Modbus TCP vs Modbus RTU: Quick Summary
Modbus RTU runs over RS-485 (or RS-232) serial links with binary framing and CRC error checking — the field bus of choice for legacy PLCs, drives, and sensors in industrial automation for over 40 years. Modbus TCP wraps the same register-based application layer in TCP/IP packets over standard Ethernet, enabling Modbus to work across modern IP networks. Both use identical register maps and function codes — only the physical layer and framing differ between Modbus TCP and Modbus RTU.
Modbus Protocol Variants: Architecture Overview
Modbus was developed by Modicon in 1979 and remains the most widely deployed industrial serial communication protocol. Three Modbus protocol variants exist:
- Modbus RTU (Remote Terminal Unit): Binary encoding over RS-485 or RS-232 serial. Uses a CRC-16 checksum. Most common in legacy industrial environments.
- Modbus ASCII: ASCII character encoding over serial — longer frames, simpler debugging, rarely used today.
- Modbus TCP/IP: Modbus application layer over TCP/IP on standard Ethernet (typically port 502). Introduced in 1999 to bring Modbus into IP networks.
Physical Layer Comparison: RS-485 vs Ethernet
The most fundamental difference in Modbus TCP vs Modbus RTU is the physical layer:
- Modbus RTU physical layer (RS-485): Two-wire differential balanced bus. Up to 32 nodes on a single segment (247 with repeaters). Maximum distance 1200 metres at low baud rates, 15 metres at 10 Mbps. Speeds: 9600 to 115200 baud (common), 1 Mbps (maximum). Half-duplex — only one node transmits at a time. Requires 120Ω termination resistors at each end of the bus.
- Modbus TCP physical layer (Ethernet): Standard 100BASE-TX or 1000BASE-T. Star topology (via switches). Distance limited by Ethernet standards (100 metres per segment, extended with switches). Full-duplex, 100 Mbps to 1 Gbps. Compatible with existing IT network infrastructure.
Framing and Addressing Differences
The Modbus RTU frame format:
- Slave Address (1 byte) — 1 to 247 (0 = broadcast)
- Function Code (1 byte)
- Data (0 to 252 bytes)
- CRC-16 (2 bytes, little-endian)
- Frame delimited by 3.5 character-times of silence on the bus
The Modbus TCP frame adds a Modbus Application Protocol (MBAP) header instead of the slave address and CRC:
- Transaction Identifier (2 bytes) — for request-response matching over TCP
- Protocol Identifier (2 bytes) — always 0x0000 for Modbus
- Length (2 bytes) — number of bytes following
- Unit Identifier (1 byte) — equivalent to slave address, used when TCP gateway accesses serial Modbus slaves
- Function Code + Data (no CRC — TCP provides its own error checking)
Performance Comparison: Modbus TCP vs Modbus RTU
For real-time industrial serial communication performance, the comparison depends on the application:
- Polling rate: Modbus RTU at 19200 baud can poll a 100-register block in approximately 55ms. Modbus TCP over a switched Ethernet LAN typically achieves 5–20ms round-trips, though TCP jitter can vary.
- Concurrent connections: Modbus RTU is a master-slave bus — one master, sequential polling. Modbus TCP supports multiple simultaneous connections from multiple masters (SCADA, PLC, HMI) to the same slave device.
- Security: Modbus RTU has no authentication — physical access to the RS-485 bus grants protocol access. Modbus TCP is equally insecure by default but can be protected by network segmentation, VLANs, and TLS (Modbus Security extension, RFC draft).
Choosing Between Modbus TCP and Modbus RTU
- Use Modbus RTU when: connecting to legacy PLCs, drives, and sensors with RS-485 ports; operating in noisy industrial environments where cable runs exceed 100 metres; minimising hardware cost (RS-485 transceivers are cheaper than Ethernet MAC/PHY).
- Use Modbus TCP when: connecting to SCADA systems over an IP network; requiring multiple simultaneous master connections; integrating with IIoT platforms and cloud data historians; replacing or bridging legacy Modbus RTU via a protocol converter gateway.
Embien's Modbus Protocol Stack Development
Embien Technologies has developed and deployed Modbus RTU master/slave stacks and Modbus TCP server/client implementations across embedded Linux gateways (NXP i.MX, Renesas RZ), bare-metal microcontrollers (STM32, NXP S32K), and industrial IoT edge devices. Our RAPIDSEA industrial communication suite includes production-ready Modbus protocol implementations supporting Modbus RTU, Modbus TCP, and RTU-to-TCP protocol conversion for gateway devices.
