Modbus RTU Frame (Binary Serial)

Modbus RTU relies on timing for frame separation (a silent interval of at least 3.5 character times). Because serial lines are prone to electromagnetic interference (EMI), it includes a robust error-checking mechanism.

• CRC (Cyclic Redundancy Check): A 16-bit mathematical checksum added to the end of every packet to ensure no bits were flipped during transmission.

Modbus TCP Frame (Ethernet)

Modbus TCP removes the Slave ID and CRC, replacing them with a 7-byte MBAP Header (Modbus Application Protocol). Since TCP/IP already handles error checking and packet retransmission at the lower networking layers, the Modbus CRC is redundant and thus omitted.

• Transaction Identifier: Used for pairing requests and responses in a multi-threaded environment.
• Unit Identifier: Replaces the Slave ID, primarily used when communicating with an Ethernet-to-Serial gateway.

Protocol Comparison Table

The Role of Modbus Gateways

Can they coexist? Yes. In modern factories, Modbus Gateways are used to convert Modbus RTU (Serial) into Modbus TCP (Ethernet). This allows a central SCADA system in the office to poll legacy RS485 sensors on the factory floor over the existing local area network (LAN).

Note: Modbus RTU is significantly cheaper per node, but Modbus TCP is faster and easier to troubleshoot remotely.

Metric	Modbus RTU (RS485)	Modbus TCP (Ethernet)
Typical Data Rate	9.6 kbps to 115.2 kbps	10 Mbps to 1 Gbps
Max Nodes	247 Slaves (limited by hardware)	Unlimited (limited by IP space)
Response Time	10ms – 100ms (Serial overhead)	< 1ms to 5ms (Network lag)
Communication	Half-Duplex (Sequential)	Full-Duplex (Simultaneous)

Strategic takeaway: If your system requires sub-10ms updates for more than 5 devices, Modbus TCP is the only viable option. For slow-moving data like soil moisture or ambient temperature, Modbus RTU is more cost-efficient.

🛡️ A Critical Note on Security

Neither classic Modbus RTU nor Modbus TCP includes encryption or authentication. Modbus TCP is particularly vulnerable because it is accessible via standard IP networks.

Pro Tip: If using Modbus TCP, always isolate the traffic on a VLAN (Virtual Local Area Network) and use a VPN for remote access. Never expose Port 502 directly to the public internet.

When to Choose Which?

Test Both Protocols with QModMaster

The best way to understand the difference is to see the data in action. QModMaster supports both Modbus RTU and Modbus TCP, allowing you to simulate Master/Client requests for any industrial device.

Common Questions About Modbus Protocols

Quick answers to the most common technical dilemmas in industrial networking.

Q: Is Modbus RTU more reliable than Modbus TCP?

A: It depends on the environment. Modbus RTU (via RS485) is more reliable in environments with extreme electromagnetic interference (EMI) due to its differential signaling. However, Modbus TCP is more reliable in terms of data delivery, as the TCP/IP stack automatically handles packet retransmission and error correction, which serial lines do not.

Q: Can I run Modbus RTU over an Ethernet cable?

A: Yes, but only physically. You can use the twisted pairs inside a Cat5e/Cat6 cable to carry RS485 signals for Modbus RTU. However, this is not Modbus TCP. To truly integrate RTU devices into an Ethernet network, you need a Modbus Gateway to convert the serial frames into TCP packets.

Q: Which is faster: Modbus TCP or RTU?

A: Modbus TCP is significantly faster. While Modbus RTU usually tops out at 115.2 kbps, Modbus TCP operates at standard network speeds (10/100/1000 Mbps). Furthermore, TCP allows for “Parallel Polling,” where a master can talk to multiple slaves at the same time, whereas RTU is strictly “one-by-one.”

Q: What is “Modbus RTU over TCP”?

A: This is a hybrid method (often called Encapsulated Modbus) where a standard Modbus RTU frame (including the CRC) is wrapped inside a TCP packet. It is commonly used by Serial Device Servers to send serial data over a network without stripping the serial formatting. Note that QModMaster supports this mode via its settings.

Have a specific scenario? Use QModMaster to test both protocols today.

Required Hardware Checklist

1

Step 1: Physical Wiring (The RS485 Bus)

2

Step 2: Windows COM Port Verification

1. Plug in your USB-to-RS485 adapter.
2. Right-click the Start button and select Device Manager.
3. Expand the Ports (COM & LPT) section.
4. Look for an entry like USB-SERIAL CH340 (COM3) or Silicon Labs CP210x (COM5).
5. Pro Tip: If you see a yellow exclamation mark, you need to download the specific driver for your chipset (FTDI, CH340, or CP2102).

Tip: Recording the COM Port Number (e.g., COM3) is essential, as you will need to input this exact value into QModMaster’s Modbus RTU settings in the next step.

3

Step 3: Setting Up the Modbus RTU Connection

1. Modbus Mode Selection

Go to the top menu and select Options > Modbus RTU. Unlike Modbus TCP which uses Ethernet, RTU (Remote Terminal Unit) is the specific protocol for serial RS485 communication.

2. Serial Port Parameters

Click on Options > Serial Port. A dialog box will appear. Fill in the following based on your sensor’s manual:

Connecting to the Bus

Once the parameters are set, click the Connect icon (the plug symbol) or go to Commands > Connect.

Status Check: Look at the bottom status bar of QModMaster. It should say CONNECTED. If you see “Error opening serial port,” ensure no other software (like a PLC IDE or Serial Monitor) is currently using that COM port.

4

Step 4: Reading Sensor Data

Applying Settings in QModMaster Interface:

• 🔹 Set Slave ID in the top-left box (labeled “Slave ID”).
• 🔹 Select Read Holding Registers (03) from the “Function Code” dropdown.
• 🔹 Enter the Start Address (e.g., 0) and Number of Registers (e.g., 2).
• 🔹 Click the Scan icon (the blue loop) or press F5 to start polling.

Common Pitfall: Zero-Based vs. One-Based Addressing
If your sensor manual says “Address 40001,” Modbus software usually expects 0 or 1. Commercial manuals often use “PLC Addressing” (40xxx), while QModMaster uses raw protocol addresses. Always try subtracting 1 if you get an “Illegal Data Address” error.

5

Step 5: Using the Bus Monitor for Debugging

Symptom / Error	Root Cause	Solution
Timeout Error	No response from sensor.	Check wiring (A/B swap), power supply, or incorrect Slave ID.
CRC Error	Data is corrupted.	Check Baud Rate, Parity, or use a shielded cable for RS485 noise.
Illegal Function	Sensor doesn’t support code.	Try 04 (Input Reg) instead of 03 (Holding Reg).
Illegal Data Address	Register doesn’t exist.	Check your manual for the correct start address (try 0 or 1).

Pro Tip: Floating Point Data

If you see strange large numbers instead of temperature values, your sensor might be using 32-bit Float. In QModMaster, go to View > Data Format and select Float or Swapped Float to correctly decode the two 16-bit registers into a single decimal value.

🛡️ Expert Tip: The Termination Resistor

If your connection works perfectly on your desk but fails in the field with long cables (over 10 meters), you likely need a 120-ohm termination resistor. Place the resistor between the A+ and B- lines at the very last sensor on the bus. This prevents signal reflection and is the #1 fix for “Ghost” CRC errors in industrial environments.

Ready to Start Debugging?

Ensure you are using the most stable version of QModMaster for your operating system.

Go to Download Center →

Frequently Asked Questions

Expert solutions for common Modbus RTU and RS485 challenges.

Q: Why do I get a “Timeout” error even though my wiring is correct?

A: This is usually caused by a Slave ID mismatch or an incorrect Baud Rate. Most sensors default to ID 1 and 9600 bps. Also, ensure your USB-to-RS485 adapter is assigned to the correct COM port in QModMaster’s Serial Port settings. If using a long cable, check if the sensor requires a higher voltage (e.g., 24V instead of 12V) due to voltage drop.

Q: How many RS485 sensors can I connect to one QModMaster instance?

A: Technically, the Modbus RTU protocol supports up to 247 slave devices on a single bus. However, physical RS485 transceivers usually support 32, 64, or 128 nodes depending on the “Unit Load.” To poll multiple sensors, you must change the Slave ID in the QModMaster interface for each request.

Q: What is the difference between Function Code 03 and 04?

A: Function Code 03 is for “Read Holding Registers” (read/write memory), while Function Code 04 is for “Read Input Registers” (read-only data from the physical process). If you use the wrong code, the sensor will likely return an “Illegal Function” (Exception Code 01) error. Always check your sensor’s Modbus map.

Q: Can QModMaster handle 32-bit Integer or Floating-point values?

A: Yes. Since Modbus registers are 16-bit, a 32-bit value spans two consecutive registers. In QModMaster, you can use the Data Format menu to select Float, Swapped Float, or Long (Int32) to automatically combine and decode these registers into a human-readable number.

Still having trouble? Check our Support Channels or join the SourceForge discussion.