Modbus was published by Modicon in 1979 for its first programmable controllers, and every energy meter, drive, temperature controller, solar inverter, generator controller and PLC sold today still speaks it. It is simple enough to read on an oscilloscope and to implement on the smallest microcontroller, which is why it survived, and it is loose enough in its definitions that the same four things go wrong on almost every first commissioning: an address that is off by one, two 16-bit halves in the wrong order, a serial setting that does not match, and an RS-485 bus that is wired as a star or left unterminated. This guide covers the model, the frame, the wiring and those four mistakes.
The model: one master, many slaves, four tables
Modbus is a request and reply protocol. One device, the master, sends a request to one other device, the slave, identified by its unit ID, and that device alone replies. Slaves never speak unasked and never to each other. The Modbus Organization renamed the roles client and server in 2020 and the specifications now use those words; the field, and most device manuals, still say master and slave, and this guide uses both.
Every slave presents its data as four tables. Coils are single bits that can be read and written: a run command, a relay. Discrete inputs are single bits that can only be read: a switch state, a fault flag. Input registers are 16-bit words that can only be read: a measurement. Holding registers are 16-bit words that can be read and written: a setpoint, a configuration value, and in practice most measurements too, because many manufacturers put everything in holding registers. The tables are conventionally numbered by their first digit in the old Modicon scheme, 0xxxx for coils, 1xxxx for discrete inputs, 3xxxx for input registers and 4xxxx for holding registers, which is why a device manual says "register 40001". Each table can have up to 65 536 entries and each register is exactly 16 bits: there is no other data type in Modbus, and everything larger is built from pairs of registers by convention rather than by the standard.
The function codes you will meet
| Code | Name | Table | Limit per request |
|---|---|---|---|
| 01 | Read coils | coils (0x) | 2 000 bits |
| 02 | Read discrete inputs | discrete inputs (1x) | 2 000 bits |
| 03 | Read holding registers | holding registers (4x) | 125 registers |
| 04 | Read input registers | input registers (3x) | 125 registers |
| 05 | Write single coil | coils | 1 bit (value FF00 on, 0000 off) |
| 06 | Write single register | holding registers | 1 register |
| 15 (0x0F) | Write multiple coils | coils | 1 968 bits |
| 16 (0x10) | Write multiple registers | holding registers | 123 registers |
| 23 (0x17) | Read/write multiple registers | holding registers | read 125, write 121, in one exchange |
| 43/14 (0x2B) | Read device identification | — | vendor, product code, revision |
Addressing: the off-by-one that costs a day
The frame carries a 16-bit address that starts at zero. Device documentation, following Modicon's convention, numbers registers from one and prefixes the table: holding register 40001 is address 0 in the frame, 40002 is address 1, and 40108 is address 107. Some manuals give the frame address; some give the one-based register number; some give both in adjacent columns; some give the one-based number without the leading 4; and some say "address" and mean whichever the author had in mind. A master configured with 40001 where the frame wants 0, or with 107 where the manual said 108, reads the neighbour of every register, and a meter's voltage arrives looking like a plausible but wrong current.
The test that settles it takes a minute: poll a single register whose value you know, such as a device's serial number, its model code or the line voltage, at the documented address and at the address one lower, and see which returns the expected number. Do it before wiring the rest of the register map. Then write down, in the project's register list, whether every address in it is zero-based or one-based, because the next person will not know either.
Data types bigger than 16 bits: byte and word order
The standard says that a register is 16 bits sent high byte first, and says nothing about anything larger. A 32-bit float, a 32-bit integer for an energy total or a 64-bit counter is spread across two or four consecutive registers, and the order in which the halves are placed is the manufacturer's choice. The two common ones are big-endian, with the high word in the first register (ABCD when the four bytes are written out), and word-swapped, with the low word first (CDAB), which arises naturally from a little-endian processor writing its memory into consecutive registers. Byte-swapped variants (BADC and DCBA) exist but are rarer.
A swapped float is easy to recognise once you have seen one. A voltage of 230.0 is 43 66 00 00 as a big-endian float; read word-swapped it is 00 00 43 66, which decodes to 2.4 × 10−41. An energy total of 12 345.67 kWh is 46 40 E6 AE; swapped it is E6 AE 46 40, which decodes to −4.1 × 1023. A reading that should be in the hundreds and comes back as a number smaller than 10−30, or larger than 1020, or negative when it cannot be, is almost always a word-order problem, not a broken meter. Integers swap the same way: a 32-bit count of 100 000 (0001 86A0) read swapped is 86A0 0001, or 2 258 632 705. Every decent master has a setting for the order; find the manufacturer's statement of it, or find it by experiment on a value you know, and record it beside the address convention.
Modbus RTU: RS-485, the frame and the timing
RTU is the serial form, and on a plant it runs on two-wire RS-485. A frame is the unit ID, the function code, the data, and a 16-bit CRC, sent as raw bytes with no start or end character; the frame is delimited by silence. The serial-line specification requires a gap of at least 3.5 character times between frames and allows at most 1.5 character times between the bytes of one frame; at 9 600 baud a character (start bit, 8 data bits, parity, stop bit: 11 bits) takes 1.15 ms, so the inter-frame silence is 4 ms. Above 19 200 baud the specification fixes the two intervals at 1.75 ms and 750 µs, because most devices cannot time shorter periods reliably. A device that starts its reply too soon, or a master that sends the next request before the silence has elapsed, produces frames that run together and fail their CRC.
The CRC is CRC-16 with the polynomial 0x8005 in reflected form (0xA001), initial value 0xFFFF, sent low byte first. The request to read ten holding registers from address 0 on unit 1 is 01 03 00 00 00 0A C5 CD: unit 1, function 03, start address 0000, quantity 000A, CRC C5CD. The reply is 01 03 14, then 20 data bytes, then its own CRC: 25 bytes in all. The default serial format in the specification is 8 data bits, even parity, one stop bit (8E1) at 9 600 baud, with 19 200 also required; the most common setting in the field is 8N1, and the specification's remark that no parity should be paired with two stop bits is honoured by almost nobody. What matters is that every device on the bus is set the same: a mismatch of parity or stop bits does not stop communication outright, it produces a bus that works for some frames and fails for others, which is worse.
Unit IDs run from 1 to 247; 0 is a broadcast that every slave acts on and none answers, used for writes only; 248 to 255 are reserved. The master waits a configurable time for a reply, typically 100 ms to 1 s, and retries a set number of times before declaring the slave offline; set the timeout to what the slowest device needs, not to the largest number available, because a dead device holds up every poll behind it for the full timeout on every retry. Finally, speed: 9 600 and 19 200 baud work on cheap cable over hundreds of metres; 115 200 over 500 m of unterminated, unshielded cable on a plant floor produces CRC errors and a lot of hunting, and buys little, because the devices' turnaround time, not the wire, dominates the poll time.
RS-485 wiring done right
- Two wires and a common. Two-wire RS-485 is half duplex: one twisted pair carries both directions, one device driving at a time. The pair is differential, but the receivers work only if every device's signal ground is within −7 to +12 V of every other's (TIA/EIA-485-A), so the Modbus serial-line specification makes a third conductor, the common, mandatory. Run it, in the same cable, and connect it at every device.
- A and B are not reliably named. The Modbus specification names the pair D0 (also called A or −) and D1 (B or +). TIA-485-A defines A as the wire that is negative with respect to B in the idle state. A good many manufacturers label their terminals the other way round, and a few use only + and −. Wire by the manuals, and if a device does not answer, swap its pair: a reversed pair does no harm, it simply does not work.
- Shielded twisted pair. Use a cable made for RS-485 (100–120 Ω characteristic impedance, a twisted pair plus a common, overall shield), not a spare core of the power cable. Earth the shield at one end only, usually at the panel, so that it does not carry current between two earths.
- Daisy chain, not a star. The cable runs from the master to the first device, on to the second, on to the third. Each device is on the trunk or on a stub of at most a few metres. A star, with a cable from the panel to each device, or a long stub to a device across the yard, reflects every edge back down every branch, and a bus that works at 9 600 baud with two devices stops working at 19 200 with six.
- Termination at the two ends only. A 120 Ω resistor across the pair at each physical end of the trunk, matching the cable, absorbs the signal instead of reflecting it. Not at every device, not in the middle, and not left out: many devices have a termination switch or jumper, and the commonest fault is three or four of them switched on, which loads the drivers and pulls the signal down, or none, which leaves the bus ringing. Two, at the ends, and know which two.
- Bias, once. With no device driving, the pair floats and receivers see noise as data. A pull-up on D1 and a pull-down on D0, typically 450–650 Ω to the supply and to the common, hold the idle state; they belong in one place on the bus, usually at the master, and a bus with several sets of bias resistors switched in has the same loading problem as one with too many terminators.
- Loads and length. TIA-485 allows 32 unit loads on a segment; a transceiver rated at 1/8 unit load allows 256 devices, and most modern devices are 1/4 or 1/8. Length is set by baud rate and cable: 1 000 m at 9 600 baud on AWG 26 or heavier is the serial-line guide's figure, and 1 200 m is the usual practical limit up to about 100 kbit/s. Beyond that, or between buildings whose earths differ, use a repeater or an isolated segment.
- Isolation. Long runs, outdoor runs, and any bus that joins equipment fed from different transformers or buildings should use isolated transceivers or an isolated repeater at the panel. A ground potential difference of a few volts is common between buildings and destroys unisolated transceivers on the first thunderstorm.
- The polarity swap test. With the bus idle, a meter across A and B reads a small positive voltage (about 200 mV or more with the bias resistors fitted) on B relative to A. If it reads negative at one device and positive at another, that device's pair is reversed.
Modbus TCP: the same registers over Ethernet
Modbus TCP carries the same function codes, the same tables and the same 16-bit registers inside a TCP connection on port 502. The serial frame's unit ID and CRC are replaced by a seven-byte MBAP header: a transaction identifier that lets the client match replies to requests, a protocol identifier that is always 0, the length of what follows, and a unit identifier. There is no CRC; TCP's own checksum and retransmission take care of integrity. A server can accept several client connections at once, so an HMI, a data logger and a PLC can all read the same meter, which a serial bus with its single master cannot do.
The unit identifier is what makes gateways work. A serial-to-Ethernet gateway takes a Modbus TCP request, uses the unit ID to pick the RS-485 slave, sends the request as RTU, and returns the reply as TCP; the client addresses meter 3 behind the gateway as unit 3 at the gateway's IP address. A device that is itself on Ethernet ignores the unit ID or expects 255 (the implementation guide's recommendation) or 1; the manual says which. A gateway with two serial ports, or two gateways on one subnet, needs a mapping between unit IDs and ports, and that mapping is the second most common TCP fault after a wrong IP address.
Modbus TCP has no authentication and no encryption: anyone who can reach port 502 can write any register, including the setpoints and the run command. The Modbus/TCP Security variant, TLS on port 802, was published in 2018 and almost nothing in the field implements it. Treat a Modbus network as a private wire: put it on its own VLAN or physical network, reach it from the office network only through a firewall or a gateway that exposes read-only tags, and never route it to the internet. If a remote party needs the data, a VPN into a gateway is the least you should accept.
Performance: how many registers per second
A serial poll takes the time to send the request, the slave's turnaround, and the time to send the reply, plus two inter-frame silences. At 9 600 baud with 11-bit characters, a request for ten registers (8 bytes) takes 9.2 ms on the wire and the 25-byte reply 28.6 ms; with 4 ms of silence at each end and a slave that turns round in 10 ms, the transaction is about 55 ms, and a slow device can double that. The wire time scales with the byte count and the baud rate; the turnaround does not, and it is often the larger term for cheap devices.
Two rules follow. Read blocks, not single registers: forty consecutive registers cost one request and an 85-byte reply, 107 ms of wire time at 9 600 baud or 53 ms at 19 200, where forty single-register reads would cost forty turnarounds. And budget the bus before it is built: ten meters read once a second, one block each, fill a 9 600 baud bus completely and leave no room for retries, so either run at 19 200, split the meters across two ports, or accept a slower rate for the values that do not change fast. Modbus TCP removes the wire limit (a poll is a millisecond on Ethernet) but not the device's: a meter's Modbus stack answers at the meter's pace whatever the transport, and a gateway to RS-485 has the serial budget behind it.
Diagnostics, tools and the four mistakes
The commissioning kit is a USB-to-RS-485 adapter, preferably isolated, and a free polling tool such as modpoll or QModMaster on a laptop. Take the master off the bus, put the laptop in its place, and poll one device at a time by unit ID: a device that answers the laptop and not the PLC has a configuration problem in the PLC; a device that answers neither has a wiring, setting or address problem of its own. Read the exception codes rather than just counting failures: 01 means the device does not support that function code (try 03 instead of 04, or the reverse); 02 means the address or the quantity runs off the end of what the device has, usually the off-by-one; 03 means the request is malformed or the value is out of range; 04 means the device itself has failed to do what was asked. A CRC error counter in the master, rising steadily, means noise, reflections or a mismatched serial format; rising only when a particular drive runs means its motor cable is coupling into the bus.
An oscilloscope on A and B, differential, shows the rest: clean edges and a flat idle level of a few hundred millivolts on a good bus; ringing after each edge on an unterminated one; a sagging signal on one with too many terminators; and the idle level collapsing to zero where the bias is missing. The four mistakes, as a checklist for the first day:
- Off by one. Poll a known register at the documented address and one below it; write down which convention the device uses.
- Swapped words. Read a known 32-bit value and check it decodes; if it comes back as 10−41 or 1023, change the word order in the master.
- Wrong serial settings. Baud, parity and stop bits identical on every device and the master; 9 600 or 19 200, 8N1 or 8E1, but the same everywhere. Unit IDs unique on the bus.
- Missing termination or a star. One trunk, daisy-chained, 120 Ω at the two ends only, bias in one place, common wire connected, shield earthed once.
Where Modbus is not the answer
Modbus has no notion of time, priority, events or data types beyond a 16-bit word. Anything that needs synchronised motion, cyclic data at kilohertz rates or a safety function belongs on a bus designed for it: EtherCAT, PROFINET IRT or EtherNet/IP with CIP Motion for motion; PROFIsafe, CIP Safety or FSoE for safety, on top of those. A system with thousands of points and many consumers, or one that must describe its own data rather than hand out numbered registers, is what OPC UA (IEC 62541) exists for, with typed, named, browsable data and built-in signing and encryption. A connection from a plant to a cloud dashboard is MQTT: publish and subscribe, a broker, TLS, and a payload that carries names and units rather than register 40108.
None of that displaces Modbus where it lives. A meter, a drive, a temperature controller, an inverter, a generator controller, a UPS or a chiller comes with a Modbus port and a register map, and reading it is an afternoon's work with a laptop and this guide. The systems Ahmedonics integrates almost always have a Modbus bus somewhere near the bottom, and the point of getting the four things right is that once they are right, the bus runs for years without anyone thinking about it.
References
- Modbus Organization, MODBUS Application Protocol Specification V1.1b3, 2012 — function codes, data model, exception codes
- Modbus Organization, MODBUS over Serial Line Specification and Implementation Guide V1.02, 2006 — RTU framing and timing, CRC, RS-485 wiring, termination, bias, the common conductor
- Modbus Organization, MODBUS Messaging on TCP/IP Implementation Guide V1.0b, 2006 — MBAP header, port 502, unit identifier
- Modbus Organization, MODBUS/TCP Security Protocol Specification, 2018 — TLS on port 802
- TIA/EIA-485-A, Electrical Characteristics of Generators and Receivers for Use in Balanced Digital Multipoint Systems — unit loads, common-mode range, A and B polarity
- IEC 61158 series, Industrial communication networks — Fieldbus specifications
- IEC 62541 series, OPC Unified Architecture