Modbus exception codes 01 to 0B: what they mean and how to fix them
· By Vladimir Chemeris, developer of Modbus TCP FieldKit
Short answer: a Modbus exception is a valid reply saying the device understood the frame and refused it. The function code comes back with 0x80 added, followed by one code byte. 83 02 means function 03 failed with exception 02, Illegal Data Address. An exception proves the connection works, so you can stop checking the network.
How to read one
An exception response takes 9 bytes on Modbus TCP. A pymodbus 3.16.1 server sent this one when we asked for an address it doesn’t have:
TX 00 03 00 00 00 06 01 03 00 64 00 01
RX 00 03 00 00 00 03 01 83 02The length field says 3: the Unit ID, 83 and 02. Paste a frame into the frame decoder to get the fields named.
The codes
The table lists the codes in section 7 of the specification. The meaning is theirs; the fix column is ours.
| Code | Name | Common cause | Try this |
|---|---|---|---|
01 |
Illegal Function | The device doesn’t support this function code here, or isn’t configured yet | Check which function codes the manual lists. Input registers need 04, holding registers 03 |
02 |
Illegal Data Address | Address plus quantity runs outside the map | Check the numbering, then reduce the quantity. Read one register at a time to find the edge |
03 |
Illegal Data Value | A malformed request: bad quantity or byte count | Stay within 125 registers for a read and 123 for a write |
04 |
Server Device Failure | The device hit an internal error while acting on the request | Look at the device itself. Some servers also use this for a Unit ID they don’t serve |
05 |
Acknowledge | Accepted, and it will take a long time | Used with programming commands. Rare in normal polling |
06 |
Server Device Busy | Busy with a long program command | Retry later and slow the polling |
08 |
Memory Parity Error | File record read failed a consistency check | Only with function codes 20 and 21. Service the device |
0A |
Gateway Path Unavailable | The gateway couldn’t allocate a path to the output port | Check gateway configuration and load |
0B |
Gateway Target Device Failed to Respond | The gateway got no reply from the device behind it | Check the Unit ID, serial settings and wiring |
Code 07, Negative Acknowledge, appears in older references and some libraries, but not in the V1.1b3 table.
Exception 03 does not mean “bad value”
The specification is explicit: 03 “specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program”. It flags a structural problem in the request. Write 9999 to a register that accepts 0 to 100, and a device can legally accept it, reject it with its own vendor logic, or clamp it. Read the register back after a write.
What a real server did
We sent bad requests on purpose to pymodbus 3.16.1 with raw sockets. Some answers differ from the specification, so check your own stack too:
| Request | Spec says | pymodbus 3.16.1 answered |
|---|---|---|
| Read address 100 on a 100-register map | 83 02 |
83 02 |
| Read 126 registers | 83 03 |
80 01 |
Undefined function code 63 |
E3 01 |
80 01 |
Write Single Coil with value 0001 |
85 03 |
05 00 00 FF 00, treated as ON |
| Unit ID the server doesn’t have | No rule for direct TCP | 83 04 |
A client that only tests for fc + 0x80 would miss the 80 01 answers. A test suite built on one simulator can pass and still fail on a real device.
Gateways change the picture
Behind a TCP to RS-485 gateway, two different failures look alike from your laptop: a dead serial device and a wrong Unit ID. A gateway that follows the specification answers 0B for both. Many instead stay silent, so your client reports a timeout. See Modbus TCP timeouts.
Sources
- Modbus Application Protocol Specification V1.1b3, section 7
- Frames captured on 30 October 2026 from pymodbus 3.16.1 on Linux
FAQ
What does exception 02 mean?
Illegal Data Address. The address, or the address plus the quantity, is outside what the device serves. The usual cause is a numbering mistake such as sending 40001 instead of 0, or reading past the end of a block.
How do I recognise an exception response?
The function code comes back with its top bit set, so 03 becomes 83, and the next byte holds the exception code. A TCP frame ending in 83 02 is exception 02 for a function 03 request.
What is the difference between exceptions 0A and 0B?
Both come from a gateway. 0A means the gateway could not allocate a path, which points to its configuration or load. 0B means the gateway got no answer from the target device, which points to a wrong Unit ID or a dead serial line.