IoTOctober 19, 202612 min readBy IoT Insights Hub Editorial Team

What Is Modbus? Ultimate Guide with 7 Real-World IoT Uses

Ask an engineer what is Modbus and you will often get a shrug and a smile. It is old, plain and a little awkward. It also sits inside a huge number of energy meters, drives, pumps and controllers, which is why it keeps showing up in IoT projects.

This guide from IoT Insights Hub explains how the protocol works, the difference between RTU and TCP, what registers and function codes are, seven real uses, and where it falls short. Where a figure comes from a vendor page, or is old, the text says so.

New to connected devices? Read our beginner guide to IoT first. Modbus is the wired, industrial cousin of the wireless protocols we cover in our explainer on what is Zigbee.

What is Modbus and where did it come from?

Per Wikipedia, Schneider Electric bought Modicon in 1997, and in 2004 the rights moved to the Modbus Organization, a trade association of users and suppliers. A National Instruments page repeats a promotional line calling the Modbus Organization the steward of “the world’s most widely adopted industrial communication protocol,” so read that with a grain of salt. The royalty-free part is easier to check: Wikipedia calls the protocol “openly published and royalty-free.”

That openness explains the longevity. A drive maker, a meter maker and a PLC maker can all add Modbus without a licence fee, and a buyer can mix their kit on one cable. National Instruments describes the aim as making communication possible between automation devices, and it says the basic standard has barely changed in decades.

Modbus works at the application layer. It defines what a message means, how data is addressed and how it is formatted, and it leaves the wiring to something else. If you want to see where that sits in a larger design, our guide to IoT architecture maps the layers.

How does Modbus work?

The Modbus pattern: the client asks, a server answers.

Wikipedia says a serial bus can carry up to 247 servers, addressed 1 to 247, with address 0 reserved for broadcast. Addresses 248 to 255 are reserved. Schneider Electric’s FAQ describes the same one-client, 247-server layout, and it notes a non-standard two-byte addressing extension that raises the limit to 65,535 servers if both ends support it.

The cost of this design is polling. Wikipedia explains that field devices on serial links cannot send events by themselves, so the client has to keep asking, and that uses bandwidth. Wikipedia notes an exception for Ethernet TCP/IP, sometimes called open-mbus.

In practice, a typical setup has a gateway acting as the client, reading values from meters and drives on a schedule, then forwarding them upward. That forwarding step is often where lightweight messaging takes over, and our explainer on what is MQTT covers the protocol most gateways use to reach the cloud.

What is the difference between Modbus RTU, ASCII and TCP?

The table below uses Wikipedia, National Instruments and Schneider Electric. Where we add a judgement, it is marked as our view.

Two points are easy to miss. First, RTU depends on timing. Wikipedia says frames are separated by silent intervals of 3.5 character times, and National Instruments warns that USB-to-serial adapters can introduce gaps that cause RTU timing errors. Second, the TCP header carries a unit ID, which National Instruments says is typically unused on devices that have their own IP address.

RTU usually rides on RS-485. Wikipedia describes it as a multi-drop bus, supports at least 32 unit loads, recommends wiring it as a line rather than a star, and says cables should be terminated at each end to match the cable’s impedance, typically 120 ohms for twisted pair. It puts the reach at up to 1,200 m (4,000 ft), but only at lower speeds.

National Instruments says ASCII is worth a look if RTU causes timeouts or the link is very slow, such as 300 bps or a dial-up modem. Modern installs rarely need that. For a sense of speed, Schneider Electric’s page uses 9600 baud as a typical serial example, and Grundfos calls Modbus slower than many other fieldbuses but stable, simple and proven.

What are Modbus registers and function codes?

Per Wikipedia, each table allows up to 65,536 items, addressed 0 to 65,535. Two are read-only and two are read and write.

Here is where beginners trip. The familiar numbers such as 40001 are reference names, not the address sent on the wire. National Instruments explains that coil 1 sits at address 0 in the message itself, so many tools shift everything by one. When a reading looks wrong by one slot, that is the first thing to check.

Wikipedia lists many more, including 22 (mask write), 23 (read and write multiple registers) and 43 (device identification). National Instruments adds that function 43 is “not commonly implemented,” so do not count on it. If a request fails, the server replies with an exception code: 01 for an illegal function, 02 for an illegal address, 03 for illegal data and 04 for an unrecoverable server error.

Some practical limits matter. National Instruments says masters often limit reads to 125 holding registers at a time. A 32-bit value needs two registers, and the standard does not define byte or word order, so you must match each device’s habit. In IoT Insights Hub’s view, that single gap causes more first-day debugging than anything else.

What is Modbus used for? 7 real uses

1. PLC and drive control. National Instruments says Modbus can replace discrete wiring between a PLC and a variable-frequency drive, covering start and stop, direction, speed setpoint and fault monitoring over one shared cable.
2. Energy, water and heat metering. MIVO lists energy, electricity, water and heat meters among Modbus applications, with registers such as 40001 for voltage and 40004 for energy consumption in its example. A gateway polls them as the client.
3. HVAC and building management. Grundfos says Modbus is used in building management systems for offices, schools, airports, hotels and hospitals, and in HVAC. It cites remote control, scheduling, trending and alarming as services.
4. Solar and battery storage. MIVO lists solar power systems, battery storage, heat pumps and EV charging infrastructure among Modbus uses, usually read by a gateway for an energy management system.
5. Pumps and water systems. Grundfos names wastewater and water supply among the places its Modbus-connected products serve, alongside process and factory automation. It says status messages, alarms, operation hours and energy use can be passed to the building manager.
6. SCADA and supervisory monitoring. Schneider Electric says Modbus moves data between instruments, controllers and supervisory systems such as SCADA, which is how plant operators see many devices from one screen.
7. Gateways that feed IoT platforms. MIVO says a gateway can act as the Modbus client and forward values to cloud IoT platforms, energy management and reporting tools. National Instruments also describes gateways that expose wireless field-instrument data to Modbus masters.

Across all seven, what is Modbus doing? In IoT Insights Hub’s reading, it is moving small, numeric values between devices that were never designed to talk to each other, using one common set of tables. For the wireless side of the same jobs, compare it with our guide to Zigbee vs LoRaWAN, and for mixed estates see our piece on multi-protocol IoT systems.

A reading is only useful if someone sees the alarm. IoT Mail Bridge explains how to turn device events into email in its guide to setting up IoT email automation. For larger fleets, see its write-up on a reliable SMTP relay for IoT and M2M fleet alerts.

Is Modbus secure?

The Modbus Organization’s 29 October 2018 press release describes Modbus Security as traditional Modbus wrapped in Transport Layer Security. It uses X.509v3 certificates to authenticate both client and server, and a certificate extension carries role-based access control. The release says interoperability was first shown in May 2017 by four member companies and that products were expected in 2019. The specification is free on modbus.org.

IoT Insights Hub could not confirm how many devices ship with it today, so treat adoption as unknown. Our view is that most Modbus you meet in the field is still plain, which means the network around it has to do the protecting.

• Keep Modbus on its own network segment, away from office and guest traffic.
• Never expose port 502 to the open internet.
• Put a gateway between Modbus devices and the cloud, and let the gateway handle encryption and logins.
• Log which clients write to holding registers and coils, since writes change equipment behaviour.

Those four points are IoT Insights Hub’s practical advice, not quotes from a standard. For wider habits, read our guide to IoT security risks and how to fix them. IoT Mail Bridge covers the data-in-transit side in its piece on edge-to-cloud data security for IoT fleets.

What do critics say about Modbus?

• No security: Wikipedia says there is no protection against unauthorised commands, and MIVO says there is no built-in encryption.
• Polling overhead: on serial links the client must keep asking, per Wikipedia, which wastes bandwidth and adds delay.
• Manual setup: MIVO says each device typically needs to be configured by hand, because Modbus has no automatic device identification.
• Thin data model: MIVO says it is designed mainly for numbers. The standard defines only the bit and the unsigned 16-bit word, per National Instruments, so strings and floats vary by vendor.
• Address limits: 247 servers on one serial link, per Wikipedia.
• Fragmentation: Wikipedia says variants such as Pemex Modbus and Enron Modbus are extensions that are not interoperable with the rest.
• Vendor bias: several pages IoT Insights Hub read come from companies selling Modbus gateways or meters, so their praise for simplicity is not neutral.

It is also worth separating Modbus from newer options. If you need self-describing data, events and strong security, protocols such as MQTT or OPC UA fit better, though that comparison is our view and not a finding from the sources above. For power trade-offs on the wireless side, see our guide to energy-efficient IoT protocols.

Modbus FAQs

Is Modbus still worth using?

For reading numbers from meters, drives and controllers, yes. It is simple, open and understood by almost every industrial vendor. For anything that needs security, events or rich data, put a gateway in front of it and use a modern protocol upstream. If you remember what is Modbus in one line: a plain, durable way for a client to ask devices for numbers.

IoT Insights Hub will keep publishing practical, sourced guides on IoT protocols and industrial networks. For the business side of building in this space, read The Business Perspective’s guide to raising seed funding.