What is Modbus

Modbus is an application-layer protocol for exchanging data between automation devices: PLCs, HMIs, variable frequency drives, meters and I/O modules. It is popular because it is simple: a client sends a request and a server returns a response or an exception. The base protocol has no subscriptions, events or typed objects.

Variants

The application part of a message — the PDU (function code + data) — is identical in all variants. Only the wrapper (ADU) differs: RTU adds the device address and a CRC, TCP adds the MBAP header. The PDU is limited to 253 bytes, so an RTU frame is at most 256 bytes and a Modbus TCP ADU at most 260 bytes.

Client/server vs. master/slave

The serial line specification historically uses master and slave. In 2020 the Modbus Organization switched to client (initiates requests) and server (processes requests and responds). Vendor documentation uses both:

• Modbus master = Modbus client — polls devices (usually a PLC or SCADA);
• Modbus slave = Modbus server — answers requests (drive, meter, I/O module).

One RS-485 line has one client and up to 247 servers with addresses 1…247. Address 0 is reserved for broadcast write requests, which are never answered.

Data model

The protocol does not know what a register contains: a signed or unsigned integer, half of a FLOAT32 or a bit field. The device's register map defines the interpretation. Most practical problems come from this: off-by-one addresses and the wrong word order. See Modbus addressing and Byte and word order.

Example exchange

The client reads two holding registers starting at address 0 from device 1 (Modbus RTU):

Request:  01 03 00 00 00 02 C4 0B
          │  │  └─┬─┘ └─┬─┘ └─┬─┘
          │  │    │     │    CRC (low byte first)
          │  │    │     quantity = 2 registers
          │  │    starting address = 0 (documented as 40001)
          │  function 03 Read Holding Registers
          device address 1

Response: 01 03 04 42 F6 E6 66 C4 33
                │  └────┬────┘
                │    4 data bytes = registers 0x42F6, 0xE666
                byte count

Registers 0x42F6 0xE666 in ABCD order are the FLOAT32 value 123.45. Decode such frames with the Modbus RTU Frame Parser.

Checklist for a new device

1. Protocol variant and physical layer (RTU over RS-485 or TCP).
2. For RTU: baud rate, parity, stop bits, device address.
3. The register map: addresses, data types, scaling, units.
4. Which numbering the manual uses (0- or 1-based) and the word order of 32-bit values.