Calculate the CRC-16 of a Modbus RTU frame, or the LRC of a Modbus ASCII frame, and see every byte in the order it goes on the wire.
CRC bytes, as sent
C5 CD
Check the values to see a result.
Modbus sends the low byte of the CRC first.
CRC starts at 0xFFFFXOR each byte, shift eight times using polynomial 0xA001transmit CRC low byte first
The Modbus CRC-16 of 01 03 00 00 00 0A is 0xCDC5, sent low byte first as C5 CD.
Tip: Paste a frame from a serial capture without its last two bytes; if the CRC here matches them, the frame arrived intact.
Every Modbus RTU frame ends with a 16-bit CRC over all the bytes before it, sent low byte first. A device that works out a different CRC discards the frame without replying, which is why a bad CRC shows up as a timeout rather than an error. Modbus ASCII uses a simpler one-byte LRC instead. The calculator works out both and shows the frame byte by byte.
start 0xFFFF; for each byte: XOR, then 8 × (shift right; if a 1 fell out, XOR 0xA001)
Start with 0xFFFF. XOR the first byte into the low byte of the register, then shift right eight times, XOR-ing 0xA001 after every shift that pushes out a 1. Repeat for every byte from the unit address to the last data byte.
CRC 0x8776 → sent 76 87
The CRC is the only field in a Modbus frame sent low byte first. Everything else, addresses and register values included, goes high byte first.
LRC = (0x100 − (sum of bytes mod 0x100)) mod 0x100
Add the address, function and data bytes, drop any carry past 8 bits, and take the two’s complement. It is sent as two hex characters after the data and before CR LF.
Unit 0x11 (17), function 03, starting at address 0x006B, three registers: the request from the Modbus serial line guide. Its CRC is 0x8776, sent as 76 87, so the complete frame is 11 03 00 6B 00 03 76 87.
CRC bytes, as sent 76 87 Open in the calculator
0x11 + 0x03 + 0x00 + 0x6B + 0x00 + 0x03 = 0x82. Its two’s complement is 0x7E, so the LRC is 7E and the line reads :1103006B00037E, then CR LF.
LRC byte 7E Open in the calculator
A serial capture shows 01 03 00 00 00 0A C5 CD. Enter the first six bytes: the CRC comes out as C5 CD, the same as the last two bytes captured, so the frame arrived intact. If they differ, look at wiring, termination and noise before the device.
CRC bytes, as sent C5 CD Open in the calculator
Requests from unit 1 and unit 17, with the CRC in the order it is sent and the Modbus ASCII LRC.
| Frame (hex) | CRC-16, as sent | LRC |
|---|---|---|
| 01 03 00 00 00 01 | 84 0A | FB |
| 01 03 00 00 00 0A | C5 CD | F2 |
| 01 04 00 00 00 02 | 71 CB | F9 |
| 01 06 00 01 00 03 | 98 0B | F5 |
| 11 03 00 6B 00 03 | 76 87 | 7E |
| 11 10 00 01 00 02 04 00 0A 01 02 | C6 F0 | CB |
It falls out of how the CRC is computed, shifting right from the least significant bit. The Modbus serial line specification fixes the order: low byte, then high byte. Tools that show 0x8776 and frames that end 76 87 are both right.
The device discards the frame and does not answer, so the master sees a timeout. It never sends an exception for a bad CRC. Repeated CRC errors usually point at termination, biasing, grounding or cable routing.
No. Modbus TCP relies on TCP’s own error checking and replaces the CRC with the MBAP header. A gateway between TCP and RTU adds and removes the CRC.
CRC-16/MODBUS: polynomial 0x8005 used in reflected form (0xA001), initial value 0xFFFF, no final XOR.
A ZMB builds and checks the RTU frames itself. It polls the Modbus device locally over RS-485 and sends the data to the Gateway over the wireless mesh.
