Modbus is an industrial communication protocol published by Modicon in 1979 and maintained today by the Modbus Organization. It defines a data model of 16-bit registers and 1-bit coils that a client reads from or writes to a server, in serial variants (RTU and ASCII) and over Ethernet (Modbus TCP). It is royalty-free.
Modbus RTU, Modbus ASCII and Modbus TCP
There is one protocol; what changes is the wrapper it travels in. Modbus RTU uses a compact binary frame protected by a 16-bit CRC, usually over two-wire RS-485, a multidrop bus shared by every device on the segment. Frames are not delimited by special characters but by silence: a gap of roughly 3.5 character times separates one message from the next, which makes link timing part of the protocol. Modbus ASCII sends each byte as two hexadecimal characters, starts frames with a colon, ends them with CR/LF and checks them with an LRC; it doubles the bandwidth cost in exchange for tolerating slow or gappy links, and is rare today. Modbus TCP wraps the same request in a TCP frame with an MBAP header (transaction identifier, protocol identifier, length, unit identifier) on port 502; the CRC disappears because TCP handles integrity, and several clients can query the same server concurrently.
RTU and TCP are therefore not successive versions but different topologies. RTU allows a single master per segment polling slaves in turn, with addresses 1 to 247 (0 reserved for broadcast) and typical speeds of 9600 or 19200 baud. TCP inherits Ethernet concurrency and IP addressing, and also its lack of determinism: nothing guarantees when the reply arrives.
Registers, coils and addressing
Modbus organises data into four tables: coils (1 bit, read/write), discrete inputs (1 bit, read-only), input registers (16 bit, read-only) and holding registers (16 bit, read/write). The common functions are 01 and 02 for bits, 03 and 04 for registers, and 06 and 16 for writes. A single register read returns at most 125 registers; a coil read, 2000 bits.
Addressing is where projects lose time. On the wire, addresses are zero-based 16-bit offsets, but vendor documentation traditionally numbers from 1 and prefixes each table: the well-known 40001 is holding register 0 in the frame. On top of that, a register holds only 16 bits, so a 32-bit integer or a float spans two consecutive registers, and while the standard fixes byte order within a register it says nothing about the order of the two registers relative to each other: the classic word swap that returns nonsense until the pair is flipped. Above all, Modbus carries no units, no data type, no scaling and no timestamp: a register holding 235 may be 23.5 °C or 235 rpm, and only the vendor register map settles it.
Where you find it on the plant floor
Modbus is the lowest common denominator of the installed base: power analysers and energy meters, variable-frequency drives, weighing systems and load cells, temperature controllers, compressors, boilers and chillers, water treatment instrumentation, and practically any device whose vendor wanted an open interface without paying for a protocol stack. A typical plant runs two layers side by side: recent machines exposing OPC-UA, and auxiliary equipment that only speaks Modbus over RS-485, often already wired into the SCADA cabinet.
Modbus versus OPC-UA
Treating them as same-level alternatives is the usual mistake. Modbus moves numbers without context: the reader must know in advance what each address means. OPC-UA also moves an information model, where each variable carries name, type, units and hierarchy, supports subscription on value change instead of continuous polling, and includes authentication, encryption and message signing. The base Modbus specification defines no security at all (a TLS variant exists but is rarely found in the field) so protection depends entirely on network segmentation. In exchange, Modbus fits in a cheap microcontroller, which is exactly why it is still everywhere.
What it takes to get data out of a Modbus device
Extracting Modbus data means polling: there are no events or notifications, someone asks and the device answers. Three consequences follow.
Latency is set by the poll cycle, not by the network. Every read is a round trip and serial bandwidth is scarce: reading a hundred registers at 9600 baud occupies the line for roughly two tenths of a second in transmission alone, before device response times. With a one-second cycle, any event shorter than that cycle may never be seen. The engineering rule is to prefer accumulated counters over instantaneous states when the cycle is slow: a piece counter preserves what happened between reads, a run bit does not.
The timestamp comes from the reader. The device does not date its data, so what lands in the database is the moment of reception. That is irrelevant for process trends and decisive for correlating a stoppage with the signal that caused it, which is why the value should be stamped as close to the device as possible, at the industrial gateway, rather than at the end of the chain.
Who may ask is limited by the medium. A Modbus RTU segment allows one master only: if the SCADA is already polling that bus, a second interrogator cannot simply be added without collisions. There are three clean options: the gateway becomes the master of its own segment, the data is taken from the existing master instead of the bus, or the traffic is listened to passively. On Modbus TCP the problem changes shape: several clients can connect at once, but embedded servers accept a small number of concurrent connections and aggressive polling competes with the device CPU.
None of this requires stopping the line. Reading is a passive operation that never touches control logic or safety interlocks; the real risk is saturating the serial bus or the device processor, and it is bounded by sizing the cycle and grouping contiguous registers into a few large requests instead of many small ones. Writing registers, however, deserves the same caution as touching control, since on many devices it changes setpoints live. The mediating hardware is typically an RS-485-to-Ethernet converter or a gateway that acts as master, republishes values over MQTT or OPC-UA and adds the typing and scaling the protocol lacks; on the electrical side, galvanic isolation, 120 Ω termination and bus biasing are part of the job, not a detail.
Why it is still alive in 2026
Because it is royalty-free, fits in a few kilobytes of firmware, can be implemented without permission or certification, and because the installed base does not retire: a power analyser bought fifteen years ago still measures just as well. Modern architectures do not remove Modbus, they encapsulate it: read at the edge and republished upwards with semantics, which is precisely what an edge computing layer feeding a Unified Namespace does.
Related terms
Modbus is one of the access paths to PLC and field instrumentation data, complementary to OPC-UA and upstream of transport over MQTT. The full comparison between machine access and data distribution is in the OPC UA vs MQTT guide, and connecting equipment of any brand and protocol to a common layer is the scope of heterogeneous systems interoperability.