Networking
Modbus register maps: scaling and byte order
A number read over Modbus is not an engineering value until address base, scale and word order are verified.
What is the difference between Modbus RTU and Modbus TCP?
Short answer
Modbus RTU runs over a serial line, usually RS-485, and ends each frame with a CRC-16. Modbus TCP carries the same register model and function codes over Ethernet, normally on port 502, with an MBAP header instead of a CRC. The data meaning is identical; a gateway bridges the two when needed.
What stays the same, what changes
Modbus is a client-server protocol that exposes a device's data as 16-bit registers. RTU and TCP share the same register model and function codes; code 03 reads holding registers in both. What changes is how a frame is carried and checked.
RTU runs over a serial link such as RS-485. Silent gaps between frames mark where each frame starts and ends. A typical bus has one master and several slaves, with slave addresses from 1 to 247.
TCP runs over Ethernet inside an ordinary TCP connection, usually on port 502. Each request begins with a 7-byte MBAP header holding a transaction identifier, a protocol identifier, a length field and a unit identifier. Depending on the device, several clients may connect.
Worked example: one read request
Hypothetical request: read 2 holding registers starting at address 0 from slave 17 (0x11). The function code is 03. The protocol data unit (PDU) is 5 bytes: function code (1), start address (2) and register count (2).
RTU frame: slave address (1) + PDU (5) + CRC (2) = 8 bytes. At 9600 baud with 8N1 framing, each byte takes 10 bits: start, 8 data and stop. Transmission takes about 8 × 10 / 9600 ≈ 8.3 ms; the silent gaps are not included.
TCP frame: MBAP (2 + 2 + 2 + 1 = 7) + PDU (5) = 12 bytes. The MBAP length field counts the unit identifier and the PDU: 1 + 5 = 6.
The data content is the same in both versions. Only the envelope changes.
Common mistakes
The most frequent mistake is carrying RTU settings over to TCP. Baud rate, parity and stop bits (for example 9600 8E1) mean nothing on Ethernet, where the IP address, port and unit identifier matter. Behind a gateway, a wrong unit identifier can send the request to a different serial device.
The second mistake is reading the absence of a CRC as proof of clean transmission. TCP and Ethernet check integrity, but values should still be checked against the process. An unexpected value is often the first sign of a wrong register map.
The third mistake is assuming a single master. If several clients poll the same device, check its connection limit and response behaviour in the manual.
Follow-up questions
Can one device speak both RTU and TCP?
Some devices offer both interfaces. The register map is the same. A serial-only device usually needs a gateway to join Ethernet. Check the device documentation for supported interfaces.
If Modbus TCP has no CRC, what happens to corrupted data?
Ethernet frames with a bad frame check sequence are normally discarded, and TCP asks for damaged segments again, so transmission errors rarely pass silently. Application checks still matter: watch for timeouts, missing responses and unexpected values.
Sources
Example numbers are hypothetical, not measured field results.