How does Modbus TCP work?
The client sets up a TCP connection to the device, usually on port 502, and sends its request. The device answers over the same connection. Unlike Modbus RTU, nobody has to wait for the bus to be free: several clients can be connected at the same time, for example the building management system and an energy management system.
The checksum of the serial variant is dropped because TCP itself secures the transmission. Instead, every telegram is preceded by the MBAP header (Modbus Application Protocol Header):
| Field | Length | Content |
|---|---|---|
| Transaction number | 2 bytes | matches the response to the request |
| Protocol identifier | 2 bytes | always 0 for Modbus |
| Length | 2 bytes | number of following bytes |
| Unit ID | 1 byte | address of the device behind a gateway; always 1 on the EMU Professional II |
What is the difference between Modbus TCP and Modbus RTU?
| Feature | Modbus RTU | Modbus TCP |
|---|---|---|
| Transmission | RS485, two wires | Ethernet |
| Addressing | Slave address 1–247 | IP address, plus the unit ID |
| Protection | CRC16 checksum | TCP, MBAP header |
| Polling | one master | several clients at the same time |
| Topology | Line with terminating resistors | Network with switches |
| Speed | typically 9600 to 19200 baud | 10 or 100 Mbit/s |
Both variants are compared in detail in the article Modbus TCP or Modbus RTU?.
How do Modbus RTU devices get onto the network?
With a gateway. A simple gateway accepts Modbus TCP requests and passes them on to the RS485 bus; the unit ID in the MBAP header determines which device on the bus is meant.
A data logger such as the EMU M-Center goes further: it reads the devices itself, stores the values and makes them available as a Modbus TCP server in a register table of its own. The control system then does not poll each meter over the bus, but the M-Center on the network.
What does IT need for Modbus TCP?
- a fixed IP address or a DHCP reservation per device
- a VLAN or network segment of its own for the metering devices
- a firewall rule that allows only the polling system to access port 502
- the register list with data types and word order from the manual
Modbus TCP itself knows neither password nor encryption. Anyone who can reach the device on the network can read its registers. The extension Modbus/TCP Security with TLS on port 802 only works with devices that explicitly support it.
Modbus TCP with EMU devices
The EMU Professional II power meter with Modbus TCP is available as EMU Professional II 3/100 for direct connection up to 100 A and as 3/5 for CT connection. The register table is on the product page. How Modbus TCP and MQTT differ on the same meter is shown on the page TCP/IP on the EMU Professional II.
The EMU M-Center makes M-Bus and Modbus RTU meters available as a Modbus TCP server, see M-Bus to Modbus TCP. For Loxone there are templates for the EMU Professional II, see EMU meters in Loxone.