Modbus in plain terms: how the protocol works

Modbus is the most widespread industrial communication protocol. Controllers, sensors, meters, and SCADA exchange data over it. If a device "speaks Modbus," it can almost always be connected to a supervisory control system. In this article, Atlas Scada engineers explain in plain terms how Modbus works.

What Modbus is

It is an open protocol for exchanging data between devices on a master-slave principle. The master (for example, a controller or SCADA) polls the slaves (sensors, instruments) and reads values from them or sends commands. Its openness and simplicity have made Modbus the de facto standard in industry.

Modbus RTU and Modbus TCP

• Modbus RTU — transmission over an RS-485 serial line (less often RS-232). Cheap and reliable over long distances, but slower; devices are connected in a bus.
• Modbus TCP — the same protocol over Ethernet and a TCP/IP network. Faster, convenient for communicating with servers and SCADA, and it uses ordinary network infrastructure.

The communication logic is the same in both cases — only the "transport" differs.

How the exchange works

The master sends a request containing the device address and a function code (read or write), and the slave responds with data. Every device on the bus has its own unique address. If a device does not respond, the master logs a communication error.

Registers and coils

Data in Modbus is organized into four areas

• Discrete Inputs — discrete inputs (read-only): an "on/off" state.
• Coils — coils (read and write): discrete outputs, commands.
• Input Registers — input registers (read-only): analog values.
• Holding Registers — holding registers (read and write): setpoints and parameters.

To read a value correctly, you need to know the register address, its type, and the data format (integer, floating-point number, multiplier) — this is taken from the device's register map (Modbus map).

Common problems

• Wrong device or register address — no data, or "garbage."
• Different baud rate/parity settings on RS-485 — no communication.
• An unaccounted-for data format (byte order, multiplier) — incorrect values.
• Missing termination resistors on a long RS-485 line — failures.

Register addressing

A common source of confusion is register numbering. In documentation, addresses may start "from one" (for example, 40001) or "from zero" (0). When configuring, it is important to understand which addressing the device uses and which the SCADA uses, otherwise data is read from the wrong registers.

Modbus and security

Modbus was designed for reliability, not for protection: it has no encryption and no authentication. That is why Modbus networks are kept in a trusted segment, and remote access is arranged through secure channels and a supervisory platform rather than exposed directly "to the outside."

Where Modbus is used

Boiler houses and heating substations, pumping stations, ventilation, energy resource meters, variable-frequency drives, operator panels. Practically any modern industrial equipment supports Modbus — which is why it is convenient for integrating heterogeneous systems.

The key points in brief

Modbus is a simple and reliable way to make equipment from different manufacturers "get along." RTU works over RS-485, TCP over Ethernet; data is stored in registers and coils, and correct reading requires the device's register map. Atlas Scada configures Modbus RTU/TCP communication when programming controllers and deploying SCADA — and the equipment starts "talking" to the supervisory system.