Modbus Exception Codes 01–0B Explained: Causes and Fixes
A Modbus exception is the device telling you “I understood your request, but I won’t or can’t do it.” The reply carries your function code with the high bit set (FC03 becomes 0x83, FC06 becomes 0x86) followed by a one-byte exception code. That is different from a timeout, where the device never answered at all.
This page lists every standard exception code, what usually triggers it on inverters, energy meters and gateways, and what to change first.
Quick reference
| Code | Name | What it usually means in the field |
|---|---|---|
| 01 | Illegal Function | The device does not support this function code (for example FC04 on a device that only exposes holding registers). |
| 02 | Illegal Data Address | The start address, or start + count, falls outside the device’s register map. The most common exception by far. |
| 03 | Illegal Data Value | The request is structurally wrong: count too large, or a written value the device rejects. |
| 04 | Server Device Failure | The device hit an internal error while executing the request. |
| 05 | Acknowledge | Long-running command accepted; poll again later. Rare outside programming operations. |
| 06 | Server Device Busy | The device is processing something else; retry after a delay. |
| 08 | Memory Parity Error | File record access failed a consistency check. Rare. |
| 0A | Gateway Path Unavailable | A Modbus TCP gateway cannot route to the serial port or device you addressed. |
| 0B | Gateway Target Device Failed to Respond | The gateway forwarded your request, but the device behind it stayed silent. |
Exception 02: Illegal Data Address
If you only fix one exception, it will be this one. Three causes cover most cases:
- Off-by-one addressing. Datasheets often write holding registers as
40001,40108and so on. On the wire,40001is address0. Some tools add the offset for you, some don’t. If the datasheet says40108, try107and108. - Reading across a gap. Many devices only answer for addresses that actually exist. Reading 20 registers starting at a valid address fails if register 15 in that block is undefined. Read smaller blocks.
- Wrong table. Input registers (FC04) and holding registers (FC03) are separate address spaces. A value documented as an input register returns 02 when read with FC03.
Exception 01: Illegal Function
The device doesn’t implement the function code. Typical examples:
- Reading with FC04 (input registers) from a device that exposes everything as holding registers (FC03)
- Writing a single register with FC06 to a device that only accepts FC16 (write multiple), which is common on some inverters
- Coil functions (FC01, FC05) on a meter that has no coils
Check the function codes listed in the device manual rather than assuming the full FC01–FC16 set.
Exception 03: Illegal Data Value
- Quantity too large. The Modbus specification caps a single read at 125 registers (FC03/FC04) and 2,000 coils or discrete inputs (FC01/FC02). Many devices set a lower limit, often 64 or even 32 registers.
- Rejected write. The value is out of range, or the register is read-only in the current operating mode. Inverters often reject power-limit writes unless remote control is enabled in their settings first.
Exception 04 and 06: device failure or busy
Both come from the device itself. Exception 06 is harmless if a retry after a second works. Repeated 04 responses usually mean a firmware problem, or a request the device cannot serve in its current state (for example, an inverter at night with its control board powered down). Log the time and the request, then compare with the device’s own event log.
Exceptions 0A and 0B: gateway problems
These appear when you talk Modbus TCP to a gateway (a datalogger, serial server or smart meter hub) that forwards requests to RS-485 devices.
- 0A (path unavailable): the gateway has no route for the unit ID you used. Check the gateway’s unit ID to serial port mapping.
- 0B (target failed to respond): the route exists, but the RS-485 device didn’t answer in time. Check wiring (A/B polarity), baud rate, parity, termination, and whether two devices share the same slave ID on the bus.
A useful test: connect to the RS-485 device directly over RTU with the same parameters. If it answers directly but not through the gateway, the problem is the gateway configuration, not the device.
Timeout is not an exception
No reply at all points to a different layer:
| Symptom | Check first |
|---|---|
| TCP connect fails | IP, port 502, firewall, device’s allowed-client list |
| TCP connects, no reply | Unit ID (try 1 and 255), one-client-at-a-time limits |
| RTU, no reply | Baud/parity/stop bits, A/B swap, slave ID, termination resistor |
A 5-minute field checklist
- Read one known register (often a serial number or model ID) with the documented function code.
- If you get 02, try address −1 and +1.
- Reduce the count to 1, then grow it until the device refuses.
- Only then move to writes, and confirm the device is in remote-control mode.
- Record raw hex and the decoded value side by side, so byte-order problems are not mistaken for wrong addresses.
Test it without writing code
Ranaliz iOT Tester is a free desktop Modbus tester for Windows and macOS. It covers Modbus TCP, UDP and RTU with FC01–FC16, and keeps a transaction history in which exception responses are visible. You can switch between int, uint, float, hex and ASCII views with different byte orders. That makes it quick to tell an addressing problem (exception 02) from a byte-order problem (a valid response with the wrong number).
If the device is a solar inverter, most modern models follow the SunSpec register layout. See SunSpec Modbus: how to read solar inverter data.
FAQ
What does Modbus exception 0x83 mean?
It is an exception reply to function code 03 (read holding registers): 0x03 + 0x80 = 0x83. The byte that follows is the actual exception code, most often 02 (illegal data address).
Is a Modbus exception a communication error?
No. The request reached the device and it answered. Communication problems show up as timeouts or CRC errors, not exception codes.
Why does the same address work in one tool and fail in another?
Most likely because one tool applies the 40001-style offset and the other doesn’t. Compare the raw request each tool sends.
Sources
- Modbus Organization — MODBUS Application Protocol Specification V1.1b3 (exception codes, quantity limits)
- Modbus Organization — MODBUS Messaging on TCP/IP Implementation Guide V1.0b (gateway exceptions 0A/0B)
