What Is Modbus?

Modbus is an open, royalty-free protocol for exchanging data between industrial devices. Modicon published it in 1979 for its programmable logic controllers, and it is now maintained by the Modbus Organization. Because the specification is free and simple, it is built into PLCs, energy meters, variable-speed drives, temperature controllers, HMIs and gateways from almost every manufacturer.

Modbus uses a request and response model. One device, the client (traditionally called the master), sends a request containing a function code, such as read holding registers, and an address. The server (traditionally the slave) carries out the request and replies with the values or a confirmation. Servers never speak unprompted, so the client controls all traffic on the link. The same core message, a function code plus its data, is carried over serial lines in Modbus RTU and ASCII and over Ethernet in Modbus TCP.

Every Modbus device presents its data as four simple tables. Two hold single bits for on and off values, and two hold 16-bit registers for numbers such as temperatures, speeds and setpoints. Larger values, such as 32-bit floating-point readings, are split across two consecutive registers.

The five-digit ranges are a long-standing convention, not part of the message: on the wire each table is addressed from zero, which is why register 40001 is sent as address 0. Mixing up the two is the most common cause of reading the wrong value, so always check the device’s register map and whether it counts from 0 or 1.

A simple example shows how little is involved. Suppose an HMI needs the supply temperature from a chiller controller at Modbus address 5, and the controller’s register map lists it as holding register 40011, scaled in tenths of a degree.

The HMI sends a request to server 5 with function code 03, read holding registers, a starting address of 10 and a quantity of 1. The controller replies with function code 03, a byte count of 2 and the register value, for example 0x00D7, which is 215 in decimal. The HMI applies the scaling and shows 21.5 °C. If the request is invalid, for instance an address the device does not have, the server returns an exception code instead, so the client knows why it failed.

The three variants carry the same requests in different envelopes. Modbus RTU sends compact binary frames over serial links, most often RS-485, with a CRC checksum on every frame. Modbus ASCII sends the same content as readable text characters, which is slower and now rare. Modbus TCP wraps the request in a TCP/IP packet on port 502, so it runs over standard Ethernet networks and through switches and routers. Our FAQ comparing Modbus RTU vs Modbus TCP covers the frame formats, speeds and wiring side by side.

Newer protocols such as OPC UA, PROFINET and EtherNet/IP offer richer data and better security, yet Modbus remains the common denominator on the factory floor and in building services.

Modern monitoring and AI systems rarely talk to the cloud in Modbus. Instead, an edge computer or IIoT gateway polls the Modbus devices on site, converts the registers into named, scaled values, stores or analyses them locally and forwards the results over MQTT or HTTPS. Our industrial IoT gateways combine isolated RS-485 ports and Ethernet for that job. In our supermarket HMI case study, a touch screen gateway reads refrigeration controllers this way and presents their data on site and remotely.

Modbus itself has no authentication or encryption, so a Modbus network should be kept behind the gateway and never exposed directly to the internet. The newer Modbus/TCP Security specification adds TLS on port 802, but support is still limited.

We build gateways and edge computers with isolated serial ports, Modbus software and the operating system image configured as standard, and test them against your register maps before they ship.