Why it is used
Modbus provides simple request–response communication with meters, inverters, drives and controllers. It is widely supported, but not every industrial device implements it or permits every control operation. RTU and TCP share a basic data model while using different framing.
Data and functions
Coils/discrete inputs contain bits; holding/input registers contain 16-bit words. Functions 01/02 read bits, 03/04 read registers, 05/06 write individual values and 15/16 write groups. An exception sets the function's high bit and reports a cause. Device documentation defines available quantities, scaling and access.
Within a protocol register the high byte is first. Multi-register word order and nonstandard rearrangements follow the device map. UINT32 and FLOAT32 commonly use two registers, 64-bit values four. Verify units, signedness and scale before interpreting energy or power. Traditional 4xxxx references differ from the zero-based PDU offset.
RTU and TCP
RTU adds a serial address and CRC-16. Individual addresses are 1–247; address 0 is broadcast without response. At low rates, frame separation uses 3.5 character times; above 19,200 bit/s the guide recommends fixed t1.5/t3.5 values of 750 μs/1.75 ms.
TCP normally uses port 502 and a seven-byte MBAP header containing Transaction ID, Protocol ID, Length and Unit ID. It has no RTU CRC. TCP detects transmission errors but is not cryptographic protection. Transaction ID matches replies; concurrency and connection capacity depend on the server.
Physical limits and gateways
A serial master normally controls the request cycle. Traditional RS-485 loading is 32 unit loads, not necessarily 32 instruments; reduced-load transceivers may allow more. Cable length depends on rate, edges, stubs and interference. About 1200 m at low rates and 100 m for common copper Ethernet channels are conditional physical guides, not universal Modbus limits.
A gateway translates TCP requests to serial transactions using Unit ID and configured routing. Its capacity depends on ports, loading, timing and processing. Match serial speed, parity and stop bits. The guide uses even parity by default or two stop bits without parity; some equipment uses 8N1, requiring explicit agreement.
Energy models and security
Meter maps may expose energy, voltage, current and power; inverter/battery maps may expose state, temperature and permitted settings. SunSpec provides additional models for supported energy products; plain Modbus does not imply a shared map. Device timestamps or logs can exist, but are not a universal base event service.
Classic RTU/TCP lacks built-in encryption and authentication. Modbus Security provides TLS/X.509 on port 802 when supported. Access restrictions, segmentation and secure remote access remain relevant. Diagnose offsets, word order, duplicate addresses, timeouts, termination and excessive polling before increasing load.
