial bus each slave has an address from 1 to 247, and address 0 is broadcast, which gets no reply. The master sends a request addressed to one slave, that slave answers, and only then can the next request go out.
Because all nodes share two wires, an RS-485 segment is half-duplex: a slave must enable its transmitter only for its own reply. Typical limits are 32 unit loads per segment (more with modern low-load transceivers), about 1200 m at 9600 baud, and 120 Ω termination at both ends of the line. Wrong termination or a missing bias network is the number one cause of "it works on the bench but not in the plant".
What a slave actually exposes
Modbus models a device as four tables of numbered items. It knows nothing about "temperature" or "motor speed"; the vendor's register map says which number means what.
| Table | Size | Access | Read / write function codes |
|---|---|---|---|
| Coils | 1 bit | read/write | 01 / 05, 15 |
| Discrete inputs | 1 bit | read-only | 02 |
| Input registers | 16 bit | read-only | 04 |
| Holding registers | 16 bit | read/write | 03 / 06, 16 |
The function code tells the slave what to do. If a slave cannot comply it replies with the same code with bit 7 set (for example 0x83) followed by an exception code: 01 illegal function, 02 illegal data address, 03 illegal data value, 04 slave device failure.
Interview trap: documentation often says "register 40001", but on the wire that is holding register address 0. Forgetting the off-by-one (and the 4xxxx prefix) is the classic reason a read returns exception 02 or the wrong value. A 32-bit float spans two registers, and word order (big or little) is not standardized, so always check the vendor manual.
RTU: the compact serial variant
RTU sends raw binary bytes, usually 8 data bits with even parity and one stop bit (8E1) or no parity with two stops (8N2). A frame is: slave address (1 byte), function code (1), data (0 to 252) and a CRC-16 (2, low byte first). Frames are separated by silence, not by a marker character: at least 3.5 character times of idle line ends a frame. At 9600 baud one character is 11 bits, about 1.146 ms, so the gap is roughly 4 ms; above 19200 baud the spec simply fixes it at 1.75 ms. The CRC uses the reflected polynomial 0xA001 with initial value 0xFFFF.
A real example: to read two holding registers starting at address 0 from slave 1, the master sends 01 03 00 00 00 02 C4 0B. A typical reply is 01 03 04 00 0A 00 14 xx xx: four data bytes carrying the values 10 and 20.
uint16_t crc16(const uint8_t *p, int n) {
uint16_t crc = 0xFFFF;
while (n--) {
crc ^= *p++;
for (int i = 0; i < 8; i++)
crc = (crc & 1) ? (crc >> 1) ^ 0xA001 : crc >> 1;
}
return crc; /* send low byte first */
}ASCII and TCP
Modbus ASCII encodes every byte as two hex characters, starts the frame with a colon, ends it with CR LF, and swaps the CRC for a one-byte LRC (two's complement of the byte sum). It is twice as long as RTU and slower, but because frames are delimited by characters, it tolerates gaps of up to a second. That made it handy on radio and modem links and on slow software UARTs, where the 3.5-character timing of RTU is hard to meet.
Modbus TCP drops the slave address and CRC from the front and tail, since TCP already guarantees integrity, and prefixes a 7-byte MBAP header: transaction ID (2 bytes), protocol ID (2, always 0), length (2) and unit ID (1). Servers listen on TCP port 502. The unit ID matters only when a gateway forwards the request to serial slaves behind it.
A request in motion
Strengths, limits and what to use today
- Strengths: a one-page spec, free of licence, runs on tiny MCUs, and every PLC, SCADA and gateway speaks it.
- No security: no authentication or encryption; any host reaching port 502 can write coils. Keep it on isolated VLANs or wrap it in Modbus/TCP Security (TLS, port 802).
- No push: slaves cannot report events, so polling rate caps latency. 20 slaves at 9600 baud, each answering about 25 bytes, leaves roughly 50 ms per transaction, so one scan takes about a second.
- Small payloads: a PDU is limited to 253 bytes, so a single read returns at most 125 registers.
For a deeper tour of function codes and exception handling, continue with our Modbus protocol article, and compare its polling model with the multi-master bus in CAN bus basics. If you want to build embedded firmware and verification skills around such interfaces, browse our courses; for hands-on RTL and embedded training in India see ChipXpert.
Ready to go from protocol basics to designing real embedded and VLSI systems? Explore the CourseTron courses and start building today.
FAQ
Is Modbus still relevant?
Yes. Its simplicity and free licensing keep it in new meters, drives and inverters, and most industrial gateways translate newer protocols into Modbus for legacy SCADA.
What is the difference between RTU and ASCII?
RTU sends binary bytes with a CRC-16 and uses idle-time framing; ASCII sends hex characters with a colon start, CRLF end and an LRC checksum. RTU is about twice as efficient.
Can a Modbus network have multiple masters?
Not on one serial bus; only one master may initiate requests. On Modbus TCP multiple clients can connect to a server, though many devices limit the number of simultaneous connections.
Why does Modbus TCP have no CRC?
TCP and the Ethernet frame check already protect the data, so the MBAP header replaces the address and checksum with transaction, protocol, length and unit fields.