Modbus RTU vs Modbus TCP Explained: Registers, Function Codes and Common Pitfalls

Modbus was first published by Modicon in 1979 and is now an open standard maintained by the Modbus Organization. It uses a simple request-and-response model: one master (also called the client) asks, and a slave (the server) answers. That simplicity is why you find it on almost every energy meter.

Diagram: Modbus RTU frame with address, function, data and CRC, and Modbus TCP frame with MBAP header, function and data

Tap or click the diagram to enlarge it.

Three Flavours

RTU, ASCII and TCP

The data model is the same. Only the way it is carried differs.

Modbus RTU

Compact binary frames over a serial line (usually RS-485), checked with a 16-bit CRC. Frames are separated by a silent gap of at least 3.5 character times.

Modbus ASCII

Human-readable text frames over serial, checked with an LRC. Rare today, but still found on some older devices.

Modbus TCP

Modbus carried inside TCP/IP over Ethernet, normally on port 502. A short MBAP header replaces the address and CRC; TCP itself provides error checking.

Data Model

The Four Data Types

Every Modbus device exposes its data as one of four tables. The classic numbering is shown in brackets.

1
Coils (0xxxx)1-bit, read and write. Usually outputs such as relays.
2
Discrete inputs (1xxxx)1-bit, read only. Usually digital inputs and status flags.
3
Input registers (3xxxx)16-bit, read only. Often measured values such as voltage or power.
4
Holding registers (4xxxx)16-bit, read and write. Settings, and on many meters the readings too. Always check the device's register map.

Requests

Function Codes You Will Use Most

The function code tells the slave what to do.

1
03 — Read Holding RegistersThe most used request. A single request can read up to 125 registers.
2
04 — Read Input RegistersLike 03, but for the read-only input table.
3
01 and 02 — Read Coils and Discrete InputsRead single-bit values such as on/off states.
4
05, 06, 15, 16 — WriteWrite one or many coils (05, 15) or registers (06, 16). Write carefully: changing settings on a live meter or drive can affect operation.

Troubleshooting

Why Will It Not Answer?

Check these in order before blaming the device.

1
Serial settings do not matchBaud rate, parity and stop bits must be identical on both sides. Common choices are 9600 or 19200 baud.
2
Wrong or duplicate slave addressEach device on a serial bus needs its own address (1 to 247).
3
Register address off by oneManuals may list register 40001 while the request uses offset 0. Check which numbering your tool and the manual use.
4
32-bit values and floatsA 32-bit value spans two registers, and the word or byte order differs between brands. If numbers look wrong, try swapping the order.
5
Polling too fast, timeout too shortSlow devices need time to answer. Lengthen the timeout and reduce the polling rate.
6
WiringA and B swapped, missing termination or a bad shield cause most RTU faults. See our RS-485 wiring guide.

RTU or TCP? Many meters offer RS-485 only. A gateway or data logger can convert Modbus RTU to Modbus TCP so software on the network can read them.

Electrical work should be done by qualified people with the equipment switched off and locked out. Always follow the device manuals; this article is general guidance, not a design for your site.

Struggling to connect a device over Modbus?

Talk to our engineers about connecting your meters and devices.

Contact Our Team