Modbus RTU is a binary protocol over serial lines (RS-485, RS-232). The master (PLC, HMI, PC) sends a request and only the slave with the matching address replies. With the register map from the device manual you can build requests yourself.
Request: read 2 holding registers
01 03 00 00 00 02 C4 0B
| Bytes | Meaning |
|---|---|
| 01 | Slave ID 1 |
| 03 | Function 03 — read holding registers |
| 00 00 | Start address 0 (high byte first) |
| 00 02 | Quantity 2 |
| C4 0B | CRC16 — low byte first |
Response: values 100 and 200
01 03 04 00 64 00 C8 BA 7A
| Bytes | Meaning |
|---|---|
| 01 03 | Same address and function |
| 04 | Data byte count (2 registers × 2) |
| 00 64 | First register = 100 |
| 00 C8 | Second register = 200 |
| BA 7A | CRC16 |
Exception replies
When a request cannot be served, the slave adds 0x80 to the function code and appends an exception code. This one is «illegal data address (02)».
01 83 02 C0 F1
- 01 — illegal function
- 02 — illegal data address (out of range)
- 03 — illegal data value (e.g. quantity too large)
- 04 — slave device failure
40001 means address 0
«40001» in a manual means «the first holding register»; the address on the wire is 0. 40010 is 9, and 30001 (input registers) is address 0 with function 04. If values look shifted by one, check this notation first.
CRC and byte order
CRC16 Modbus uses polynomial 0xA001 (reflected) and initial value 0xFFFF over everything from the address to the last data byte, and the low byte is sent first. The CRC above is 0x0BC4 and appears as «C4 0B». Try «01 03 00 00 00 02» in the CRC calculator to check.
The silent interval between frames
RTU ends a frame after 3.5 character times of silence. One character is 11 bits (start, 8 data, parity or stop, stop).
| Baud | 1 char | 3.5 chars | 8-byte request on the wire |
|---|---|---|---|
| 9600 | 1.15 ms | 4.0 ms | 9.2 ms |
| 19200 | 0.57 ms | 2.0 ms | 4.6 ms |
| 38400 | 0.29 ms | 1.0 ms | 2.3 ms |
| 115200 | 0.10 ms | 0.33 ms (spec recommends 1.75 ms) | 0.8 ms |
Above 19200 bps the specification recommends a fixed 1.75 ms instead of 3.5 characters. USB adapters deliver data in chunks of several milliseconds, which easily breaks this timing — see the next guide.
Published 2026-10-17