CoderTools

Modbus Protocol Parser

Parse, convert, and debug Modbus RTU/ASCII/TCP communications

Please enter input data

Modbus Protocol Reference

Modbus is the most widely used industrial communication protocol, originally developed by Modicon in 1979. It enables communication between electronic devices over serial lines (RTU) or Ethernet (TCP/IP). This tool helps engineers debug and analyze Modbus communications without specialized hardware or software.

Modbus RTU Frame Structure

Modbus RTU (Remote Terminal Unit) transmits data in binary format over serial connections like RS-232 or RS-485. Each frame includes a slave address, function code, data, and a 16-bit CRC checksum for error detection. The compact binary format makes RTU efficient for bandwidth-constrained environments.

Slave ID
1 byte
Function
1 byte
Data
N bytes
CRC-16
2 bytes

Modbus RTU Frame Structure

Modbus TCP Frame Structure

Modbus TCP encapsulates RTU frames within TCP/IP packets, using a 7-byte MBAP (Modbus Application Protocol) header. This header contains a transaction ID for request-response matching, protocol identifier (always 0 for Modbus), message length, and unit ID. TCP communication uses port 502 by default.

Trans ID
2 bytes
Proto ID
2 bytes
Length
2 bytes
Unit ID
1 byte
Function
1 byte
Data
N bytes

Modbus TCP Frame Structure (MBAP Header + PDU)

Common Function Codes

Function codes define the operation type in a Modbus request. Read operations (01-04) retrieve coil states or register values, while write operations (05, 06, 0F, 10) modify device data. Each function code has specific data format requirements.

Code Function Type
0x01Read CoilsRead
0x02Read Discrete InputsRead
0x03Read Holding RegistersRead
0x04Read Input RegistersRead
0x05Write Single CoilWrite
0x06Write Single RegisterWrite
0x0FWrite Multiple CoilsWrite
0x10Write Multiple RegistersWrite

Byte Order in Modbus

Different PLC manufacturers use varying byte orders for 32-bit and 64-bit values. The four common arrangements are: Big Endian (ABCD) - standard network order; Little Endian (DCBA); Mid-Big Endian (BADC); and Mid-Little Endian (CDAB). When reading incorrect values, try different byte orders to find the correct interpretation.

Big Endian (ABCD)
A B C D
Little Endian (DCBA)
D C B A
Mid-Big Endian (BADC)
B A D C
Mid-Little Endian (CDAB)
C D A B

CRC-16/Modbus Algorithm

Modbus RTU uses CRC-16 with polynomial 0x8005 and initial value 0xFFFF for error detection. The CRC is calculated over the slave address, function code, and data bytes, then appended in low-byte-first order. A frame with incorrect CRC should be discarded by the receiver.

Polynomial: 0x8005
Initial Value: 0xFFFF
Reflect In: Yes
Reflect Out: Yes

Practical Applications

  • Troubleshoot communication errors between PLCs and SCADA systems by analyzing raw packet data
  • Verify register values during commissioning by converting hex data to engineering units
  • Generate test commands for device validation without dedicated Modbus master software
  • Debug byte order issues when integrating devices from different manufacturers

Related Tools

Quick Menu

No recent tools