The Origins of PLCs

​

The world's first Programmable Logic Controller (PLC) was developed and introduced by Modicon in 1969. The PLC was designed as a robust computerized alternative to replace the complex electromechanical relay panels that were widely used in manufacturing industries at the time.

 

For its era, the equipment represented a major technological leap in industrial automation. Although its specifications were modest by today's standards, they were revolutionary for the late 1960s. It offered programmable memory, fanless operation, digital I/O capability, and logic programming using the Ladder Diagram language.

 

During the 1970s, industrial automation experienced rapid technological growth. Several manufacturers entered the PLC market as it became increasingly clear that programmable controllers represented the future of industrial automation.

​

Digital Communication in PLCs

​

As PLC technology evolved during that decade, the need for digital communication between PLCs and other industrial systems became increasingly important. At that time, the automation market was dominated by isolated communication networks, where each manufacturer developed its own proprietary communication protocol in order to keep customers tied to its products.

 

There was no standard communication protocol for PLCs in the industrial market.

 

Unlike most manufacturers of that period, Modicon developed and introduced the Modbus protocol in 1979 as an open standard, making the protocol specification publicly available and free of licensing fees.

 

It was a disruptive market strategy that enabled the protocol to be rapidly adopted throughout the global industrial automation market. Any manufacturer of sensors, actuators, PLCs, or competing automation systems could simply read the Modicon documentation and implement the Modbus protocol in its own products without paying royalties.

​

The Modbus Protocol

​

Today, Modbus is one of the most widely used industrial communication protocols in the world. Even after more than four decades, it remains highly popular due to its simplicity and compatibility with equipment from a wide range of manufacturers.

 

As industrial networks evolved, the protocol was adapted to support new physical communication layers in response to increasing demands for reliability, lower latency, and higher transmission speeds. However, its original logical commands, function codes, and data mapping were preserved. In other words, while the physical communication layer evolved, the Modbus application layer remained essentially unchanged.

​

Modbus RTU

​

Modbus RTU was the original version of the Modbus protocol. It uses compact binary encoding and was designed from the beginning to support multipoint communication between industrial devices.

 

Originally, Modbus RTU was developed to operate over RS-232, which was the dominant communication standard for industrial equipment at the time. Since RS-232 only supports point-to-point communication, Modbus networks relied on alternative methods to achieve multipoint communication, including 20 mA current loops, telephone modems, radio communication systems, and Modicon's own RS-232 multiplexers.

 

In 1983, the RS-485 standard was introduced, allowing up to 32 devices to be connected natively to the same two-wire communication bus. No changes to the Modbus protocol were required, since it had already been designed with multipoint communication in mind. The industry simply replaced the RS-232 transceiver chips with RS-485 devices.

 

Modbus RTU (RTU = Remote Terminal Unit) operates using a Master/Slave communication model. In this architecture, only the Master device is allowed to initiate communication, while Slave devices respond exclusively to requests received from the Master. This communication model guarantees an orderly exchange of messages and significantly reduces the probability of collisions on the network.

 

Originally, the Slave device was typically a PLC. Today, however, it can be virtually any industrial field device, including remote I/O modules, valves, variable frequency drives (VFDs), weighing systems, communication gateways, sensors, transmitters, or any measurement device capable of processing and providing data to a Modbus Master.

 

Modbus RTU offers the following characteristics:

​

• Supports communication with up to 247 Slave devices.

• Provides function codes for reading and writing both discrete and numeric data.

• Includes a built-in CRC (Cyclic Redundancy Check) mechanism for communication error detection.

​

Modbus RTU Message Structure

​

A Modbus RTU request sent by the Master consists of the following fields:

​

• Slave Address: Identifies which Slave device should respond.

• Function Code: Specifies the requested operation (for example, reading registers or writing coils).

• Data: Contains the information to be transmitted or the parameters required by the requested operation.

• CRC: Used to verify data integrity during transmission.

 

The CRC (Cyclic Redundancy Check) is calculated by the Master and transmitted together with the message. Upon receiving the frame, the Slave recalculates the CRC and compares the result with the received value to verify the integrity of the entire message.

 

A successful Modbus RTU response from a Slave consists of the following fields:

​

• Slave Address: Identifies the responding Slave device.

• Function Code: Confirms the requested function.

• Data: Contains the information returned by the Slave, when applicable.

• CRC: Used to verify data integrity during transmission.

 

Modbus RTU Frame Format

 

A Modbus RTU request frame consists of four main fields, transmitted in a compact binary format (bytes).

​

Field                                Size              Description                                                                                                                                  

Slave Address               1 byte           Identifies the destination Slave device (1 to 247).

Function Code               1 byte          Defines the requested operation (for example, register reading).

Data                                 N bytes        Register values, parameters, addresses, or other data required by the operation.

CRC                                  2 bytes         Error-checking code used to validate the message integrity.

​

A Modbus RTU response frame also consists of four main fields.

​

When the Master's request is successfully processed, the Slave confirms the operation or returns the requested data.

​

Successful Response

 

Field                                  Size              Description                                                                                                                               

Slave Address                 1 byte           Confirms the address of the responding Slave device.

Function Code                 1 byte           Echoes the same function code received from the Master.

Data                                   N bytes         For read operations, contains the byte count followed by the requested values.

                                                                   For write operations, echoes the written data.

CRC                                    2 bytes          Error-checking code used to validate the message integrity.

 

Exception Response

 

If the requested operation cannot be executed, the Slave returns an Exception Response.

 

Field                                         Size            Description                                                                                                                                               

Slave Address                        1 byte         Confirms the address of the responding Slave device.

Function Code + 0x80         1 byte         The original function code with its most significant bit set (original code + 0x80).

Exception Code                     1 byte         Indicates the exact error (for example, 01 = Illegal Function, 02 = Illegal Data Address).

CRC                                           2 bytes       Error-checking code used to validate the message integrity.

 

Advantages of Modbus RTU

 

Modbus RTU still offers several advantages that justify its widespread use in industrial automation.

 

Among its main benefits are:

​

• Simplicity: Open standard that is easy to understand, configure, and implement.

• Compatibility: Interoperable with equipment from a wide variety of manufacturers.

• Low Cost: Requires simple and inexpensive communication hardware.

• Reliability: Highly resistant to electrical noise when used over RS-485 networks.

• Flexibility: Can be implemented over wired, wireless, or gateway-based communication networks.

​

Modbus TCP

​

As industrial networks evolved throughout the 1990s and Ethernet technology became increasingly common on the factory floor, Modbus TCP emerged as an adaptation of the Modbus protocol for Ethernet networks.

 

Ethernet communication is based on the TCP/IP (Transmission Control Protocol / Internet Protocol) model, which defines how data is transmitted and received across computer networks, including the Internet, through IP packets.

 

Modbus TCP uses the TCP/IP protocol stack while preserving the same command structure and data mapping defined by Modbus RTU. To support Ethernet communication, it adds a specific header called the MBAP (MODBUS Application Protocol) Header.

 

Unlike Modbus RTU, Modbus TCP does not include a CRC field. Instead, it relies on the error detection mechanisms already provided by Ethernet and TCP/IP. Ethernet frames include a CRC-32 checksum, while the TCP protocol itself provides additional mechanisms to ensure reliable data delivery.

 

Later, without requiring any modification to the protocol itself, Modbus TCP also became widely used over Wi-Fi networks using the same TCP/IP infrastructure. This allowed the protocol to operate transparently on both wired and wireless LANs and WANs, making it possible for industrial devices to communicate directly with supervisory systems and higher-level enterprise applications.

 

The communication architecture also evolved. Instead of the traditional Master/Slave model used by Modbus RTU, Modbus TCP adopts a Client/Server architecture, allowing multiple systems or PLCs to access data from the same device simultaneously — something that is not possible on a traditional RS-485 Modbus RTU network.

 

In this model, the Server provides data to one or more Clients, allowing multiple Clients to read from or write to the same Server at the same time.

 

Multiple Clients and Servers can share the same IP network and communicate simultaneously using their IP addresses. Traffic management, collision handling, routing, and error detection are handled by the TCP/IP protocol stack, allowing Modbus TCP to focus exclusively on the application layer.

 

Modbus TCP operates at the application layer over TCP/IP, using the standard TCP port 502, ensuring reliable delivery of communication packets.

 

Because Ethernet networks provide significantly higher bandwidth than serial communication, Modbus TCP can exchange a much larger number of messages within the same period of time. This makes it particularly suitable for applications requiring high-speed communication, large volumes of data, or simultaneous access by multiple supervisory systems.

 

Modbus TCP Message Structure

 

A Modbus TCP message consists of the following structure:

 

Field                                                             Size      

MBAP Header                                            7 bytes

Function Code                                           1 byte

Data                                                             N bytes

​

The MBAP Header is 7 bytes long and consists of the following fields:

​

• Transaction Identifier (2 bytes): Used to match requests and responses.

• Protocol Identifier (2 bytes): A value of 0 identifies the Modbus protocol.

• Length (2 bytes): Indicates the number of bytes that follow.

• Unit Identifier (1 byte): Identifies the remote Slave device when communicating through Modbus RTU gateways.

 

The Function Code occupies 1 byte and specifies the requested operation (for example, 0x03 for reading Holding Registers or 0x06 for writing a Single Register).

​

The Data field has a variable length and contains register addresses, the number of registers, or the values to be written.

 

The Function Code and Data fields preserve exactly the same structure defined by Modbus RTU. The only difference is that the CRC field is no longer required, since communication integrity is handled by the Ethernet and TCP/IP protocols.

 

Advantages of Modbus TCP

 

Modbus TCP offers several advantages that justify its widespread adoption in modern industrial automation systems.

 

Among its main benefits are:

​

• Network Integration: Uses standard industrial and corporate Ethernet infrastructure, allowing communication through switches, routers, and Wi-Fi networks.

• High Speed: Operates at Megabit or Gigabit Ethernet speeds, far exceeding the bandwidth limitations of serial communication.

• Multiple Clients: Supports multi-master operation by allowing several Clients to access the same Server simultaneously.

• Scalability: Removes the physical limitation of 32 devices per RS-485 segment, expanding the network to the limits of the available IP address space.

• Remote Access and Diagnostics: Enables remote monitoring and configuration of industrial devices through corporate networks, VPNs, or the Internet.

• Flexibility: Can operate over wired Ethernet, Wi-Fi, and gateway-based communication networks.

 

Modbus RTU vs Modbus TCP Comparison

​

Feature                                                        Modbus RTU                                                Modbus TCP                                                                 

Physical Layer                                            Serial (RS-485 / RS-232 / RS-422)        Ethernet / Wi-Fi                                                           

Transmission Medium                              Shielded twisted-pair cable                     Cat5e/Cat6 Ethernet cable, fiber optic or Wi-Fi 

Architecture                                               Master / Slave (only one Master               Client / Server (multiple Clients can

                                                                       controls the network)                                  communicate simultaneously)

Network Topology                                     Bus                                                                  Star (using switches and routers)                          

Frame Identification                                 Slave ID (1 byte)                                         MBAP Header (7 bytes)                                             

Device Identification                                Physical address (1–247)                        IP Address + Unit Identifier                                     

Communication Speed                            Limited by the configured baud rate     Determined by Ethernet bandwidth (100 Mbps,

                                                                        (e.g., 9600, 19200, 38400 bps)            1 Gbps or higher)                                                        

Maximum Distance                                   Up to 1200 m (RS-485 without              100 m per cable segment (extendable using

                                                                        repeaters)                                                    switches or fiber optics)                                           

Communication Mode                              Half-Duplex                                                 Full-Duplex                                                                   

Maximum Number of Devices                Up to 32 devices per RS-485                 Practically unlimited (limited only by the IP

                                                                        segment                                                       network)                                                                       

Frame Delimitation                                   Silent interval (minimum of 3.5             Determined by the TCP packet length
                                                                        character times)                                                                                                                                 

Error Detection                                          CRC (2-byte Cyclic Redundancy            Managed by the TCP/IP protocol stack

                                                                        Check)                                                          (Checksum and Ethernet CRC-32)                         

​

Conclusion

​

Modbus RTU and Modbus TCP are not competing protocols, but rather complementary solutions designed for different application scenarios. The choice between one or the other depends primarily on the available network infrastructure and the communication requirements of the application.

 

Both protocols share the same logical structure of registers and function codes, making interoperability between devices from different manufacturers straightforward.

 

Modbus RTU stands out for its simplicity, low implementation cost, robustness against electromagnetic interference when operating over RS-485 networks, and its ability to provide reliable communication between industrial devices from multiple manufacturers. It remains an excellent choice for small and medium-sized local automation systems.

 

Modbus TCP, on the other hand, takes advantage of the existing Ethernet/IP infrastructure and has become one of the enabling technologies for the transition toward Industry 4.0. It supports scalable architectures, higher bandwidth, lower latency, and seamless integration with corporate networks. It is the preferred solution whenever applications require high-speed communication, large-scale data exchange, simultaneous access by multiple Clients, direct integration with supervisory systems (SCADA), or remote monitoring over long distances.

​

​