Exception Code 02 means the slave understood your request but the register address you asked for doesn't exist on that device. This is the second most common Modbus error after timeouts, and it's almost always caused by an addressing offset mistake.
What It Actually Means
The slave received a valid Modbus frame with a valid function code, but the combination of starting register address + quantity of registers references an address range that the device hasn't implemented. Either the starting address is wrong, or the quantity extends past the end of the device's register map.
The 0-Based vs 1-Based Trap
This catches experienced engineers, not just beginners. The Modbus protocol on the wire is always 0-based. But many manufacturer documents and Modbus tools display addresses as 1-based. So when the datasheet says "Register 1", the actual address in the Modbus frame is 0.
If a register map says the first holding register is at address 1, and you put address 1 in your Modbus request, you're actually asking for the second register (because the wire protocol is 0-indexed). Send address 0 instead. This single issue accounts for a huge number of Exception 02 errors.
The 40001 Prefix Problem
The old Modicon convention prefixes register addresses with a digit indicating the register type: 0xxxx for coils, 1xxxx for discrete inputs, 3xxxx for input registers, and 4xxxx for holding registers. So "40001" means "holding register 1" — not "register forty thousand and one".
When you see a register map that says "40001", you need to strip the leading 4 and subtract 1 (because of the 0-based issue above). The actual address to send in your FC03 request is 0, not 40001 or even 4001.
Register Range Overflow
Even if your starting address is correct, requesting too many registers can overflow the device's map. If a device has registers 0-99 and you request starting at 95 with a quantity of 10, that would need registers 95-104 — but 100-104 don't exist. The device returns exception 02.
How to Fix It
- Try subtracting 1 from your register address
- If using "4xxxx" style addresses, strip the prefix and subtract 1
- Reduce your quantity to 1 and read a single register to isolate the problem
- Try both FC03 and FC04 — you might be using the wrong register space
- Check the device's actual register range — some devices have sparse maps with gaps
ModBus Pro handles addressing automatically
Built-in device profiles use verified, tested addresses — no mental arithmetic required. 80+ built-in register maps mean the correct addresses are already configured for common devices.
Download Free