Calculate or check the CRC-16 of a Modbus RTU frame, or the LRC of a Modbus ASCII frame, and read every field the bytes carry.
Append 8C D4 to send this frame. A frame pasted with its CRC is checked instead.
Read Holding Registers, request
| Bytes | Field | Value | Meaning |
|---|---|---|---|
| 01 | Unit address | 1 | The server this frame is for or from |
| 03 | Function | 0x03 | Read Holding Registers |
| 2E E0 | Starting address | 12000 | Holding register 412001, protocol address 0x2EE0 |
| 00 01 | Quantity | 1 | 1 holding register; the reply carries 2 data bytes |
| 8C D4 | CRC-16 | 0xD48C | Low byte first |
The complete frame
01 03 2E E0 00 01 8C D40x01, 0x03, 0x2E, 0xE0, 0x00, 0x01, 0x8C, 0xD401032EE000018CD4:01032EE00001EDThe register starts at 0xFFFF. Each byte is XORed into its low byte, then it is shifted right eight times, XORed with 0xA001 whenever a 1 falls out.
| Byte | Value | Register after it |
|---|---|---|
| 1 | 01 | 0x807E |
| 2 | 03 | 0x2140 |
| 3 | 2E | 0xECA0 |
| 4 | E0 | 0xF0ED |
| 5 | 00 | 0x4D30 |
| 6 | 01 | 0xD48C |
The register ends at 0xD48C and is sent low byte first: 8C D4.
CRC bytes, as sent
8C D4
Read Holding Registers request to unit 1.
Check the values to see a result.
Modbus sends the low byte of the CRC first.
CRC starts at 0xFFFFXOR each byte, shift eight times using polynomial 0xA001transmit CRC low byte first
The Modbus CRC-16 of 01 03 2E E0 00 01 is 0xD48C, sent low byte first as 8C D4.
Tip: Paste a frame straight from a serial capture, CRC and all. If the function code sizes the frame, its last bytes are checked and the verdict says whether it arrived intact.
Every Modbus RTU frame ends with a 16-bit CRC over all the bytes before it, sent low byte first. A device that works out a different CRC discards the frame without replying, which is why a bad CRC shows up as a timeout rather than an error. Modbus ASCII uses a simpler one-byte LRC instead. The calculator works out both and shows the frame byte by byte.
start 0xFFFF; for each byte: XOR, then 8 × (shift right; if a 1 fell out, XOR 0xA001)
Start with 0xFFFF. XOR the first byte into the low byte of the register, then shift right eight times, XOR-ing 0xA001 after every shift that pushes out a 1. Repeat for every byte from the unit address to the last data byte.
CRC 0x8776 → sent 76 87
The CRC is the only field in a Modbus frame sent low byte first. Everything else, addresses and register values included, goes high byte first.
LRC = (0x100 − (sum of bytes mod 0x100)) mod 0x100
Add the address, function and data bytes, drop any carry past 8 bits, and take the two’s complement. It is sent as two hex characters after the data and before CR LF.
Unit 0x11 (17), function 03, starting at address 0x006B, three registers: the request from the Modbus serial line guide. Its CRC is 0x8776, sent as 76 87, so the complete frame is 11 03 00 6B 00 03 76 87.
CRC bytes, as sent 76 87 Open in the calculator
0x11 + 0x03 + 0x00 + 0x6B + 0x00 + 0x03 = 0x82. Its two’s complement is 0x7E, so the LRC is 7E and the line reads :1103006B00037E, then CR LF.
LRC byte 7E Open in the calculator
A serial capture shows 01 03 00 00 00 0A C5 CD. Enter the first six bytes: the CRC comes out as C5 CD, the same as the last two bytes captured, so the frame’s check value matches its preceding bytes. If they differ, look at wiring, termination and noise before the device.
CRC bytes, as sent C5 CD Open in the calculator
Requests from unit 1 and unit 17, with the CRC in the order it is sent and the Modbus ASCII LRC.
| Frame (hex) | CRC-16, as sent | LRC |
|---|---|---|
| 01 03 00 00 00 01 | 84 0A | FB |
| 01 03 00 00 00 0A | C5 CD | F2 |
| 01 04 00 00 00 02 | 71 CB | F9 |
| 01 06 00 01 00 03 | 98 0B | F5 |
| 11 03 00 6B 00 03 | 76 87 | 7E |
| 11 10 00 01 00 02 04 00 0A 01 02 | C6 F0 | CB |
It falls out of how the CRC is computed, shifting right from the least significant bit. The Modbus serial line specification fixes the order: low byte, then high byte. Tools that show 0x8776 and frames that end 76 87 are both right.
The device discards the frame and does not answer, so the master sees a timeout. It never sends an exception for a bad CRC. Repeated CRC errors usually point at termination, biasing, grounding or cable routing.
No. Modbus TCP relies on TCP’s own error checking and replaces the CRC with the MBAP header. A gateway between TCP and RTU adds and removes the CRC.
CRC-16/MODBUS: polynomial 0x8005 used in reflected form (0xA001), initial value 0xFFFF, no final XOR.
A ZMB builds and checks the RTU frames itself. It polls the Modbus device locally over RS-485 and sends the data to the Gateway over the wireless mesh.
