Modbus Gateway: How to Connect Legacy Equipment to the Cloud

A ModbusMProtocolModbusThe most widespread industrial fieldbusView profile gateway reads meters, drives, and PLCs that have run for 20 years and sends their data to the cloud without changing a single wire on the equipment.

Tomás works in field service for a manufacturer of industrial chillers. They have more than 300 machines installed at customer sites, some dating from 2006, and all of them have the same port: two RS-485 terminals and a 40-page manual with the Modbus register map. For years, every breakdown started the same way. The customer called, described an alarm that had already cleared, and a technician traveled to see what the machine would have reported on its own if anyone had asked it.

Modbus is probably the most widely used industrial protocol in the world. It is in energy meters, power analyzers, variable frequency drives, PLCs, chillers, compressors, and HVAC equipment. It is simple, open, and nearly indestructible. What it doesn't do is reach the internet on its own, and it shouldn't.

This guide explains how Modbus works inside, how RTU and TCP differ, what a Modbus gateway actually does, and which mistakes turn a one-week project into a three-month one. It is written for system integrators, machine builders, and maintenance teams.

Why Modbus Is Still Everywhere

Modicon published Modbus in 1979 to connect its PLCs. Today the Modbus Organization maintains it, and its specifications are public and free. Any manufacturer can implement it without paying license fees, and almost all of them have.

Its success comes from how little it asks for. A cheap microcontroller with an RS-485 transceiver is enough to speak Modbus RTU. There are no sessions to negotiate, no services to discover, and no certificates to manage. A request says "give me ten registers starting at 100," and the response carries 20 bytes. That design lets 30-year-old equipment and equipment built last month share the same bus.

The simplicity has a price worth knowing before you start:

• No discovery. The protocol doesn't say what each register means. You need the manufacturer's map, and each manufacturer organizes it differently.
• No data types. Everything is a 16-bit register. Whether the value is a 32-bit float, a signed integer, or text is stated in the manual, not in the protocol.
• No security. Classic Modbus TCP has no authentication and no encryption. Anyone who reaches port 502 can read and write.
• No events. The device doesn't report when something changes. You have to ask it again and again.

A Modbus gateway exists to make up for these four gaps: it adds meaning, converts the types, protects the network, and decides how often to ask.

How Modbus Works: Registers, Functions, and Maps

A Modbus device exposes four data tables. It pays to know them well, because each one is read with a different function code.

Writes use functions 05 and 15 (coils) and 06 and 16 (holding registers). A single read with function 03 can request up to 125 consecutive registers.

The Register Map

The map is the table in the manual that says what lives at each address. A typical power analyzer might look like this:

A `float32` takes two registers. Addresses 0 and 1 together hold the L1 voltage, which is why the next measurement starts at 2.

Addresses: 0 or 40001

This is where the first misunderstanding starts. Many manuals use the classic Modicon notation, where holding registers start at 40001. On the wire, however, the first register's address is 0. Register "40101" in a manual is requested in the protocol as address 100. If the gateway and the manual don't use the same convention, every reading shifts by one position and none of the values make sense.

Exceptions

When a device can't answer, it returns an exception code instead of data. The three you see most during integration are 01 (illegal function), 02 (illegal data address), and 03 (illegal data value). A 02 almost always means the map was misread or the device runs a different firmware version.

Modbus RTU vs Modbus TCP: Wiring, Speed, and Limits

Modbus has two variants in everyday use. They share the tables and functions and differ in transport.

Modbus RTU over RS-485

This is the serial version. Devices are daisy-chained on a bus with twisted-pair cable. The basic RS-485 rules are few, and they are broken often:

• Up to 32 unit loads per segment without a repeater, and about 1,200 m (4,000 ft) of cable at low speeds.
• Bus topology, with no long stubs and no star wiring.
• A 120 Ω termination resistor at each end of the bus, and only at the ends.
• Every device on the same baud rate and parity. The most common rates are 9,600 and 19,200 baud.
• Each slave with its own address, from 1 to 247, never repeated.
• A single master. Two masters on one bus cause collisions and intermittent errors that are very hard to diagnose.

Modbus TCP over Ethernet

The same logic inside a TCP packet, on port 502. It is faster, has no 32-device limit, and fits into the plant network. In exchange, anyone who reaches that network can talk to the device. There is a secure variant, Modbus/TCP Security, which adds TLS on port 802, but very few installed devices support it.

How Long a Bus Takes to Read

This is the calculation people forget most. At 9,600 baud, each character takes just over one millisecond. A request for ten registers plus its response adds up to about 33 bytes, and with the silent intervals and the device's response time, each transaction costs roughly 60 to 100 ms. With 20 devices on the bus and five register blocks per device, a full cycle takes between six and ten seconds.

That number decides what you can ask for. Reading one variable from every device on that bus every second isn't possible, and forcing it produces timeouts that look like failures. Grouping contiguous registers into one request, raising the bus speed if every device supports it, and moving fast devices to a separate bus are the three levers.

What a Modbus Gateway Does

A Modbus gateway is a device, or software on an industrial computer, that speaks Modbus to the plant equipment and another protocol upstream. To bring data to a cloud platform, that protocol is usually MQTTProtocolMQTTThe standard pub/sub protocol of IoTView profile. Its job has five parts.

Poll. It asks each device for the configured registers, with an interval for each group. Accumulated energy can be read every 15 minutes and power every 10 seconds.

Interpret. It applies the map: joins the two registers of a `float32` in the right order, applies the scale, converts signed integers, and gives each value a name and a unit. What leaves the gateway is no longer "register 52"; it is "total active power: 41,200 W."

Filter. It publishes by exception or with a deadband. If the voltage moves by a tenth, there is no need to send it. With 400 variables polled every 10 seconds, publishing only what changes cuts traffic substantially.

Buffer when the connection drops. If the internet goes down, the gateway stores readings with their timestamps and sends them when the link returns. Without this, a four-hour outage leaves a four-hour gap in the charts and in the energy reports.

Protect. The gateway opens the connection to the platform, encrypted with TLS. The plant firewall needs no inbound rules, and port 502 is never exposed outside the control network. It is the principle we develop in our guide to industrial remote access, and it fits the zones and conduits model of ISA/IEC 62443 and the recommendations in NIST SP 800-82.

If the plant also has OPC UAOProtocolOPC UAInteroperability standard for industrial automationView profile equipment, the gateway usually reads both protocols and publishes everything over the same connection. Our comparison of OPC UA vs MQTT explains how they split the work, and the MQTT broker guide covers the transport.

Common Modbus Gateway Integration Mistakes

Almost every Modbus project that runs late does so for the same reasons. None of them is hard to fix if you look for it on purpose.

Word order. A `float32` takes two registers, and each manufacturer decides which comes first. A voltage of 230.4 V is encoded as `0x4366 0x6666`. If the gateway reads the registers in the opposite order, the value that comes out is around 2.7 × 10²³. The same happens with the 32-bit integers in energy meters. The test is simple: compare one reading with the device's own display.

Sign. A cold room probe at -20.0 °C (-4 °F), stored as an integer with a scale of 10, sends `0xFF38`. Read as an unsigned integer, that is 6,533.6 °C. The error doesn't show up in office tests at room temperature. It shows up the first time the cold room drops below zero.

Scale. A register that stores frequency as 4998 isn't saying 4,998 Hz. It is saying 49.98 Hz with a scale of 0.01. The scale is in the map, sometimes in a footnote.

Off-by-one addresses. The mix-up between address 40101 in the manual and 100 in the protocol. Every value looks plausible but crossed: voltage where current should be.

Polling faster than the bus allows. Random timeouts, devices that "drop out" and come back. It is almost always an optimistic cycle estimate or a slow device holding up the others.

A second master. The machine's PLC was already master of the bus and someone adds the gateway as another master. It works some of the time. The fix is to read from the PLC instead of the devices, or to split the buses.

Lucía, an integrator in Zaragoza, connected 26 energy meters in a logistics warehouse in one week, using a rule she now applies every time. Before installing anything, she takes one unit of each model to the test bench, reads ten values with a diagnostic tool, and compares them with the meter's display. Those two hours on the bench caught a model with reversed word order that would have read wrong on 14 of the 26 meters.

A Work Order That Avoids Surprises

1. Inventory. Model, firmware, interface (RTU or TCP), baud rate, parity, and address of every device.
2. Maps. The register map for each model and version, with type, scale, unit, and word order.
3. Bench. One unit of each model read and checked against its display.
4. Cycle. The polling time for each bus calculated, and intervals assigned per variable.
5. Pilot. One complete bus for two weeks, with communication alarms active.
6. Rollout. The remaining buses with the same template per model.

Where Cloud Studio IoT Fits with a Modbus Gateway

Cloud Studio IoTITermIoT (Internet of Things)The IoT (Internet of Things) is the network of physical objects with sensors, software and connectivity that collect and exchange data and act autonomously.View profile connects Modbus equipment through a software module we install at the edge as a gateway. That module polls the devices over Modbus RTU or Modbus TCP at the plant, applies each model's map, and sends the data to the platform over MQTT with TLS on port 8883. The cloud doesn't talk Modbus to the equipment: that connection stays inside the plant network.

Each instance has its own MQTT server, with credentials managed from the platform. Once the data is in, you configure dashboards, alarm rules with notifications by email, SMS, WhatsApp, voice call, or push, scheduled reports, and SCADA-style views over the installation diagram. If you already run a local SCADA, our introduction to what a SCADA system is explains how it coexists with a cloud platform.

For a manufacturer like Tomás's, the model that pays off most is one template per machine model: the register map is configured once and every new machine inherits its dashboards and alarms. Each customer sees their equipment under the manufacturer's brand, and field service sees the whole installed base. The same principles apply to energy meters in buildings, as we cover in building management system and IoT and in our energy monitoring guide. The industrial IoT page and the industrial automation solution cover the other use cases.

Conclusion

Modbus will stay in plants for many more years, and you don't need to replace any equipment to use its data. The essentials:

• A modbus gateway supplies what the protocol lacks: the meaning of each register, data types, security, and polling frequency.
• The expensive mistakes are always the same: word order, sign, scale, address offset, and polling too fast.
• Calculate each bus's cycle before promising a data rate.
• Test one unit of each model on the bench before rolling out.
• Publish outbound over MQTT with TLS and never expose port 502 outside the control network.

If you have an installed base of Modbus equipment and want to see its data without touching the machines, talk to our team about your models and buses.

Frequently Asked Questions

What Is a Modbus Gateway?

It is a device or software that reads Modbus RTU or Modbus TCP equipment at the plant and sends the data to another system over another protocol, usually MQTT to a cloud platform. It applies the register map, converts data types, and protects the control network.

What Is the Difference Between Modbus RTU and Modbus TCP?

They use the same tables and functions. Modbus RTU runs on an RS-485 serial bus, with up to 32 unit loads per segment and a single master. Modbus TCP runs over Ethernet on port 502, is faster, and has no such device limit.

Can You Connect Modbus Directly to the Internet?

You shouldn't. Classic Modbus TCP has no authentication or encryption: anyone who reaches port 502 can read and write registers. The secure approach is to read locally with a gateway and publish outbound over an encrypted connection.

How Often Can You Read Data from a Modbus Bus?

It depends on bus speed, the number of devices, and how many registers you request. At 9,600 baud, a bus with 20 devices and five requests per device takes between six and ten seconds to complete a cycle.