LADX
Start free
← Resources
Networking·7 min read·

Modbus, still everywhere after forty years

The simplest industrial protocol, why it survives, and the three things that catch people out.

Short answer

Modbus is a request-response protocol where a client asks a server for register values and the server replies. It defines four data areas: coils and discrete inputs for bits, holding and input registers for 16-bit words. It survives because it is trivial to implement, and it catches people out on register numbering, which is offset by one between documentation and the wire.

Which protocol sits whereENTERPRISEOPC UAMQTTCONTROLEtherNet/IPPROFINETModbus TCPDEVICEIO-LinkPROFIBUS DPModbus RTUEthernet carries most of it now, which is why the layers blur.

Modbus was published in 1979 and is still the most widely implemented industrial protocol, which says more about the value of simplicity than about the protocol.

The data model

Four areas, and everything is one of them:

  • Coils. Single bits, readable and writable.
  • Discrete inputs. Single bits, read only.
  • Input registers. 16-bit words, read only.
  • Holding registers. 16-bit words, readable and writable.

That is the whole model. There are no data types, no structures and no discovery.

The three things that catch people

  • Off-by-one addressing. Documentation numbers from one, the wire addresses from zero. Register 40001 is address 0.
  • Word order for 32-bit values. A REAL takes two registers and the protocol does not say which comes first. Vendors disagree. If a value reads as garbage or as a wildly wrong magnitude, swap the words.
  • Timing on RTU. Frames are delimited by silence, so a slow converter or a busy gateway can split a frame and produce intermittent faults that look like noise.
None of these are hard once you know them, and all of them cost somebody an afternoon the first time.

Why it survives

It is small enough to implement on anything, the specification is free, and every device supports it. Newer protocols are better in every technical respect and none of them are on every device.

Common questions

What is the difference between Modbus RTU and Modbus TCP?
The same data model over different transport. RTU runs over serial, typically RS-485, with a CRC and strict timing between frames. TCP runs over Ethernet and drops the CRC because TCP already guarantees delivery. The register model and function codes are identical.
Why is my Modbus register off by one?
Because documentation traditionally numbers registers from one while the protocol addresses them from zero. Holding register 40001 in a manual is address 0 on the wire. Most masters expose one convention and most device manuals use the other, which is why the first value you read is almost always one register out.

Keep reading