What is Modbus?
Modbus is a simple request and answer protocol that lets one device (the master, or client) read and write values held by other devices (slaves, or servers) on a serial line or an Ethernet network.
Where it came from
Modbus was published by Modicon in 1979 for use with its programmable logic controllers (PLCs). It is an application-layer protocol: it defines the requests, the answers and the data layout, and leaves the physical wiring and the transport to the network underneath. Because it is open and simple, it became one of the most widely used protocols in industrial automation.
Master and slave
Every exchange starts with the master. It sends a request to one slave, identified by a unit (slave) ID, and waits for the answer. Slaves never start a conversation on their own; they only answer. On a serial bus one master polls several slaves in turn; on Ethernet a master opens a TCP connection to each device it talks to.
Function codes and registers
A request names a function code and an address range. Function 03 reads holding registers and function 01 reads coils; function 06 writes one holding register and function 16 writes several. Modbus organises data in four tables: coils (read and write bits), discrete inputs (read-only bits), input registers (read-only 16-bit values) and holding registers (read and write 16-bit values). Holding registers, coils and data types have their own pages.
RTU, ASCII, TCP and TLS
- Modbus RTU sends binary frames on a serial line (RS-232 or RS-485) and ends each frame with a CRC-16 check.
- Modbus ASCII sends the same data as readable hex characters on a serial line, with an LRC check. It is slower and less common.
- Modbus TCP carries the same request inside a TCP/IP packet with a 7-byte header (MBAP). It usually listens on port 502 and has no CRC, because TCP already checks the data.
- Modbus/TCP Security wraps Modbus TCP in TLS, so the link is encrypted and both sides can present certificates.
What to read next
- Modbus function codes: every code in one table, with the limits per request.
- Modbus register addressing: why 40001 is sent as address 0.
- Modbus exception codes: what a device answers when it refuses a request.
- How to decode a Modbus frame: byte by byte, for each transport.
Try Busscope
Install Busscope and run it without a license key to see whether it fits your work. Evaluation mode is for trying the tool, not for production or commercial use.