Modbus RTU vs TCP comes down to the wire. Modbus RTU runs over a serial line, usually RS-485, and ends every frame with a 16-bit CRC. Modbus TCP runs over Ethernet on TCP port 502, puts a 7-byte MBAP header in front of the same request and has no CRC of its own. The register model underneath is identical.
Checked 28 October 2026. Protocol facts come from the Modbus.org documents named below, opened that day: Modbus Application Protocol Specification V1.1b3 (dated 26 April 2012), Modbus over Serial Line V1.02 (dated 20 December 2006) and Modbus Messaging on TCP/IP Implementation Guide V1.0b (dated 24 October 2006). The wiring advice cites a Schneider Electric support page. We quote nothing from memory.
What is Modbus, and why is it still everywhere?
The specification calls Modbus an application layer messaging protocol that provides client/server communication between devices on different types of buses or networks, and a request/reply protocol. It also says it has been the industry's serial de facto standard since 1979. The specification is public, and devices from many makers, such as meters and drives, offer it.
The Modbus.org specifications page lists the documents. The three that matter here are the Application Protocol Specification, the Modbus Serial Line Protocol and Implementation Guide, and the TCP/IP messaging guide. The page also lists an older "Modbus over Serial Line" document marked for legacy applications only and says it should not be used for new implementations, so make sure you read the V1.02 guide.
Every Modbus exchange is a client asking and a server answering. The specification says the client builds the request and the function code tells the server what to do. On a serial line the client is the master and the servers are slaves. Slaves do not speak unless asked.
Modbus RTU: serial, RS-485, frames and the CRC
On a serial line the Serial Line guide says the default transmission mode must be RTU. A frame is: address (1 byte), function code, data, then a 16-bit CRC. The guide says the CRC is appended low byte first, then high byte, and that it is calculated by the sender and recalculated by the receiver. It also says the CRC is applied regardless of any parity checking.
Other serial facts, all from that guide:
- Slave addresses run from 1 to 247. Address 0 is the broadcast address, and no response is returned to a broadcast.
- Frames are separated by a silent interval of at least 3.5 character times. A gap of more than 1.5 character times inside a frame makes the frame incomplete. For baud rates above 19200 the guide recommends fixed timer values of 750 microseconds and 1.750 milliseconds.
- The default parity is even. The guide says that using no parity requires 2 stop bits.
- 9600 and 19200 bits per second are required, and 19200 is the required default.
The whole serial ADU is limited to 256 bytes, which the Application Protocol Specification says leaves 253 bytes for the function code and data.
Modbus TCP: Ethernet, the MBAP header, ports and connections
The TCP guide describes a dedicated MBAP header in front of the function code and data. It is 7 bytes long:
| Field | Length | What it does |
|---|---|---|
| Transaction identifier | 2 bytes | Pairs a response to its request; the server copies it back |
| Protocol identifier | 2 bytes | 0 means Modbus |
| Length | 2 bytes | Count of the following bytes, including the unit identifier |
| Unit identifier | 1 byte | Identifies a remote slave behind a gateway on a serial line or other bus |
The guide says all Modbus/TCP data units are sent via TCP to registered port 502, and that fields are big-endian. It explains that the serial slave address is replaced by the unit identifier, and that the length field lets the receiver find message boundaries. It also says that Ethernet's CRC-32 check, with the length rules, gives an "infinitesimal" chance of undetected corruption, which is why the frame carries no CRC of its own. The Application Protocol Specification gives the full TCP ADU as 253 bytes plus the 7-byte header, 260 bytes.
The guide says several transactions can be active on one TCP connection, in which case the transaction identifier must be used to match responses.
RTU vs TCP vs "RTU over TCP": what is the difference?
| Modbus RTU | Modbus TCP | |
|---|---|---|
| Medium | Serial: RS-485 (also RS-232 or RS-422 in the spec) | Ethernet, TCP/IP |
| Who asks | One master on the bus | Any client that opens a connection to port 502 |
| Frame | Address, function, data, CRC | MBAP header (7 bytes), function, data |
| Who is addressed | Slave address 1 to 247 | IP address, plus unit identifier for gateways |
| Error check | 16-bit CRC | None in the frame; relies on TCP and Ethernet |
| Largest frame | 256 bytes | 260 bytes |
"RTU over TCP" is the confusing third column. None of the three documents we opened defines it. Some gateways and devices offer a mode with that or a similar name, so read the device manual to find out what the frame carries. A likely sign of a mismatch is a tool that connects without error but gets no valid replies. Check whether the device expects the 7-byte header or a CRC before you blame the network.
That video is a 3-minute overview from Teltonika Networks, a networking equipment vendor, so device specifics are about its own products. For a deep dive into both variants, ControlByte Automation's 46-minute video follows; we have not checked it line by line against the specification.
How do you read a register map?
The Application Protocol Specification describes four primary tables:
| Table | Object | Access |
|---|---|---|
| Discrete inputs | Single bit | Read-only |
| Coils | Single bit | Read-write |
| Input registers | 16-bit word | Read-only |
| Holding registers | 16-bit word | Read-write |
So an input register is something the device measures, and a holding register is something you can also write, such as a setpoint. Function code 03 reads holding registers and 04 reads input registers; 06 writes a single register and 16 (0x10) writes several. The specification says a read of holding registers can ask for 1 to 125 registers in one go.
Three details cause most of the confusion:
- Addresses start at zero in the frame. The specification says that in the PDU, registers numbered 1 to 16 are addressed as 0 to 15. Its worked example reads registers 108 to 110 with starting address hex 006B, which is 107. Manuals and tools differ on whether they show the number or the address, so check which one yours uses before you decide a register is missing.
- Bytes are big-endian. The specification says the most significant byte of a 16-bit value is sent first. Its example reads back 02 2B as 555.
- The specification stops at 16-bit registers. We searched all three documents and found nothing on how a 32-bit integer or a floating-point number is split across two registers. That is the device maker's choice, so the manual's word order and any scaling factor (for example "value in tenths of a degree") decide what you see. Wrong word order gives numbers that look plausible but wrong.
RS-485 wiring and commissioning checklist
This section describes what the guidance says. Work on panels and live circuits needs a competent person, isolation and permits where your site requires them; HSE's Electricity at work: safe working practices (HSG85) is a place to start, and nothing here replaces training.
The Serial Line guide covers the bus itself:
- Daisy chain, with termination at both ends. The trunk cable is one run with a line termination near each of its two ends. No more than two terminations on a pair, and none on a derivation (spur) cable. It suggests a 150 ohm resistor, or a 120 ohm resistor with a 1 nF capacitor when biasing is used.
- Bias at one point only. If one or more devices need the pair biased, the guide says to fit one pair of resistors at one location for the whole bus, usually at the master, with values between 450 and 650 ohms. Other devices must not bias, and the number of devices allowed drops by 4.
- Common to protective earth at one point. The signal common should connect to protective ground preferably at one point only for the whole bus.
- Length and spurs. The guide gives 1000 m as the maximum at 9600 baud with AWG26 or wider cable, and says derivations must be short, never more than 20 m.
- Naming. It names the two signal lines D0 and D1, with a common, and lists D0 as A/A' and D1 as B/B'. It asks makers to use the D0/D1 names in documentation, which suggests that other labels exist. Always follow the device manual for polarity.
A manufacturer's page agrees on the main points. Schneider Electric's support page "Wiring of RS485 Communications Networks" (published 2007, last modified 19 December 2023 when we read it) calls the daisy-chain bus the most efficient layout, lists a star of multiple cables and a backbone with long stubs under improper networks, says unconnected stubs act as an antenna, gives 100 to 120 ohm termination at both ends for 24 AWG twisted pair, and says to connect the shield to chassis ground at one end. Read that page next to your device manual. Note that its resistor range differs from the serial guide's, so use the value in the manual for your device.
A commissioning order that follows from the above:
- Match the serial settings (baud rate, parity, stop bits) on every device. The guide says they must be the same for all devices on the line.
- Give every slave a unique address from 1 to 247.
- Check termination is at the two ends only and biasing in one place.
- Read one register from one device, then add the others one at a time.
Common faults and how to find them
The specification tells you what a server does when something is wrong, and that is your best clue:
- No response at all. If a server receives a request but detects a communication error (parity, LRC, CRC), no response is returned and the client eventually times out. So a silent device can mean wrong baud, parity, address, polarity or a corrupt frame, not a dead device.
- An exception response. The server sets the top bit of the function code, so a failed read of function 03 comes back as 0x83 followed by an exception code. Code 01 is illegal function, 02 is illegal data address, 03 is illegal data value and 04 is server device failure. The specification's example: on a device with 100 registers, addressed 0 to 99, a request starting at 96 for 4 registers works, and for 5 registers fails with code 02.
- A reply, but the wrong number. Think scaling, signed against unsigned, word order, or reading the right register at the wrong address by one.
- Works on the bench, drops on site. Long spurs, stars, missing or doubled terminations, or common not tied to earth at one point, in the order the guidance lists them.
Where does Modbus fit next to Profinet and OPC UA?
Modbus moves register values between devices. The Modbus.org page lists a separate "Modbus Security Protocol" document that combines TLS with Modbus and uses port 802, so the frames described above carry no authentication of their own. Profinet and OPC UA solve different problems. Our comparison of Profinet and EtherNet/IP and our guide to OPC UA for industrial IoT connectivity cover those, and our free Profinet and industrial Ethernet course is a starting point for the Ethernet side.
Start free
EDWartens courses are not regulated qualifications and give certificates of completion. Here is what you can do for free:
- Work through the free industrial communication course to see where serial and Ethernet protocols sit.
- Try the SCADA and HMI engineer job simulation: the first five days are free, and it is practice, not employment.
- Browse current PLC and automation jobs to see how often Modbus appears in the requirements. We run a free job board and do not place anyone in a job.
