What is Modbus RTU?
Modbus RTU is the serial, binary transmission mode of the Modbus protocol, in which a single master polls up to 247 slaves such as PLCs, sensors, actuators, HMIs and energy meters over an RS-485 or RS-232 line, using short messages delimited by silence and checked with a CRC-16. The name comes from the Remote Terminal Unit mode in the original specification by Modicon (now Schneider Electric); the protocol shares only the origin of that name with the RTU device. The current rules are set out in the Modbus over Serial Line Specification and Implementation Guide V1.02 of December 2006.
Modbus RTU is the default mode for serial Modbus: every serial Modbus device must support RTU, whereas the text-based ASCII mode is optional. Because the Modbus specifications are public and royalty-free, almost every manufacturer supports it, which is why Modbus RTU remains a widely used protocol at field level in industrial automation and building automation, including many legacy systems.
🧠 How does Modbus RTU work?
Modbus RTU follows a strict request-response principle. The master (since 2020 called the client by the Modbus Organization) sends a request to one slave (server), which replies within a time-out. Slaves never take the initiative and never talk to each other. Only one device may transmit on the bus at any time.
- Unicast - the master addresses one slave with an address from 1 to 247; only that slave replies
- Broadcast - address 0 reaches all slaves at once; it is allowed for write commands only and nobody replies
- Reserved - addresses 248 to 255 are not used for devices
The data model (coils, discrete inputs, input registers and holding registers) and the function codes are the same as in Modbus TCP; only the packaging differs. An RTU message consists of an address byte, a function code byte, up to 252 data bytes and two CRC bytes, at most 256 bytes in total.
🔧 What does a Modbus RTU frame look like?
Each byte travels over the line as an 11-bit character: one start bit, eight data bits (least significant bit first), one parity bit and one stop bit. Without parity a second stop bit is mandatory, so the character remains 11 bits long. Even parity is required and is the default setting.
There is no start or end character. A frame begins and ends with a silence of at least 3.5 character times (t3.5). If a gap of more than 1.5 character times (t1.5) occurs inside a frame, the receiver treats the frame as incomplete and discards it. Above 19,200 bit/s the specification prescribes fixed values: 750 µs for t1.5 and 1.75 ms for t3.5.
| Field | Length | Example | Meaning |
|---|---|---|---|
| Silence | ≥ 3.5 characters | - | Marks the start of the frame |
| Address | 1 byte | 01 |
Slave 1 |
| Function code | 1 byte | 03 |
Read holding registers |
| Data | 0–252 bytes | 00 00 00 0A |
Start address 0, quantity 10 registers |
| CRC | 2 bytes | C5 CD |
CRC-16, low byte first |
| Silence | ≥ 3.5 characters | - | Marks the end of the frame |
The CRC-16 starts with a register of all ones (0xFFFF), processes every data byte with the polynomial 0xA001 and is appended low byte first. Start, stop and parity bits are not included. If the calculated CRC does not match, the slave ignores the message and sends no reply; the master only notices through the time-out.
🔄 What is the difference between Modbus RTU, Modbus ASCII and Modbus TCP?
| Aspect | Modbus RTU | Modbus ASCII | Modbus TCP |
|---|---|---|---|
| Physical layer | RS-485 (2- or 4-wire), short RS-232 links | RS-485 or RS-232 | Ethernet with TCP/IP, port 502 |
| Encoding | Binary, 8 data bits | Hexadecimal characters, 7 data bits | Binary with MBAP header |
| Frame boundaries | Silence of 3.5 character times | : at the start, CR LF at the end |
TCP segment with length field |
| Error check | CRC-16 | LRC (8 bits) | Handled by TCP |
| Addressing | 1–247, 0 = broadcast | 1–247, 0 = broadcast | IP address plus unit ID |
| Speed | Typically 9,600–115,200 bit/s | Same baud rates, but messages roughly twice as long | 10/100 Mbit/s or more |
| Clients per network | One master | One master | Several clients at once |
| Topology | Line (daisy chain) | Line | Star or switched network |
Modbus TCP replaces the address byte and CRC with a seven-byte header but uses the same function codes. A gateway can therefore translate easily: the unit ID in the TCP message determines which serial device behind the gateway is addressed.
🧱 What are the requirements for cabling and settings?
Besides the protocol rules, the serial line specification sets concrete requirements for the physical installation:
| Topic | Requirement or rule of thumb |
|---|---|
| Baud rate | 9,600 and 19,200 bit/s mandatory; 19,200 bit/s is the default |
| Character format | 8 data bits, even parity, 1 stop bit (8E1); without parity 2 stop bits |
| Number of devices | 32 per segment without a repeater always allowed; more with lower-load transceivers |
| Cable length | Up to 1,000 m at 9,600 bit/s with AWG26 or thicker; stubs never longer than 20 m |
| Termination | At both ends of the trunk: 150 Ω, or 120 Ω in series with 1 nF when polarisation is used |
| Polarisation | At one point, usually the master: pull-up on D1 and pull-down on D0 of 450–650 Ω |
| Signal names | D0 (A), D1 (B) and Common; Common connected to protective earth at one point |
| Cable | Shielded twisted pair; shield earthed at one end |
A classic pitfall is the A/B labelling: manufacturers swap the meaning of A and B. If you get no communication, the first thing to try is swapping the two data wires. The specification prescribes D0 and D1 precisely to avoid this confusion.
🏭 How do you use Modbus RTU in practice?
Modbus RTU is found in energy meters, variable frequency drives and other drives, temperature controllers, solar inverters, heat pumps, HVAC equipment, flow meters and I/O modules with relay outputs, from manufacturers such as Schneider Electric, Siemens, WAGO and ABB. A PLC or SCADA system reads them cyclically, often alongside other fieldbuses such as Profibus, BACnet or M-Bus.
An approach that prevents commissioning problems:
- Inventory the devices - record each device’s address, baud rate, parity and the manufacturer’s register map, and add this to your asset inventory
- Choose one parameter set - for example 19,200 bit/s 8E1 for the whole bus, because a device with different settings does not recognise the frames and stays silent
- Wire as a line - no star points, termination only at the two ends and polarisation at one point
- Test device by device - first read one register with a Modbus test tool, check scaling and word order, then add the next slave
- Calculate the cycle time - work out the number of requests per round before you fix the polling time in the PLC
The limited bandwidth determines how many devices you can poll per bus. A worked example: at 19,200 bit/s one character takes 0.57 ms. Reading ten registers takes an 8-byte request and a 25-byte response, 33 bytes in total or about 19 ms, plus two silences of 2 ms and the slave’s processing time. In practice, allow 30 to 50 ms per transaction. Thirty meters with one request each therefore give a cycle of roughly one to one and a half seconds. At 9,600 bit/s the transmission time doubles, so the cycle becomes almost twice as long. The specification mentions a usual time-out of one to several seconds at 9,600 bit/s; choose it generously, but be aware that a slave that does not answer then delays the whole cycle.
🔐 How do you secure Modbus RTU?
Modbus RTU has no encryption, no authentication and no authorisation, so security has to come from around the protocol. Every device on the bus executes a valid request regardless of the sender. On the serial line itself this limits the risk to anyone with physical access to the cable or a terminal, but that changes as soon as a serial-to-Ethernet gateway makes the bus reachable via Modbus TCP. That the Modbus family is abused in practice was shown by FrostyGoop in January 2024: controllers of a heating utility in Lviv were manipulated via Modbus TCP.
Measures:
- Segmentation - place gateways in their own zone according to the Purdue Model and IEC 62443, never directly on the internet
- Firewall with protocol filtering - allow port 502 only from known clients and block write function codes where reading is enough
- Gateway configuration - disable unused web interfaces, change default passwords and restrict which unit IDs are reachable
- Monitoring - an OT IDS or passive monitoring flags unexpected write commands on the TCP side
- Physical security - lock cabinets and restrict access to terminal strips and service ports
For organisations covered by NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet), such as water boards and energy companies, controlling these connections is part of the duty of care for network and information security.
❓ Frequently asked questions
What does RTU stand for in Modbus RTU?
RTU stands for Remote Terminal Unit and is the name of the binary transmission mode in the serial Modbus specification. The name refers to its origins in telemetry, but Modbus RTU is used by every type of serial device, not just by RTUs.
What are the default Modbus RTU settings?
The default Modbus RTU setting according to the specification is 19,200 bit/s, 8 data bits, even parity and 1 stop bit. Every device must also support 9,600 bit/s, and all participants on one bus must use exactly the same settings.
How many devices can be connected to a Modbus RTU bus?
Modbus RTU has 247 slave addresses, but an RS-485 segment is designed by default for 32 devices without a repeater. With lower-load transceivers or repeaters more devices are possible, up to the address limit of 247.
How long can a Modbus RTU cable be?
The Modbus specification gives a maximum of 1,000 metres of trunk cable at 9,600 bit/s with AWG26 or thicker, with stubs of no more than 20 metres. The often quoted 1,200 metres is a general RS-485 rule of thumb, not the Modbus requirement. At higher baud rates the maximum length decreases, and over RS-232 Modbus RTU is only suitable for short point-to-point links.
Can Modbus RTU and Modbus TCP be connected?
Yes, a Modbus gateway translates Modbus TCP to Modbus RTU because both variants use the same function codes and data model. The TCP client uses the unit ID to select which serial device behind the gateway responds.
Why does my Modbus RTU device not respond?
A silent Modbus RTU slave usually has a different baud rate or parity, a wrong address, swapped A and B wires or missing termination. Because a slave silently ignores a message with a bad CRC, the master only sees a time-out.
📌 In summary
Modbus RTU is the binary, serial mode of Modbus, defined in the serial line specification V1.02 of 2006. Frames are delimited by silence and checked with a CRC-16, one master polls up to 247 slaves over RS-485, and the specification sets concrete rules for baud rate, termination, polarisation and cable length. The protocol is simple and universal but has no security, and through gateways it also ends up on the Ethernet network.
Modbus RTU is the default mode for serial Modbus: compact, robust and supported by almost every manufacturer, provided you wire the bus according to the specification and secure its link to Ethernet as strictly as any other OT network.