Modbus Exception Codes 01/02/03/04 Explained (+ Fixes)
An exception response is actually good news: it proves your wiring, baud rate, slave ID, and CRC are all correct — the device heard you perfectly and is refusing on purpose. You can recognize one in the bus monitor: the response function code is the request code plus 0x80 (a request with FC 03 comes back as 0x83), followed by a single byte — the exception code.
| Code | Name | What it means | Typical cause | Fix |
|---|---|---|---|---|
| 01 | Illegal Function | The slave doesn’t implement that function code | Writing with FC 16 to a read-only device | Use only function codes listed in the device manual (QModMaster supports 01, 02, 03, 04, 05, 06, 15, 16) |
| 02 | Illegal Data Address | The register doesn’t exist at that address | Entering 40001 as the protocol address — the 0-based trap | Subtract the base: 40001 → address 0 (see the addressing guide) |
| 03 | Illegal Data Value | The value or quantity is out of range | Writing 70000 to a 16-bit register; requesting an illegal quantity | Check the register’s valid range and the device’s quantity limits |
| 04 | Server Device Failure | The slave failed while executing the request | Faulted input channel, unconfigured module, transient device error | Check device status indicators; retry; consult the manual |
| 05 | Acknowledge | Accepted, still processing | Long operations (calibration, EEPROM writes) | Wait, then poll again |
| 06 | Server Device Busy | The slave is busy right now | Polling too aggressively | Retry with a delay; lengthen the scan interval |
| 0B | Gateway Path Unavailable | A gateway can’t reach the target slave | Wrong slave ID behind the gateway; gateway misconfigured | Check the gateway’s routing/forwarding table |
Reading an exception in the bus monitor
Example: you send a read (FC 03) and the reply starts with 0x83 followed by 02 — that’s exception code 02, illegal data address. Match the code byte against the table above and you’ll usually have the fix in under a minute, instead of guessing at wiring that was never broken.
Frequently asked questions
I get exception 02 but the register definitely exists in the manual. Why?
Nine times out of ten it’s the 0-based vs 1-based trap: the manual prints register number 40001 while the protocol address on the wire is 0. Run through the addressing guide’s conversion before anything else.
Exception 04 — is my device broken?
Not necessarily. Code 04 means the device understood the request but failed while executing it — a faulted channel, an unconfigured module, or a transient internal error. Check the device’s status LEDs and diagnostics, then retry.
Why do I get exception 01 on a brand-new device?
The device simply doesn’t implement that function code. Check the manual’s Modbus map for its supported list — many simple sensors support reads (FC 01–04) but no writes at all.
What about exception codes on a Modbus TCP gateway?
Gateways add code 0B (gateway path unavailable) when they can’t reach the downstream serial slave. Verify the gateway’s serial settings and confirm the slave ID it forwards to actually exists on its RS485 side.
Related Guides
- Modbus Addressing: 0-Based vs 1-Based (The 40001 Trap) — the cause behind most exception 02s
- QModMaster ‘No Response’ Timeout: 9 Fixes — when the device answers with silence instead
- Modbus CRC Errors: Causes and Fixes — when frames arrive corrupted
- Download QModMaster — free, open-source (LGPLv3), Windows and Linux