Guide
What is Modbus? RTU vs TCP explained
Modbus is the most widely used industrial messaging protocol — simple enough that almost every PLC, VFD, meter, and sensor speaks it. This guide covers how it works, the difference between its serial (RTU) and Ethernet (TCP) forms, and how to bridge between them.
Updated July 2026 · ThingConnect team
What Modbus is
Modbus is a messaging protocol — a set of rules for how one device asks another for data or tells it to change a value. It was published by Modicon in 1979 and has stayed in wide use because it is simple, openly documented, and free to implement, unlike many proprietary industrial protocols.
Modbus itself does not care what wires or network it travels over. The same message structure runs over a serial RS485 bus (as Modbus RTU) or over Ethernet (as Modbus TCP) — only the framing around the message changes.
How Modbus messages work
Modbus follows a strict master/slave (or client/server) model. One device — a PLC, SCADA system, or gateway — is the master and initiates every exchange. Slave devices (meters, drives, sensors) never speak unless asked. A typical exchange:
- The master sends a request naming a slave address, a function code, and a register range.
- Only the slave matching that address responds.
- The slave returns the requested register values, or an error code if the request was invalid.
This request/response pattern is why Modbus is easy to troubleshoot — every message has a known sender, receiver, and purpose, unlike protocols with unsolicited/spontaneous reporting.
Registers & function codes
Data inside a Modbus device lives in four types of numbered memory, each function code reading or writing one type:
| Data type | Access | Typical use |
|---|---|---|
| Coils | Read/write, 1 bit | Digital outputs — relays, on/off control |
| Discrete inputs | Read-only, 1 bit | Digital inputs — limit switches, run status |
| Input registers | Read-only, 16-bit | Analog readings — temperature, current, level |
| Holding registers | Read/write, 16-bit | Setpoints, configuration, general-purpose data |
Common function codes include 03 (read holding registers), 04 (read input registers), 06 (write single register), and 16 (write multiple registers). Every Modbus device ships a register map in its manual mapping specific addresses to specific meanings — there is no universal standard for what address 40001 means across devices.
Modbus RTU vs Modbus TCP
| Modbus RTU | Modbus TCP | |
|---|---|---|
| Physical layer | Serial — RS485 or RS232 | Ethernet (IP network) |
| Framing | Binary, CRC checksum, silence-based message gaps | Wraps the same message in a TCP/IP header (MBAP) |
| Addressing | Slave ID (1–247) on the wire | IP address + unit ID |
| Typical speed | 9,600–115,200 bps | 10/100 Mbps Ethernet |
| Devices per bus | Up to 32+ on one RS485 line | Limited by network, not protocol |
| Multiple masters | Effectively one at a time | Multiple TCP clients can connect |
| Common port | N/A (serial) | TCP port 502 |
The two are close cousins by design — the register model, function codes, and overall message content are the same. Only the framing (how a message is packaged for the wire) differs, which is exactly what makes a Modbus RTU-to-TCP gateway a simple, reliable translation rather than a complex protocol conversion.
Addressing & polling
On a Modbus RTU bus, every slave device is configured with a unique address from 1–247, set via DIP switches or a config tool. The master polls devices one address at a time — two devices sharing an address will collide and neither will respond reliably.
On Modbus TCP, addressing works at two levels: the device's IP address on the network, plus a unit ID (mirroring the RTU slave address) for cases where a TCP-connected gateway represents multiple RTU slaves behind it — exactly what a RS485-to-Ethernet gateway does.
Where Modbus shows up
- Energy meters, power analyzers, and sub-metering panels
- Variable frequency drives (VFDs) and soft starters
- PLCs, HMIs, and building/plant automation controllers
- Environmental and process sensors (temperature, pressure, flow)
- Legacy machine controllers with a serial diagnostic or data port
If a spec sheet lists "Modbus RTU" or "Modbus TCP" support, it is almost always this protocol — vendor-specific variants are rare because the open specification is free to implement.
Bridging RTU to TCP
Most plants end up with both: older serial devices on an RS485 Modbus RTU bus, and newer systems (SCADA, MES, cloud dashboards) that expect Modbus TCP or MQTT over Ethernet/WiFi. A protocol gateway bridges the two without touching the field wiring — it polls the RTU slaves on the serial side and re-exposes their registers as Modbus TCP (or MQTT) on the network side.
ThingConnect's MDIM-485 does exactly this over wired Ethernet, and the MDIM-485/WL adds native MQTT for direct connection to cloud platforms — both support multiple RTU slaves on a single RS485 port with transparent, lossless bridging.
Rule of thumb: if your device manual mentions RS485 wiring, it is speaking Modbus RTU; if it mentions an IP address and port 502, it is speaking Modbus TCP. A gateway lets either side reach the other.
Frequently asked questions
Is Modbus RTU or Modbus TCP better?
Neither is universally better — they suit different situations. Modbus RTU (over RS485) is cheaper to wire for many field devices on one bus and works without a network switch. Modbus TCP (over Ethernet) is faster, easier to integrate with IT infrastructure, and allows multiple masters to poll the same device. Many plants use both, bridged by a gateway.
What port does Modbus TCP use?
Modbus TCP uses TCP port 502 by default. Firewalls and network segmentation should account for this when Modbus TCP traffic needs to cross VLANs.
Can I convert Modbus RTU to Modbus TCP?
Yes — a Modbus gateway (protocol converter) sits on the RS485 bus as the RTU master, and re-exposes the same registers over Modbus TCP on Ethernet or WiFi. Modbus TCP clients (SCADA, MES, cloud platforms) then poll the gateway exactly as if it were a native TCP device.
What is a Modbus register?
A register is a numbered memory location inside a Modbus device holding a value — a temperature reading, a setpoint, a run/stop bit. Devices publish a register map (in their manual) listing what each address means; software reads or writes specific addresses to get or set that data.
Is Modbus secure?
Modbus has no built-in authentication or encryption — any device that can reach the bus or the TCP port can read and write registers. It was designed for isolated industrial networks. Modern deployments keep Modbus traffic on a segmented plant network and put any authentication or encryption at the gateway/cloud boundary instead.
Need to bridge Modbus RTU to Modbus TCP?
MDIM-485 converters are made in India, carry a 2-year warranty, and ship with free technical support.