Modbus is over forty years old and still the most common way industrial devices share data. Energy meters, VFDs, PLCs, temperature controllers, flow meters and water analysers almost always offer it. It is simple, open and free — but "simple" does not mean it always works first time. This guide covers the two variants you will meet in a plant and the practical details that decide whether a network is reliable.
The basic idea
Modbus is a request–response protocol. One device asks (the master or client), others answer (the slaves or servers). A slave never speaks unless asked. Data inside a slave is organised in numbered registers, and the master asks for a range of them using a function code.
Modbus RTU vs Modbus TCP at a glance
| Modbus RTU | Modbus TCP | |
|---|---|---|
| Physical layer | Serial, usually RS-485 (sometimes RS-232) | Ethernet (copper, fibre, WiFi) |
| Addressing | Slave ID 1–247 on a shared bus | IP address + port 502 (unit ID for gateways) |
| Speed | Typically 9,600–115,200 baud | 10/100 Mbps or more |
| Distance | Up to ~1,200 m per segment at low baud | 100 m per copper run, unlimited with switches |
| Devices | 32 unit loads per segment (more with repeaters or ⅛-load transceivers) | Limited by network design |
| Error check | CRC-16 in each frame | Handled by TCP |
| Typical devices | Energy meters, small sensors, controllers | PLCs, larger VFDs, power analysers |
In practice most panels have both: a string of RS-485 meters, and a PLC or HMI on Ethernet. A good gateway reads both at the same time.
Wiring RS-485 properly
Most Modbus RTU problems are wiring problems. Follow these rules:
- Daisy-chain, don't star. Run one cable from device to device. Long branches ("stubs") cause reflections and random errors.
- Use twisted-pair, shielded cable. A dedicated RS-485 cable or at least a good twisted pair. Keep it away from power cables and VFD output cables.
- Mind A/B polarity. Manufacturers label terminals differently (A/B, D+/D−, +/−). If nothing answers, swapping A and B is the first test.
- Terminate both ends. A 120 Ω resistor across A and B at the two physical ends of the bus — not at every device. Many meters and gateways have a termination DIP switch.
- Connect the reference / ground. RS-485 is differential but still needs a common reference within its voltage range; use the cable's third conductor or shield as per the device manual, and ground the shield at one end only.
- Biasing. The bus should have bias resistors at one point (often built into the master) so that it rests in a known state.
Communication settings must match exactly
Every device on one RS-485 bus must use the same:
- Baud rate — 9600 is the most common default for meters; 19200 is a good balance.
- Data format — usually 8 data bits, with parity None/Even/Odd and 1 or 2 stop bits (8N1, 8E1…).
- Unique slave ID — two devices with the same ID will corrupt each other's replies.
Write the settings on a label inside the panel. The next engineer who adds a meter will thank you.
Function codes you will actually use
| Code | Name | Used for |
|---|---|---|
| 01 | Read Coils | On/off outputs |
| 02 | Read Discrete Inputs | On/off inputs (status, alarms) |
| 03 | Read Holding Registers | Most meter and controller values |
| 04 | Read Input Registers | Measured values on many devices |
| 05 / 06 | Write Single Coil / Register | Commands, set-points |
| 16 (0x10) | Write Multiple Registers | Writing 32-bit values, configurations |
For monitoring, you will mostly use 03 and 04. Whether a meter puts voltage in "holding" or "input" registers is decided by the manufacturer — the register map tells you.
Reading a register map without mistakes
The register map in the device manual is your most important document. Watch for these traps:
- Address offset. A map may say "40001", "30001" or "0x0000". The 4xxxx/3xxxx prefix indicates the register type, and many tools expect the zero-based offset (40001 → 0). Off-by-one errors are very common.
- Data type. Values may be 16-bit integers, 32-bit integers or 32-bit floats occupying two registers.
- Word and byte order. A 32-bit float can be sent as ABCD, CDAB, BADC or DCBA. If you see wild numbers like 1.2e-38, swap the word order.
- Scaling. An integer of 2304 might mean 230.4 V (×0.1). Check the multiplier and units, and whether CT/PT ratios are already applied inside the meter.
- Block reads. Reading 20 consecutive registers in one request is far faster than 20 separate requests — group your reads.
Polling: how fast is fast enough?
At 9600 baud a typical request–response for a block of registers takes tens of milliseconds, plus each device's response time. With ten meters and a few blocks each, a full cycle every few seconds is realistic. Energy monitoring rarely needs faster than 1–5 seconds; process alarms may need faster cycles on fewer values. Set sensible timeouts and retries so one offline device does not stall the whole bus.
Troubleshooting checklist
- No response from any device: check A/B polarity, baud rate, parity and that the master's port is right.
- One device missing: check its slave ID and its own comms settings.
- Intermittent CRC errors: check termination, stubs, cable routing near VFDs and grounding.
- Values wrong but stable: check register offset, data type, word order and scaling.
- Modbus TCP not connecting: check IP, subnet, port 502 and whether the device allows more than one client.
From Modbus to the cloud
Once your devices talk Modbus reliably, getting their data to a dashboard is the easy part. The ModbusSudo gateway acts as the Modbus master on RS-485 and Ethernet, applies the register map, scaling and word order for each device, buffers data locally if the internet drops, and sends it securely to the SensorLoop platform. Our engineers do the register mapping during installation, so your team only sees clean, named values.