What Modbus is
Modbus is a simple request–response protocol created in 1979 for programmable controllers. Today it is supported by energy meters, frequency drives, PLCs, solar inverters and sensors. Its simplicity is why it is so widespread.
Model
One side is the client (formerly master), the other the server (slave). The client asks, the server answers. The server never starts a conversation on its own.
Data
| Type | Size | Access |
|---|---|---|
| Coils | 1 bit | read and write |
| Discrete Inputs | 1 bit | read only |
| Input Registers | 16 bit | read only |
| Holding Registers | 16 bit | read and write |
Main functions
- 01 / 02 — read coils / discrete inputs
- 03 / 04 — read holding / input registers
- 05 / 06 — write a single coil / register
- 15 / 16 — write multiple coils / registers
Variants
- Modbus RTU — binary, over a serial line, most often RS-485. Addresses 1–247, CRC-16 checksum. Frames are separated by a silence of at least 3.5 characters.
- Modbus ASCII — text-based, rarely used.
- Modbus TCP — over Ethernet, port 502, no CRC (TCP covers it), with an extra MBAP header.
Typical mistakes
- Address offset — the documentation says 40001, the protocol wants 0. Tools count from 0 or from 1.
- Byte order — a 32-bit integer or float occupies two registers, and their order (big/little endian, swapped words) depends on the maker.
- Different line settings — speed, parity and stop bits must be the same on all devices.
- Two devices with one address — both reply at once and the frames get corrupted.
- Polling too fast — devices need time to answer. The timeout should not be shorter than that.
Limitations
Modbus has no built-in security, no device description and no events — everything is read by periodic polling. In networks reachable from outside, separate transport protection is added.
