What is Modbus?
Modbus is a way for one machine to ask another machine for numbers. It was published in 1979, it is deliberately simple, and it is in an enormous amount of building and industrial equipment: meters, variable-speed drives, chillers, boilers, rooftop units, generators, UPSs, and sensors of every kind. A Modbus request says, in effect, “give me the contents of sixteen-bit slot number 7”. The equipment answers with sixteen bits. It does not say what those bits mean — that information lives only in the manufacturer's documentation, and that single fact is the source of almost every difficulty people have with Modbus.
What a Modbus device actually gives you
Picture the equipment as having four numbered lists inside it, and nothing else:
| List | What it holds | Can you change it? |
|---|---|---|
| Coils | Single on/off values — a start command, an enable, a reset | Yes |
| Discrete inputs | Single on/off values the equipment reports — running, alarm | No |
| Input registers | Numbers the equipment measures — temperatures, pressures | No |
| Holding registers | Numbers you can read and usually write — setpoints, modes, and on many devices the readings too | Usually |
Each list is just numbered slots. Slot 0, slot 1, slot 2, and so on. A register slot holds exactly sixteen bits, which is a whole number from 0 to 65535, or −32768 to 32767 if the manufacturer decided it was a signed number. There are no names, no units, and no descriptions anywhere in the protocol.
This is the part that surprises people coming from BACnet, or from almost any modern system. A BACnet controller will tell you what it has: you ask for its object list and it replies with names and units. A Modbus device will never do this. It answers exactly the question you asked and volunteers nothing.
What that means in practice
To get one useful number out of a Modbus device you need to know four things, and the protocol supplies none of them:
- Which list the value is in.
- Which slot number — and there are several rival ways of writing that number down. See why your Modbus address is off by one.
- How to interpret the bits — is it a whole number, a decimal, a number spread across two slots, one bit of a status word? See why your Modbus value looks wrong.
- What it means — that slot 7 is the leaving water temperature, in tenths of a degree Fahrenheit.
All four live in a document called a register map, which your equipment vendor has and you probably do not. See what a Modbus register map is.
The flavours you will run into
- Modbus TCP — runs over an ordinary Ethernet network, normally on port 502. If the equipment has an Ethernet socket, this is probably what it speaks.
- Modbus RTU — runs over a two- or three-wire serial cable, usually RS-485, with devices daisy-chained along it. Far more common in the field than Modbus TCP, and much older.
- Modbus RTU over TCP — serial Modbus stuffed inside a network connection by a small box called a gateway. Extremely common, and a frequent source of “the device is not responding”.
Which kind do I have? covers how to tell them apart.
Why it is still everywhere
Because it is simple enough to implement in a few hundred bytes of code, it is not owned by anybody, and it works. A protocol that reads sixteen bits out of a numbered slot has essentially nothing to go wrong or go out of date. The cost of that simplicity is that all the meaning has to be documented somewhere else, by humans, and kept up to date by humans.
Is reading from it safe?
Reading is harmless. A read request cannot change anything; the equipment looks up a number and sends it. Writing is a different matter entirely — Modbus has no undo, no timeout, and no concept of priority. A value you write is simply the value now, until something else writes over it. Read is it safe to write to a Modbus register? before changing anything on live equipment.