What do Modbus exception codes mean?
Updated 18 September 2026
An exception reply is the device saying no — and that is good news, because it proves the device received your request, understood it, and is alive. The code tells you why it declined. The two you will meet most are 02, illegal data address (that register does not exist — almost always an off-by-one address, not a broken device) and 0B, gateway target device failed to respond (the gateway is fine, but nothing answered at that unit ID). The rest are rarer and each points at one specific thing.
An exception is proof of life
This is worth saying first because it changes how you read the situation. A timeout is silence — maybe nothing is there. An exception is a reply: a real Modbus device got your message, parsed it, and returned a coded refusal. The device is reachable. You are now debugging the request, not the connection.
The codes, in plain English
| Code | Name | What actually happened, and the fix |
|---|---|---|
| 01 (0x01) | Illegal function | This device does not support that function code. You used code 4 on a value that lives in the holding registers, or vice versa. Try 3 instead of 4. See function codes explained. |
| 02 (0x02) | Illegal data address | That register number does not exist on this device. Nine times out of ten the address is off by one, or you are using the Modicon 40001 form where the tool wants the zero-based 0. The device is fine. |
| 03 (0x03) | Illegal data value | The value or the quantity is out of range. Usually you asked for too many registers in one request, or wrote a value the device rejects. Ask for fewer; check the allowed range. |
| 04 (0x04) | Server / device failure | Something failed inside the device while handling the request. Often a sensor that register depends on is faulted. Retry; if it persists, it is the equipment, not you. |
| 05 (0x05) | Acknowledge | Accepted, but it needs more time (used with long operations). Wait and poll. Rare in building equipment. |
| 06 (0x06) | Device busy | The device is mid-task and cannot answer now. Wait and retry. |
| 0A (0x0A) | Gateway path unavailable | A gateway has no configured route to that unit ID. The gateway's routing table needs the unit, or you have the wrong gateway. |
| 0B (0x0B) | Gateway target device failed to respond | The gateway is healthy; nothing answered at that unit ID on its serial side. Wrong unit ID, a device powered off, or an RS-485 wiring fault. |
Exception 02 in detail, because it is the common one
“Illegal data address” almost never means the device is broken. It means you asked for a slot that is not there, and there are three usual reasons:
- Off-by-one. The map lists
40001and you sent1instead of0— or the reverse. This is the single most common addressing mistake in Modbus. See why is my Modbus address off by one? - Wrong table. The value is a holding register but you read it as an input register, so the address does not exist in the table you asked. Check the register type in the map.
- Reading past the end. A block read that starts valid but runs off the end of the device's map returns 02 for the whole block. Shorten it.
Because an 02 confirms the device is answering, it is actually the easiest error to chase: change one thing about the address and read again.
Exception 0B versus a timeout
These two get confused constantly. A plain timeout means no gateway even answered. An 0B means the gateway answered for a device that then stayed silent — so the gateway, the network and the port are all fine, and the problem is downstream on the serial chain: the unit ID, or the wiring to that one device. That is a much smaller haystack.
Easy Modbus shows the exception name in full rather than a bare hex code, and for an 02 it points you at the addressing guide, because that is what it almost always is.