RS-485

What is RS-485?

RS-485 is an electrical standard for serial, differential data communication in which multiple transmitters and receivers share a single twisted pair as a common bus, over distances of up to about 1200 metres and in electromagnetically harsh industrial environments. RS-485 only describes the physical layer: voltage levels, loading and driver characteristics. How devices are addressed, who may transmit and what a message looks like are defined by the protocols that run on top of it, such as Modbus RTU, Profibus DP and BACnet MS/TP. That is why RS-485 has been a widely used physical layer in industrial automation and building automation for more than forty years.

🧠 What exactly does RS-485 do?

RS-485 sends data serially (bit by bit) as the voltage difference between two wires, A and B, rather than as a voltage relative to ground. A receiver only looks at that difference. A noise spike from, say, a variable frequency drive arrives almost equally on both wires of a twisted pair and therefore cancels out. This principle is called common-mode rejection, and it is the reason RS-485 reaches much further than RS-232.

Key characteristics:

• Multidrop or multipoint - dozens of devices are connected in parallel to the same two wires, in a line or bus topology.
• Half duplex (2-wire) - only one device transmits on a pair at any moment; the others listen. The transmitter enables its driver to send and disables it afterwards.
• Full duplex (4-wire) - optional, with a separate pair for each direction.
• No protocol - RS-485 has no addresses, master or slave. In the OSI model it is purely layer 1.

The standard was first published in April 1983 as EIA RS-485. The current version is ANSI/TIA/EIA-485-A, approved in 1998 and reaffirmed in 2012. In practice almost everyone still calls it RS-485; EIA-485 and TIA-485 are the same standard.

🔧 What are the electrical characteristics of RS-485?

Two figures are often quoted incorrectly:

• “32 devices” really means 32 unit loads. Modern transceivers load the bus with 1/4 or 1/8 of a unit load, which allows 128 or 256 devices on one segment. The protocol may limit this again: Modbus RTU has 247 slave addresses, Profibus DP 126 addresses.
• “1200 metres at 10 Mbit/s” does not exist. Distance and speed trade off against each other. A widely used rule of thumb is that data rate (bit/s) multiplied by cable length (m) should stay below about 10⁸: 100 kbit/s over 1000 metres, or 10 Mbit/s over roughly 10 metres.

The common-mode range of −7 to +12 V means the ground potentials of transmitter and receiver may differ by a few volts. On long cables between buildings, each with its own earthing, that difference can grow larger; galvanically isolated transceivers or repeaters are then needed.

🔄 What is the difference between RS-485, RS-232 and RS-422?

A 4-wire RS-485 bus is sometimes called “RS-422” in documentation. That is not correct: RS-422 allows only one driver per pair, RS-485 allows several. Conversely, RS-485 devices often work fine on an RS-422 link.

🏭 Where is RS-485 used?

RS-485 is the physical layer beneath many well-known industrial protocols:

Typical places in a plant or building are the bus between a PLC or RTU and a row of energy meters, O stations along a production line, the link between an HMI and a controller, and communication with actuators such as valves and drives. Many solar inverters and battery systems also have an RS-485 port running Modbus RTU, a point that comes back in Solar Inverter Cybersecurity.

RS-485 should not be confused with M-Bus: that is a separate two-wire bus for utility meters, with different voltage levels and power supplied over the bus.

⚙️ How do you install an RS-485 bus correctly?

Most RS-485 faults are installation errors. The approach below follows the Modbus implementation guide from Modbus.org (version 1.02, 2006), which in practice also serves as a guideline for other protocols:

1. Choose the right cable - a shielded twisted pair with a characteristic impedance of about 120 Ω (Profibus: 150 Ω type A). According to Modbus.org, AWG 24 is always sufficient; a Cat 5 cable can reach about 600 metres.
2. Lay a line, not a star - one main cable (trunk) running from device to device (daisy chain). Stubs must stay short: never more than 20 metres for Modbus, and much shorter at high speeds.
3. Terminate both ends - one resistor at each end of the trunk, never on a stub and never more than two. Modbus specifies 150 Ω (0.5 W), or 120 Ω in series with 1 nF when the line is biased.
4. Ensure a defined idle state - when nobody transmits, the bus floats and receivers may see noise as data. Modbus therefore requires, at one point only, a pull-up on D1 and a pull-down on D0 of 450 to 650 Ω. Many modern transceivers have built-in failsafe receivers.
5. Run a reference wire - “2-wire” RS-485 needs a third conductor in practice: the signal common. Modbus makes it mandatory and recommends connecting it to protective earth at a single point, usually at the master.
6. Watch A and B - manufacturers do not use the labels A and B consistently. Modbus avoids the problem with D0 and D1, where D1 (B) is positive relative to D0 (A) in the idle state. If a device does not respond, swap the two signal wires first.
7. Respect the distance for the chosen speed - Modbus specifies 1000 metres at 9600 bit/s; Profibus DP reaches 1200 metres at up to 93.75 kbit/s, 1000 metres at 187.5 kbit/s, 200 metres at 1.5 Mbit/s and 100 metres at 12 Mbit/s. Use repeaters for longer distances or more devices.

Also follow EMC practice: do not run the cable in the same tray as motor cables, terminate the shield properly and isolate the bus galvanically at transitions between buildings.

🔐 How secure is RS-485?

RS-485 itself has no security at all: no authentication, no encryption and no integrity checking beyond what the protocol adds. Modbus RTU, for example, executes any valid command that appears on the bus. Anyone with physical access to the cable or a terminal strip can eavesdrop, change values or replay commands, as in a replay attack.

For a long time the serial bus was considered safe because it was not connected to a network. IT/OT convergence changes that: serial-to-Ethernet gateways expose old RS-485 devices via Modbus TCP or as a virtual COM port, often for edge or IIoT applications. An unprotected bus then becomes reachable from the IP network.

Practical measures:

• Place gateways in a separate zone following network segmentation and the zones and conduits model of IEC 62443.
• Restrict which function codes or registers a gateway passes through, preferably read-only.
• Secure physical access to cabinets, terminals and cable routes.
• Inventory RS-485 segments and gateways as part of your legacy systems; they are often missing from network scans.

Together these layers fit a defence-in-depth strategy.

❓ Frequently asked questions

Is RS-485 a protocol?

No, RS-485 is an electrical physical-layer standard, not a communication protocol. RS-485 defines voltage levels, loading and driver characteristics, but not what messages, addresses or master-slave roles look like. A protocol such as Modbus RTU, Profibus DP or BACnet MS/TP runs on top of it for that.

How many devices can you connect to an RS-485 bus?

An RS-485 bus is designed for 32 unit loads, which equals 32 classic transceivers per segment. With modern 1/8 unit load transceivers, up to 256 devices fit on one segment, and more with repeaters. The protocol may limit the number further, as Modbus RTU does with a maximum of 247 slave addresses.

Why does an RS-485 bus need termination resistors?

Termination resistors of about 120 Ω at both ends of an RS-485 bus prevent signals from reflecting at the end of the cable. Without termination, reflections corrupt the bits, especially at higher speeds and on long cables. A termination resistor never belongs on a stub or in the middle of the bus.

What do A and B mean on RS-485?

A and B are the two signal wires of the differential pair in RS-485. Manufacturers do not use the labels consistently, so A on one device sometimes has to connect to B on another. Modbus.org therefore uses D0 and D1, where D1 is positive relative to D0 in the idle state.

Does RS-485 need a ground wire?

Yes, in practice RS-485 needs a reference wire (signal common) in addition to the signal pair. It keeps the voltages of all devices within the permitted common-mode range of −7 to +12 V. The Modbus implementation guide therefore makes this third conductor mandatory.

Is RS-485 still relevant next to Industrial Ethernet?

Yes, RS-485 remains relevant because it is cheap, robust and suited to long cables, and because millions of meters, controllers and drives are equipped with it. New installations more often choose Industrial Ethernet or PROFINET, but RS-485 will stay in use in existing plants and buildings for years. Gateways connect both worlds, which does require extra security.

📌 In summary

RS-485 is the electrical foundation of much of the serial communication in factories and buildings. Differential signalling makes the bus immune to noise and suitable for long distances, while protocols such as Modbus RTU, Profibus DP and BACnet MS/TP define the content. Installing the bus correctly, with a line topology, termination, biasing and a reference wire, prevents most faults. Because RS-485 has no security of its own, gateways to the IP network deserve extra attention.

RS-485 is not a protocol but a robust differential physical layer for up to 32 unit loads over about 1200 metres, which forms the basis of Modbus RTU and other fieldbuses and offers no security of its own.