Modbus (Building Automation)

Modbus is an open messaging protocol that lets a controller read and write the data held inside field devices. It runs over a serial RS-485 bus, known as Modbus RTU, or over Ethernet, known as Modbus TCP. Some photovoltaic (PV) inverters and energy meters offer it. For example, the Fronius GEN24 inverter supports both variants and passes on data from a Fronius Smart Meter.

What is Modbus and where does it come from?

Modbus is an application-layer messaging protocol, placed at level 7 of the OSI model. It provides client and server communication between devices on different kinds of buses and networks. The Modbus specification calls it the industry's serial de facto standard since 1979. A client sends a request and a server replies. The protocol defines the message format and a set of function codes. It does not say what a register means, so each device maker documents that in its own register list.

Older documents use the terms master and slave. The Modbus over Serial Line guide still uses them, while the application protocol specification uses client and server.

How does Modbus RTU work on a serial bus?

Modbus RTU is the serial variant. The serial line guide calls the two-wire RS-485 interface the most common one. It makes RTU mode mandatory for every device and treats ASCII mode as an option. The transmission mode and the serial port settings must be the same for all devices on one line.

One master starts every transaction. Up to 247 slave devices share the line, and each takes a unique address from 1 to 247. A slave never sends data unless the master asks. Each frame ends with a CRC check, so the receiver can reject a damaged message. A master that polls an inverter and a meter on one cable sends a request, waits for the reply, then asks the next device.

How does Modbus TCP add an Ethernet header?

Modbus TCP carries the same request and reply data inside a TCP/IP connection, on registered port 502. Each message starts with a 7-byte MBAP header. It holds a transaction identifier that pairs requests with replies, a protocol identifier that is zero for Modbus, a length field and a unit identifier. A gateway uses the unit identifier to reach a device behind it on a serial line. The table compares the two variants.

Feature	Modbus RTU	Modbus TCP
Transport	Serial line, most often two-wire RS-485	TCP/IP over Ethernet
Device addressing	Slave address from 1 to 247 on one bus	IP address, plus a unit identifier behind a gateway
Error check	CRC at the end of each frame	No CRC field in the MBAP header. The Ethernet frame carries its own CRC-32
Registered port	Not applicable	TCP port 502
Maximum message size	256 bytes on a serial line	260 bytes over TCP

What data can a Modbus device expose?

The specification defines four data tables. Discrete inputs and coils hold single bits. Input registers and holding registers hold 16-bit words. Discrete inputs and input registers are read-only. The client can write coils and holding registers. The protocol addresses coils, discrete inputs and registers from zero. Coils numbered 1 to 16 in a manual are addresses 0 to 15 on the wire. The protocol data unit holds at most 253 bytes, so one read request returns a limited block of values.

Data table	Size	Access
Discrete inputs	Single bit	Read-only
Coils	Single bit	Read-write
Input registers	16-bit word	Read-only
Holding registers	16-bit word	Read-write

How do PV inverters, meters and heat pumps use Modbus?

The Fronius GEN24 manual shows what this looks like for an inverter. The inverter offers Modbus TCP over Ethernet and Modbus RTU over RS-485. It lists register blocks for inverter data and for meter data. A connected energy meter can be read through a settable Modbus device ID. A home controller can read these values and use them in its control logic.

Whether a heat pump offers Modbus depends on the model and its controller. Ask the maker for the register list of the exact model before you buy. The Modbus protocol does not say which register holds which value, so the register list in the maker's manual is the real reference.

How is Modbus different from BACnet and KNX?

Modbus and BACnet are different protocols. Modbus defines function codes and data tables, and the meaning of each value comes from the device maker. BACnet defines objects with standard properties that describe each object to other devices. The BACnet entry explains the object model.

Question	Modbus	BACnet
What does the protocol define?	Message format, function codes and data tables	Objects with standard properties
Who gives a value its meaning?	The device maker, in a register list	The object type and its properties
How does a device describe itself?	It does not. The register list in the manual does it	Its device object lists the objects and services it supports

KNX is a third protocol. The KNX Association describes it as an open standard and shows family homes among its project categories. A building automation system may combine more than one protocol, and a gateway joins them. Modbus is one way to bring readings from a PV inverter or a smart meter into such a system.

What should you check before connecting Modbus devices?

Start with the device manuals, not the protocol specification. Find out whether the device offers RTU, TCP or both, and which register list applies to its firmware version. Give every serial device a unique address and use the same settings on the whole bus. Write the register list into your project documentation, because the numbering in manuals may differ from the numbering on the wire.

Security also needs attention. The Modbus Organization publishes a separate Modbus Security Protocol that combines Transport Layer Security (TLS) with the traditional Modbus protocol. It uses X.509v3 certificates for authentication. The Modbus Organization marks the 1996 serial line document as obsolete, so use the serial line guide V1.02 for any new RS-485 installation.