Look up any public Modbus function code or exception code, or paste an exception response such as 83 02 to see which request failed and why.
Exception 0x02
Illegal Data Address
Check the values to see a result.
The first byte is the function code plus 0x80, which marks an exception; the second is the exception code.
Exception response function code = request function code + 0x80
Response 83 02 means the Read Holding Registers request (0x03) failed with exception 0x02, Illegal Data Address.
Tip: No reply at all is not an exception. Check wiring, the unit ID, baud rate, parity and termination before the register map.
When a Modbus device receives a request it cannot carry out, it answers with an exception response: the function code with its top bit set (the code plus 0x80), then a one-byte exception code. 83 02 means a Read Holding Registers request (0x03) failed with exception 02, Illegal Data Address. Paste the response bytes into the box above to decode them.
function in the response = request function + 0x80
A normal reply repeats the request’s function code. An exception sets the top bit, so 0x03 becomes 0x83 and 0x10 becomes 0x90. Subtract 0x80 to find the request that failed.
01 function · 02 address · 03 value · 04 device failure
01 Illegal Function: the device does not support the request. 02 Illegal Data Address: the address, or the address plus the count, is outside what it holds. 03 Illegal Data Value: a value in the request is not allowed. 04 Server Device Failure: the device failed while carrying it out.
FC16 = 16 decimal = 0x10
Manuals quote function codes both ways. The box above reads a bare number as decimal when that names a function (16 is Write Multiple Registers) and shows the hexadecimal reading beside it; write 0x16 to mean hexadecimal.
No reply at all is not an exception. A timeout points at the wiring, the unit ID, the baud rate and parity, termination, or a frame the device threw away for a bad CRC. Only a device that understood the frame can send an exception.
Subtract 0x80 from 0x83 to get 0x03, Read Holding Registers. Exception 02 is Illegal Data Address: the registers asked for do not exist in the device. The usual cause is an off-by-one address from a 40001-style reference, or a request that runs past the end of a block; the Modbus address converter settles the first.
Exception 0x02 Illegal Data Address Open in the calculator
0x90 − 0x80 = 0x10, Write Multiple Registers, and 03 is Illegal Data Value. The device received the frame but refused a value in it: a setpoint outside its range, a register count that does not match the byte count, or a write to a read-only block.
Exception 0x03 Illegal Data Value Open in the calculator
In decimal, function 16 is Write Multiple Registers, sent on the wire as 0x10. Read as hexadecimal, 0x16 would be Mask Write Register, a different request. When a manual says “FC16” it means decimal.
Function 16 (0x10) Write Multiple Registers Open in the calculator
The common public function codes in decimal and hexadecimal, and the first byte a device sends back if the request fails.
| Function | Name | Hex | Exception response |
|---|---|---|---|
| 1 | Read Coils | 0x01 | 0x81 |
| 2 | Read Discrete Inputs | 0x02 | 0x82 |
| 3 | Read Holding Registers | 0x03 | 0x83 |
| 4 | Read Input Registers | 0x04 | 0x84 |
| 5 | Write Single Coil | 0x05 | 0x85 |
| 6 | Write Single Register | 0x06 | 0x86 |
| 15 | Write Multiple Coils | 0x0F | 0x8F |
| 16 | Write Multiple Registers | 0x10 | 0x90 |
| 22 | Mask Write Register | 0x16 | 0x96 |
| 23 | Read/Write Multiple Registers | 0x17 | 0x97 |
| 43 | Encapsulated Interface Transport | 0x2B | 0xAB |
No row matches that filter.
Defined public functions in V1.1b3. A listed function is not proof that a particular device implements it.
| Code | Function | Data access | Protocol request limit | Transport note |
|---|---|---|---|---|
| 0x01 | Read Coils | Read coils · bits | 1–2,000 contiguous coils | Application protocol |
| 0x02 | Read Discrete Inputs | Read discrete inputs · bits | 1–2,000 contiguous inputs | Application protocol |
| 0x03 | Read Holding Registers | Read holding registers · 16-bit words | 1–125 contiguous registers | Application protocol |
| 0x04 | Read Input Registers | Read input registers · 16-bit words | 1–125 contiguous registers | Application protocol |
| 0x05 | Write Single Coil | Write one coil · bit | Exactly one coil | Application protocol |
| 0x06 | Write Single Register | Write one holding register · 16-bit word | Exactly one register | Application protocol |
| 0x07 | Read Exception Status | Read eight implementation-defined status outputs | No request data | Serial line only |
| 0x08 | Diagnostics | Communication diagnostics by subfunction | Subfunction-specific | Serial line only |
| 0x0B | Get Comm Event Counter | Read communications status and event count | No request data | Serial line only |
| 0x0C | Get Comm Event Log | Read communications status, counters and event bytes | No request data | Serial line only |
| 0x0F | Write Multiple Coils | Write contiguous coils · bits | 1–1,968 contiguous coils | Application protocol |
| 0x10 | Write Multiple Registers | Write contiguous holding registers · 16-bit words | 1–123 contiguous registers | Application protocol |
| 0x11 | Report Server ID | Read device-specific identity and run status | No request data | Serial line only |
| 0x14 | Read File Record | Read one or more file-record groups | Request byte count 7–245 | Application protocol |
| 0x15 | Write File Record | Write one or more file-record groups | Request byte count 9–251 | Application protocol |
| 0x16 | Mask Write Register | Modify bits in one holding register | Exactly one register | Application protocol |
| 0x17 | Read/Write Multiple Registers | Write holding registers, then read holding registers | Read 1–125; write 1–121 registers | Application protocol |
| 0x18 | Read FIFO Queue | Read FIFO count and value registers | Returned FIFO count no more than 31 | Application protocol |
| 0x2B | Encapsulated Interface Transport | Dispatch an MEI-defined interface | Published MEI types 0x0D and 0x0E | Application protocol |
Source: MODBUS Application Protocol Specification, V1.1b3
The four primary Modbus data tables. Device memory mapping and whether tables overlay are implementation-specific.
| Object | Element | Protocol access | Core public functions |
|---|---|---|---|
| Coils | Single bit | Read–write | 0x01 read · 0x05/0x0F write |
| Discrete Inputs | Single bit | Read-only | 0x02 read |
| Input Registers | 16-bit word | Read-only | 0x04 read |
| Holding Registers | 16-bit word | Read–write | 0x03 read · 0x06/0x10/0x16/0x17 write |
Source: MODBUS Application Protocol Specification, V1.1b3
Exception codes returned in a Modbus exception response. A timeout or discarded CRC/parity error is not itself one of these exception responses.
| Code | Exception | Protocol meaning |
|---|---|---|
| 0x01 | Illegal Function | The requested function is not allowable for this server or its current state. |
| 0x02 | Illegal Data Address | The starting address, requested span or their combination is not allowable for the server. |
| 0x03 | Illegal Data Value | The request data structure contains a value the server cannot accept; it does not describe the application value stored in a register. |
| 0x04 | Server Device Failure | An unrecoverable error occurred while the server attempted the requested action. |
| 0x05 | Acknowledge | The server accepted a specialised programming request but needs more time to complete it. |
| 0x06 | Server Device Busy | The server is busy with a long-duration programming command; the client may retry later. |
| 0x08 | Memory Parity Error | A file-record consistency check failed while using function 0x14 or 0x15 with reference type 0x06. |
| 0x0A | Gateway Path Unavailable | A gateway could not allocate an internal path from its input port to the requested output path. |
| 0x0B | Gateway Target Device Failed to Respond | A gateway did not obtain a response from the target device. |
Source: MODBUS Application Protocol Specification, V1.1b3
Illegal Data Address. The device does not hold the address asked for, or the address plus the number of registers runs past what it holds. Check the address convention and the length of the read.
Illegal Function. The device does not support that function code, or not in its current state. Many meters support only a few functions, often 03, 04 and 16.
The device never understood the request: wrong unit ID, baud rate or parity, reversed A and B wires, missing termination, or a CRC error. Exceptions only come from a device that read the frame correctly. The RS-485 termination and bias checker covers the wiring side.
Gateway exceptions. 0A, Gateway Path Unavailable, means the gateway could not route the request; 0B, Gateway Target Device Failed to Respond, means the device behind it did not answer. Both point past the gateway, to the serial side.
A ZMB reads and writes Modbus RTU devices locally and sends the data to the Gateway over the wireless mesh, so a meter can be integrated without a data cable back to the panel.
