Modbus Function Code Reference

Reference and search common Modbus RTU function codes, request formats, and exception responses in one page.

Function and exception code lookup

Type a function code, hex value, object type, or exception name. Search is case-insensitive and tolerant to spaces and punctuation.

Search function/exception code

Quick filters

- -

Modbus function code table

Code	HEX	Name	Object	Access	Typical request	Common use
01	0x01	Read Coils	Coils	Read	start address + quantity	Read digital outputs (coil status).
02	0x02	Read Discrete Inputs	Discrete inputs	Read	start address + quantity	Read digital inputs.
03	0x03	Read Holding Registers	Holding registers	Read	start address + quantity	Read writable holding registers.
04	0x04	Read Input Registers	Input registers	Read	start address + quantity	Read input registers (read-only values).
05	0x05	Write Single Coil	Coil	Write	address + value	Write one digital output.
06	0x06	Write Single Register	Holding register	Write	address + value	Write one holding register.
07	0x07	Read Exception Status	Status byte	Read	function only	Less common serial-line status read.
08	0x08	Diagnostics	Diagnostics	Read/Write	sub-function + data	Diagnostics and loopback operations.
11	0x0B	Get Comm Event Counter	Counter	Read	function only	Serial-line communication event counter.
12	0x0C	Get Comm Event Log	Event log	Read	function only	Serial-line communication event log.
15	0x0F	Write Multiple Coils	Coils	Write	start address + quantity + byte count + data	Write multiple digital outputs.
16	0x10	Write Multiple Registers	Holding registers	Write	start address + quantity + byte count + data	Write multiple holding registers.
17	0x11	Report Server ID	Server identification	Read	function only	Legacy serial-line identification response.
20	0x14	Read File Record	File record	Read	sub-request reference + length	Less common file record read.
21	0x15	Write File Record	File record	Write	sub-request reference + data	Less common file record write.
22	0x16	Mask Write Register	Holding register	Write	address + AND mask + OR mask	Bit-mask update for one register.
23	0x17	Read/Write Multiple Registers	Holding registers	Read/Write	read range + write range	Combined read/write in one transaction.
24	0x18	Read FIFO Queue	FIFO queue	Read	FIFO pointer address	Read FIFO queue content from server.
43	0x2B	Encapsulated Interface Transport	MEI / device identification	Read	MEI type + data	Device identification and MEI transport.

Modbus exception code table

Code	HEX	Name	Meaning	Common cause
01	0x01	Illegal Function	The server does not support this function code.	Using a function the device firmware does not implement.
02	0x02	Illegal Data Address	Address is out of valid range for this object.	Wrong register map base, offset, or object type.
03	0x03	Illegal Data Value	One or more request values are invalid.	Quantity/value out of allowed limits.
04	0x04	Server Device Failure	Server failed while processing the request.	Internal firmware fault or temporary failure.
05	0x05	Acknowledge	Accepted, but operation is taking more time.	Long-running programming command.
06	0x06	Server Device Busy	Server is busy and cannot process now.	Device is processing another task.
08	0x08	Memory Parity Error	Memory parity or consistency error occurred.	Memory integrity issue on the server device.
10	0x0A	Gateway Path Unavailable	Gateway path is not available.	Gateway routing or network segment issue.
11	0x0B	Gateway Target Device Failed to Respond	Gateway did not get response from target.	Target server offline or no response path.

What are Modbus function codes?

A Modbus function code is a one-byte operation identifier in the PDU. It tells the server which object to access and how to process request data.

Common Modbus RTU function codes

Functions 01, 02, 03, 04, 05, 06, 15, and 16 are the most common in field devices. They cover coil and register read/write transactions.

Modbus exception codes

When a request fails, Modbus returns an exception response with an exception code that indicates the reason, such as illegal function or illegal address.

Exception response: function code + 0x80

In RTU exception responses, the returned function byte is the original function code plus 0x80. For example, 0x03 request errors return 0x83.

Function 03 vs 04

Function 03 reads holding registers, usually writable values. Function 04 reads input registers, usually read-only measured values.

Function 06 vs 16

Function 06 writes a single holding register. Function 16 writes multiple contiguous holding registers in one request.

Modbus RTU request/exception examples

Function 03 example

Request frame

01 03 00 00 00 02 C4 0B

01 is server/slave address, 03 is Read Holding Registers, 0000 is start address, 0002 is quantity, and C4 0B are CRC low/high bytes.

Function 06 example

Request frame

01 06 00 01 00 64 D9 E1

Writes value 0x0064 into register 0x0001. D9 E1 are CRC low/high bytes for this request.

Exception response example

Response frame

01 83 02 C0 F1

0x83 means function 0x03 exception response, and 0x02 means Illegal Data Address.

FAQ

What is Modbus function code 03?

Function 03 reads holding registers from a server/slave device.

What is the difference between Modbus function 03 and 04?

Function 03 reads holding registers, while function 04 reads input registers. Device register maps define which addresses are valid.

What is Modbus function code 16?

Function 16 (0x10) writes multiple holding registers in one request frame.

What does exception code 02 mean?

Exception code 02 is Illegal Data Address, typically caused by an invalid register or object range.

Why is the exception function code 0x83 for function 0x03?

Modbus RTU exception responses set bit 7 of the original function code. 0x03 therefore becomes 0x83.