Definition
Modbus is a widely used serial communication protocol in the industrial field, including Modbus RTU (based on RS-485 serial port) and Modbus TCP (based on Ethernet). It is used for data acquisition and control of industrial devices such as PLCs, sensors, instruments, and inverters, supporting function codes 01/02/03/04/05/06/15/16 for reading and writing coils and registers.
Protocol Variants
Modbus RTU: based on RS485 half-duplex, master-slave polling, CRC check, typical baud rate 9600; Modbus ASCII: better readability, lower efficiency; Modbus TCP: based on Ethernet, on TCP port 502, adds MBAP header, convenient for cross-network usage. Industrial gateways, RTU, DTU often support Modbus RTU data acquisition and convert it to Modbus TCP, MQTT, OPC UA, etc. for reporting.
Function Codes and Data Area
01 Read Coil, 02 Read Discrete Input, 03 Read Holding Register, 04 Read Input Register, 05 Write Single Coil, 06 Write Single Register, 15 Write Multiple Coils, 16 Write Multiple Registers. Register addresses are usually 0–65535, and different devices have conventions for address mapping (e.g., 40001 Holding Register). Industrial gateways need to configure slave address, register mapping, and data types (INT16/UINT32/Float, etc.) according to the device manual.
Use Cases
PLC, inverter, instrument, sensor data acquisition; SCADA, DCS, MES device integration; AMR meter reading, EMS energy management; industrial IoT edge gateway protocol conversion. Modbus is the de facto industrial standard, widely supported by devices, with low integration cost.
Address Model and Master Polling
Coils and registers are not the same kind of quantity
The protocol splits field values into tables that are not interchangeable. Coils and discrete inputs are bits. Holding registers and input registers are words. A function code that reads coils cannot be used to read an analog value, and the frame length for writing one register is not the length for writing a block of registers. The master sends slave address, function code, start address, and quantity. The slave answers only its own frame. Nothing on the bus reports on its own, so the scan period is entirely the master's schedule. As slaves are added, the worst-case response is the sum of every device's timeout.
The serial variant is half duplex on a differential or three-wire link. The end of a frame is judged by a silent gap, and the check is a cyclic redundancy code. The Ethernet variant puts the same function codes into TCP, by convention on port 502, with a transaction identifier in front so several requests can be in flight. The device's internal queue may still not survive that concurrency. If a gateway maps serial slaves onto several TCP connections and reads them at once, there is still only one half-duplex wire underneath. Requests queue in the gateway, and the timeout has to be recalculated for the time after that queue.
A half-duplex bus allows only one master
On a serial link, one physical bus allows only one master to poll. A second master, a laptop left plugged in for debugging, or another gateway that is also broadcasting will smash the reply frames. Slave addresses must be unique on that bus. If baud rate, parity, or stop bits disagree on even one of three devices, that one device times out forever while the other slaves stay healthy. The fault looks like "this one device is broken."
It fits instruments, drives, and small controllers whose point list is stable and whose refresh sits between a hundred milliseconds and a few seconds, with the collector reading on its own initiative. It does not fit a large burst of alarms, and it does not fit a slave that needs to speak at any moment. When events must be pushed, convert the polled result to some other report inside the gateway. Do not expect the slave to speak for itself. When talking to a PLC, confirm first whether the data sits in holding registers or input registers, then choose the function code.
Word order, bit order, and address offset
Address offset is where integration most often goes wrong. Some manuals number holding registers from 0. Others treat 40001 as the first word. If the configuration tool then subtracts one on its own, you read the neighboring register. The value looks present and is wrong. A 32-bit integer or a float spans two registers. The word order may be high word first or low word first, and the bytes inside a word may be swapped again. Without checking a known physical quantity against the manual, the scaled engineering value will be off by an order of magnitude.
Writes are more dangerous than reads. Mapping a command point onto a coil, or a setpoint onto the wrong register, makes the field device move at once. Commission read-only first. Confirm the slave address, the function code, and one or two known quantities, then open writes. Parse exception codes on their own: a slave answering "illegal address" is not the same fault as the master timing out. Two masters fighting for the bus, a broadcast write that cannot be confirmed, and treating the object model of EtherNet/IP as a flat register address all produce intermittent errors that will not repeat on demand.