Modbus Exception Codes — The Complete Reference

How Exception Responses Work

When a Modbus slave can't process a request, it doesn't just stay silent — it sends back an exception response. You can identify this because the function code in the response has bit 7 set (0x80 added). So if you sent function code 0x03 (Read Holding Registers), the exception response has function code 0x83.

The next byte is the exception code, which tells you the specific problem.

Normal Response:   [Slave Addr] [0x03] [Byte Count] [Data...]  [CRC]
Exception Response: [Slave Addr] [0x83] [Exception Code]         [CRC]

Exception Code Reference Table

Exception 01: Illegal Function

The device doesn't support the function code you sent. Common causes:

• Using FC03 (Read Holding Registers) when the device only supports FC04 (Read Input Registers) for measurements
• Trying to write (FC06/FC16) to a read-only device
• Using FC01 (Read Coils) on a device that doesn't implement coils
• The device has a stripped-down Modbus implementation that only supports a few function codes

Fix: Check the device's Modbus documentation for supported function codes. Try switching between FC03 and FC04.

Exception 02: Illegal Data Address

This is the most common exception code in practice. The register address you requested doesn't exist on this device, or the address + quantity extends beyond the valid range.

• Off-by-one error: The documentation says "register 40001" but the actual Modbus address is 0. See Register Address Offset guide.
• Wrong register map: You're using the map for a different firmware version or device variant
• Quantity too large: Requesting 100 registers starting at address 9950, but the device only has registers up to 9999
• Unimplemented registers: Some devices have gaps in their register map — not every address in the range is valid

Fix: Verify the exact register address against the device documentation. Try reading a smaller quantity. Confirm you're using the register map for the correct device model and firmware version.

Exception 03: Illegal Data Value

The register address is valid, but the value you're trying to write is not acceptable. This only occurs on write operations (FC05, FC06, FC15, FC16).

• Writing a value outside the permitted range (e.g., setting a parameter to 500 when the device accepts 0-100)
• For FC05 (Write Single Coil): only 0x0000 (OFF) and 0xFF00 (ON) are valid
• Writing to a register while the device is in a state that doesn't allow it (e.g., changing configuration while running)

Exception 04: Slave Device Failure

Something went wrong internally on the slave while it tried to process your request. This is the device saying "I understood what you asked, but I crashed trying to do it." Rare in practice — usually indicates a firmware bug or hardware fault on the slave device.

Exceptions 05 & 06: Acknowledge / Busy

These are "please wait" responses. Exception 05 means the slave accepted your request but will take a long time (e.g., firmware update, configuration save). Exception 06 means it's currently busy with another long-running operation. Retry after a short delay.

Exceptions 0A & 0B: Gateway Errors

If you're communicating through a Modbus gateway (TCP-to-RTU bridge, protocol converter), these codes indicate the gateway itself is working but can't reach the downstream device:

• 0A (Gateway Path Unavailable): The gateway can't establish a connection to the target network. Check the gateway's serial port configuration.
• 0B (Gateway Target No Response): The gateway forwarded your request over serial, but the target device didn't respond. The downstream device is likely offline, has a wrong address, or the serial settings are misconfigured.