IoTOctober 21, 202612 min readBy IoT Insights Hub Editorial Team

Modbus RTU vs TCP: Ultimate Guide with 7 Key Differences

Modbus RTU vs TCP looks like a big decision. In practice it is a smaller one than most people expect. Both speak the same Modbus, so the choice comes down to what is between your controller and your devices: a twisted-pair cable or an Ethernet network.

This guide from IoT Insights Hub sets out the seven differences that matter, which one suits which job, how to mix them, and where they share the same weaknesses. Where sources disagree or come from vendors, the text says so.

If the basics are new to you, read our explainer on what is Modbus first. It covers the client and server roles, the four data tables and the function codes that both variants share.

What is the main difference in Modbus RTU vs TCP?

The same Modbus message, wrapped two different ways.

Per Wikipedia, the PDU is the function code plus its data, with a maximum of 253 bytes. The full frame, the ADU, tops out at 256 bytes on RS-232 or RS-485 and 260 bytes over TCP. That 7-byte difference is the TCP header.

Wikipedia describes RS-485 two-wire as the most popular serial option, and Modbus TCP as running on port 502. National Instruments adds that all three variants, including ASCII, carry the same kind of messages and differ in how those messages are packaged.

What are the 7 key differences between Modbus RTU and TCP?

1. Medium and wiring

RTU usually runs on RS-485, a multi-drop serial bus. Wikipedia says it should be wired as a line rather than a star, with termination at each end that matches the cable, typically 120 ohms for twisted pair. Wevolver describes the same daisy-chain layout.

TCP runs over standard Ethernet. Wevolver says devices connect to switches or routers in star, tree, ring or mesh layouts. For a building that already has network cabling, that can mean no new cable at all.

2. Frame and error checking

An RTU frame is the address, the PDU and a 2-byte CRC. Wikipedia says the CRC is CRC-16, sent low byte first. Schneider Electric also notes the last two bytes of a serial message are the CRC.

TCP leaves the CRC out. Wikipedia explains that no checksum is needed because lower layers provide one. Instead, the MBAP header carries a transaction ID, a protocol ID, a length and a unit ID, per Wikipedia.

3. Frame timing

Here is where RTU can bite. It has no start or end marker, so the receiver finds frame boundaries from silent gaps. Wikipedia puts the gap at 3.5 character times, and each RTU byte is 11 bits with even parity by default.

National Instruments warns that USB-to-serial adapters can introduce gaps that cause RTU timing errors. TCP avoids the whole issue, because the length field in the header says where the message ends.

4. Addressing and device limits

On a serial bus, Wikipedia says servers are addressed 1 to 247, with address 0 for broadcast. Wevolver adds a practical limit: modern RS-485 transceivers allow up to 32 servers without repeaters, and repeaters can raise the count to 247. Its own text is inconsistent on this point, so check your transceiver datasheet.

TCP addresses devices by IP address instead. The 1-byte unit ID matters mainly behind a gateway, where, per a distributor knowledge-base page from Industrial Monitor Direct, it carries the downstream serial address. National Instruments says it is typically unused on devices with their own IP.

5. Speed and distance

Wikipedia puts RS-485 reach at up to 1,200 m (4,000 ft), but only at lower speeds. Wevolver says RS-485 typically runs from 1.2 to 115.2 kbaud, while Schneider Electric’s own example uses 9600 baud.

Ethernet is faster. Wevolver lists 10 Mb/s, 100 Mb/s and 1 Gb/s or higher, with 100 m per copper segment and effectively no limit once you add switches and routers. That said, Modbus messages are small, so IoT Insights Hub’s view is that raw link speed is rarely your bottleneck. That is a judgement, not a sourced finding.

6. Multiple clients

A serial Modbus bus has one client. Wikipedia says only the client starts a transaction, and that on serial links the client has to poll because field devices cannot send events on their own.

TCP can serve several clients at once. The Industrial Monitor Direct page says the protocol sets no connection limit, that embedded servers commonly allow 4, 8, 16 or 32 concurrent connections, and that there is no write arbitration, so the last writer wins. It is a distributor’s page and gives some figures without a source, so treat the numbers as rough.

7. Security

Neither variant has built-in security. Wikipedia says the protocol offers no protection against unauthorised commands or interception. Wevolver notes that on RTU the main protection is physical, since an attacker needs access to the cable, while TCP is reachable by anyone on the network.

The Modbus Organization announced Modbus Security in October 2018, which wraps Modbus in TLS and uses port 802. More on that in the security section below.

Which should you pick in the Modbus RTU vs TCP decision?

Cost is part of it. Wevolver says RTU hardware is low-cost and Ethernet hardware slightly more expensive, though existing cabling can cut installation cost. It also says RTU may need field visits for maintenance, while TCP allows remote diagnostics. Those are one author’s views, so weigh them against your own site.

Whichever you pick, plan what happens to the data next. A gateway often forwards readings upward using a lightweight protocol, and our explainer on what is MQTT covers the most common one. For the bigger picture, see our guide to industrial IoT architecture.

Can Modbus RTU and TCP work together?

Wevolver calls this a common hybrid: RTU on the factory floor, with a TCP gateway collecting data from each RTU segment and passing it to SCADA over Ethernet. The Industrial Monitor Direct page describes the same gateway steps and says one socket can reach up to 247 serial addresses through it.

Two cautions. First, the unit ID matters here, because behind a gateway it selects which serial device you are talking to, and some gateways reject the default 255, per the same page. Check the gateway manual. Second, a gateway adds delay. That page claims 5 to 50 ms, but gives no source, so measure it yourself.

If your site mixes protocols beyond Modbus, our guide to multi-protocol IoT systems shows how to keep them tidy. A gateway also turns device events into alerts, and IoT Mail Bridge explains the email side in its guide to setting up IoT email automation. For larger fleets, see its write-up on a reliable SMTP relay for IoT and M2M fleet alerts.

Is Modbus RTU or TCP more secure?

The Modbus Organization’s 29 October 2018 press release says Modbus Security combines Transport Layer Security with traditional Modbus, uses X.509v3 certificates to authenticate server and client, and carries role-based access control in a certificate extension. It says interoperability was first shown in May 2017 and that products were expected in 2019.

IoT Insights Hub could not confirm how many devices ship with it today. In IoT Insights Hub’s view, the safest assumption is that your Modbus is plain, which means the network has to do the protecting.

• Keep Modbus on its own network segment, away from office and guest traffic.
• Never expose port 502 to the internet.
• Put a gateway between Modbus devices and the cloud, and let it handle logins and encryption.
• Log which clients write to coils and holding registers, since writes change how equipment behaves.

Those four points are IoT Insights Hub’s practical advice, not quotes from a standard. For wider habits, read our guide to IoT security risks and how to fix them and our piece on industrial cybersecurity. IoT Mail Bridge covers the data-in-transit side in its piece on edge-to-cloud data security for IoT fleets.

What do critics say about Modbus RTU vs TCP?

• Shared weaknesses: both variants have no built-in security, per Wikipedia and Wevolver, and both rely on the client polling.
• Source quality: the Wevolver comparison is a single-author article. It gives 32 devices in one place and 247 in another, and calls Modbus TCP both connection-oriented and connectionless.
• Vendor bias: the Industrial Monitor Direct page is a distributor’s knowledge-base article with product promotion, and some of its figures have no source.
• No live measurements: none of the pages we read tested RTU and TCP side by side, so claims about response times are not backed by data here.
• Not always cheaper or simpler: TCP can mean more hardware, and Wevolver itself calls Ethernet hardware slightly more expensive.
• Timing risk on RTU: the 3.5-character gap rule can cause errors with USB adapters, per National Instruments.

It is also fair to ask whether either is the right choice for new designs. If you need self-describing data, events and strong security, a newer protocol may fit better. That is IoT Insights Hub’s view, and our guide to Zigbee vs Z-Wave shows the same kind of trade-offs on the wireless side.

Modbus RTU vs TCP FAQs

So, Modbus RTU vs TCP: which one wins?

Neither wins outright. Choose RTU for a few devices on one cable and for older gear. Choose TCP for networked sites and remote access, and use a gateway when you need both. In the Modbus RTU vs TCP choice, the message is the same, so the wire and the network around it decide.

IoT Insights Hub will keep publishing practical, sourced guides on IoT protocols and industrial networks. For the business side of building in this space, read The Business Perspective’s guide to raising seed funding.