Understanding Modbus RTU
Serial field protocol reference for RS485 bus deployments — frame format, addressing, CRC, and integration with Wiman gateway platforms.
Introduction
Modbus RTU is a binary serial protocol used to exchange register and coil data between a bus master and one or more slave devices. On industrial sites it typically runs over RS485 physical layers with a single master polling multiple field devices in sequence.
Why Modbus RTU is still widely used
- Installed base — PLCs, meters, and sensors shipped with Modbus RTU for decades.
- Deterministic polling — master-controlled timing suits fixed-cycle SCADA and PLC logic.
- Low overhead — compact frames suit bandwidth-constrained serial links.
- Interoperability — function codes and register maps are documented per device.
Frame Structure
A Modbus RTU frame consists of an address byte, function code, data field, and CRC. Maximum PDU data length is 252 bytes; total frame size depends on the function code and payload.
| Field | Size | Range | Notes |
|---|---|---|---|
| Slave Address | 1 byte | 0–247 | 0 = broadcast (writes only) |
| Function Code | 1 byte | 01–06, 0F–10 | Defines PDU operation |
| Data | N bytes | Function-specific | Addresses, counts, or values |
| CRC | 2 bytes | 16-bit | Polynomial 0xA001, LO byte first |
| Code | Name | Description |
|---|---|---|
| 01 | Read Coils | Read discrete outputs (DO) |
| 03 | Read Holding Registers | Read read/write 16-bit registers |
| 04 | Read Input Registers | Read read-only 16-bit registers |
| 06 | Write Single Register | Write one holding register |
| 10 | Write Multiple Registers | Write contiguous holding registers |
Addressing
Slave addresses occupy one byte at the start of each frame. Valid station addresses are 1–247. Address 0 is reserved for broadcast write operations; slaves do not respond to broadcast requests. Address 248–255 are reserved and must not be assigned in the field.
CRC
Modbus RTU appends a 16-bit CRC to each frame using polynomial 0xA001 (reflected form of 0x8005). The CRC covers the address, function code, and data fields. Byte order is low-order CRC byte first, followed by high-order byte.
Example frame
Request: Read 10 holding registers from slave 1, starting at address 0
01 03 00 00 00 0A C5 CD
│ │ │ │ └── CRC (LO HI)
│ │ │ └── Quantity of registers (10)
│ │ └── Starting address (0)
│ └── Function code 03
└── Slave address 1Typical Industrial Applications
- Factory Automation — Machine connectivity, PLC integration, and production line telemetry in manufacturing environments.
- Water Monitoring — Remote sensing and telemetry for water treatment, distribution, and environmental monitoring.
- Energy Monitoring — Power metering, consumption tracking, and grid-edge data collection for energy management systems.
- Building Automation — HVAC, lighting, and environmental control integration for commercial and industrial facilities.
- Industrial IoT — General-purpose edge connectivity for OEM and integrator IoT platforms across verticals.
- Remote Telemetry — Cellular and wireless data collection from geographically distributed or inaccessible sites.
Advantages
- Simple master–slave topology with predictable scan cycles.
- Minimal frame overhead on RS485 multi-drop buses.
- Broad vendor support across energy, HVAC, and machine I/O devices.
- Direct mapping to holding registers and coils for SCADA tags.
Limitations
- Single master per bus segment — no peer-to-peer arbitration.
- No built-in discovery; register maps must be obtained from device documentation.
- Serial speed and cable length constrain total devices and poll rate.
- No encryption or authentication at the protocol layer.
Compatible Wiman Platforms
| Modbus RTU | Modbus TCP | |
|---|---|---|
| Transport | Serial (RS485/RS232) | Ethernet TCP/IP |
| Framing | Binary with CRC-16 | MBAP header + PDU |
| Topology | Single master, multi-drop | Client/server over LAN |
| Typical use | Field buses, meters, remote I/O | SCADA, edge gateways, plant networks |
- MAX Series — Industrial Multi-Protocol Gateway Platform
- PRO Series — Advanced Industrial Edge Platform
- LITE Series — Compact Industrial Connectivity Platform
- Industrial I/O Modules — Field I/O expansion for gateway and controller integrations
- Industrial Protocol Converters — Protocol translation between field buses and modern connectivity layers
Modbus RTU bus topology
Diagram placeholder
Related Products
- WT460M — 4G LAN industrial gateway with multi-protocol edge connectivity for demanding deployments.
- WT470M — Expanded I/O and protocol stack for complex multi-site industrial edge deployments.
- WT600M — High-throughput gateway for multi-site industrial networks and concurrent protocol workloads.
- WT400M — Advanced edge gateway with deep protocol support for machine builder integrations.
- WT600M — Expanded edge compute and protocol concurrency for integrator-grade deployments.
- WT700M — Top-tier PRO platform for multi-protocol machine integration and edge processing.
- WT410M — Compact gateway for space-constrained installations with essential protocol support.
- WT610M — Mid-range LITE gateway with expanded wireless and serial connectivity options.
- WT710M — Full-featured LITE platform within a compact form factor for integrator deployments.
- 2I — Compact digital input expansion module for DIN-rail gateway integrations.
- 6I — Multi-channel digital input module for field signal aggregation.
- 32I — High-density digital input expansion for large-scale field deployments.
- Serial-to-Ethernet — Bridge RS485/RS232 serial networks to Ethernet for modern connectivity layers.
- Modbus-to-MQTT — Translate Modbus field data to MQTT topics for cloud and SCADA pipelines.
Related Downloads
- WT460M Datasheet
- WT460M User Manual
- WT460M Firmware v2.4.1
- WT460M Configuration Tool
- WT470M Preliminary Datasheet
- WT400M Datasheet
- WT400M User Manual
- WT400M Firmware v2.1.0
- WT410M Datasheet
- WT410M User Manual
- WT410M Firmware v1.8.0
- WT460M Quick Start Guide
- WT460M Mechanical Drawing
- WT460M CE Declaration of Conformity
- WT460M FCC Certificate
Frequently Asked Questions
What baud rates are commonly used for Modbus RTU?
9600, 19200, and 115200 bit/s are typical. All devices on a bus segment must use the same baud rate, parity, and stop-bit configuration.
How many slaves can share one RS485 segment?
The Modbus specification allows up to 247 addressed devices per segment. Practical limits depend on cable length, baud rate, and required poll cycle time.
Can a Wiman gateway act as Modbus RTU master and slave simultaneously?
Gateway firmware supports configurable serial roles per deployment. Consult the product manual for concurrent master/slave capability on your model.
Where do register addresses start?
Vendor documentation defines zero-based or one-based addressing. Always confirm the register map in the device datasheet before mapping SCADA tags.