Modbus RTU — frame, timing and CRC

RTU frame

┌──────────┬───────────────┬────────────────┬──────────────┐
│ Address  │ Function code │ Data           │ CRC          │
│ 1 byte   │ 1 byte        │ 0…252 bytes    │ 2 bytes (L,H)│
└──────────┴───────────────┴────────────────┴──────────────┘

• Address: 1…247 — a device; 0 — broadcast write (no response).
• Function code and data — the PDU, identical in RTU and TCP (see Modbus function codes).
• CRC — 16-bit checksum over all preceding bytes of the frame.

Maximum frame length is 256 bytes.

Serial settings

Each byte is sent as an 11-bit character: start, 8 data bits (LSB first), parity, stop. The specification requires Even parity by default. Without parity a second stop bit keeps the character at 11 bits: 8N2. 8N1 is common in practice but deviates from the specification and must be supported explicitly by the device.

Mandatory baud rates are 9600 and 19200 bit/s; 19200 is the default. The client and all servers on a line must use the same settings.

Frame boundaries: t3.5 and t1.5

RTU has no start/end characters. Frames are separated by a silent interval of at least 3.5 character times (t3.5). If a gap longer than 1.5 character times (t1.5) occurs inside a frame, the frame is declared incomplete and discarded.

Character time = 11 bits / baud rate. At 9600 bit/s a character takes ≈1.15 ms, so t3.5 ≈ 4 ms. Above 19200 bit/s the specification recommends fixed values: t1.5 = 750 µs, t3.5 = 1.75 ms.

Practical consequences: USB-to-RS-485 converters and Windows timers can split a frame with gaps, and polling too fast without a pause merges frames.

CRC-16/MODBUS

Parameters (CRC RevEng catalogue): width=16, poly=0x8005 (reflected form 0xA001), init=0xFFFF, refin=true, refout=true, xorout=0x0000, check=0x4B37.

Byte order. The CRC is appended low byte first, unlike all other 16-bit Modbus fields:

Data:       01 03 00 00 00 02
CRC:        value 0x0BC4
On the wire: 01 03 00 00 00 02 C4 0B
                               └─┴── low byte (C4), then high byte (0B)

This is the most common source of confusion: calculators show the CRC value (0x0BC4) while the frame carries the bytes in reverse (C4 0B). Both are correct.

Useful property: the CRC computed over a frame including a correct CRC is zero, so a receiver checks the frame in one pass.

Check a CRC with the Modbus CRC16 Calculator or the Checksum Calculator, which shows both the value and the byte order.

RS-485 line

• Bus topology with short stubs, not a star.
• Terminations at both ends: 150 Ω, or 120 Ω in series with 1 nF.
• If devices require line polarization: one pair of 450…650 Ω resistors at one location, usually at the client.
• 32 devices without a repeater (the exact number depends on the devices' unit load).
• Up to 9600 bit/s with AWG26 or thicker cable, the bus may be up to 1000 m long.
• The common conductor connects device reference potentials; the shield is grounded at one point.

Decode a frame

Paste a frame into the Modbus RTU Frame Parser: it checks the CRC, shows the CRC bytes in the frame and the expected bytes, identifies the function and decodes the data.