Modbus Frame and CRC Calculator
Build a Modbus RTU request with its CRC, paste in a captured frame to decode it and check the CRC, or work out the CRC-16 of any bytes. It also shows how long the frames take at your baud rate.
How it works
A Modbus RTU frame is the slave address, the function code, the data, and a two-byte CRC-16. The CRC is computed over every byte before it: start with FFFF (hex), XOR in each byte, then shift right eight times, XOR-ing with A001 (hex) whenever a 1 falls off the end. The result is sent low byte first. A receiver that runs the same calculation over the whole frame, CRC included, gets zero. Timing follows the standard: a character is 10 or 11 bits, frames are separated by at least 3.5 character times of silence (a fixed 1.75 ms above 19 200 baud), and a gap of more than 1.5 character times inside a frame ends it. Use it with the Modbus RTU, ASCII and TCP and Sniffers, Analyzers and Serial Tools pages.
Worked example
To read two holding registers starting at address 0 from slave 1, the request is 01 03 00 00 00 02 and the CRC is C4 0B, so the frame on the wire is 01 03 00 00 00 02 C4 0B (8 bytes). A healthy reply is 01 03 04 00 0A 01 02 5A 60: byte count 4, register values 10 and 258. If the slave rejects the address, it answers 01 83 02 C0 F1: function 83 is 03 plus 80 (an error) and exception code 02 is “illegal data address”. At 9 600 baud, 8N1, the request takes 8.3 ms, the reply 9.4 ms, and with two 3.6 ms gaps and 5 ms of slave processing one poll takes about 30 ms.
Things to know
The start address is the address sent in the message. Many manuals number holding registers from 40001 (or 1), so register 40001 is address 0; if your device uses another convention, subtract one more.
The calculator builds requests only. A real reply has the slave’s data, so use the decode mode to read a reply you captured.
The decoder cannot tell whether a captured frame is a request or a reply from the bytes alone; it decides from the length and shows its best reading. Check that against the direction of the capture.
Modbus TCP frames have no CRC (TCP checks the data) and begin with a 7-byte header; this tool is for serial RTU frames.
Some tools show the CRC high byte first. On the wire it is always low byte first.
Common questions
Why does the CRC come out as C4 0B when my tool shows 0BC4?
They are the same number. The CRC value is the 16-bit number 0x0BC4, and Modbus sends the low byte (C4) first and the high byte (0B) second. This page shows the bytes in the order they go on the wire, and the 16-bit value next to them.
Why is my captured frame flagged as having a wrong CRC?
A bit changed (noise, a baud rate or parity mismatch), the capture missed a byte, or the frame includes extra bytes at the start or end. Check the capture settings, and remove any bytes that belong to the previous or next frame.
What is the largest read I can ask for?
Up to 125 registers or 2000 coils/discrete inputs in one request. The reply must fit in the 256-byte serial frame, and some devices allow less than the standard maximum.
Why do I get no reply to address 0?
Address 0 is the broadcast address. Slaves carry out write commands sent to it but do not answer, so the master has nothing to wait for.
Sources
- Modbus Organization, MODBUS over Serial Line Specification and Implementation Guide V1.02 (framing, timing, CRC-16 and the function codes).
- Modbus Organization, MODBUS Application Protocol Specification V1.1b3 (function codes, exception codes, data limits).
Last reviewed: October 22, 2026