In brief · As of October 2026
Modbus has exactly one identification service: function code 43, MEI type 14 "Read Device Identification". The basic objects VendorName, ProductCode and MajorMinorRevision are mandatory – but only if the device implements FC 43 at all, and that is voluntary. There is no serial number, no hardware revision, no vendor registration and no discovery: every IP address is queried individually on TCP 502. For the plant SBOM, Modbus is therefore a supplementary path for drives, energy meters, power supplies and gateways – after ARP table and SNMP, not instead of them.
FC 43 provides three mandatory objects and a few optional ones
The Modbus Application Protocol Specification V1.1b describes three categories of identification objects in section 6.21:
| Object | Category | Mandatory | Meaning for the device list |
|---|
| 0x00 VendorName | Basic | yes (if FC 43 is implemented) | Manufacturer as free text – "Schneider Electric" and "Schneider Electric Industries SAS" are two spellings |
| 0x01 ProductCode | Basic | yes | Product code, manufacturer-defined – at Schneider often the commercial reference |
| 0x02 MajorMinorRevision | Basic | yes | Firmware revision, the comparison value against the advisory |
| 0x03–0x06 VendorUrl, ProductName, ModelName, UserApplicationName | Regular | no | Model name helps with assignment, application name with the plant section |
| 0x80–0xFF | Extended | no | Manufacturer-specific, often the serial number – undocumented |
The request runs as FC 0x2B with MEI 0x0E and a read code (1 = Basic, 2 = Regular, 3 = Extended, 4 = single object); the response names the device's conformity level and whether further objects follow.
No discovery, no mandatory service, no registration
Modbus TCP has no broadcast mechanism: the scan needs an address list (from ARP and switch tables) and queries each address individually on TCP 502; behind Modbus gateways additionally per unit ID, otherwise the gateway answers with its own identity. FC 43 is a public function code, but no device has to implement it – many answer with exception 01 ("Illegal Function"), some older stacks do not react well to unknown codes at all. The service is reliably implemented at Schneider Electric (Modicon, Altivar, PowerLogic), in many energy meters (Janitza, Socomec, ABB) and in Phoenix and WAGO couplers; how Schneider documents it for M580 and BMENOC is described in the article on Schneider Electric and the plant SBOM.
Without FC 43, what remains is FC 17 "Report Server ID" (manufacturer-defined byte block) or manufacturer-specific holding registers for serial number and firmware – with a register map per manufacturer.
What Modbus does not provide
- Serial number and hardware revision: no standard object; if at all, in the manufacturer-specific range.
- A normalised manufacturer name: VendorName is free text without registration; matching needs a normalisation table.
- Completeness: whatever cannot do FC 43 remains without identity – and that is many devices.
- Security: Modbus has no authentication. Read requests are harmless; the danger of any tool lies in write codes (FC 05/06/15/16), which an inventory scan must never send.
What this means for the plant SBOM
- Run Modbus as the third stage: first ARP and switch tables for the address list, then SNMP, then FC 43 only against addresses with port 502 open.
- Normalise VendorName and match ProductCode against the product name in the advisory; at Schneider the ProductCode is frequently the commercial reference.
- List devices without FC 43 as open items with MAC address and manufacturer assignment and complete them from the parts list or type plate – as described in the article on the network scan.
- Limit the scan to a fixed port list and read codes only; agree a trial run that lists every request in advance with the network department.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot Scan reads these fields from the maintenance PC, read-only and with a fixed request list, and keeps them per plant. This article describes the state of the specifications at the time of publication.
