Modbus RTU vs Modbus TCP: Frames, Wiring, Speed and When to Use Each

Modbus RTU and Modbus TCP carry the same function codes and the same register model, defined in the Modbus Application Protocol specification. RTU sends compact binary frames over a serial line, usually RS-485, with one master, a slave address and a CRC-16. TCP wraps the same request in a 7-byte MBAP header and sends it over Ethernet to port 502, with no Modbus CRC. Pick by the physical network you have or are building.

Modbus RTU vs Modbus TCP at a glance

All figures above come from the Modbus Organization’s free specifications: the Modbus application protocol specification, the Modbus over serial line specification, the Modbus messaging on TCP/IP implementation guide and the Modbus/TCP Security protocol specification. Wikipedia’s Modbus article is useful further reading.

Frame by frame: RTU address and CRC-16 vs the 7-byte MBAP header

The same request in both formats: read two holding registers (function 03) starting at address 0 from device 1. The specification numbers registers from 1 but addresses them from 0 on the wire. In the common Modicon-style convention many manuals use, holding register 40001 is address 0.

Modbus RTU request

01 03 00 00 00 02 C4 0B
01     slave address
03     function: read holding registers
00 00  start address 0
00 02  quantity 2
C4 0B  CRC-16, low byte first

Modbus TCP request

00 01 00 00 00 06 01 03 00 00 00 02
00 01  transaction identifier
00 00  protocol identifier (0 = Modbus)
00 06  length: 6 bytes follow
01     unit identifier
03 00 00 00 02  the same PDU, no CRC

The PDU in the middle is identical; only the wrapper changes. Check a Modbus CRC-16 yourself: choose CRC-16/MODBUS and low byte first.

Reading the response: why do floats read wrong?

A 32-bit float needs two 16-bit registers. Modbus sends each register high byte first, but the Modbus application protocol specification does not say which register comes first, so master and device can disagree without any error. A pressure transmitter on a 0 to 50 bar range returns 01 03 04 41 26 66 66 A4 4E over RTU, or 00 01 00 00 00 07 01 03 04 41 26 66 66 over TCP. The two registers are 4126 and 6666 (hex):

Only ABCD falls inside 0 to 50 bar. These values match the free tool to decode Modbus float word order (ABCD, CDAB).

RTU is a protocol, RS-485 is the wire

Modbus RTU is a framing; RS-485 is the electrical layer it most often runs on. From the Modbus over serial line specification:

• Addresses: 1 to 247 for slaves, 0 for broadcast, one master at a time.
• Silent interval: frames are separated by at least 3.5 character times.
• Devices: 32 devices are always allowed on a segment without a repeater; more only if the device documentation says so. Transceivers rated at a fraction of a unit load raise this. TI’s RS-485 design guide notes that 1/8 unit load parts allow up to 256 nodes on an unbiased bus, but failsafe bias resistors can add up to 20 unit loads, which cuts that to about 96. The Modbus specification likewise reduces the allowed count by 4 when the line is polarised.
• Trunk length: up to 1000 m at a maximum of 9600 baud with AWG26 or wider cable, halved when 4-wire cable is used as a 2-wire system. Category 5 cable may be used up to 600 m.
• Drops: derivation cables never more than 20 m. Faster transceivers need shorter stubs, according to the same TI design guide (SLLA272).
• Termination: at both ends of the trunk only, a 150 ohm resistor, or 120 ohm in series with 1 nF where the line is polarised. Never on a drop, and none on RS-232.
• Bias (polarisation): one pair of resistors for the whole bus, pull-up to 5 V on D1 and pull-down to common on D0, between 450 and 650 ohm, usually at the master. The specification reduces the allowed device count by 4 when bias is fitted, and 650 ohm allows more devices than 450 ohm.

Check your values with the free RS-485 termination and bias calculator.

Speed and polling in practice: which is faster?

On RTU, the arithmetic

At the specification default of 19200 baud, 8 data bits, even parity and 1 stop bit, each byte takes 11 bits, about 0.573 ms. Reading 10 registers from one device:

1. Request, 8 bytes: about 4.58 ms.
2. Silent gap of 3.5 characters: about 2.01 ms.
3. Response, 25 bytes (address, function, byte count, 20 data bytes, CRC): about 14.32 ms.
4. Another 3.5 character gap: about 2.01 ms.
5. Total wire time: about 22.9 ms, plus the device’s own response time from its manual.

With 10 such devices on one segment, a full scan takes at least 229 ms plus ten device response times. Above 19200 baud the serial line specification recommends fixed timer values: 1.75 ms for the inter-frame gap (t3.5) and 750 µs for the inter-character time-out (t1.5). Read registers in blocks, up to 125 per request with function 03. If a slave answers only some of the time, rule out clock baud rate error at either end.

On TCP

Wire time is rarely the limit. The device’s response time, how many simultaneous requests it serves, and any gateway in the path, which brings back the serial timing above, decide the real speed. “Faster” depends on the network and the devices, not on the protocol name.

Ports and security: 502, 802 and authentication

• Modbus TCP uses registered port 502, as the TCP/IP implementation guide states.
• Plain Modbus defines no authentication: any client that reaches the port can read and write. NIST SP 800-82 Rev. 3 notes that many OT protocols have no authentication at any level.
• The Modbus/TCP Security protocol wraps Modbus in TLS, with X.509v3 certificates for authentication and role-based authorisation, on port 802. Check that both ends support it before relying on it.
• Keep plain Modbus TCP on a segmented OT network, never on the internet.

Multiple clients on Modbus TCP vs one master on an RTU bus

An RTU bus has exactly one master, and slaves never talk to each other. Modbus TCP uses a client and server model: the TCP implementation guide lets a server accept several connections and serve several requests at once, up to a limit set by the device’s design, and several transactions can share one connection using the transaction identifier. So two SCADA systems can read one TCP device directly, if the device allows enough connections, but two masters cannot share one RS-485 segment.

Modbus RTU over TCP is not Modbus TCP

Some serial device servers forward raw RTU frames, CRC and all, inside a TCP stream, often called “RTU over TCP”. That is not the Modbus TCP format: there is no MBAP header, and framing still depends on the CRC. A Modbus TCP client talking to such a server, or the reverse, gets garbage or timeouts. Set both ends to the same mode.

Converting RTU to TCP: gateways and the Unit Identifier

A Modbus TCP to RTU gateway is a TCP server on the Ethernet side and the single RTU master on the serial side. The TCP implementation guide says the Unit Identifier carries the serial slave address through the gateway; for a device directly on Ethernet it recommends 0xFF. Plan for:

• requests from several TCP clients being queued and sent one at a time on the serial side;
• a gateway serial timeout longer than the slowest device’s response, and a client timeout longer still;
• a table of IP address, Unit Identifier and serial address for every device.

Which one should you choose for your panel?

For moving whole machines onto a plant system, OPC UA is often the better upper layer; see our guide to retrofitting legacy machines with OPC UA or Modbus.

Where does Embedos fit?

The Embedos 4G Ethernet Modbus gateway page lists Modbus RTU and Modbus TCP with RS-485, Ethernet, Wi-Fi and 4G interfaces.

Decode your registers with the free Modbus register interpreter, and size your bus with the RS-485 termination and bias calculator.