Modbus Function and Exception Codes

Read Coils

Reads discrete outputs (coils), one bit each. Traditional reference range 00001 to 09999. Used for on and off states the master may also write.

Read Discrete Inputs

Reads read only discrete inputs, one bit each. Traditional reference range 10001 to 19999. Typical for status contacts: breaker position, door switches, alarm contacts.

Read Holding Registers

Reads 16 bit holding registers, traditional reference range 40001 and up. The workhorse function code: most inverter, meter, and tracker data lives in holding registers even when it is read only. If a device returns wrong or zero values with function code 03, try 04; vendors disagree about which table their data lives in.

Read Input Registers

Reads 16 bit read only input registers, traditional reference range 30001 to 39999. Measurement style data. The holding versus input register mixup (function code 03 versus 04) is one of the most common causes of a device that connects but returns nothing useful.

Write Single Coil

Writes one discrete output on or off (0xFF00 on, 0x0000 off). On plant equipment a coil write can start, stop, or reset a device.

Writes to plant equipment are control actions: coordinate with the control room and follow site change control.

Write Single Register

Writes one 16 bit holding register. Setpoints, mode selections, and scale factors travel this way. Some devices only accept function code 16 even for single registers; a device that rejects 06 with an illegal function exception may still accept the same write as a one register 16.

Writes to plant equipment are control actions: coordinate with the control room and follow site change control.

Write Multiple Coils

Writes a contiguous block of discrete outputs in one transaction.

Writes to plant equipment are control actions: coordinate with the control room and follow site change control.

Write Multiple Registers

Writes a contiguous block of 16 bit holding registers in one transaction. Required for 32 bit values that must land atomically (both halves in one write), and the only write some devices accept.

Writes to plant equipment are control actions: coordinate with the control room and follow site change control.

Exception codes

When a slave rejects a request it echoes the function code with the high bit set plus an exception code. 01 Illegal Function: the device does not support that function code; try the other read family. 02 Illegal Data Address: the register does not exist at that address; check zero versus one based addressing and the map version. 03 Illegal Data Value: quantity or payload out of range for that register. 04 Slave Device Failure: the device faulted internally while answering. 05 Acknowledge: request accepted, long processing underway. 06 Slave Device Busy: retry later. 0A Gateway Path Unavailable and 0B Gateway Target Failed to Respond: the gateway could not reach the serial device behind it, so troubleshoot the serial side, not the Ethernet side.

Addressing conventions

Two layers cause endless confusion. First, the table prefix convention: references like 40001 encode the table (4 means holding registers) plus a one based index, while the actual address on the wire is zero based, so 40001 transmits as address 0. Second, vendor documents may list either the reference (40001) or the raw address (0), and some list raw addresses in hex. When a read returns data shifted by exactly one register, the off by one between conventions is almost always the cause.