Modbus RTU not responding, BACnet lagging? We break down why RS-485 fails at the worst possible moment: topology mistakes, terminators, register offsets and quick diagnostics with an ordinary multimeter.
RS-485: anatomy of collisions, bad data and broken mapping
A call at 10 PM: “The ventilation is down, the dispatcher can't do anything, the chiller has stopped.”
Automation engineers, EMS/BMS commissioning specialists and system integrators get calls like this all the time.
The causes vary, but in our experience it very often comes down to communication! The RS-485 standard is more than forty years old, and the Modbus protocol will soon turn fifty.
You would think everything should work flawlessly by now. But on real sites the picture is always the same: installers have run the twisted pair in the same tray as the power cable, terminators were either left out or fitted on every device “just to be safe”, and an engineer has spent three hours sitting on an upturned bucket trying to guess in what order a Chinese manufacturer described the data.
What we'll cover
Where Modbus / BACnet logic breaks against physics, how to diagnose a line with an ordinary multimeter, and how to stop wasting your life on manual configuration:
- Physical layer: topology and terminators
- Addressing and protocol: a zoo of vendors
- How to get away from manual integration
1. The “Death Star”: physics installers never think about
RS-485 is a differential interface: information is transmitted not as a voltage but as the potential difference between lines A and B. This makes it remarkably immune to noise, which is why it is still specified in projects today. Cheap and reliable — but only as long as the rules are followed.
Rule #1
Daisy chain only. No stars
Installers love running cable in a star from a central cabinet: it's “more convenient — yes, it takes more cable, but it's easier to pull”.
✓ The right way: daisy chain
✕ Never do this: star / “stubs”
Rule #2
120 ohm terminators — exactly two per line (at the start and at the end)
The characteristic impedance of standard industrial twisted-pair cable is about 120 ohms. The signal from the transmitter travels in both directions along the line. To absorb the wavefront and eliminate echo, exactly two termination resistors are fitted:
First resistor
On the very first physical node of the bus — on the A/B terminals of the controller or polling gateway.
Second resistor
On the very last physical device in the chain — for example, the farthest drive or meter.
Intermediate devices
All of them must be without terminators.
There are always nuances: controllers and devices from different manufacturers
You need to check the built-in resistor in the controller. A common commissioning mistake is blindly believing that “an expensive controller surely has the terminator built in”.
Reality is different: the automation giants have no common standard. Some expect you to fit resistors by hand, some switch them in software, and some require you to buy proprietary jumpers. As a cheat sheet, here is a comparison of the most common product lines:
| Manufacturer / line | Typical port | Built-in resistor | How it's enabled |
|---|---|---|---|
| Siemens Desigo PX / PXC | Screw terminals | No (in 90% of cases) | External 120 ohm resistor under the terminal screws, or an external termination/biasing module |
| Siemens S7 Profibus/MPI | Sub-D 9-pin | Yes (in the plug itself) | Mechanical ON / OFF switch on the housing of the purple connector |
| Schneider SpaceLogic AS-P/B | Removable terminals | Yes | A checkbox in the software (EcoStruxure EBO) or internal jumpers |
| Schneider Modicon M221/M241 | RJ45 connector | No | Proprietary T-adapter and RJ45 terminator plug |
| Uspace FlexNode, OctaNode | Screw terminals | Yes (inside the housing) | Standard jumper |
⚠ The critical check rule
Reading the documentation is good, but not every nuance makes it into the manuals. Make it a rule to do a hardware test before start-up:
- Power down the controller.
- Put the multimeter in ohmmeter mode on the controller's own A and B terminals (with the external line disconnected).
Quick multimeter diagnostics: two test measurements
1Measure the equivalent line resistance (with power OFF)
~60 Ω
Normal: two 120 ohm resistors in parallel at the ends of the line.
120 Ω
The line is broken in the middle, or the second terminator was forgotten (for example, someone assumed Siemens has one by default).
< 45 Ω
Terminators are enabled on intermediate devices.
2Measure the idle-state voltage
When the controller is not sending requests (the bus is idle), the line must not be left “floating”. The potential difference UB − UA measured with a multimeter must be STRICTLY positive: from +200 to +300 mV. If it is close to zero, external interference will seriously degrade communication quality.
2. Addressing and protocol: a zoo of vendors
If the physical layer is sound, problems can still arise at the logical layer.
Off-by-one offset (zero-based vs one-based)
Always check that the register addresses you read in your system are correct. The documentation may say: “Frequency register: 40001 (or address 1)”.
- If the polling controller counts addresses from zero (0-based), a request for
0x0001will actually go to the device's second register and return an error. - If the device returns error 02 (Illegal Data Address) or shows the value of a neighbouring parameter, simply try subtracting or adding one to the register address.
Endianness: four ways to break a Float32
Modbus transmits data in 16-bit words. Any fractional value (pressure, flow, power) occupies 2 registers (32 bits). But the standard does not specify the byte order. As a result, you have 4 combinations:
ABCD
Big-Endian: straight order.
DCBA
Little-Endian: reversed order.
CDAB
Word Swap: the words are swapped. The most common option — used by 80% of electricity and heat meters.
BADC
Byte Swap: the bytes within each 16-bit word are swapped. The rarest option.
NaN, 0.00 or -1.42e-38, the maths is fine — just try the other Endian combinations.
3. Breaking the vicious circle of manual integration
A commissioning engineer's typical process on site looks like this:
If six months later the device is replaced with an equivalent of a different revision, all the work starts from scratch.
The modern approach: auto-configuration on IoT Edge gateways
A field device should not depend on manual configuration:
- Polling by standard templates: device polling parameters (addresses, data types, coefficients) are not hard-coded into the PLC logic.
- On-the-fly conversion of raw data: the gateways normalise data for your energy monitoring system (EMS) themselves.
- Publishing: the upper-level system or BMS/SCADA receives not anonymous Modbus registers but messages with meaningful values and a timestamp.
Example of normalised telemetry from a metering point:
{
"ts": 1727542800,
"device": "heat_meter_01",
"supply_temp": {"v": 82.4, "unit": "C", "status": "valid"}
}