01 — MODBUS RTU
The 1979 protocol still running half the plant floor.
Estimated 25 minutes.
What is Modbus?
Modbus is a simple serial protocol invented in 1979 by Modicon. It is still everywhere in industry — VFDs, PLCs, energy meters, temperature controllers. Almost every device speaks it or has an option for it.
Why did it survive 45+ years?
It is simple, free, vendor-neutral, and "good enough" for most data exchange. Once a standard reaches a critical mass, it sticks. That is exactly what happened to Modbus.
Three flavours.
You will meet Modbus in three forms. RTU — binary, over a serial cable (this lesson). ASCII — text-based, slower, almost extinct. TCP — over Ethernet (a future lesson). RTU is the most common serial form.
Where you'll meet it.
Anywhere there's a small device on a serial cable: a VFD reporting motor current, an energy meter, a flow meter, a temperature controller, an I/O block in a remote panel. If it has two RS-485 wires, it probably speaks Modbus RTU.
The cable: RS-485.
Modbus RTU rides on a wiring standard called RS-485. RS-485 is a differential pair — two wires that carry opposite signals. Differential signalling rejects electrical noise, which is why it works in factories full of motors and contactors.
2-wire vs 4-wire.
Most installations use 2-wire RS-485: one twisted pair for both directions, half-duplex (only one side talks at a time). 4-wire is rare but slightly faster. If someone says "RS-485" without qualifying it, they mean 2-wire.
Termination resistors.
A 120-ohm resistor goes at each end of the bus — and only at the ends. They prevent signal reflections that would corrupt data. Missing terminators is the #1 cause of "communication works most of the time" problems.
How do you wire it?
Modbus RTU devices on a single bus must be wired in which topology?
- Star — every device to a central hub
- Line — daisy-chained, terminated at both ends
- Ring — closed loop
A typical Modbus RTU bus.
One master, multiple slaves, terminators at each end.
One master, many slaves.
Modbus RTU is master/slave. Only the master speaks first. It asks a slave a question; that slave answers; then the master moves on. Slaves never speak unless asked.
Up to 247 slaves.
Each slave has an address from 1 to 247. Address 0 is reserved for broadcast (all slaves listen, none reply). Two slaves cannot share an address — sound familiar from IP conflicts?
Who plays each role?
The master is usually a PLC, SCADA, or gateway. Slaves are usually field devices — drives, meters, remote I/O. The role is fixed by configuration; you cannot have two masters on one bus.
Function codes.
The master tells the slave what to do using a single-byte function code. There are about a dozen standard codes, but four cover 95% of all real traffic.
The four you'll use.
0x01 Read Coils. 0x02 Read Discrete Inputs. 0x03 Read Holding Registers. 0x04 Read Input Registers. The write codes — 0x05, 0x06, 0x0F, 0x10 — round out the set.
Route every value to its table.
Eight real plant signals — pick the Modbus table each belongs in.
Which function code?
You want to read the temperature (a 16-bit measurement) from a sensor. Which function code do you use?
- 0x01 — Read Coils
- 0x03 — Read Holding Registers
- 0x04 — Read Input Registers
- 0x06 — Write Single Register
Anatomy of a request.
A Modbus RTU message has 4 parts: slave address (1 byte), function code (1 byte), data (variable length), and a CRC checksum (2 bytes) for error detection.
Read 2 holding registers from slave 1.
Each byte has a job. The CRC catches transmission errors.
The CRC.
The last 2 bytes are a CRC-16 checksum the master computes over the rest of the message. The slave recomputes it on receipt. If the value differs, the message is discarded silently. Modbus RTU has no retries built in — your master decides what to do.
And the slave's reply.
Slave echoes the function code, says how many bytes follow, then the data, then CRC.
Gotcha #1: off-by-one.
Some manufacturers number registers from 0, others from 1. A "register 40001" in documentation may actually be register 0 in the protocol. This is the single biggest source of Modbus bugs. Always test with a known value before trusting addresses from a spec sheet.
Gotcha #2: byte order.
Modbus only natively supports 16-bit registers. To send a 32-bit float or integer, vendors split it across two registers — but the order varies (big-endian, little-endian, or "swapped"). Two devices that both "speak Modbus" can still disagree on what 0x42 0xF6 0xE6 0x66 means. Always test.
Gotcha #3: baud rate.
Master and slave must use the exact same baud rate (commonly 9600, 19200, 38400, or 115200) and same parity. Mismatch = total silence. There is no auto-negotiation.
Decode any packet.
Paste any Modbus RTU hex string. The breakdown updates live, including a CRC check.
You now know Modbus RTU.
- RTU rides on RS-485, daisy-chained, terminated at both ends.
- Master / slave: addresses 1–247, address 0 = broadcast.
- Four data tables: coils, discrete inputs, holding regs, input regs.
- Frame = slave + function + data + CRC.
- Off-by-one addressing and byte order are your two biggest enemies.
Modbus RTU complete.
- You can decode any Modbus RTU packet by eye.
- You know the four function codes that cover 95% of traffic.
- You can wire and terminate an RS-485 bus correctly.
- You know the gotchas before they bite you.