Modbus TCP vs RTU
Modbus RTU runs over serial links such as RS485 and ends every frame with a CRC. Modbus TCP carries the same function codes over Ethernet/IP on port 502, with a 7-byte MBAP header in place of the CRC. Registers, function codes and the data model are identical. Only the transport differs. That difference bites hardest when you set up gateways and misconfigured “RTU over TCP” links.
Quick comparison
| Modbus RTU | Modbus TCP | |
|---|---|---|
| Physical layer | Serial: RS485 (sometimes RS232) | Ethernet / IP network |
| Addressing | Slave ID 1–247 | IP address + unit ID |
| Port | COM / tty serial port | TCP 502 |
| Error check | CRC-16 at the end of each frame | TCP’s own checksum; no Modbus CRC |
| Header | None (slave ID + PDU + CRC) | MBAP: transaction ID, protocol ID, length, unit ID |
| Masters | One master per bus | Several clients at once (device limits apply) |
| Typical speed | 9600–115200 bit/s | 10/100 Mbit/s network; device response time dominates |
| Distance | About 1,200 m per segment | Depends on the network |
| Typical devices | Meters, sensors, drives, small inverters | Inverters, PLCs, gateways, power analyzers |
Frame structure: where the real difference is
Both variants share the middle part: the PDU (function code + data). What changes is what wraps it.
RTU frame:
[Slave ID 1 byte] [PDU] [CRC 2 bytes]
Frames are separated by at least 3.5 character times of silence. That silence is how the receiver knows a frame has ended.
TCP frame:
[Transaction ID 2] [Protocol ID 2 = 0] [Length 2] [Unit ID 1] [PDU]
There is no CRC because TCP already verifies the data. The transaction ID lets the client match each response to its request.
Why does TCP still have a unit ID?
A device with its own Ethernet port usually ignores the unit ID (or expects 1 or 255). Behind a TCP-to-RTU gateway, though, the unit ID tells the gateway which slave on the RS485 side to forward to. If a device behind a gateway doesn’t answer, check the unit ID first.
“Modbus RTU over TCP” is not Modbus TCP
Some serial-to-Ethernet converters carry the RTU frame unchanged (CRC included, no MBAP header) over TCP. This is called “RTU over TCP”, “encapsulated” or “transparent mode”.
- A Modbus TCP client connecting to it gets a TCP connection but no response, or garbage.
- Fix: switch the converter to “Modbus TCP gateway” mode, or use the client’s RTU-over-TCP option.
An open port 502 does not prove the device speaks Modbus TCP.
Which one should you use?
- Many simple devices over short distances (meters, sensors): RTU. Cabling is cheap and no network is needed.
- The site is already Ethernet, or you need higher throughput: TCP.
- Mixed sites (for example a solar plant): inverters on TCP, meters and sensors on RTU, bridged by a gateway or datalogger.
In practice the device usually makes the choice. What matters is being able to test both sides.
Testing both sides with one tool
For a gateway installation, work in this order:
- Test the RTU side directly with a USB-to-RS485 adapter (serial settings, slave ID, registers). See how to test Modbus RS485 communication.
- Then test the TCP side by connecting to the gateway’s IP on port 502 and reading the same register with the same unit ID.
- Same value on both reads means the gateway works. Different values mean the gateway mapping is wrong.
Ranaliz iOT Tester supports Modbus TCP, UDP and serial RTU in one window. You can switch from RTU to TCP in the same session and compare the two results side by side. FC01–FC16, endianness options, transaction history and Excel/CSV export are free, on Windows and macOS.
FAQ
Is Modbus TCP faster than RTU?
On the wire, yes. Real poll time is often set by the device’s processing time. A multi-device RTU bus is slow mainly because one master polls each device in turn.
What port does Modbus TCP use?
TCP 502 by default. Some devices and gateways let you change it.
Can one device support both TCP and RTU?
Yes. Many inverters and power analyzers have both an Ethernet and an RS485 port. The register map is usually the same, but verify the address offset on both.
What is Modbus ASCII?
An older serial variant that sends data as hex characters with an LRC check. It is rare today; new installations use RTU.
Sources
- Modbus Organization — MODBUS Application Protocol Specification V1.1b3
- Modbus Organization — MODBUS Messaging on TCP/IP Implementation Guide V1.0b
- Modbus Organization — MODBUS over Serial Line Specification and Implementation Guide V1.02
