Modbus Exception Codes — A Practical Engineer's Guide

Quick Navigation

0x01 — Illegal Function 0x02 — Illegal Data Address 0x03 — Illegal Data Value 0x04 — Slave Device Failure 0x05 — Acknowledge 0x06 — Slave Device Busy 0x07 — Negative Acknowledge 0x08 — Memory Parity Error 0x0A — Gateway Path Unavailable 0x0B — Gateway Target Failed Common Root Causes Cheat Sheet

This guide focuses on what matters in the field: why each code occurs, what it means electrically or logically, and the most effective ways to resolve it.

Standard Exception Codes (0x01–0x0B)

0x01 — Illegal Function

The device received a valid Modbus frame, but the function code is unsupported or disabled.

Typical Causes: Using a write function on a read-only register set • Device firmware does not implement the requested function • Function is restricted in certain operating modes

Fix: Verify the device supports that function. Confirm you're addressing the correct register type (Input, Holding, Coil, Discrete Input).

0x02 — Illegal Data Address

You asked for a register that does not exist or falls outside the valid block boundary.

Typical Causes: Requesting an address beyond the available map • Off-by-one mismatch between software and documentation • Requesting a length that extends past the end of a block • Vendor-specific segmentation

Fix: Validate the address against the device's actual register map. Adjust for zero-based vs. one-based documentation. Reduce the quantity field if the range spills over.

0x03 — Illegal Data Value

The value is formatted correctly but violates a constraint inside the device.

Typical Causes: Writing outside the allowable range • Incorrectly formatted multi-word values (float, DINT) • Endianness/byte-swapping mismatches • Parameter locked by mode or state

Fix: Confirm valid ranges and data types. Check byte/word order settings ("ABCD," "CDAB," etc.). Ensure the device is in the correct mode.

0x04 — Slave Device Failure

The device hit an internal fault while attempting to execute the request.

Typical Causes: Corrupted internal memory • Hardware failure • Firmware hang or watchdog event

Fix: Power-cycle and re-test. Inspect onboard diagnostics or error logs. Replace hardware if the fault repeats.

0x05 — Acknowledge

The device accepted the request but needs extended time to complete it.

Fix: Increase response timeout in the master. Avoid polling the same device aggressively during long operations (EEPROM writes, calibration routines, etc.).

0x06 — Slave Device Busy

The device is processing a command and cannot accept a new one.

Typical Causes: Excessive poll rate • Slow EEPROM operations • Gateways juggling multiple serial slaves

Fix: Extend the polling interval. Implement retry logic with a meaningful delay (≥100 ms).

0x07 — Negative Acknowledge

The device refuses the command due to its current operating state.

Typical Causes: Device in programming/maintenance mode • Safety interlock or permissive blocking remote changes • Parameter write attempts during lockout

Fix: Check mode/state conditions. Unlock or exit programming states as required.

0x08 — Memory Parity Error

Internal memory parity or CRC failed during a read.

Typical Causes: Electrical noise corrupting memory regions • Actual failing memory devices

Fix: Inspect grounding, shielding, routing near VFDs or HF noise sources. Expect hardware replacement if errors persist.

0x0A — Gateway Path Unavailable (Modbus TCP)

The gateway cannot reach the target slave.

Typical Causes: Incorrect routing/mapping configuration • Downstream device unpowered or disconnected

Fix: Validate the gateway's register map and slave routing table. Confirm downstream devices have power and clean wiring.

0x0B — Gateway Target Device Failed to Respond (Modbus TCP)

The gateway reached the slave but received no response.

Typical Causes: Faulty RS-485 wiring or termination • Serial format mismatch (baud, parity, stop bits) • Slave is overloaded or non-responsive

Fix: Check physical wiring, A/B polarity, biasing, and termination. Confirm identical serial settings across gateway and slave.

Common Root Causes in Real Installations

1. Addressing Off-By-One Errors (Usually behind 0x02)

Documentation often shows 1-based addressing; Modbus frames use 0-based. If the device's manual says a register lives at 40001, the protocol expects 0 or 1 depending on the vendor's convention.

Always test adjacent offsets when mappings don't align.

2. Timing Mismatches (Behind 0x06 and 0x05)

Many devices—older drives, serial gateways, embedded sensors—cannot handle aggressive polling.

Rule of Thumb: Take the device's processing time and add real margin. 10 ms cycles on gear engineered in the 1990s will absolutely trigger busy codes.

3. Incorrect Byte/Word Ordering (Often causes 0x03)

Multi-word values (floats, 32-bit integers) must match the device's expected order. A value like 100.0 may be interpreted as an out-of-range integer if the byte order is wrong.

Validate settings: Word swap, Byte swap, Full byte-word permutations (ABCD, CDAB, BADC, etc.)

Final Notes

These exception codes exist for one reason: the device is communicating well enough to complain. That alone tells you the wiring and physical layer are mostly intact. Use the code as a pointer, not a guess, and you can isolate Modbus issues with far less trial-and-error.

Exception Code Cheat Sheet

Code	Name	What it Means	How to Fix It
0x01	Illegal Function	The Master sent a command (Function Code) that the Slave does not support. (e.g., Trying to Write (FC06) to a Read-Only Input Register).	1. Check the Manual: Verify the device supports the Function Code you are using. 2. Check Register Type: You cannot "Write" to Input Registers (3xxxx) or Discrete Inputs (1xxxx).
0x02	Illegal Data Address	You requested a register address that does not exist in the Slave device.	1. Check the Range: If the device has 100 registers and you ask for Register 101, you get this error. 2. The "Offset" Issue: Try subtracting or adding 1 to your address. 3. Length: If you read Address 99 with a length of 5, you are trying to read past the end. Reduce the length.
0x03	Illegal Data Value	The data sent is technically valid, but not allowed for this specific register.	1. Check Data Range: Are you writing 100Hz to a VFD with a max limit of 60Hz? 2. Check Data Type: Ensure you aren't writing a 32-bit Float into a 16-bit Integer slot without proper formatting.
0x04	Slave Device Failure	The Slave received the request but an unrecoverable error occurred while trying to execute it.	1. Hard Reset: Power cycle the Slave device. 2. Check Internal Faults: Look at the device's physical screen or error logs; the sensor or memory might be damaged.
0x05	Acknowledge	"I received your command, but it will take a long time to process. Don't wait for me."	Adjust Timeout: Increase the response timeout setting in your Master/Scanner software to prevent a timeout error while the device works.
0x06	Slave Device Busy	The Slave is currently processing a long-duration command and cannot accept a new one yet.	1. Slow Down: Your polling rate is faster than the device's processing speed. Reduce the scan rate. 2. Retry Logic: Configure your Master to wait 100ms and retry automatically.
0x07	Negative Acknowledge	The Slave cannot perform the program function received.	Check State: The device might be in a "Program Mode" or "Maintenance Mode" that locks out remote communication.
0x08	Memory Parity Error	The Slave detected a parity error in its internal memory while reading the extended file area.	1. Interference: Check for high-voltage noise (VFDs) near the comms wiring. 2. Hardware: This often indicates corrupted memory in the Slave. The device may need replacement.
0x0A	Gateway Path Unavailable	(Modbus TCP) The Gateway is misconfigured or cannot find the target Slave on its sub-network.	1. Check Gateway Config: Ensure the Gateway has the correct mapping for the Slave ID. 2. Check Slave Power: The Gateway is alive, but the Slave behind it is likely powered down or disconnected.
0x0B	Gateway Target Device Failed to Respond	(Modbus TCP) The Gateway found the Slave, but the Slave isn't replying.	1. Check Wiring: The connection between the Gateway and the final device is broken. 2. Check Baud/Parity: The Gateway and the Slave likely have mismatched Serial settings (e.g., 9600 vs 19200).

Debug Faster with Modbus Connect

Modbus Connect shows you exception codes in real-time with detailed protocol logging. See exactly what your devices are telling you.

Download Free Beta →