RTU Modbus Frame Utility

Modbus RTU Frame Builder & Decoder

Use this Modbus RTU Frame Builder & Decoder to create valid Modbus request frames, calculate the Modbus CRC-16 automatically, or decode captured RTU frames into slave address, function code, register or coil address, quantity, data bytes and CRC status.

✓ CRC-16 Modbus ✓ Read Registers ✓ Write Registers ✓ Coil Functions ✓ Exception Decoder

CRC

Build / Decode Modbus RTU

● Ready

Slave Address Typical unicast slave addresses are 1–247. Address 0 is Modbus broadcast.

Function Code Choose the Modbus operation to generate.

Starting Address 16-bit protocol address in hexadecimal, for example 0000 or 006B.

Quantity Number of registers or coils requested.

Coil State Function 05 uses FF00 for ON and 0000 for OFF.

CRC byte order: The Modbus CRC-16 numerical result is transmitted with its low byte first. For example, CRC value 0xCDC5 appears on the wire as C5 CD.

Modbus RTU Result Valid

Generated Frame –

Slave Address –

Function –

Start Address –

Quantity / Value –

CRC Value –

CRC Wire Bytes –

Frame Length –

CRC Status –

Frame Breakdown

Complete RTU Frame

–

What Is a Modbus RTU Frame Builder & Decoder?

A Modbus RTU Frame Builder & Decoder creates or interprets the binary message format used by Modbus RTU devices on serial communication links. Instead of manually assembling slave address, function code, data fields and CRC bytes, the calculator generates the complete request automatically.

Decoder mode performs the reverse operation. Paste a captured RTU frame and the tool verifies its CRC, identifies the slave address and function code, and interprets common register, coil, write and exception-message fields.

This is useful when working with PLCs, industrial sensors, variable-frequency drives, energy meters, remote I/O modules, gateways, embedded controllers and other Modbus-compatible equipment.

Modbus RTU Frame Format

A normal Modbus RTU application data unit contains a slave address, function code, function-specific data and a two-byte CRC.

General format: [ Slave Address ] [ Function Code ] [ Data … ] [ CRC Low ] [ CRC High ]

Unlike Modbus TCP, RTU does not use an MBAP header. Device addressing and integrity checking are carried directly by the serial RTU frame.

How to Build a Modbus RTU Request

Enter the slave address

Select the Modbus server/slave device that should receive the request.

Select a function code

Choose whether you want to read coils, read registers or write values.

Enter the protocol address

Provide the 16-bit starting coil or register address carried in the Modbus PDU.

Enter quantity or write data

The required fields change automatically according to the chosen function.

Generate the CRC

The calculator appends the correct Modbus CRC-16 low byte and high byte.

Modbus RTU CRC-16

Modbus RTU uses a 16-bit cyclic redundancy check for error detection. The CRC register starts at hexadecimal FFFF. Each message byte is XORed into the low portion of the CRC register and processed bit by bit using the reflected polynomial associated with hexadecimal A001.

Conceptually: Initial CRC = 0xFFFF Polynomial = 0xA001 The CRC is calculated over: Slave Address + Function Code + Data Bytes The received CRC bytes themselves are not included when recalculating the CRC.

Modbus CRC Byte Order

A common source of errors is confusing the numerical CRC value with its transmitted byte sequence.

Modbus RTU sends the lower-order CRC byte first, followed by the higher-order CRC byte.

For the request: 01 03 00 00 00 0A Calculated CRC: 0xCDC5 RTU wire bytes: C5 CD Complete frame: 01 03 00 00 00 0A C5 CD

Modbus Function Code 03 Example

Function code 03 reads holding registers. A request contains the starting protocol address and the number of registers to read.

Example: 01 03 00 00 00 0A C5 CD Decoded: Slave = 1 Function = 03 Start = 0x0000 Quantity = 10 registers CRC = 0xCDC5 Wire CRC = C5 CD

Supported Modbus RTU Function Codes

Hex	Function	Typical Request Data
01	Read Coils	Starting address + coil quantity
02	Read Discrete Inputs	Starting address + input quantity
03	Read Holding Registers	Starting address + register quantity
04	Read Input Registers	Starting address + register quantity
05	Write Single Coil	Coil address + FF00 or 0000
06	Write Single Register	Register address + 16-bit value
0F	Write Multiple Coils	Address, quantity, byte count and packed coil states
10	Write Multiple Registers	Address, quantity, byte count and register values

Function 01 — Read Coils

Function code 01 requests the ON/OFF state of one or more coils. The request contains a starting coil address and quantity.

PDU structure: 01 Starting Address High Starting Address Low Quantity High Quantity Low

The corresponding response normally contains a byte count followed by packed coil status bits.

Function 03 — Read Holding Registers

Function 03 is among the most commonly encountered Modbus functions. It reads one or more 16-bit holding registers.

The request specifies the starting protocol address and quantity. A normal response contains the same function code followed by a byte count and two bytes for every returned register.

Function 04 — Read Input Registers

Function 04 has a request structure similar to function 03, but reads input registers rather than holding registers.

Request data: Starting Address = 2 bytes Quantity = 2 bytes

Function 05 — Write Single Coil

Function 05 writes one coil. Modbus represents the requested state with a specific 16-bit field.

ON: FF 00 OFF: 00 00

The normal server response echoes the function code, coil address and written value.

Function 06 — Write Single Register

Function 06 writes one 16-bit holding register. The request contains the register protocol address followed by the new 16-bit register value.

Example request without CRC: 01 06 00 01 00 03 CRC: 0x0B98 Wire CRC: 98 0B Complete frame: 01 06 00 01 00 03 98 0B

Function 10 — Write Multiple Registers

Function code hexadecimal 10 writes multiple consecutive registers. The request contains the start address, number of registers, data-byte count and the register values themselves.

For three 16-bit registers: Quantity = 3 Byte Count = 6 because: 3 registers × 2 bytes = 6 data bytes

The builder calculates quantity and byte count automatically from the values entered.

Function 0F — Write Multiple Coils

Function hexadecimal 0F writes multiple coil states. Because each coil is one bit, the coil states are packed into data bytes rather than transmitted as one byte per coil.

The least-significant bit of the first data byte represents the first coil, with subsequent coil states following through progressively higher bits and then additional bytes.

Modbus Register Address vs 40001-Style Number

A major source of Modbus confusion is the difference between the protocol address transmitted in the request and the human-readable reference number often shown in manuals.

Protocol Address

The zero-based 16-bit address actually transmitted in the Modbus request PDU.

Reference Number

Documentation may describe registers using notation such as 40001 or 40002. This notation is not transmitted literally as the 16-bit protocol address.

Always check the device manual to determine whether displayed register numbers are zero-based protocol addresses, one-based addresses or Modbus reference notation.

Modbus RTU Request vs Response

Request

A client/master sends a slave address, function code and parameters describing the requested operation.

Response

The server/slave returns the requested data, echoes write information or sends an exception response if the operation cannot be completed.

Decoder mode examines the frame structure and interprets common request and response layouts where sufficient information is available.

Modbus Exception Responses

When a Modbus server reports an error, it sets the most significant bit of the requested function code. The next byte contains the exception code.

Normal function: 03 Exception response function: 83 because: 0x03 | 0x80 = 0x83

Exception	Meaning
01	Illegal Function
02	Illegal Data Address
03	Illegal Data Value
04	Server Device Failure
05	Acknowledge
06	Server Device Busy
08	Memory Parity Error
0A	Gateway Path Unavailable
0B	Gateway Target Device Failed to Respond

How the Decoder Validates CRC

The decoder removes the final two bytes from the entered frame, recalculates the Modbus CRC over every preceding byte and compares the result with the received CRC bytes.

For: 01 03 00 00 00 0A C5 CD Received CRC bytes: C5 CD They represent numerical CRC: 0xCDC5 Recalculated CRC: 0xCDC5 Therefore: CRC VALID

Modbus RTU vs Modbus TCP

Feature	Modbus RTU	Modbus TCP
Transport	Serial	TCP/IP
Integrity field	CRC-16	No RTU CRC
Header	No MBAP header	MBAP header
Unit addressing	RTU slave address	Unit Identifier field
Common function codes	Shared Modbus PDU functions	Shared Modbus PDU functions

Common Modbus RTU Frame Mistakes

Reversing CRC Bytes

The low-order CRC byte is transmitted first.

Using Register Reference Number

A manual’s 40001-style notation may not equal the transmitted address.

Wrong Function Code

Holding registers, input registers, coils and discrete inputs have different functions.

Incorrect Quantity

Read requests specify number of objects, not number of response bytes.

Wrong Multi-Write Byte Count

Function 10 requires two data bytes for each 16-bit register value.

Including CRC in CRC Calculation

The CRC is calculated over the frame bytes before the two CRC bytes are appended.

Modbus RTU Frame Builder & Decoder FAQs

How do I build a Modbus RTU frame?

Combine the slave address, function code and function-specific data, calculate the Modbus CRC-16 over those bytes, then append the CRC low byte followed by the CRC high byte.

What CRC does Modbus RTU use?

Modbus RTU uses a 16-bit CRC initialized to 0xFFFF with the reflected polynomial commonly represented as 0xA001.

Which CRC byte comes first in Modbus?

The low-order CRC byte is transmitted first, followed by the high-order byte.

What does function 03 do?

Function 03 reads holding registers.

What does function 04 do?

Function 04 reads input registers.

What does function 06 do?

Function 06 writes one holding register.

What does function 10 do?

Hexadecimal function 10 writes multiple consecutive holding registers.

What does function 0F do?

Function 0F writes multiple coils, with coil states packed into data bytes.

What is Modbus slave address 0?

Address zero is used for broadcast requests where supported. Broadcast requests do not receive normal slave responses.

What is the normal Modbus RTU slave range?

Addresses 1 through 247 are normally used for uniquely addressed Modbus servers.

How do I verify a Modbus CRC?

Recalculate the CRC over all frame bytes except the final two received CRC bytes and compare the calculated low/high bytes with the received values.

Why does my register address differ by one?

Device manuals may use one-based register numbering while the Modbus protocol address itself is zero-based. Check the manufacturer’s addressing convention.

Is Modbus RTU big endian?

Multi-byte Modbus data fields such as addresses and register values are normally transmitted high byte first, while the RTU CRC is transmitted low byte first.

What is a Modbus exception response?

An exception response sets bit 7 of the original function code and includes an exception code describing why the request failed.

Does Modbus TCP use the RTU CRC?

No. Modbus TCP uses an MBAP header and relies on the underlying TCP/IP stack rather than appending the Modbus RTU CRC field.

Can this tool decode responses?

Yes. It identifies common response layouts, data-byte responses, write echoes and Modbus exception responses in addition to normal request frames.

Build and Decode Modbus RTU Frames

Create Modbus read and write requests with the correct CRC, or paste a raw serial frame to validate its CRC and inspect slave address, function code, register information, data bytes and exception status.