Fact-checked by Grok 2 weeks ago

Modbus

Modbus is a widely adopted, open protocol originally developed in 1979 by Modicon (now part of ) to facilitate data exchange between programmable logic controllers (PLCs) and other industrial automation devices. Operating at the (Layer 7) of the , it defines a simple, request-response messaging structure for reading and writing data such as discrete inputs, coils, input registers, and holding registers, typically in 16-bit word formats representing statuses, counters, or analog values. The protocol employs a master-slave architecture, where a master device (e.g., an HMI or system) initiates transactions and slaves (e.g., sensors or actuators) respond, ensuring reliable communication across diverse physical media like lines or Ethernet. The core of Modbus is its (PDU), a compact structure consisting of a 1-byte code (e.g., 03 for reading holding registers or 16 for writing multiple registers) followed by up to 252 bytes of , with a maximum PDU size of 253 bytes to support efficient, low-overhead transactions. Addressing in Modbus uses four distinct banks—coils and inputs for values, and holding and input registers for 16-bit words—each supporting up to elements addressed from 0 to , often prefixed in documentation (e.g., 4xxxx for holding registers). handling includes exception responses for issues like invalid addresses or unsupported s, using codes such as 01 (illegal ) or 02 (illegal address). Modbus has evolved into several variants to accommodate different network types, including Modbus RTU (binary format over serial lines like with error checking and silent inter-frame periods), Modbus ASCII (human-readable hexadecimal over serial with LRC checks), and Modbus TCP/IP (adapted for Ethernet using for reliable delivery and a Modbus Application header). The protocol's serial line specifications date back to 1996, with ongoing updates like the Modbus Security Protocol, which integrates (TLS) and X.509v3 certificates for authentication and integrity on port 802. Despite its simplicity and lack of native support for advanced features like large data types or built-in security in base variants, Modbus remains a due to its openness, broad device compatibility, and ease of implementation in industrial environments. In practice, Modbus powers critical applications in , , and process control, enabling seamless integration between PLCs, sensors, drives, and supervisory systems while serving as a foundational protocol in the transition to Industrial (IIoT). Its enduring popularity stems from over four decades of widespread adoption, with conformance classes (0 for basic public functions, 1 for diagnostics, and 2 for vendor-specific extensions) ensuring interoperability across thousands of compliant devices globally.

Overview

History and Development

The Modbus protocol was developed in 1979 by Modicon, a pioneering company in programmable logic controllers (PLCs) that is now part of , to enable reliable communication between PLCs and other devices in industrial automation systems. Initially designed as a simple, master-slave protocol for reading and writing data over serial lines such as and , it addressed the need for standardized data exchange in manufacturing environments dominated by Modicon's proprietary hardware. This foundational version, often referred to as Modbus RTU or ASCII, quickly gained traction within Modicon ecosystems for its robustness and ease of implementation in multidrop networks. Originally proprietary to Modicon, the protocol was released as an open, royalty-free standard in the , allowing broader adoption across vendors and reducing barriers to in settings. A significant milestone came in with the introduction of Modbus TCP/IP by Modicon, which extended the protocol over Ethernet networks using /IP as the , facilitating higher-speed integration with modern IT infrastructure while preserving the core messaging structure. This adaptation marked Modbus's transition from serial-based systems to networked environments, enhancing its applicability in distributed control architectures. In 2004, transferred stewardship of the Modbus specification to the newly formed Modbus Organization, a nonprofit comprising users, suppliers, and developers dedicated to maintaining, evolving, and certifying the protocol. This shift ensured ongoing support and , solidifying Modbus's status as a . Evolution continued with proprietary variants like Modbus Plus, introduced by Modicon in the late as a high-speed, token-passing network for demanding applications, though it diverged from the in implementation. Additionally, integrations such as gateways for have enabled Modbus to coexist with other industrial protocols, extending its utility in hybrid networks.

General Protocol Characteristics

Modbus operates as a client-server, request-response , originally designed as a master-slave , facilitating communication between devices in industrial environments. In this model, a single client (master) initiates requests to one or more servers (slaves), which respond with the requested data or actions, enabling efficient control and monitoring without constant polling from all devices simultaneously. This structure positions Modbus at the of the , independent of the underlying physical and data link layers, allowing it to run over lines, Ethernet, or other networks. Key characteristics of Modbus include its simplicity, openness, and royalty-free nature, which have contributed to its widespread adoption since its inception. The protocol features a minimalistic messaging structure with low overhead, making it easy to implement on resource-constrained devices such as programmable logic controllers (PLCs), sensors, and actuators. It supports up to 247 devices on a single , addressed via 8-bit identifiers ranging from 1 to 247, allowing for scalable deployments in multi-device systems. As an maintained by the , it is freely available for use without licensing fees, promoting across vendors in industrial control systems (ICS), supervisory control and data acquisition (), and automation applications. Modbus finds primary applications in industries such as , production, and , where it enables the reading and writing of discrete inputs/outputs, analog values, and diagnostic information between field devices and control systems. For instance, it allows PLCs to query sensors for process variables like or and command actuators to adjust valves or motors accordingly, supporting tasks. Its ease of implementation and low overhead make it suitable for and modern systems alike, though it lacks built-in security mechanisms such as or , necessitating additional safeguards in sensitive deployments.

Protocol Fundamentals

PDU and ADU Structure

In the Modbus protocol, the (PDU) represents the core, application-layer message that is independent of the underlying physical and layers. It consists of a single-byte function code followed by variable-length bytes specific to the requested or response. The function code, ranging from 0x01 to 0xFF (with values 0x80 to 0xFF indicating exceptions), specifies the action to be performed, such as reading or writing , while the data field carries parameters like addresses or values. The maximum PDU size is 253 bytes to accommodate transport-layer constraints, ensuring compatibility across different implementations. The Application Data Unit (ADU) encapsulates the PDU with transport-specific headers and integrity checks to form a complete suitable for over a particular medium. In serial line implementations, the ADU prepends a one-byte slave (ranging from 0x01 to 0xF7 for individual devices or 0x00 for broadcast) to the PDU and appends an error-checking field: either a two-byte for RTU or a one-byte LRC for ASCII . This results in a maximum ADU of 256 bytes for RTU, comprising the , up to 252 bytes of PDU data, and the CRC. For ASCII , the ADU uses printable characters, with the and LRC each represented as two characters, leading to a maximum of 513 characters including delimiters. For Modbus , the ADU replaces serial-specific elements with a seven-byte Modbus Application (MBAP) header prefixed to the PDU, yielding a maximum of 260 bytes. The MBAP includes a two-byte transaction identifier for matching requests and responses, a two-byte identifier (fixed at 0x0000 for Modbus), a two-byte field indicating the bytes following it (always at least 1 for the unit identifier), and a one-byte unit identifier serving as the logical slave address. Unlike serial ADUs, variants omit explicit or LRC, relying instead on the / stack's mechanisms for error detection. Error-checking fields ensure data integrity in serial ADUs. The CRC-16 used in RTU mode employs the polynomial $0xA001 (equivalent to x^{16} + x^{15} + x^2 + 1) with an initial register value of $0xFFFF. The calculation processes each byte of the message (address through PDU data) by XORing it with the low byte of the register, right-shifting 16 times while XORing the polynomial into the high byte whenever the outgoing bit is 1, and appending the low byte followed by the high byte. For ASCII mode, the LRC is computed as the two's complement negation of the sum of all message bytes (address through PDU data) modulo 256, represented in two hexadecimal characters with the high-order nibble first. These mechanisms provide robust frame validation without impacting the protocol-independent PDU.
ComponentRTU ADU (Serial)ASCII ADU (Serial)TCP ADU
Prefix/HeaderSlave Address (1 byte)Start (:) + Address (2 chars) + Function (2 chars)MBAP (7 bytes: Transaction ID , Protocol ID , Length , Unit ID )
CorePDU (up to 253 bytes: Function Code + Data [0-252])Data (up to 2×252 chars)PDU (up to 253 bytes: Function Code + Data [0-252])
Suffix/CheckCRC-16 (2 bytes)LRC (2 chars) + End (CR LF)None ( checksum)
Max Length256 bytes513 characters260 bytes

Data Model and Addressing

Modbus employs a straightforward organized into four distinct tables, each representing a different type of data accessible within a . These tables are: coils ( outputs), inputs, holding registers, and input registers. Coils and inputs store single-bit values, while holding and input registers hold 16-bit words. This model allows for the logical separation of read-write and read-only data, as well as bit-level and word-level information, facilitating efficient access in industrial control systems. The following table summarizes the four data tables, including their characteristics and associated primary function codes for access:
Data TableDescriptionAccess TypeSizePrimary Function Codes
CoilsDiscrete outputs (bits)Read-Write1 bit01 (Read), 05/15 (Write)
Discrete InputsDiscrete inputs (bits)Read-Only1 bit02 (Read)
Holding RegistersAnalog values/output (words)Read-Write16 bits03 (Read), 06/16 (Write)
Input RegistersAnalog input values (words)Read-Only16 bits04 (Read)
Each supports up to 65,536 (2^16) addresses, addressed using 16-bit unsigned integers ranging from 0 to 65,535 in the definition. However, practical limitations arise from the function codes, which allow accessing up to 2,000 consecutive coils or inputs or 125 holding or input per transaction, depending on the function code (e.g., function code reads up to 2,000 coils). In the , addressing is zero-based, starting from 0, but many device implementations and documentation use one-based referencing for readability, such as labeling the first coil as 00001 (corresponding to address 0) or the first holding register as 40001. Data types in Modbus are limited to support its original design for simple . Coils and discrete inputs represent values (on/off, 0/1). Holding and input registers store 16-bit integers, which can be interpreted as signed or unsigned depending on the application. Larger data types, such as 32-bit integers or floating-point numbers, are not natively supported but can be represented by combining two consecutive registers (e.g., a 32-bit spans registers N and N+1, with byte ordering conventions like big-endian or little-endian specified by the device). The protocol provides no built-in support for strings, 64-bit values, or other complex types; such representations must be handled at the by concatenating multiple registers. Device addressing in Modbus distinguishes between serial and TCP implementations. In serial modes (RTU/ASCII), each slave device is assigned a unique slave ID from 1 to 247, with 0 reserved for broadcast messages that do not require a response. For Modbus TCP, the and (default 502) identify the device, while a one-byte unit identifier (0–255) in the MBAP header serves a similar role to the slave ID, enabling through gateways or encapsulation of serial Modbus messages over ; a value of 255 is commonly used for direct TCP devices or unspecified . This unit identifier is echoed back in responses and ignored by simple TCP servers.

Communication Mechanisms

Modbus Transactions

Modbus transactions operate on a , where the master (client) initiates all communications in a polling manner by transmitting a request Application Data Unit (ADU) to one or more slave devices (servers). The targeted slave processes the request and returns a response ADU containing the results or an indication of success; requests to specific slaves expect a reply, while the master implements a timeout mechanism—typically 1 to several seconds at —to detect non-responses and handle errors accordingly. In broadcast transactions, the addresses the request to all slaves using device 0, limiting it to write operations since no responses are generated or expected from the slaves; this allows efficient multi-device updates without reply overhead. The master-slave polling ensures orderly access to shared media, preventing collisions in multi-drop networks. Timing constraints are essential for reliable transaction framing, particularly in serial line implementations. In Modbus RTU , a begins and ends with a silent interval of at least 3.5 times, while the interval between consecutive must not exceed 1.5 times to avoid the declaring the frame incomplete and discarding it. For ASCII , inter-character timeouts allow up to 1 second of silence. Turnaround delays after broadcasts range from 100 to 200 ms to permit slave processing before the next master transmission, and these must be shorter than the overall response timeout. A representative example of a simple read transaction involves the master sending an ADU with the slave's address, a read function identifier, and references to specific data locations such as coils or holding registers. Upon receipt, the slave validates the request, retrieves the data, and transmits a response ADU mirroring the structure but populated with the read values; the entire exchange completes within the configured timeout if successful. These transactions reference the Modbus of discrete inputs, coils, input registers, and holding registers.

Function Codes Overview

Modbus function codes define the specific operations requested by a in a Modbus , forming a critical part of the (PDU) to specify actions such as reading or writing data from server . These codes are standardized to ensure across , with the function code occupying the first byte of the PDU following the transaction identifier and protocol ID fields. Some functions include an optional subfunction code byte for additional specificity, such as in diagnostic operations, while multi-bit or multi-register functions employ bitmasks or byte arrays to efficiently handle batches of data without individual addressing. Function codes are categorized into public, user-defined, and reserved groups to balance standardization with flexibility for custom implementations. Public codes, ranging from 1 to 127 (0x01 to 0x7F), are officially defined and validated by the Modbus Organization for broad use in reading and writing coils (discrete outputs) and registers (analog values). User-defined codes, in the ranges 65-72 (0x41-0x48) and 100-110 (0x64-0x6E), allow vendors to implement device-specific commands without conflicting with public standards, though they lack uniqueness guarantees and are intended for proprietary extensions. Reserved function codes are those currently used by some companies for legacy products and are not available for public use (as listed in Annex A of the specification). The public function codes are grouped by data type and operation, primarily targeting coils (single-bit values representing on/off states) and registers (16-bit words for holding or input data). For coils, code 01 reads the status of multiple coils, code 02 reads discrete inputs (read-only coil equivalents), code 05 writes a single coil to on or off, and code 15 writes multiple coils using a bitmask-packed byte array for efficiency. For registers, code 03 reads multiple holding registers (writable), code 04 reads input registers (read-only), code 06 writes a single holding register, code 16 writes multiple holding registers with a sequence of 16-bit values, code 22 performs a mask write on a single register using AND/OR bitmasks to modify specific bits without affecting others, and code 23 combines reading and writing multiple holding registers in one transaction to reduce communication overhead. These groupings enable targeted access to the Modbus data model, where coils address up to 2000 bits and registers up to 125 words per function call, promoting scalable industrial automation.
CategoryCode (Hex)PurposeData Type
Public (Coils/Discrete)01Read multiple coilsBits (outputs)
Public (Coils/Discrete)02Read discrete inputsBits (inputs)
Public (Coils/Discrete)05Write single coilBit (output)
Public (Coils/Discrete)15 (0F)Write multiple coilsBits (outputs, bitmask)
Public (Registers)03Read holding registers16-bit words (holding)
Public (Registers)04Read input registers16-bit words (input)
Public (Registers)06Write single register16-bit word (holding)
Public (Registers)16 (10)Write multiple registers16-bit words (holding)
Public (Registers)22 (16)Mask write register16-bit word (holding, bitmask)
Public (Registers)23 (17)Read/write multiple registers16-bit words (holding)
Exception responses, which modify the function code by setting the high-order bit, are used when a server cannot process a public function request due to errors like invalid addresses.

Error Handling

Exception Responses

In Modbus, when a server (slave) encounters an error while processing a client (master) request, it generates an exception response to indicate the issue rather than a normal response. The server detects errors such as unsupported functions, invalid addresses, or invalid data values in the request. To signal an exception, the server modifies the function code in the response by setting its most significant bit to 1, which is equivalent to adding 0x80 (in hexadecimal) to the original function code; for example, a request with function code 0x01 would result in an exception response with function code 0x81. This modified function code allows the client to immediately recognize the response as an exception without parsing further data. The structure of an exception response follows the same application data unit (PDU) format as a normal response but includes the modified function code followed by a single-byte exception code in the field, with no additional . In the full application data unit (ADU), which encompasses the PDU plus transport-layer elements (such as address fields in implementations or transaction identifiers in ), the exception response maintains the overall frame structure of the original request type but flags the error via the function code and exception code. This concise format ensures minimal overhead while providing essential diagnostic information about the failure. Modbus defines a set of standard exception codes to specify the nature of the error, each represented as a single byte value. These codes are universally applicable across Modbus variants and are returned only when a specific condition is met during request validation or execution. The following table summarizes the standard exception codes:
Code (Hex)NameDescription
01Illegal FunctionThe function code received is not supported by the server or the server is in an improper state to execute it.
02Illegal Data AddressThe data address referenced in the request is not accessible or does not exist in the server's data model.
03Illegal Data ValueA value contained in the request data is invalid, such as a quantity exceeding supported limits.
04Server Device FailureAn unrecoverable error occurred while the server attempted to perform the requested action.
05AcknowledgeThe server has accepted the request but requires significant processing time; the client should perform a polling operation to monitor completion, such as using Read Exception Status (function code 0x07).
06Server Device BusyThe server is engaged in processing another request and cannot handle the current one; the client should retry later.
07Negative AcknowledgeThe data value received in the query is not an allowable value for the server (e.g., a parameter that is ignored or an unsupported operation).
08Memory Parity ErrorA parity error was detected in the memory during file record read or write operations (specific to functions 20 and 21).
0AGateway Path UnavailableIn a gateway configuration, the path to the target device cannot be established due to configuration or overload issues.
0BGateway Target Device Failed to RespondThe gateway was unable to receive a valid response from the target device within the timeout period.
Upon receiving an exception response, the client typically logs the for diagnostics, may retry the after a delay (especially for transient errors like code 06), or escalate to higher-level handling in the application. This mechanism enhances reliability by allowing graceful in noisy or fault-prone environments, though repeated exceptions can indicate configuration issues or hardware faults requiring manual intervention. The exception responses are integral to Modbus's robustness, ensuring that errors do not propagate silently and enabling systematic in industrial systems.

Diagnostic and Error Codes

Modbus provides diagnostic capabilities primarily through Function Code 08 (Diagnostics), which enables masters to query slaves for communication status and internal error conditions, particularly in serial line implementations. This function is essential for issues, such as verifying message integrity or resetting communication counters, without disrupting normal data access operations. It operates by specifying a subfunction code in the request PDU to select the diagnostic test, with the slave echoing or providing relevant data in the response. The subfunctions for Diagnostics (Function Code 08) include a range of tests, as defined in the Modbus Application Protocol Specification. For example, subfunction 00 (Return Query Data) simply echoes the request data back to confirm basic communication, while subfunction 01 (Restart Communications Option) restarts the slave's communication port and clears diagnostic counters, though it generates no response if the slave is in Listen Only Mode. Other key subfunctions provide counters for error tracking: subfunction 0C (Return Bus Communication Error Count) reports the number of messages discarded due to errors since the last restart, and subfunction 0D (Return Bus Exception Error Count) counts exception responses sent by the slave. The complete set of subfunctions includes the following:
Subfunction (Hex)DecimalNameDescription
000Return Query DataEchoes request data for communication verification.
011Restart Communications OptionRestarts port and clears counters; no response in Listen Only Mode.
022Return Diagnostic RegisterReturns 16-bit diagnostic register contents.
033Change ASCII Input DelimiterSets new end-of-message delimiter (replaces default colon and line feed).
044Force Listen Only ModePuts device in Listen Only Mode; no response returned.
0A10Clear Counters and Diagnostic RegisterClears all counters and diagnostic register.
0B11Return Bus Message CountReturns total messages processed or detected since last restart.
0C12Return Bus Communication Error CountCounts CRC errors since restart.
0D13Return Bus Exception Error CountCounts exception responses since restart.
0E14Return Server Message CountCounts processed messages since restart.
0F15Return Server No Response CountCounts messages addressed to server but no response sent since restart.
1016Return Server NAK CountCounts Negative Acknowledge exception responses since restart.
1117Return Server Busy CountCounts Server Device Busy exception responses since restart.
1218Return Bus Character Overrun CountCounts messages lost due to character overrun since restart.
1420Clear Overrun Counter and FlagClears overrun error counter and resets overrun flag.
Beyond Function Code 08, vendor-specific diagnostics are supported through the Modbus Encapsulated Interface (MEI) via Function Code 43 (Read Device Identification), which encapsulates additional interfaces for extended querying. MEI Type 14 specifically enables reading device identification objects, such as vendor name, product code, and revision details, which assist in diagnosing compatibility or configuration issues during . MEI Type 13 provides access to CANopen object dictionary entries for devices supporting that extension, allowing indirect error analysis through specialized data reads. These MEI mechanisms are particularly useful in TCP/IP implementations for non-standard diagnostic needs, though they rely on standard exception codes for error reporting. In addition to proactive diagnostic queries, Modbus includes non-exception error indicators detected primarily by the during communication. Timeout errors occur when no response is received within the configured interval, often signaling or slave unavailability. CRC failures in RTU mode or LRC errors in ASCII mode are detected by the upon validating the received , prompting retransmission or alerting for cabling faults. In implementations, parity errors during bit indicate or issues, typically leading to frame rejection without a slave response. These indicators complement diagnostic functions by providing immediate on integrity, essential for maintaining reliable networks.

Serial Line Implementations

Modbus RTU

Modbus RTU is a of the Modbus protocol designed for , utilizing compact 8-bit byte encoding to maximize efficiency on low-bandwidth lines. Each byte in an RTU frame consists of 1 start bit, 8 data bits transmitted least significant bit first, an optional , and 1 or 2 stop bits, resulting in a total of 11 bits per character. Even is typically required, though or no parity (with 2 stop bits) may be used depending on the . This format allows for higher data throughput compared to text-based alternatives due to its greater character density. RTU frames are delimited by periods of silence on the communication line, with a minimum of 3.5 character times of idle space before the start of a frame and after its end to separate messages. The frame structure begins with a 1-byte slave address (ranging from 1 to 247, or 0 for broadcast), followed by a 1-byte function code, a variable-length (0 to 252 bytes), and ends with a 2-byte CRC-16 checksum appended in low-byte-first order. The total frame length is limited to a maximum of 256 bytes to ensure compatibility across devices. Strict timing is essential for RTU operation to detect frame boundaries and errors; between consecutive characters within a frame, the inter-character timeout must not exceed 1.5 character times, or the receiver discards the frame. For baud rates of 19,200 bits per second or lower, these timings are calculated directly in character times (e.g., 3.5 character times equates to approximately 1.75 at 19.2 kbps), while higher baud rates use fixed values of 1.750 for the frame delimiter and 750 µs for inter-character gaps to account for variations. Modbus RTU is particularly suited for resource-constrained serial interfaces such as and , where its compact binary nature optimizes bandwidth usage in master-slave or multi-drop configurations. It supports up to 247 addressable slave devices in a , though practical limits without repeaters typically allow for 32 devices due to electrical constraints on bus loading.

Modbus ASCII

Modbus ASCII is a human-readable variant of the Modbus protocol designed for transmission over lines, where each byte is represented by two s in the ASCII set. This mode encodes the (PDU) into a text-based frame that begins with a colon (:) (ASCII 3A ) and ends with a return-line feed (CRLF) pair (ASCII 0D 0A ), making it suitable for environments where of messages is beneficial. Unlike formats, Modbus ASCII allows for easier and since the transmitted data can be directly interpreted by humans using standard text tools. The structure in Modbus ASCII consists of the start (1 character), slave address (2 characters), function code (2 characters), data field (an even number of characters, up to 504 for a maximum PDU size of 252 bytes), (LRC) (2 characters), and end (2 characters), resulting in a total length of up to 513 characters. Each byte from the message is converted to two ASCII digits (0-9, A-F), ensuring the data portion has an even character count. The LRC, an 8-bit , is computed by summing all bytes in the address, function, and data fields (excluding delimiters), taking the of the result, and appending it as two characters before the CRLF; this provides basic error detection for the . Timing requirements in Modbus ASCII are more lenient than in binary modes, with inter-character intervals permitted up to 1 second (or up to 4-5 seconds in wide-area network scenarios) before the frame is considered invalid, eliminating the need for precise millisecond-level . This flexibility arises because the explicit start and end delimiters (: and CRLF) clearly bound the message, allowing receivers to tolerate delays without ambiguity. However, the encoding doubles the transmission size compared to binary equivalents, leading to higher consumption and reduced throughput at the same rate, which can slow parsing and increase in high-volume applications. Modbus ASCII is particularly employed in systems or scenarios where the strict timing constraints of modes cannot be reliably met, such as over noisy or low-speed connections, and its readable format supports and with text-based tools. Despite these benefits, its inefficiencies make it less common in modern, high-performance industrial networks, where compact alternatives are preferred for better resource utilization.

TCP/IP Implementations

Modbus TCP

Modbus TCP is an adaptation of the Modbus designed for communication over Ethernet networks using the as the . It encapsulates the Modbus (PDU) within an Application Data Unit (ADU) that includes a Modbus Application (MBAP) header, eliminating the need for slave address fields and present in serial variants. This implementation enables direct integration with standard infrastructure, allowing Modbus devices to operate within or environments without requiring specialized serial hardware. The MBAP header consists of four fields: a 2-byte transaction identifier for matching requests and responses, a 2-byte identifier set to 0 to denote Modbus TCP, a 2-byte length field indicating the size of the subsequent data, and a 1-byte unit identifier for to specific devices on the network. Modbus TCP operates on port 502, facilitating client-server interactions where clients initiate connections to servers. These connections are typically persistent, supporting multiple concurrent s over a single ; the transaction identifier ensures proper pairing of requests and responses, preventing mismatches in high-traffic scenarios. Unlike serial Modbus, there is no inherent addressing or error-checking overhead in the ADU, as handles reliability and ordering. To illustrate, consider a request to read two holding registers starting from 0 using function code 03. The ADU in format is 00 01 00 00 00 06 01 03 00 00 00 02, broken down as follows:
  • 00 01: Transaction identifier
  • 00 00: Protocol identifier (0)
  • 00 06: Length (6 bytes following)
  • 01: Unit identifier
  • 03: Function code (read holding registers)
  • 00 00: Starting
  • 00 02: Number of registers
A corresponding response, assuming values of 555 and 100 in the registers, would be 00 01 00 00 00 07 01 03 04 02 2B 00 64:
  • 00 01: Transaction identifier
  • 00 00: Protocol identifier (0)
  • 00 07: Length (7 bytes following)
  • 01: Unit identifier
  • 03: Function code
  • 04: Byte count (4 bytes of data)
  • 02 2B 00 64: Register values (big-endian: 555 and 100 )
This structure maintains compatibility with core Modbus PDUs while leveraging for transport. Modbus offers significant advantages over implementations, including higher data transmission speeds—up to 100 Mbps or more on standard Ethernet—and the ability to cover longer distances without repeaters, limited only by . It is widely deployed in modern control systems (), often via gateways that legacy devices to Ethernet, enhancing and remote in environments like and .

Modbus over UDP and Other IP Variants

Modbus over represents a connectionless adaptation of the Modbus protocol, leveraging the () for -based communication, typically on port 502. This variant retains the core Modbus while eliminating the connection overhead of , enabling faster transmission with reduced bandwidth usage. It supports stateless, -oriented exchanges where requests and responses are paired using a transaction identifier in the MBAP header, similar to Modbus but without persistent sessions. Key advantages include support for and broadcast messaging, which facilitates efficient dissemination in multi-device environments such as low-latency sensor networks in industrial setups. For instance, in monitoring applications, UDP's nature allows quicker polling of multiple slaves without the retransmission delays inherent in . However, the lack of built-in reliability means no guaranteed delivery, ordering, or error correction at the , necessitating application-level acknowledgments and retry logic to handle . This makes Modbus UDP particularly suited for scenarios where occasional is tolerable, but it sees limited adoption due to the prevalence of more robust alternatives and the absence of an official specification from the Modbus . Beyond , other variants extend Modbus TCP with enhancements, such as the Modbus Security Protocol, which integrates (TLS) to encapsulate messages, ensuring via X.509v3 certificates, , and . Operating on port 802, this wrapper addresses Modbus's inherent vulnerabilities in open networks by providing encrypted channels without altering the underlying protocol structure. Additionally, protocol gateways enable Modbus integration with contemporary -based systems, mapping device registers to publish/subscribe topics for cloud connectivity or to OPC UA information models for secure, semantic exchange in environments. These mappings support IIoT but require careful to maintain timing and . Overall, such variants enhance Modbus's versatility on networks while mitigating its traditional limitations in reliability and .

Protocol Extensions and Variants

User-Defined and Reserved Codes

In the Modbus , user-defined function codes provide a mechanism for implementers to extend the set of operations without conflicting with publicly defined codes. These codes allow for the creation of services tailored to specific applications, such as interactions or specialized data exchanges. The ranges designated for user-defined codes are 65 to 72 ( 0x41 to 0x48) for simple extensions and 100 to 110 ( 0x64 to 0x6E) for more complex encapsulated interfaces. Implementers selecting these codes must ensure no overlap with public function codes (1 to 64), and there is no guarantee of uniqueness unless a (RFC) is submitted to the Modbus Organization for potential reclassification as public. Reserved function codes, spanning 73 to 99 (hexadecimal 0x49 to 0x63) and 111 to 127 (hexadecimal 0x6F to 0x7F), are held exclusively for future allocation by the and are not available for public or user-defined implementations. These ranges support legacy uses by specific companies but prohibit new public developments to maintain protocol integrity. No known public implementations exist within these reserved spaces, ensuring they remain protected for standardized extensions. Implementation guidelines emphasize compatibility and non-interference; user-defined codes must adhere to the general (PDU) structure, with responses including the same function code unless an exception occurs (indicated by setting the high-order bit). These codes are often employed for proprietary features, such as advanced operations that build on public codes like 20 (Read File Record) and 21 (Write File Record) for subfunction-based record access, or function code 23 (Read/Write Multiple Registers) for atomic read-write combinations in specialized contexts. A key application of the higher user-defined range involves encapsulation, where function code 43 (Encapsulated Interface Transport) uses Modbus Encapsulated Interface (MEI) types—such as type 13 for tunneling commands—to wrap non-Modbus protocols within a Modbus for in hybrid networks.
CategoryDecimal RangeHexadecimal RangePurpose
User-Defined (Simple)65–720x41–0x48Basic custom extensions without encapsulation
User-Defined (Encapsulated)100–1100x64–0x6EComplex interfaces, e.g., protocol tunneling
Reserved73–990x49–0x63Future public use by
Reserved111–1270x6F–0x7FLegacy and future allocations, no new public use

JBUS and Enron-Daniels Mappings

JBUS, developed in 1985 by the French company Merlin Gerin (now part of ), represents an early variant of the Modbus protocol tailored for industrial in programmable logic controllers. This protocol emerged from collaborations between companies like Automation and Merlin Gerin, sharing the core Modbus messaging structure but introducing specific adaptations for compatibility with their hardware. Over time, initial differences in entity counts and slave station limits became obsolete, aligning JBUS closely with standard Modbus. The primary distinction in JBUS lies in its addressing scheme, which employs zero-based indexing compared to Modbus's one-based indexing. For instance, a JBUS such as a word (QW) or bit (QB) at address n maps to the equivalent Modbus holding register or at address n + 1. This offset requires careful handling in gateways or drivers to ensure seamless , as JBUS objects like input words () or output words (QO) directly correspond to Modbus input or holding registers with the adjusted addressing. Function codes remain largely identical, supporting standard operations like reading or writing registers via codes 03 and 06. Today, JBUS is considered largely obsolete, having faded with the decline of associated legacy PLCs like the series, though it persists in some older industrial equipment. The views such variants as historical, recommending standard Modbus for new deployments to avoid compatibility issues. The Enron-Daniels mapping extends Modbus for enhanced data precision, particularly in the and gas sector, where high-resolution measurements like rates demand 32-bit floating-point or long integer support beyond the protocol's native 16-bit registers. Originating from implementations by Corporation and Daniels (a equipment provider), this variant treats 32-bit values as single logical registers, returning 4 bytes per request instead of 2, often within designated address ranges such as 4x7001–4x7999 for floats. This approach modifies the interpretation of the register count in standard function codes like 03 (Read Holding Registers), assuming units of 32-bit words rather than 16-bit, which can lead to offset errors if not handled explicitly (e.g., the next block starts at 4x5051, not 4x5101). A key non-standard aspect involves the use of function codes 20 (Read File Record) and 21 (Write File Record), originally defined for accessing sequential files in Modbus, but repurposed here to read and write 32-bit high-precision records in a structured . For example, in Daniels flow computers like the 2551 series, function 20 retrieves sequential of extended , enabling efficient transfer of multi-word values without fragmenting them across standard register reads. This mapping supports industry-specific needs, such as AGA gas metering calculations, by embedding 32-bit longs in 4x5001–4x5999 ranges. Enron-Daniels remains common in legacy supervisory control and (SCADA) systems for oil and gas but is discouraged for new designs by the Modbus Organization due to its deviations from the standard protocol, which can cause failures with compliant devices. Support persists in specialized drivers and gateways for .

Security and Limitations

Known Vulnerabilities

Modbus lacks built-in , , and checks, exposing it to , modification, and unauthorized by attackers on the same . This , originating from its development in the late for industrial environments assuming trusted networks, allows any device to send commands, enabling unauthorized reads or writes to registers and coils without verification of the sender's identity. For instance, attackers can exploit this to alter control parameters, potentially causing physical damage in industrial control systems (ICS). Replay attacks are a significant risk due to the absence of session or timestamps in the , permitting captured packets to be retransmitted to execute legitimate commands illicitly. In Modbus implementations, man-in-the-middle (MITM) attacks are facilitated by the lack of , often combined with to redirect traffic and impersonate devices. Broadcast write functions, using address 0 in Modbus , allow a single malicious packet to affect all listening devices on the network, amplifying the impact of unauthorized commands. Device enumeration is straightforward through port scanning on port 502 or serial line probing, revealing active slaves and their configurations without barriers. Specific vulnerabilities have been documented in various implementations. For example, CVE-2017-6032 highlights a session-related weakness in Modicon Modbus protocol, enabling brute-force attacks to replay sensitive commands. CVE-2021-22779 (ModiPwn) demonstrates how attackers can bypass in Modicon PLCs by exploiting Modbus's lack of , allowing remote code execution. Additionally, malformed packets can trigger denial-of-service (DoS) conditions, as seen in CVE-2023-25619, where improper handling of exceptional conditions in Modbus communications causes controller unresponsiveness. More recent vulnerabilities include CVE-2024-10918, a stack-based in libmodbus version 3.1.10, which could allow remote to execute arbitrary code or cause a by sending specially crafted Modbus responses. In 2024, the FrostyGoop was discovered targeting environments, exploiting Modbus protocol weaknesses to manipulate device controls and exfiltrate data. A notable real-world incident occurred in 2024 when used Modbus commands to alter readings in a Ukrainian heating utility, disrupting operations and demonstrating the protocol's ongoing risks in . To mitigate these vulnerabilities, isolates Modbus traffic using VLANs or air-gapped systems, preventing lateral movement by attackers. Firewalls should restrict access to port 502, allowing only whitelisted addresses and codes. Wrapping Modbus in VPN or provides and ; for instance, can encapsulate Modbus to ensure and prevent replay via session keys. The Modbus Security protocol, specified in 2018 and using () with certificates on port 802 for and , remains largely unimplemented in commercial devices as of 2025, with limited adoption reported. CISA recommends ongoing use of and monitoring for legacy Modbus systems lacking native security.

Performance and Scalability Issues

Modbus serial implementations, particularly RTU and ASCII over , are constrained by low , typically operating at rates from 9.6 kbps to 115.2 kbps, which limits the network to only a few transactions per second depending on message size and inter-frame delays of at least 3.5 character times. This results in effective throughputs often below 10 kbps in practice for multi-device setups, making it unsuitable for high-volume data exchange. In contrast, Modbus leverages Ethernet's higher speeds—up to 100 Mbps or more—but suffers from polling overhead, where the sequentially queries slaves, reducing effective utilization to 1-10% in busy networks due to request-response cycles and / encapsulation. Scalability in Modbus is inherently limited, with serial variants supporting a maximum of 247 slaves per master to avoid address conflicts and maintain reliable addressing from 1 to 247. Without native prioritization or quality-of-service mechanisms, large systems exceeding 100 devices experience bottlenecks, as each slave must wait for its poll cycle, amplifying delays in master-slave communications. Modbus TCP offers theoretical scalability beyond 247 devices via addressing, but practical performance degrades similarly in oversized networks due to the lack of built-in , leading to increased and dropped requests under load. Key performance issues stem from the protocol's design, including half-duplex operation in serial modes, which risks data collisions if turnaround timing (e.g., 100-200 ms for broadcast responses) is not precisely managed, further slowing communications. Basic Modbus lacks protocol-level flow control beyond 's avoidance, exacerbating issues in contended networks, while overall ranges from milliseconds at high rates to seconds in low-speed or crowded setups, rendering it inadequate for applications requiring sub-10 ms responses. To mitigate these, common workarounds include deploying gateways to bridge Modbus with higher-performance protocols like for enhanced throughput and scalability, or optimizing master configurations with reduced polling rates to balance load and minimize overhead.

References

  1. [1]
    Introduction to Modbus - Modbus Organization
    Modbus consists of a set of standardized digital codes intended to read data from and write data to industrial devices. A Modbus-compliant industrial device has ...
  2. [2]
    What is the Modbus Protocol & How Does It Work?
    ### Summary of the Modbus Protocol
  3. [3]
    Modbus Specifications
    The Modbus Security protocol provides protection through the blending of Transport Layer Security (TLS) with the traditional Modbus protocol. TLS encapsulates ...
  4. [4]
  5. [5]
    Modbus | Schneider Electric USA
    Introduced in 1979 by Schneider Electric (Modicon), the Modbus® fieldbus is an essential, open communication standard, supported by a large number of ...Features · Applications · Need Help?
  6. [6]
    [PDF] Introduction to Modbus TCP/IP - ProSoft Technology
    Modbus is an application protocol or messaging structure that defines rules for organizing and interpreting data independent of the data transmission medium.Missing: history milestones 1999 2004
  7. [7]
    Modbus Protocol 2025: From Basics to IIoT Integration - EMQX
    Mar 6, 2025 · It was developed in 1979 by Modicon, a company that produced Programmable Logic Controllers (PLCs), to enable these devices to communicate with ...Missing: credible | Show results with:credible
  8. [8]
    Profibus and Modbus: A Comparison - PI North America
    When it was first introduced, it was a proprietary protocol that only Modicon could use. However, it was later published royalty-free so that anyone could use ...
  9. [9]
    Understanding Modbus TCP-IP: An In depth Exploration - Wevolver
    Jun 20, 2023 · The Modbus TCP/IP protocol was introduced by Modicon (now Schneider Electric) in 1999. Developed as an extension of the Modbus serial ...Missing: history milestones ARCNET 2004
  10. [10]
    Modbus | Hilscher
    The Modbus protocol has a rich history dating back to the late 1970s. Developed by Modicon, Modbus protocol was designed to facilitate communication between ...Missing: credible | Show results with:credible
  11. [11]
    What Is Modbus? – IT Explained | PRTG - Paessler
    The first Modbus protocol – Modbus RTU (Remote Terminal Unit) – was originally published by Modicon (now Schneider Electric) systems in 1979 as a programming ...Modbus Variants · How Does Modbus Work? · Serial Connections<|control11|><|separator|>
  12. [12]
    [PDF] MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b3 ...
    Apr 26, 2012 · MODBUS is an application layer messaging protocol for client/server communication between devices connected on different types of buses or ...
  13. [13]
    Modbus Organization
    The MODBUS Organization is a group of independent users and suppliers of automation devices that seeks to drive the adoption of the MODBUS communication ...
  14. [14]
  15. [15]
    Enhanced Modbus/TCP Security Protocol - PubMed Central - NIH
    Oct 20, 2022 · Modbus is a client-server application protocol that allows communication between millions of automation devices. Nevertheless, unfortunately, ...
  16. [16]
    [PDF] Specification and Implementation Guide for MODBUS over serial line
    Dec 20, 2006 · The MODBUS standard defines an application layer messaging protocol, positioned at level 7 of the OSI model that provides.
  17. [17]
    Modbus Register Addressing - Continental Control Systems, LLC
    Zero vs. One Based Numbering. The Modbus specification says “Registers are addressed starting at zero. Therefore input registers numbered 1-16 are addressed as ...
  18. [18]
    [PDF] MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b ...
    MODBUS is an application layer messaging protocol for client/server communication between devices connected on different types of buses or networks. It is ...
  19. [19]
    Detailed description of the Modbus TCP protocol with command ...
    Apr 26, 2017 · Modbus TCP is the evolution of Modbus RTU, using a special header and a portion of the Modbus RTU message, with the SlaveID and CRC removed.
  20. [20]
    [PDF] Modbus UDP Specification - jamod
    This document introduces a Modbus/UDP flavor which we have developed to verify if the. Modbus protocol is suited for the use of UDP/IP as lower level ...
  21. [21]
    None
    Nothing is retrieved...<|separator|>
  22. [22]
    Bridging Modbus Data to MQTT for IIoT: A Step-by-Step Tutorial | EMQ
    Jun 26, 2023 · By converting Modbus RTU or TCP to MQTT messages, device data can be easily sent to the cloud for remote control and monitoring when needed.Why Bridge Modbus to MQTT? · Bridging Modbus to MQTT via...
  23. [23]
    OPC UA Server & MQTT Publisher Gateway for Modbus TCP ...
    With uaGate MB enable access to Modbus PLC Data & integrate data with OPC UA into higher level management systems such as ERP, MES or SCADA systems.
  24. [24]
    [PDF] CAN Newsletter - CAN-CIA
    Interface Transport (MEI) with the function code 43 and the MEI type 13. The 2 bytes are followed by CiA. 309-2 commands as bina- ry data. CiA 309-3 defines.
  25. [25]
    [PDF] Modbus
    Modbus Plus​​ token passing. It is a proprietary specification of Schneider Electric, though it is unpublished rather than patented.
  26. [26]
    Modbus details — MinimalModbus 2.1.1 documentation
    Both use a numeric index but the JBUS index starts at 0 while the Modbus index starts at 1.” Slave addresses larger than 255: Sometimes the slave address is ...
  27. [27]
    Different Types of Modbus, such as RTU, TCP etc. - Chipkin
    Jbus access objects for instance address n while MODBUS uses address n+1. The addressing offset of 1 which must be managed.
  28. [28]
    [PDF] Jbus/Modbus Serial Link - Socomec
    The JBUS/MODBUSS protocol available on DELPHYS MX / MP is slave and in RTU mode. It uses the function 3 as 'read registers' and the function 6 as 'write ...
  29. [29]
    What is Enron or Daniels Modbus? - Chipkin Automation Systems
    Enron Modbus is just normal Modbus with special handling of 32-bit values as ONE register instead of TWO. Enron or Enron/Daniels Modbus is Standard Modbus .
  30. [30]
    What is Enron-Daniels mode? - ProSoft Technology
    May 5, 2016 · In some of our older Modbus products we had/have a feature called float flag. This feature, which has been renamed to Enron-Daniels mode in most ...Missing: extension | Show results with:extension
  31. [31]
    Model 2000 Flow Computer Manual | PDF - Scribd
    Rating 5.0 (1) DANIELS 2551-C7 This is a special version of the Daniels 2551 machine which ... Function 20 (14h) This function should be used to retrieve the next ...
  32. [32]
    Modbus Security Issues and How to Mitigate Cyber Risks
    May 15, 2023 · Modbus TCP Security / Modbus TLS. There has been some standards works related to security for Modbus that uses Transport Layer Security (TLS).
  33. [33]
    Methodology for Assessing Existing Vulnerabilities in Modbus Protocol
    A comprehensive assessment of related literature shows that the lack of encryption is a fundamental flaw in the Modbus protocol used in ICS systems.
  34. [34]
    Using M.A.T.R.I.X to Learn About Modbus Vulnerabilities - Trustwave
    May 6, 2025 · One of the major weaknesses of Modbus is its lack of built-in authentication and authorization which allows any device on the network to issue ...
  35. [35]
    Detection and Blocking of Replay, False Command, and False ...
    Sep 27, 2021 · In this paper, we worked for False Command Injection attack, False Access Injection attack, and replay attacks on Modbus protocol.Introduction · Impact of Cyberattacks on... · Design of Methods · Conclusion
  36. [36]
    Offensive Security & Modbus Protocol Analysis
    When the lack of encryption is combined with non-existent authentication and session handling, opportunities to intercept and modify messages between the client ...History of Modbus · Security Flaws of Modbus TCP/IP · Man-In-The-Middle Attack...
  37. [37]
    Investigation of Secure Communication of Modbus TCP/IP Protocol
    However, Modbus lacks basic security features such as encryption, authentication, and integrity checks, making it highly vulnerable to interception, spoofing, ...2.1. Modbus Tcp/ip Protocol · 2.3. Arp Spoofing · 4. Experimental Evaluation<|separator|>
  38. [38]
    ModiPwn - Armis
    Jul 13, 2021 · Armis researchers discovered a new vulnerability (CVE-2021-22779) in Schneider Electric (SE) Modicon PLCs that bypasses security mechanisms added to these PLCs.<|control11|><|separator|>
  39. [39]
    Schneider Electric Modicon Modbus Protocol - CISA
    Apr 11, 2017 · The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks. CVE-2017-6032 has been assigned to this ...
  40. [40]
    CVE-2023-25619 Detail - NVD
    Apr 19, 2023 · A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when communicating ...
  41. [41]
  42. [42]
    Evolving towards secure Modbus | INCIBE-CERT
    Feb 20, 2020 · Secure Modbus/TCP uses client/server, certificate-based identity, TLS, and mutual authentication, unlike the original Modbus which lacked ...Missing: mitigations | Show results with:mitigations
  43. [43]
    [PDF] Introduction to Modbus Serial and Modbus TCP
    Although the Modbus over Serial. Line specification supports both a. 2-wire and 4-wire arrangement, the. 2-wire implementation is the most popular. Although it ...
  44. [44]
  45. [45]
    Modbus Protocol: Definition, Types, Advantages, and IoT Applications
    Sep 10, 2025 · Finally, Modbus can face scalability and performance issues. In Modbus RTU networks, response times increase as more slave devices are added, ...
  46. [46]
    Step-by-Step Guide: Setting Up a Modbus RTU Gateway on RS485
    Mar 28, 2025 · Overloaded Gateway: Reduce the number of connected devices per Modbus RTU Gateway or optimize polling intervals. Slow Serial Communication ...Missing: workarounds | Show results with:workarounds