09 — ERRORS & EXCEPTION CODES

When things go wrong, what the slave sends back.

Estimated 7 minutes.

Failures are explicit, not silent.

When a Modbus slave refuses a request, it does not just go quiet. It returns an exception response — same MBAP, but a flagged function code and a one-byte exception code telling you what went wrong.

Function code with the high bit set.

FC3 → 0x83 in the exception response. Then one byte of exception code.

Four codes cover almost everything.

The spec defines ten exception codes, but in practice four account for 95% of failures: illegal function (0x01), illegal data address (0x02), illegal data value (0x03), and slave device failure (0x04).

The four codes you actually meet.

If you know these four, you can diagnose almost any Modbus fault.

Provoke the slave.

The slave is fully visible — its supported FCs, its mapped ranges, its watchdog. Build a request and fire it. Try to coax each exception code (0x01–0x04) out of the slave on purpose. The slave never crashes; it just tells you which constraint you broke.

Illegal function (0x01).

You asked for a function code the slave does not implement. Many cheap slaves only support FC3 (read holding) and FC16 (write multiple holding) — ask for FC1 and you get 0x01 back.

Illegal data address (0x02).

The address you asked for is outside the slave's map, or your range would overrun the end of the map. Slaves test the WHOLE range — partial reads do not happen, the entire request is rejected.

Read 10 starting at 995.

A slave has holding registers 0–999. You request FC3, address 995, quantity 10. What happens?

• You get the 5 registers that exist and the rest as 0
• Exception 0x02 — the range overruns the map
• Exception 0x03 — quantity is invalid

Slave device failure (0x04).

Something is wrong inside the slave itself — a watchdog tripped, a sensor is unreachable, the application logic is paused. Not a network problem and not your request's fault. Retry, alert, then escalate.

No response at all.

You get no response — not even an exception. What is the most likely cause?

• A Modbus protocol error in your request
• The slave is busy and ignored you
• A network / connectivity problem

You can read every kind of Modbus failure.

• Exception responses use function | 0x80 + 1 exception code byte.
• 0x01 illegal function · 0x02 illegal data address · 0x03 illegal data value · 0x04 slave failure.
• Whole-range rejection: partial reads do not happen.
• No response at all = network problem, not Modbus.

Lesson 09 complete.

• You can recognize an exception response on the wire.
• You can map each top-4 code to a real-world cause.
• You can split "no answer" diagnostics into network vs Modbus.