Type a function code, an exception code or a whole response and see what it means and what usually causes it. The full list of codes follows below.
Decimal or hex: 3, 16, 0x10, 0B. An exception response such as 83 02, or a whole frame such as 01 83 02 C0 F1.
Runs entirely in your browser. Nothing you enter is sent to a server.
Function codes are written in decimal (FC 16) as well as in hex (0x10); both mean the same. Codes 65–72 and 100–110 are left to vendors for their own functions.
Reads 1 to 2000 output bits (coils). The request carries the start address and quantity; the response carries a byte count and the bits packed 8 per byte, with the first address in the lowest bit.
Coils are relay outputs or switchable flags. Many meters and inverters have no coils at all and keep status bits in holding registers instead. If 01 returns exception 01, look for the register that carries the bit.
Reads 1 to 2000 read-only input bits (discrete inputs), packed 8 per byte like coils.
Typical for the digital inputs of I/O modules and PLCs. Meters and inverters rarely use it; they report states in registers.
Reads 1 to 125 consecutive 16-bit holding registers. The request carries the start address and quantity; the response carries a byte count and two bytes per register, high byte first.
By far the most used function. Most meters, inverters and drives publish everything as holding registers, even read-only measurements. Exception 02 usually means an address off by one or a read across a gap in the register map.
Reads 1 to 125 read-only 16-bit input registers. The frames look exactly like those of function 03.
Some devices keep measurements in input registers and settings in holding registers. If 03 returns exception 02 or only zeros, try 04 at the same address, and the other way round.
Switches one coil. The value is FF 00 for ON and 00 00 for OFF; anything else is invalid. The response is an exact copy of the request.
Sending 00 01 for ON is a common mistake and ends with exception 03. Some devices use a coil for one-shot actions such as resetting energy counters.
Writes one 16-bit value to a holding register. The response is an exact copy of the request.
Not suitable for 32-bit values, because the two halves would be written at different times. Some devices accept 06 only for certain registers and require 16 for the rest.
Reads eight status bits whose meaning each device defines itself.
Rarely used today; check the manual to see whether the device supports it at all.
Diagnostics selected by a subfunction. Subfunction 0000 sends the data straight back (loopback); others read or clear the bus counters.
Subfunction 0000 is a quick way to test the line without touching any register, if the device supports it.
Returns a status word and a counter of successfully processed messages.
Reading the counter twice shows whether the device receives and processes your requests at all.
Returns a status word, event and message counters and the last 64 communication events.
Supported by few devices; mainly useful when chasing intermittent errors.
Writes 1 to 1968 consecutive coils. The values are packed 8 per byte like in function 01; the response repeats the start address and quantity.
The byte count must match the quantity: 10 coils need 2 bytes. A mismatch ends with exception 03.
Writes 1 to 123 consecutive holding registers. The request carries the start address, quantity, byte count and values; the response repeats the start address and quantity.
The right way to write 32-bit values such as floats, because both halves change at once. Some devices refuse 16 for a single register and want 06, others refuse 06.
Returns a vendor-specific identification block and a run/stop indicator.
The content differs from vendor to vendor; function 43/14 is the structured replacement.
Reads file records: numbered groups of registers addressed by file and record number.
Used for logs or configuration areas in some devices; rare in practice.
Writes file records: numbered groups of registers addressed by file and record number.
Rare in practice; the device manual describes the file layout.
Changes single bits of one holding register: result = (current AND and-mask) OR (or-mask AND NOT and-mask).
Sets one bit of a control word without reading it first. Many devices do not support it; then read with 03, change the bit and write back with 06.
Writes and reads registers in one transaction; the write is done first. Up to 121 registers are written and up to 125 read.
Supported mainly by PLCs. If a device answers exception 01, use 16 and 03 one after the other.
Reads up to 31 registers from a first-in-first-out queue, preceded by their count.
Rarely supported.
A container for sub-protocols selected by the MEI type. MEI type 0E, Read Device Identification, returns text objects such as vendor name, product code and firmware version.
Handy for finding out what sits on the bus without a manual. Support is optional, and many simple devices answer exception 01.
In an exception response the device returns the function code plus 0x80 (03 becomes 83), followed by one of these codes. 09 is not defined.
The device does not support this function. Typical case: reading input registers (04) from a device that only has holding registers (03), or the other way round.
The address or part of the range does not exist in the device. Usually the address is off by one (register 40001 is address 0), or the read covers a gap in the register map. Read fewer registers or start exactly where the manual says.
A value in the request is not allowed. Most often the quantity: more than 125 registers, or a count that cuts a 32-bit value in half. For writes, the value may be out of the allowed range.
The device failed while processing the request. Some devices also answer 04 for registers that are temporarily unavailable.
The device accepted a long-running command and is still working on it. Ask again later.
The device is busy with a long-running command. Repeat the request later.
An old code for programming commands. Current devices do not use it.
A parity error in file memory. Appears only with functions 20 and 21.
The gateway does not know where to send the request. Usually a unit ID that the gateway has no route for, or a gateway port that is not set up.
The gateway forwarded the request, but the device behind it did not answer in time. Check the unit ID, baud rate, parity, wiring and bus termination on the serial side.
The second byte of a Modbus RTU frame, and the first byte of every PDU, is the function code. It tells the device what to do: read coils, read registers, write a value. If the device can carry out the request, its response starts with the same function code. If it cannot, it sets the highest bit of the code (03 becomes 83) and adds one byte, the exception code, which says why.
An exception is good news in one respect: the device received the frame, the CRC was correct and the address matched. A device that does not answer at all has a different problem: wrong address, baud rate or parity, wiring or termination. Gateways are the exception to this rule and report a silent device behind them with code 0B.
The frame decoder shows the function and exception code of a whole captured frame, together with the address and data.
Illegal Data Address: at least one of the requested registers does not exist in the device. In practice the address is usually off by one (40001 is address 0), the function reads the wrong table (03 instead of 04), or the read covers a gap in the register map. Try reading a single register at the exact address from the manual first.
83 is 03 plus 0x80, the mark of an exception response: the device understood the request to read holding registers but refused it. The byte after 83 is the exception code with the reason, for example 02 for an address that does not exist.
Function 03 reads holding registers (4xxxx), function 04 reads input registers (3xxxx). Input registers are read-only, holding registers can usually also be written. Which one a value is in depends only on the device; the register map says which function to use.
Yes. FC 16 is written in decimal, 0x10 in hex, and both mean Write Multiple Registers. Be careful with 0x16: that is decimal 22, Mask Write Register, a different function.
None. A device answers with an exception only when it received a valid frame addressed to it. No answer means the frame did not arrive or was not valid: check the device address, baud rate, parity, stop bits, A/B wiring and the bus termination. Behind a Modbus TCP gateway, the gateway reports this situation as exception 0B.