Modbus

What is Modbus?

Modbus is an open, royalty-free communication protocol that lets industrial devices such as PLCs, sensors, actuators, HMIs and energy meters exchange measurements and commands using a simple request-response principle. Modicon (now a brand of Schneider Electric) published the protocol in 1979 for its own PLCs. Since then Modbus has become a de facto standard supported by almost every vendor, over serial lines such as RS-485 and over Ethernet.

Modbus is not a single protocol but a family: one shared application layer with several transport variants, such as Modbus RTU, Modbus ASCII and Modbus TCP. That simplicity makes it robust and widely applicable, but also vulnerable, because classic Modbus has no encryption or authentication.

🕰️ How did Modbus come about?

Because the specifications are free to download and carry no licence fees, thousands of manufacturers built Modbus into their products. That explains why, after more than forty years, the protocol still appears in new equipment.

🧠 How does Modbus work?

Modbus follows a strict request-response principle. A client (formerly master) sends a request with a function code, for example “read ten registers starting at address 100”. The server (formerly slave) executes the request and returns a response containing the requested data, or an error. A server never takes the initiative: whoever wants data has to ask for it (polling).

Every message consists of a PDU (Protocol Data Unit) of at most 253 bytes: one function code byte plus data. The transport layer wraps that PDU in an ADU with addressing and error checking; for the serial variants this is at most 256 bytes, for Modbus TCP 260 bytes.

The data model has four tables, each with addresses 0–65535:

The classic notation (such as 40001) is 1-based, whereas the address in the message is 0-based. That off-by-one difference is one of the most common causes of wrongly read values during commissioning.

📦 Which function codes does Modbus use?

If something goes wrong, the server replies with the function code plus 0x80 and an exception code, such as 01 (illegal function), 02 (illegal data address), 03 (illegal data value) or 04 (server device failure). Vendors may also use their own function codes in the user-defined ranges 65–72 and 100–110.

🧱 Which Modbus variants exist?

Modbus RTU is the most widely used serial variant; ASCII is roughly half as efficient and is mainly found in older installations. Strictly speaking, Modbus Plus is not an open variant but a separate Schneider network that carries Modbus messages, and it is rarely used in new projects.

🏭 Where is Modbus used?

• Sensor and I/O readout — temperature, pressure, flow and digital states to a PLC or SCADA system
• Drives — starting, stopping and speed control of motors, pumps and fans through variable frequency drives
• Energy management — kWh meters, solar inverters (often following the Modbus-based SunSpec model) and battery systems
• Building automation — heat pumps, air handling units and chillers, often alongside BACnet
• PLC-to-PLC communication — simple links between machines from different vendors
• Telemetry — RTUs (Remote Terminal Units) in water and energy networks reading field instruments via Modbus

In Dutch and wider European installations Modbus is often the common denominator: a water authority, dairy plant or data centre rarely has a single vendor, and Modbus is the protocol almost every device speaks.

⚠️ What are the limitations of Modbus?

• No built-in security — classic Modbus has no encryption, no authentication and no authorisation
• Only bits and 16-bit registers — 32-bit values, floats and strings are spread over several registers, with a word order that differs per vendor
• Polling instead of events — the client must request values over and over, which consumes bandwidth and provides no timestamps
• Limited speed — serial networks usually run at 9,600 or 19,200 bit/s
• One client per serial bus — with Modbus RTU and ASCII only one master may be active
• No semantics — a register is just a number; meaning, unit and scaling live in the vendor’s documentation, not in the protocol

New projects that need richer data models and built-in security therefore often choose OPC UA or MQTT, while Modbus remains at field level.

🔐 How do you secure Modbus?

Every device that can receive a Modbus request will execute it, regardless of who sent it. Anyone who can reach the network can read values, record and replay messages or change setpoints. Modbus TCP in particular is therefore an attractive target for cyberattacks.

FrostyGoop proved this is not theoretical: in January 2024 this malware sent commands over Modbus TCP to ENCO controllers at a district heating company in Lviv (Ukraine), leaving more than 600 apartment buildings without heating for almost two days in mid-winter. The network was not segmented and the controllers were directly reachable from a compromised router.

Measures in order of impact:

1. Segmentation — place Modbus devices in their own zone following the Purdue Model, the zones and conduits model and IEC 62443, and never expose Modbus directly to the internet
2. Firewall with protocol filtering — allow port 502 only from known clients and block write function codes where read access is all that is needed
3. Secure remote access — use a VPN or jump server with MFA instead of port forwarding, combined with strict access control
4. Monitoring — an OT IDS flags unexpected write commands, new clients and unusual function codes
5. Modbus/TCP Security — where devices support it, use TLS on port 802 with mutual certificate authentication
6. Physical security — restrict access to cabinets and serial buses, because RS-485 has no authentication either

For organisations that fall under NIS2, such measures are part of the mandatory duty of care for network and information security.

🔧 Modbus in practice: gateways and typical settings

Many installations combine serial and Ethernet devices. A Modbus gateway then translates Modbus TCP into Modbus RTU: the client addresses the gateway via IP and uses the unit ID in the MBAP header to select which serial device behind the gateway responds. Gateways also exist to Profibus, ProfiNET, BACnet, OPC UA and MQTT, often as an edge device.

Typical settings and rules of thumb:

• Serial parameters — default 19,200 bit/s, 8 data bits, even parity and 1 stop bit; every device on the bus must use exactly the same settings
• RS-485 cabling — twisted pair with a termination resistor at both ends (in practice usually 120 Ω); a standard 32 devices (unit loads) per segment without a repeater
• Polling interval — 100 ms to a few seconds, depending on the number of devices and the baud rate
• Timeout — often 0.5 to 1 second per request, with a limited number of retries
• Register map — document addresses, data types, word order, scaling factors and units for each device, and include this in your asset inventory
• Diagnostics — with Wireshark or a Modbus test tool you can quickly check whether addresses and function codes are correct

❓ Frequently asked questions

Is Modbus free to use?

Yes, Modbus is an open and royalty-free protocol. The specifications can be downloaded free of charge from the Modbus Organization, which has managed the protocol since Schneider Electric transferred the copyright in 2004.

What is the difference between Modbus RTU and Modbus TCP?

Modbus RTU sends binary messages over a serial line such as RS-485, with a device address from 1 to 247 and a CRC check. Modbus TCP wraps the same function codes and data model in TCP/IP on port 502, with an MBAP header replacing the serial address and the CRC.

Is Modbus secure?

Classic Modbus is not secure: it has no encryption, authentication or authorisation, so anyone with network access can read and write values. Protection comes from segmentation, firewalls with protocol filtering, monitoring and, where available, Modbus/TCP Security with TLS on port 802.

What do master and slave mean in Modbus?

In Modbus the master is the device that sends requests and the slave is the device that responds. Since 2020 the Modbus Organization uses the terms client and server instead, although master and slave still appear widely in serial documentation.

How many devices can be on one Modbus network?

A serial Modbus bus supports 247 addresses, but an RS-485 segment is designed for a standard 32 devices (unit loads); more devices require repeaters or transceivers with a lower bus load. With Modbus TCP the number of servers is limited only by the IP network and the capacity of the client.

Is Modbus being replaced by OPC UA?

In new architectures Modbus is often complemented by OPC UA or MQTT, but rarely replaced entirely. Thanks to its simplicity and broad support, Modbus will remain in use at field level for years to come, often linked to more modern protocols through a gateway.

📌 In summary

Since 1979 Modbus has been the most universal protocol for industrial devices: simple, open and supported by almost every vendor. The family covers Modbus RTU and ASCII for serial lines, Modbus TCP for Ethernet and Modbus/TCP Security as the secured variant. The data model of coils and registers is limited but effective, and the absence of security makes additional measures such as segmentation essential.

Modbus is a simple, open and broadly supported protocol for communication between industrial devices, but without built-in security; segmentation, filtering and monitoring are therefore preconditions for using it safely.