# Modbus RTU vs TCP: Key Differences, Registers, Function Codes, RS-485 Wiring and When to Use Each

> Modbus RTU vs TCP explained: registers, function codes, RS-485 wiring, Unit IDs, gateways and security, plus a five-point go-live checklist.

Source: https://digitalbridge.com.tr/en/blog/modbus-rtu-vs-tcp.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: IoT & Hardware
Published: 2026-10-01 · Updated: 2026-10-22

Modbus RTU and Modbus TCP are two transports for the same open, licence-free industrial protocol, sharing one data model and set of function codes. RTU sends compact binary frames over a serial line, usually RS-485, addressing devices 1–247. TCP carries the same requests over Ethernet. Both are standard for reading meters, drives, inverters and [PLCs](https://digitalbridge.com.tr/en/glossary.html#plc) (programmable logic controllers).

## Key takeaways

- Modbus is an open industrial protocol introduced by Modicon, now Schneider Electric, in 1979; no licence fees apply.
- Modbus RTU and Modbus TCP share the same registers and function codes; RTU runs over RS-485 serial lines, TCP over Ethernet on port 502.
- Data sits in four tables: coils, discrete inputs, input registers and holding registers; each register holds 16 bits.
- Most field faults are register map errors, such as address offset, scale factor and word order, rather than protocol faults.
- Classic Modbus has no authentication or encryption, so security relies on network segmentation, a closed port 502 and VPN access.

## What is Modbus, and why is it still in every panel?

Modbus is the language of countless field devices. Open almost any electrical panel, air handling unit, solar inverter or pump drive and you will find a two-wire serial link carrying Modbus. Open the control room next door and you will find PLCs, gateways and SCADA servers speaking Modbus over Ethernet. Every monitoring project eventually has to decide where one ends and the other begins.

The protocol owes its reach to being simple and free. The [Modbus Organization FAQ](https://www.modbus.org/faq) notes that Modicon, now Schneider Electric, introduced Modbus in **1979**, that the specification can be downloaded at no charge, and that no licence fees apply to Modbus or Modbus TCP/IP. The same page records that the well-known Ethernet **port 502** was assigned to Modbus TCP/IP.

Simplicity has a price, though. A Modbus reply carries a number, not a meaning: "register 40001 holds 2315". Whether that is 231.5 volts or 23.15 amps lives in the device manual's register map. Most so-called protocol problems turn out to be register map problems, and the RTU/TCP choice only decides which of them you will meet first.

## What does a badly built Modbus link cost?

A poorly built Modbus link rarely fails loudly. A meter drops out every few minutes, a value appears ten times too large, a counter resets at midnight. Operators stop trusting the screen and go back to clipboards, and decisions get made on numbers nobody has checked.

> According to [Siemens' The True Cost of Downtime 2024 report](https://assets.new.siemens.com/siemens/assets/api/uuid:1b43afb5-2d07-47f7-9eb7-893fe7d0bc59/TCOD-2024_original.pdf), large plants average **25 unplanned downtime incidents a month** and lose **27 hours** of production a month.

The early signs of those stoppages usually already sit in a drive's current, a motor's temperature or a pump's pressure. If that data is not read reliably over Modbus, there is nothing to feed [a predictive maintenance programme](https://digitalbridge.com.tr/en/blog/predictive-maintenance-guide.html) or an alarm system.

The second cost is security. Classic Modbus has no authentication and no encryption, so anything that can reach the device can read and write to it. [Dragos' 2024 analysis of the FrostyGoop malware](https://www.dragos.com/blog/protect-against-frostygoop-ics-malware-targeting-operational-technology/) describes code that talks to industrial controllers directly using Modbus TCP over port 502. In the attack on a district energy company in Lviv, Ukraine, Dragos assessed that the attackers probably got in through a vulnerability in an externally facing router; the network was not adequately segmented, and Modbus commands sent to heating controllers left customers without heating for **two days**.

## How does Modbus work? Registers and function codes

A Modbus exchange is always started by the client (historically the "master"); the server ("slave") only ever answers. Data lives in four tables, identical in RTU and TCP:

| Data table | Size | Access | Typical content | Read / write function codes |
|---|---|---|---|---|
| Coils | 1 bit | Read/write | Relay output, start/stop command | 01 / 05, 15 |
| Discrete inputs | 1 bit | Read only | Door contact, fault input | 02 |
| Input registers | 16 bit | Read only | Measured voltage, temperature, flow | 04 |
| Holding registers | 16 bit | Read/write | Setpoints, counters, parameters | 03 / 06, 16 |

Manuals often write addresses as "40001", where the leading digit names the table and counting starts at 1. On the wire, addressing starts at 0, so 40001 is sent as 0. If your software does not apply that offset, every value slides by one register and the dashboard fills with nonsense.

A single register holds 16 bits: 0 to 65,535 unsigned or −32,768 to 32,767 signed. Energy totals and floating-point values span two registers, and which word comes first varies by manufacturer. Read a kWh counter in the wrong word order and consumption looks absurd until the first bill arrives.

## Modbus RTU vs TCP: what is the difference?

Because Modbus RTU and Modbus TCP share the application layer, the real differences are all about transport:

| Criterion | Modbus RTU | Modbus TCP |
|---|---|---|
| Physical layer | Serial, mostly RS-485 (two wires plus reference) | TCP/IP over Ethernet, Wi-Fi or cellular |
| Addressing | Device address 1–247 on the line | IP address plus Unit ID |
| Error checking | CRC (cyclic redundancy check) on every frame | Left to TCP |
| Concurrency | One conversation at a time on the line | Several clients, parallel connections |
| Speed limit | Baud rate (typically 9,600–115,200) and cable length | Network bandwidth; in practice device response time |
| Typical home | Panel meters, drives, sensors | PLCs, gateways, SCADA servers, inverters |
| Classic fault | Missing termination, swapped polarity, parity mismatch | Wrong Unit ID, port 502 left exposed |

Choose Modbus RTU when devices sit close together in a panel, only offer a serial port, and one poller is enough. Choose Modbus TCP when devices already have Ethernet, several systems such as [SCADA](https://digitalbridge.com.tr/en/glossary.html#scada) and energy software need the same data, or distance rules out a serial run.

In most real sites you use both: a gateway polls the RS-485 line and presents the data as Modbus TCP or MQTT on the network side, with each serial address mapped to a Unit ID. Tune the gateway's timeout and retry settings so that one slow serial device does not stall the rest.

Modbus is rarely the whole architecture. Where meaning and security must travel with the data, [OPC UA's information model](https://digitalbridge.com.tr/en/blog/opc-ua-explained.html) does that job; for moving data from many remote sites to the cloud, [the MQTT protocol](https://digitalbridge.com.tr/en/blog/mqtt-protocol-industrial-iot.html) is usually the better carrier.

Buildings add another layer. HVAC controllers often speak [the BACnet protocol](https://digitalbridge.com.tr/en/blog/bacnet-building-automation.html), so a single plant room may hold Modbus meters and BACnet controllers side by side.

## How do you build a reliable Modbus integration? Seven steps

Getting a Modbus value on screen takes an afternoon. Keeping it correct for years takes a method:

1. **Build a device and register inventory.** Record make, model, firmware, address and register map for each device, plus scale factor, unit, data type and word order for every value.
2. **Fix the RS-485 topology.** Run a daisy chain rather than a star, fit termination resistors at both ends, and use twisted, shielded cable. Check device counts and cable lengths against the transceiver limits.
3. **Standardise serial settings.** Every device on a line needs the same baud rate, parity and stop bits, and every address must be unique.
4. **Design the polling plan.** Read contiguous registers in one request, poll fast-changing values more often than slow ones, and set timeouts and retries from measured response times.
5. **Validate the numbers.** Compare voltage, current and energy readings with the device's own display or a clamp meter. Any mismatch is almost always scale, offset or word order.
6. **Segment the network and restrict writes.** Keep Modbus TCP devices in a separate OT (operational technology) segment, never expose port 502 to the internet, use a VPN for remote access, and give write rights only to the client that needs them.
7. **Store and monitor.** Write readings with timestamps to [a time-series database](https://digitalbridge.com.tr/en/blog/time-series-database-iot-data.html) and track communication errors as a metric of their own.

Before go-live, walk the Modbus line through this checklist:

| Check | Question to ask | If it is wrong |
|---|---|---|
| Address offset | Is 40001 sent as 0 on the wire? | Every value shifts by one register |
| Scaling | Should the raw value be divided by 10 or 100? | Voltage shows as 2,315 V |
| Word order | Are 32-bit counters assembled in the right order? | Energy totals make no sense |
| Termination | Are both ends of the line terminated? | Intermittent CRC errors, silent devices |
| Exposure | Can port 502 be reached from outside? | Unauthorised reads and writes |

Older machines with no Modbus port at all need a different starting point, covered in our guide to [retrofitting legacy machines](https://digitalbridge.com.tr/en/blog/retrofitting-legacy-machines.html). The wider security picture is in [OT security for SCADA](https://digitalbridge.com.tr/en/blog/ot-security-scada.html).

## How Digital Bridge delivers Modbus integration

We start with discovery. For Industry 4.0 projects we offer a free site assessment, mapping panel devices, existing RS-485 runs, PLCs and network layout on site, then agreeing with your team which data supports which decision. The result is a written proposal setting out scope, phases and cost.

The pilot covers one panel or one line, validated end to end. We connect to Siemens, Allen-Bradley, Mitsubishi, Schneider and other brands over Modbus, OPC UA, Profibus and Ethernet, and bring the data into [SCADA and HMI screens](https://digitalbridge.com.tr/en/industry-40/scada-hmi.html). With the custom SCADA we build, the source code belongs to the client and there are no additional licence fees.

Readings from power analysers feed our [energy monitoring and management](https://digitalbridge.com.tr/en/industry-40/energy-monitoring-management.html) solution; how plants use that data is covered in [factory energy monitoring](https://digitalbridge.com.tr/en/blog/factory-energy-monitoring.html). In [smart building and BMS](https://digitalbridge.com.tr/en/industry-40/smart-building-bms.html) projects we bring Modbus together with BACnet, KNX and DALI in one application.

Where an off-the-shelf gateway will not do, our [device manufacturing and IoT](https://digitalbridge.com.tr/en/technology-hardware/device-manufacturing-iot.html) team designs hardware and firmware for the site, following the stages in our [IoT device development process](https://digitalbridge.com.tr/en/blog/iot-device-development-process.html). Linking Modbus data to ERP and other business software falls under [system integrations](https://digitalbridge.com.tr/en/technology-hardware/system-integrations.html), and our [cyber security](https://digitalbridge.com.tr/en/consultancy/cyber-security.html) specialists help design OT segmentation and remote access.

For dispersed assets such as [remote pump stations](https://digitalbridge.com.tr/en/blog/remote-pump-station-monitoring.html), the RS-485 line stays inside the local gateway and data reaches the centre over a cellular link.

## Where should a Modbus project start?

A Modbus project does not need to connect a whole site at once. One panel where the pain is greatest, a well-prepared register map and a handful of validated values give you a trustworthy base to build on. For related guides, browse our [IoT and hardware articles](https://digitalbridge.com.tr/en/blog/topic/iot-donanim.html).

To plan how your devices should be read over Modbus and where the data should go, [get in touch with us](https://digitalbridge.com.tr/en/contact.html). During the site assessment we map your devices and propose a concrete scope for the first pilot.

## Frequently Asked Questions

### Should I use Modbus RTU or Modbus TCP?

The devices and infrastructure decide. Most panel meters, analysers and drives speak Modbus RTU over RS-485, which is cheap and robust over short distances. Ethernet-connected devices such as PLCs, inverters and gateways are easier to use with Modbus TCP. Most projects combine both: a gateway collects the RTU line and presents it as TCP, mapping each serial address to a Unit ID.

### Is Modbus TCP faster than Modbus RTU?

Usually, but not always by as much as expected. Ethernet removes the baud-rate bottleneck and lets several clients poll in parallel, yet each device still needs time to answer. A slow meter behind a gateway responds no faster because the upstream link is TCP. Real throughput depends on device response time, how many registers each request reads and how many devices share one serial line.

### Why does register 40001 have to be entered as 0?

The "40001" style comes from older documentation, where the first digit identifies the holding register table and numbering starts at 1. The protocol itself counts from 0, so 40001 becomes address 0 and 40010 becomes 9. If the software does not apply the offset automatically, every reading shifts by one register and values look plausible but wrong, which is the worst kind of error.

### Is Modbus secure enough for remote access?

Classic Modbus has no authentication, authorisation or encryption, so security has to come from the network. Keep devices in a separate OT segment, never expose port 502 to the internet, route remote access through a VPN and limit write permissions. A TLS-based secure variant of Modbus exists, but as of 2026 device support remains limited, so network controls stay essential.

### What drives the cost of a Modbus integration?

Cost depends on the number and make of devices, the state of existing RS-485 wiring, how many gateways are needed, how many registers must be read and which system receives the data. Rebuilding missing register maps, rewiring faulty lines and segmenting the OT network add further work. That is why a reliable quote needs a site survey first, with scope and phases set out once the inventory is complete.

### How many devices can one RS-485 line support?

Modbus RTU allows device addresses from 1 to 247, but the practical limit is set by transceiver load, cable length and polling time. The more devices share a line, the longer each value waits to be refreshed. Critical or fast-changing values are better served by splitting the line or adding a second serial port on the gateway.

### Can data be read from a device without Modbus?

Yes. If the device has analogue or digital outputs, an input module can read those signals and expose them as Modbus registers. On machines with no outputs at all, adding a current sensor, meter or vibration sensor captures basic operating data. Devices using a proprietary protocol need a suitable protocol converter or gateway to translate between the two.