HDLC Protocol: Frame Format, Bit Stuffing and Frame Types

HDLC (High-level Data Link Control) is a bit-oriented data link layer protocol, standardised by ISO, that carries data in frames marked by the flag pattern 01111110 (0x7E). Each frame holds an address, a control field, optional data and a CRC frame check sequence, and bit stuffing keeps the flag pattern from appearing inside the frame. HDLC and its variants are the basis of LAPB (X.25), LAPD (ISDN), Frame Relay framing and PPP framing.

Key takeaways

• Frame layout: Flag | Address | Control | Information | FCS | Flag.
• Bit stuffing: after five consecutive 1s inside a frame, the transmitter inserts a 0, and the receiver removes it.
• Three frame types, identified by the control field: I-frames (data), S-frames (supervisory, acknowledgement and flow control) and U-frames (unnumbered, link set-up and management).
• The usual FCS is a 16-bit CRC (polynomial x¹⁶ + x¹² + x⁵ + 1), with a 32-bit option.
• HDLC descends from IBM's SDLC; PPP over serial links uses an HDLC-like framing defined in RFC 1662.

What is HDLC? (original post)

HDLC is a bit-oriented, link layer protocol for the transmission of data over synchronous networks. It is an ISO standard, but is a superset of IBM's SDLC (Synchronous Data Link Control) protocol. SDLC was the successful follow-up to the BISYNC communication protocol and was originally introduced with IBM SNA (Systems Network Architecture) products. Another name for HDLC is ADCCP (Advanced Data Communications Control Procedure), an ANSI standard, but HDLC is the widely accepted name for the protocol. There are some incompatibilities between SDLC and HDLC, depending on the vendor.

Two Internet RFCs are related to HDLC. These are RFC 2687 (PPP in a Real-Time Oriented HDLC-like Framing, September 1999) and RFC 1662 (PPP in HDLC-like Framing, July 1994).

Note (checked 1 November 2026): both RFC links still work; they now redirect to the RFC Editor site, rfc-editor.org. The current ISO standard for HDLC procedures is ISO/IEC 13239.

HDLC frame format

Field	Size	Purpose
Flag	8 bits, 01111110 (0x7E)	Marks the start and end of a frame. One flag can close one frame and open the next.
Address	8 bits (extendable)	Identifies the secondary station on a multipoint link. On point-to-point links it is often a fixed value, for example 0xFF (all stations) in PPP.
Control	8 bits (16 bits in extended mode)	Frame type, sequence numbers and the poll/final bit.
Information	Variable, may be empty	The payload, present in I-frames and some U-frames.
FCS	16 or 32 bits	CRC over address, control and information fields, used to detect errors.
Flag	8 bits, 0x7E	Closes the frame.

A sequence of seven or more consecutive 1s is an abort: the receiver discards the frame in progress. Between frames the line carries continuous flags or, in some systems, idle 1s.

Bit stuffing, with worked examples

Because the flag 01111110 contains six 1s in a row, the frame body must never contain six consecutive 1s. The transmitter therefore inserts a 0 after every run of five 1s between the flags, whatever the next bit is. The receiver, on seeing five 1s followed by a 0, deletes the 0. If it sees five 1s followed by a 1, the next bit tells it whether this is a flag (0) or an abort (1).

Data bits	Transmitted bits	Inserted 0s
01111110 (a data byte equal to the flag)	011111010	1
11111111	111110111	1
0111111101111110	011111011011111010	2

Step by step for the third row, 0111111101111110: the first five 1s (bits 2 to 6) are followed by an inserted 0, giving 0111110; the remaining 1, 1, 0 follow; then the next run of five 1s gets another inserted 0. The full result is 011111011011111010, 18 bits from 16. In the worst case, all 1s, the overhead is one extra bit per five data bits, or 20 percent.

PPP over asynchronous links (RFC 1662) cannot insert single bits, so it uses byte stuffing instead: any 0x7E or 0x7D byte inside the frame (and any control character selected by the negotiated async control character map) is sent as 0x7D followed by the original byte XOR 0x20. On synchronous links RFC 1662 uses bit stuffing as in HDLC.

A small Verilog bit stuffer

The module below inserts a 0 after every five consecutive 1s on a serial stream. It drops in_ready for one cycle while it sends the stuffed bit, so the source must hold its bit until in_ready is high. It assumes the downstream logic accepts one bit every cycle that out_valid is high. Flags are sent around the stuffer by the framing logic, since they must not be stuffed.

module hdlc_bit_stuffer (
  input  wire clk,
  input  wire rst_n,
  input  wire in_valid,
  input  wire in_bit,
  output wire in_ready,
  output reg  out_valid,
  output reg  out_bit
);
  reg  [2:0] ones;                 // count of consecutive 1s sent
  wire       stuff = (ones == 3'd5);

  assign in_ready = !stuff;

  always @(posedge clk or negedge rst_n) begin
    if (!rst_n) begin
      ones      <= 3'd0;
      out_valid <= 1'b0;
      out_bit   <= 1'b0;
    end else if (stuff) begin      // insert the 0 after five 1s
      out_valid <= 1'b1;
      out_bit   <= 1'b0;
      ones      <= 3'd0;
    end else if (in_valid) begin
      out_valid <= 1'b1;
      out_bit   <= in_bit;
      ones      <= in_bit ? ones + 3'd1 : 3'd0;
    end else begin
      out_valid <= 1'b0;
    end
  end
endmodule

The receiver does the reverse: it counts 1s, drops the bit that follows five 1s if it is a 0, and treats 01111110 as a flag and seven or more 1s as an abort.

Frame types and the control field

Type	Control field bits (first bits sent)	Contents	Examples
I-frame (information)	0, then N(S), P/F, N(R)	User data plus send and receive sequence numbers	Data transfer with piggybacked acknowledgement
S-frame (supervisory)	1 0, then type, P/F, N(R)	Acknowledgement and flow control, no data	RR (receive ready), RNR (receive not ready), REJ (reject), SREJ (selective reject)
U-frame (unnumbered)	1 1, then modifier bits and P/F	Link set-up, tear-down and other control	SABM, SNRM, DISC, UA, DM, FRMR, UI

With an 8-bit control field the sequence numbers N(S) and N(R) are 3 bits each, so they count modulo 8 and up to 7 frames can be outstanding. The extended 16-bit control field uses 7-bit numbers, modulo 128, for links with long delays such as satellite links. Error recovery uses go-back-N (REJ) or selective repeat (SREJ).

Stations and modes of operation

• Station types: primary (sends commands), secondary (sends responses) and combined (both).
• Normal Response Mode (NRM): a secondary may transmit only when polled by the primary. Typical of multipoint links, and the mode SDLC was built around.
• Asynchronous Response Mode (ARM): a secondary may transmit without being polled, but the primary still manages the link.
• Asynchronous Balanced Mode (ABM): two combined stations with equal status. This is the mode used by LAPB in X.25 and by LAPD in ISDN.

The frame check sequence

The 16-bit FCS uses the CRC-CCITT polynomial x¹⁶ + x¹² + x⁵ + 1. In the form used by HDLC and PPP the register starts at 0xFFFF, bits are processed least significant bit first, and the result is inverted before it is sent. With these settings the CRC of the ASCII string "123456789" is 0x906E, a handy check value when testing an implementation. For how CRCs work in hardware, see our series on cyclic redundancy checking: CRC part 1 and CRC part 2. A short definition of CRC (cyclic redundancy check) is on The Semiconductor Hub glossary.

Where HDLC is used

Protocol	Relation to HDLC
SDLC (IBM SNA)	The predecessor; HDLC is a superset
LAPB (X.25)	HDLC in Asynchronous Balanced Mode
LAPD (ISDN D channel)	HDLC-based, with a two-byte address field
LAPF (Frame Relay)	HDLC-style framing with a reduced control set
PPP	HDLC-like framing per RFC 1662, usually with address 0xFF and control 0x03 (UI)
Cisco HDLC	A vendor variant used on router serial links, with a protocol type field

For a look at a different link layer, see our Ethernet Q&A.

Frequently asked questions

Why is HDLC called bit-oriented?

Frames are delimited by a bit pattern, the flag, and transparency is achieved by inserting single bits. The payload does not have to be a whole number of bytes, unlike character-oriented protocols such as BISYNC.

What is the HDLC flag?

The 8-bit pattern 01111110, 0x7E in hexadecimal. It starts and ends every frame.

Why does HDLC insert a 0 after five 1s?

So that six consecutive 1s, and therefore the flag pattern, can never appear inside a frame. The receiver removes the inserted 0s.

What is the difference between HDLC and PPP?

HDLC is a complete data link protocol with sequence numbers, acknowledgements and several modes. PPP borrows HDLC-like framing but normally sends unnumbered frames and adds its own link control and network control protocols.

What is the difference between HDLC and SDLC?

SDLC is IBM's earlier protocol and works mainly in Normal Response Mode. HDLC is the ISO generalisation, adding balanced and asynchronous modes and extended sequence numbers. Details differ between vendors.