What Is Modbus? A Complete Installer Guide for 2026
What is Modbus, and why is it still the dominant protocol in 2026? How RTU and TCP differ, function codes, registers, and where you meet Modbus on real jobs.
What is Modbus? It is the de facto industrial communication protocol since 1979, and if you install heat pumps, solar inverters, energy meters, chillers, EV chargers or HVAC systems, you already work with Modbus, whether you realised it or not. Yet there is no up to date installer focused guide that covers the full picture. This article fills that gap.
You will learn what Modbus is, how Modbus RTU and Modbus TCP differ, which registers and function codes matter in practice, how to wire an RS-485 bus correctly, and where you meet Modbus on real jobs in 2026. We also cover the new EPBD IV Building Automation and Control System (BACS) requirement effective 1 January 2026 and what it means for your projects.
Written for installers and technicians, not software engineers. Specific values, specific models, no fluff.
What is Modbus in short?
Modbus is an open communication protocol published in 1979 by Modicon (now part of Schneider Electric) for its programmable logic controllers. According to the Modbus Organization, the specification custodian, Modbus is a master/slave protocol where a single master initiates transactions and slaves respond. Because the specification is royalty free and easy to implement, Modbus quickly became the common language of industrial and building automation.
In 2026 Modbus still dominates at the device level, especially in HVAC, heat pumps, solar PV, refrigeration and sub-metering. Higher protocols such as BACnet, KNX and OPC UA take over at the supervisor layer, but on the tier where an installer works, Modbus remains the norm.
Modbus RTU, TCP and ASCII: three flavours compared
Modbus exists in three variants, and the difference is purely in the transport layer. The application layer (function codes, register addresses) is identical in all three.
| Variant | Physical layer | Framing | Typical use | Speed |
|---|---|---|---|---|
| Modbus RTU | RS-485 or RS-232, serial | Binary with CRC-16 | Field devices, meters, heat pumps | 9,600 to 115,200 baud |
| Modbus TCP | Ethernet, IP port 502 | TCP packet with MBAP header | PV inverters, BAS supervisors | Up to 1 Gbit/s |
| Modbus ASCII | Serial | ASCII with LRC | Legacy, rarely new | 1,200 to 19,200 baud |
Modbus RTU remains the most common variant for installations. You recognise it by three wires on a terminal block (A, B, GND) and a daisy chain topology of up to 1,200 metres without a repeater. Modbus TCP is standard for PV inverters and any device that already has Ethernet. Modbus ASCII turns up only rarely, mainly when retrofitting older plants.
How Modbus works: master, slaves and registers
A Modbus network always has exactly one master and up to 247 slaves on the same bus. The master asks, the slaves answer. Slaves never initiate messages, which is the main reason Modbus RTU is so predictable on long daisy chains.
Each slave has a unique slave address between 1 and 247. Address 0 is reserved for broadcast messages with no response. Within a slave, memory is divided into four register types, each with its own read and write permissions.
| Type | Modicon prefix | Size | Permissions | Example |
|---|---|---|---|---|
| Coil | 0x (00001 to 09999) | 1 bit | read and write | relay on or off |
| Discrete Input | 1x (10001 to 19999) | 1 bit | read only | limit switch status |
| Input Register | 3x (30001 to 39999) | 16 bit | read only | measured temperature |
| Holding Register | 4x (40001 to 49999) | 16 bit | read and write | setpoint temperature |
In practice you mostly use holding registers (4x) for configuration and input registers (3x) for measurements. A temperature value often occupies two adjacent registers, because manufacturers split 32 bit floats over two 16 bit registers. Always check the register map of your specific device: address numbering and word order (high before low or the other way) differ between manufacturers.
Modbus function codes installers should know
A function code tells a slave what the master wants. Of the 24 codes defined in the specification, you mostly use seven in real life.
| FC | Name | Purpose | Who uses it? |
|---|---|---|---|
| 01 | Read Coils | Read relay or on/off state | Refrigeration, lighting |
| 02 | Read Discrete Inputs | Read alarm and status contacts | Alarm monitoring |
| 03 | Read Holding Registers | Read setpoints and configuration | Dominant in HVAC |
| 04 | Read Input Registers | Read measurements | Energy meters, PV |
| 05 | Write Single Coil | Set a single relay | Manual control |
| 06 | Write Single Register | Write one setpoint | Setpoint change |
| 16 | Write Multiple Registers | Write multiple 16 bit regs | Bulk configuration |
FC03 is by far the most used function code in HVAC and heat pump monitoring. You read, for example, two holding registers at address 0x0000 to get the flow temperature.
The master sends the FC03 request, the slave answers within milliseconds with the four payload bytes. A full cycle stays under 20 ms at 9,600 baud, so with a one-second polling interval you can comfortably cover dozens of slaves without overlap.
Where you meet Modbus in the field
Modbus sits in almost every segment where an international installer works. Below the most common sector specific picks.
Heat pumps
Daikin Altherma 3, Mitsubishi Ecodan (via PAC-IF071B-E adapter), Panasonic Aquarea H, LG Therma V, Nibe F and S series, Stiebel Eltron WPM, Viessmann Vitocal and Vaillant aroTHERM/geoTHERM all expose Modbus RTU or Modbus TCP, either natively or through an optional vendor gateway. For detailed per brand register maps, see our heat pump Modbus monitoring guide.
Solar inverters
SMA Sunny Boy and Tripower, Fronius Symo and GEN24, SolarEdge single phase and three phase, Huawei SUN2000 via SmartLogger, GoodWe, Kostal Plenticore, Growatt, Sungrow and Victron Cerbo GX all speak Modbus TCP. Most adhere to the SunSpec Modbus profile, which standardises the register layout across manufacturers.
Energy meters
The Eastron SDM630 is the global installer workhorse: three phase, MID certified, Modbus RTU default 9600 8N1, up to 100 A per phase. Our Eastron SDM630 Modbus register map contains the full register reference. Competing meters include Schneider iEM3000, ABB B23/B24, Janitza UMG 96RM, Siemens SENTRON 7KM PAC and Carlo Gavazzi EM24.
Refrigeration and HVAC controllers
Carel pCO5+, Danfoss AK-SM800A, Bitzer BCD, Güntner GHM, Emerson E2/E3 and Johnson Controls Penn all expose Modbus RTU or TCP. Under the EU F-gas Regulation (EU) 2024/573, refrigeration systems above 5 tCO2e need digital logbooks, and Modbus monitoring is the practical data source behind those logbooks.
Building management and home automation
Johnson Controls Metasys, Honeywell CentraLine, Siemens Desigo CC, Trane Tracer SC+, Delta Controls enteliBUS, Loxone Miniserver and Niagara Framework (Tridium) integrate Modbus as a sub protocol next to BACnet. Home Assistant has a built in Modbus platform that dominates DIY integrations worldwide.
EV charging
Alfen Eve Pro-line, ABB Terra AC and DC, KEBA P30, Schneider EVlink, Wallbe Pro and Delta Ultra Fast Chargers expose Modbus TCP for dynamic load balancing and energy management integration.
Wiring Modbus: baud rate, addressing, termination
The most common faults on a new Modbus install are always physical faults, not protocol faults. Pay attention to these five points.
- 1
Use shielded twisted pair cable
A shielded twisted pair (STP) cable with impedance near 120 Ω is mandatory. Belden 9841 or a Cat-5 cable using one twisted pair for A and B both work. Do not mix pairs.
- 2
Daisy chain, never star
RS-485 works in daisy chain topology: master to slave 1 to slave 2, with no stubs longer than 30 cm. Star topology or long stubs cause reflections and CRC errors.
- 3
Terminate with 120 Ω at each end
Place a 120 Ω termination resistor at the master and at the furthest slave, never in the middle and never on every device. Many gateways have a DIP switch for switchable termination.
- 4
Match baud rate and parity on every device
Default is 9,600 baud 8N1. Some manufacturers use 19,200 or 38,400. All devices on the bus must share identical settings, otherwise no communication.
- 5
Assign unique slave addresses
Slave addresses 1 to 247 are valid, 0 is reserved for broadcast. Duplicate addresses cause bus conflicts that are painful to debug. Document the address plan in your project folder.
For the physical layer in depth, see our full RS-485 wiring guide for Modbus covering cable selection, shielding and noise rejection.
Modbus and the 2026 EPBD BACS requirement
From 1 January 2026, the revised Energy Performance of Buildings Directive (EPBD IV, Directive (EU) 2024/1275) requires a Building Automation and Control System (BACS) in non residential buildings with HVAC rated above 290 kW, with the threshold dropping to 70 kW by 2030. EU member states must transpose EPBD IV into national law by 29 May 2026, according to EUBAC.
EPBD IV explicitly lists Modbus as an acceptable open protocol, alongside BACnet, KNX, MQTT and M-Bus (Spectral BACS 2026). For installers, this means existing Modbus infrastructure remains compliant, but a supervisor layer or cloud platform is often required to log and report energy data in the BACS class C format.
In parallel, the EU F-gas Regulation 2024/573 mandates digital logbooks for refrigeration systems above 5 tCO2e, and Modbus is how that data leaves the plant in practice.
Modbus vs BACnet vs KNX vs M-Bus: when to pick which
Modbus is not always the right answer. Use this rough guide:
- Modbus RTU: cheap, simple, works on RS-485. Pick for field devices, meters, heat pumps, refrigeration. Do not pick for high complexity building automation because there is no object model.
- Modbus TCP: same data model over Ethernet. Pick for PV inverters and anything with an IP address.
- BACnet/IP: richer object model, peer to peer, native HVAC semantics. BACnet holds roughly 60 to 77 percent of the global BACS market share as of 2025 (Optigo Networks). Pick for large commercial BAS.
- KNX: room level European standard for lighting, blinds, comfort. Not for plant rooms.
- M-Bus and wM-Bus: purpose built for meter reading. Sometimes easier than Modbus for heat meters and water meters.
Real installations usually combine two or three: Modbus at the device level, BACnet at the supervisor, and a cloud platform on top.
Troubleshooting common Modbus problems
| Symptom | Probable cause | Fix |
|---|---|---|
| No response to FC03 | Wrong slave address or A/B swapped | Check address in service menu, swap A and B if in doubt |
| CRC errors | Missing or incorrect termination | Place 120 Ω at both ends, ground shields at one side only |
| Intermittent data | Cable too long or too many stubs | Keep stubs under 30 cm, use a repeater beyond 1,000 m |
| Exception code 02 | Register address does not exist | Check manufacturer register map, mind 0 vs 1 based addressing |
| Exception code 03 | Invalid data value | Value outside the allowed range of the register definition |
| Timeout after 1 second | Slow slave or wrong baud rate | Raise timeout to 2 seconds or align baud rate across devices |
Modbus FAQ
What does Modbus stand for?
Modbus is a contraction of Modicon Bus. It was introduced in 1979 by Modicon, a PLC manufacturer now part of Schneider Electric, to let its programmable logic controllers exchange data with peripherals. The name stuck even after the protocol went open and industry wide.
What is the difference between Modbus RTU and Modbus TCP?
Modbus RTU runs over serial RS-485 in a daisy chain with up to 247 slaves. Modbus TCP runs over Ethernet on port 502 in a star topology. Function codes and register addresses are identical, only the transport differs. RTU is robust over long distances, TCP is faster and scales better.
Is Modbus still used in 2026?
Yes. Modbus remains the dominant device level protocol in 2026, especially in HVAC, heat pumps, PV, refrigeration and energy metering. The EU EPBD IV directive explicitly lists Modbus as an acceptable open protocol for the BACS requirement effective 1 January 2026. BACnet and OPC UA dominate the supervisor layer but rarely replace Modbus on devices.
What port does Modbus TCP use?
Modbus TCP uses IANA registered TCP port 502. The client opens a TCP connection to the server on this port and exchanges Modbus PDUs wrapped in an MBAP header. Some vendors allow alternative ports for security, but 502 is the default and the only widely supported value.
How many devices can connect to a Modbus network?
Modbus RTU supports up to 247 slaves per bus as defined by the specification. Electrical loading of the RS-485 transceivers typically limits this to 32 standard unit loads in practice. For more devices, add a repeater or use multiple buses. Modbus TCP has no such limit, only the network capacity matters.
What is a Modbus register?
A Modbus register is a 16 bit memory location inside a slave device, accessed by the master using a function code and an address. The four register types are coil (0x), discrete input (1x), input register (3x) and holding register (4x). Measurements larger than 16 bits, such as 32 bit floats, occupy two adjacent registers.
Is Modbus the same as RS-485?
No. RS-485 is a physical layer standard for serial communication over twisted pair cable. Modbus RTU uses RS-485 as its transport, but RS-485 also carries other protocols such as Profibus and DMX. Modbus TCP, conversely, runs over Ethernet and does not use RS-485 at all.
What baud rate should I use for Modbus RTU?
The default is 9,600 baud, 8 data bits, no parity, 1 stop bit (9600 8N1). For faster polling or more slaves, move to 19,200 or 38,400 baud. All devices on the same bus must share identical settings. Higher baud rates reduce the maximum cable length, so check the manufacturer cable length versus baud rate chart.
Summary
Modbus has been the most widely deployed industrial protocol for 47 years, and 2026 is no exception. For installers, mastering RTU versus TCP, the main FC01 to FC16 function codes, and the four register types pays back immediately on site. With EPBD IV tightening BACS requirements across the EU from January 2026, Modbus data practices also become part of formal building regulation rather than an optional extra.
If you need to consolidate Modbus data from many installations and report it automatically, pairing a local gateway with a managed cloud tends to be cheaper and faster than a custom SCADA stack. The ModbusCloud Gateway reads any Modbus RTU or Modbus TCP slave and pushes the data encrypted into the ModbusCloud portal.
Ready to get started?
Order the ModbusCloud Gateway and start monitoring your installations within 5 minutes.
View the gateway