Modbus RTU - Industrial Software Protocol over RS-485

Modbus RTU is a simple industrial application protocol commonly carried over RS-485. RS-485 moves differential electrical signals. UART frames bytes. Modbus RTU defines what the bytes mean: slave addresses, function codes, register addresses, data fields, and CRC error checks.

Created by Modicon in 1979, Modbus remains common in power meters, temperature controllers, variable frequency drives, solar inverters, water systems, and building equipment.

Learning Objectives

By the end of this lesson, you should be able to:

Explain the difference between Modbus RTU, UART, and RS-485.
Decode the fields in a Modbus RTU request and response.
Identify common function codes for coils and registers.
Calculate frame timing from baud rate and character-time gaps.
Interpret register values using scaling and byte order from a device manual.
Troubleshoot no-response, CRC, timeout, and illegal-address problems.

Hardware vs Software

flowchart TD M["Modbus RTU\nApplication protocol\nAddresses, function codes, registers, CRC"] --> U["UART\nByte framing\nStart bit, data bits, parity, stop bit"] U --> R["RS-485\nDifferential electrical bus\nA/B lines, termination, biasing, cable length"]

The same RS-485 wiring could carry many protocols. Modbus RTU is one of them. The same Modbus data model can also run over Ethernet as Modbus TCP.

Master-Slave Polling

Classic Modbus RTU has one master and up to 247 slave addresses. The master initiates every transaction. Slaves never speak unless addressed.

sequenceDiagram participant M as Master PLC participant P as Slave 1 Power Meter participant T as Slave 2 Temp Controller participant V as Slave 3 VFD M->>P: Read holding registers 0000 count 2 P-->>M: Voltage and current registers M->>T: Read input register 0000 count 1 T-->>M: Process temperature M->>V: Write single register speed command V-->>M: Echoed write confirmation

Address 0 is broadcast. Slaves process a broadcast write but do not reply, so broadcasts cannot confirm individual device success.

Modbus RTU Frame Format

Request or response:

+---------------+---------------+-------------------+---------------+
| Slave address | Function code | Data              | CRC-16        |
| 1 byte        | 1 byte        | 0 to 252 bytes    | 2 bytes       |
+---------------+---------------+-------------------+---------------+

Field	Purpose
Slave address	Selects device `1` to `247`; `0` means broadcast
Function code	Defines the operation, such as read or write
Data	Register address, count, byte count, values, or exception code
CRC-16	Detects corrupted frames; transmitted low byte first

Modbus RTU uses silent gaps rather than a length field to separate frames.

End of frame gap >= 3.5 character times
Inter-character gap within frame <= 1.5 character times

At 9600 baud with 8 data bits, no parity, and 1 stop bit, one character is about 10 bit times:

Character time = 10 bits / 9600 bit/s = 1.04 ms
3.5 character gap = 3.65 ms

With parity or two stop bits, use 11 bit times per character.

Common Function Codes

Code	Name	Data type	Typical use
`01`	Read Coils	Read/write bits	Output relays, commands
`02`	Read Discrete Inputs	Read-only bits	Limit switches, status inputs
`03`	Read Holding Registers	Read/write 16-bit words	Setpoints, measurements, configuration
`04`	Read Input Registers	Read-only 16-bit words	Measurements and status words
`05`	Write Single Coil	One bit	Start/stop command
`06`	Write Single Register	One 16-bit word	Setpoint or configuration value
`15`	Write Multiple Coils	Packed bits	Batch output command
`16`	Write Multiple Registers	Multiple words	Parameter block write

Function code 03 is the one you will use most often when reading meters and drives.

Worked Example: Read Two Holding Registers

Request from master to slave 1:

01 03 00 00 00 02 C4 0B

Bytes	Meaning
`01`	Slave address 1
`03`	Read holding registers
`00 00`	Starting register address 0
`00 02`	Read 2 registers
`C4 0B`	CRC-16, low byte first

Example response:

01 03 04 02 3A 01 F4 XX XX

Bytes	Meaning
`01`	Slave address 1
`03`	Function code echoed
`04`	Four data bytes follow
`02 3A`	Register 0 = 570 decimal
`01 F4`	Register 1 = 500 decimal
`XX XX`	CRC bytes

If the device manual says register 0 is voltage in tenths of a volt, 570 / 10 = 57.0 V. If register 1 is current in hundredths of an amp, 500 / 100 = 5.00 A.

Register Maps and Scaling

A Modbus register number is only meaningful with the device manual.

Register	Example meaning	Scale
`0000`	Line voltage	divide by 10
`0001`	Current	divide by 100
`0002`	Power	direct watts
`0100`	Baud rate setting	enumerated value
`0101`	Slave address	integer 1 to 247

Watch for three common address conventions:

Protocol address 0 may be printed as register 40001.
Some manuals start at 1; libraries often expect zero-based addresses.
Multi-register values may use word order ABCD, BADC, CDAB, or DCBA.

Exception Responses

If a slave receives a valid frame but cannot execute it, the response function code equals the request function code plus 0x80.

01 83 02 XX XX

Byte	Meaning
`01`	Slave address
`83`	Error response for function `03`
`02`	Exception code: illegal data address
`XX XX`	CRC

Common exception codes:

Code	Meaning	Common cause
`01`	Illegal function	Device does not support that operation
`02`	Illegal data address	Wrong register number or count
`03`	Illegal data value	Value outside allowed range
`04`	Slave device failure	Device could not complete the action

Practical Checks

Match baud rate, parity, stop bits, slave address, and protocol mode on every device.
Terminate RS-485 only at the two physical ends of the bus.
Use bias resistors or a transceiver with failsafe biasing when the bus idles unpredictably.
Confirm whether the software library expects zero-based or one-based register addresses.
Verify CRC byte order and Modbus word order before assuming a sensor is wrong.
Poll at a rate the slowest slave can answer; leave turnaround time on half-duplex buses.
Keep Modbus RTU off untrusted links unless a secure gateway or network control is in place.

Common Mistakes

Swapping A/B lines without checking the vendor's naming convention.
Using two masters on the same RS-485 segment.
Forgetting that register 40001 is often protocol address 0.
Reading a 32-bit float as two independent 16-bit integers.
Polling too quickly and causing timeouts on slower devices.
Blaming CRC errors on software when the bus lacks termination, biasing, or shielding.

Summary

Modbus RTU is a compact request-response protocol for industrial devices. It defines slave addresses, function codes, register access, binary frames, CRC checks, and silence-based frame boundaries. RS-485 is only the physical bus underneath it. Reliable Modbus work depends on correct serial settings, register addressing, scaling, byte order, bus wiring, and realistic polling timing.

Mind Map

mindmap root((Modbus RTU)) Core concept Master polls slaves Binary serial frames Runs often on RS-485 Applications Power meters VFDs Controllers Solar inverters Frame math Address one byte Function one byte CRC16 low byte first Gap at least 3.5 chars Design rules One master per bus Match serial settings Terminate bus ends Use correct register base Practical checks CRC errors Timeout timing Word order Scale factors Common mistakes A/B swap Two masters 40001 offset Polling too fast