Modbus function codes and exceptions
Main function codes (01–06, 15, 16, 23), quantity limits per request, PDU structure and exception responses.
PDU structure
Every Modbus application message consists of a function code (1 byte) and data. All 16-bit fields (address, quantity, register value) are sent high byte first (big-endian): 0x1234 is sent as 12 34. The exception is the Modbus RTU CRC, which is sent low byte first.
Main functions
| Code | Hex | Function | Quantity per request |
|---|---|---|---|
| 01 | 0x01 | Read Coils | 1…2000 |
| 02 | 0x02 | Read Discrete Inputs | 1…2000 |
| 03 | 0x03 | Read Holding Registers | 1…125 |
| 04 | 0x04 | Read Input Registers | 1…125 |
| 05 | 0x05 | Write Single Coil | 1 |
| 06 | 0x06 | Write Single Register | 1 |
| 15 | 0x0F | Write Multiple Coils | 1…1968 |
| 16 | 0x10 | Write Multiple Registers | 1…123 |
| 23 | 0x17 | Read/Write Multiple Registers | read 1…125, write 1…121 |
The limits follow from the maximum PDU size (253 bytes). Some devices support less, e.g. at most 32 or 64 registers per request. If a device answers a large request with exception 03, split it.
Function 05: coil value
A coil is not written as 0/1 but as FF 00 (ON) or 00 00 (OFF). Any other value is invalid.
Functions 06 and 16
Function 06 writes one register, 16 writes a block. Use 16 for 32-bit values (FLOAT32, INT32) so both registers are written in one command: with two separate 06 writes the device may briefly see a half-updated value.
Exception responses
If the server receives a valid request but cannot execute it, it returns an exception: the function code with the top bit set (0x80) followed by an exception code.
Request: 01 03 00 64 00 02 ... read two registers at address 100
Response: 01 83 02 C0 F1 0x83 = 0x03 + 0x80, exception 02
| Code | Name | Typical cause |
|---|---|---|
| 01 | ILLEGAL FUNCTION | function not supported (e.g. 04 instead of 03) |
| 02 | ILLEGAL DATA ADDRESS | address outside the register map, off-by-one, request spans a gap in the map |
| 03 | ILLEGAL DATA VALUE | invalid quantity or value |
| 04 | SERVER DEVICE FAILURE | internal device error |
| 05 | ACKNOWLEDGE | accepted, processing takes time |
| 06 | SERVER DEVICE BUSY | busy, retry later |
| 08 | MEMORY PARITY ERROR | memory error (file record functions) |
| 0A | GATEWAY PATH UNAVAILABLE | gateway has no route |
| 0B | GATEWAY TARGET DEVICE FAILED TO RESPOND | device behind the gateway did not answer |
Distinguish an exception from no response. Per the specification, a server that detects a communication error (parity, CRC) does not respond at all — the client sees a timeout. An exception means communication works and the request itself is the problem.
How to check a request
Paste the frame into the Modbus RTU Frame Parser: it shows the function, address, quantity and data, checks the CRC and decodes exception codes.
Connections
Open in Knowledge Graph →Loading the map…
Sources
- MODBUS Application Protocol Specification V1.1b3, sections 6 and 7 — Modbus Organization
Updated 2026-10-01