Modbus Frame Structure Workbench

Build and inspect Modbus RTU, TCP, and ASCII frames byte by byte.

animation
modbus
industrial
protocols
Learner-ready Modbus frame workbench with RTU/TCP/ASCII mode switching, MBAP length calculation, CRC/LRC generation, exception frames, byte-level highlighting, Play/Step controls, and mobile-safe reference support.
Modbus RTU Modbus TCP ASCII CRC / LRC

Modbus Frame Structure Workbench

Build the same Modbus request in RTU, TCP, or ASCII. The byte strip highlights which fields belong to the Modbus PDU and which fields are transport envelopes such as MBAP, slave address, CRC, LRC, or ASCII delimiters.

ModeRTU binary ADU
ADU length8 bytes
PDU length5 bytes
Check fieldCRC low byte first

Stage 1: mode envelope

RTU starts with a one-byte slave address. TCP starts with the seven-byte MBAP header. ASCII starts with a colon delimiter.

RTU ADU Slave + PDU + CRC

Envelope

Slave address 0x11 RTU address identifies the slave on a serial bus.

Function

0x03 Read holding registers The first byte of every Modbus PDU is the function code.

Data

Start 0x006B, Qty 3 Multi-byte values in the PDU are sent most significant byte first.

Integrity

CRC 0x7687 RTU appends CRC low byte then high byte.

What to notice

    Core idea

    The PDU is function code plus data. RTU, TCP, and ASCII wrap that PDU differently, so a packet analyzer must know the mode before interpreting bytes.

    Common trap

    Modbus TCP has no CRC field. Its MBAP length field counts the Unit Identifier plus the PDU, not the seven MBAP bytes themselves.

    Serial boundary

    RTU frames are delimited by silent intervals, not start/end bytes. ASCII frames use a colon start and CR/LF end delimiter.

    Quick reference and technical notes
    Mode Frame structure Important byte rule
    RTU Slave Address + PDU + CRC-16. CRC is appended low-order byte first; PDU data values are big-endian.
    TCP MBAP header + Unit Identifier + PDU. Protocol Identifier is 0; Length counts Unit Identifier plus PDU bytes.
    ASCII Colon + ASCII hex address/PDU/LRC + CR LF. LRC is computed over binary address and PDU bytes, then encoded as two ASCII hex characters.
    PDU limit Function code + data. The Modbus PDU is limited to 253 bytes; mode envelopes add bytes around it.
    Exception Address/Unit + Function Code with bit 7 set + exception code. Example: function 0x03 exception response uses 0x83 followed by one exception byte.

    This workbench shows byte layout and checksums for common teaching frames. Real serial troubleshooting also needs baud rate, parity, turnaround timing, line biasing, and the RTU silent interval rules from the serial-line guide.