Paste a Modbus RTU HEX frame to decode address, function code, parsed fields, exception status, and CRC16 Modbus validity.
Modbus RTU hex frame parser
Input
Decoded summary
Frame status-
Byte count-
Slave/server address-
Function code-
Function name-
Frame type-
Original function-
Exception code-
Exception name-
Received CRC-
Calculated CRC-
CRC check-
Paste a frame or choose an example to start decoding.
Parsed fields
Field
Value
No parsed fields yet.
RTU CRC is transmitted as low byte first, then high byte.
What is a Modbus RTU frame?
A Modbus RTU frame contains slave/server address, function code, data, and CRC16 bytes. It is widely used over RS-485 serial lines.
Modbus RTU frame format
RTU frames are usually represented in hex bytes. Requests and responses share the same address/function structure, while data fields vary by function code.
CRC16 Modbus checking
CRC16 Modbus uses polynomial 0xA001 with initial value 0xFFFF. This tool compares received CRC bytes with calculated values.
Decoding function 03, 06 and 16
Function 03/04 requests decode into start address and quantity. Function 06 decodes register/value pairs. Function 16 decodes ranges and register payload.
Exception response decoding
Exception responses set the function MSB (original function + 0x80). For example, function 0x03 exception response uses function byte 0x83.
Modbus RTU frame examples
Frame
Meaning
Notes
01 03 00 00 00 02 C4 0B
Read 2 holding registers from start address 0x0000.
Function 03 request example
01 06 00 01 00 64 D9 E1
Write value 0x0064 to register 0x0001.
Function 06 request/echo response example
01 10 00 01 00 02 04 00 0A 00 14 12 6E
Write 2 registers (0x000A, 0x0014) starting at 0x0001.
Function 16 request with validated CRC
01 83 02 C0 F1
Exception response for function 0x03 with code 0x02.
Illegal Data Address example
FAQ
How do I decode a Modbus RTU frame?
Split bytes into address, function, data and CRC. Then decode data fields based on function code and check CRC16.
How is Modbus RTU CRC calculated?
Use CRC-16 Modbus (poly 0xA001, init 0xFFFF) over all bytes except the final two CRC bytes.
Why are CRC bytes reversed in Modbus RTU?
Modbus RTU transmits CRC low byte first and high byte second, so it can look reversed compared to 16-bit big-endian notation.
How do I know if a frame is an exception response?
If function code is 0x80 or higher, it is usually an exception response and the next byte is the exception code.
What does function code 03 mean?
Function 03 reads holding registers from a Modbus server/slave.