What Function Codes Are
A Modbus function code is a single-byte instruction in every Modbus request that tells the server (slave) what operation to perform. The function code determines which register type is accessed and whether the operation is a read or a write.
Common Function Codes
These function codes cover the vast majority of building automation integrations:
| Code | Name | Data Type | Access | Max Items |
|---|---|---|---|---|
| 01 | Read Coils | Coil (1 bit) | Read | 2,000 |
| 02 | Read Discrete Inputs | Discrete Input (1 bit) | Read | 2,000 |
| 03 | Read Holding Registers | Holding Register (16 bit) | Read | 125 |
| 04 | Read Input Registers | Input Register (16 bit) | Read | 125 |
| 05 | Write Single Coil | Coil (1 bit) | Write | 1 |
| 06 | Write Single Register | Holding Register (16 bit) | Write | 1 |
| 15 | Write Multiple Coils | Coil (1 bit) | Write | 1,968 |
| 16 | Write Multiple Registers | Holding Register (16 bit) | Write | 123 |
Register Type ↔ Function Code Mapping
Each register type has a fixed set of function codes. Using the wrong function code for a register type returns an Illegal Function exception (exception code 01).
| Register Type | Read FC | Write FC |
|---|---|---|
| Coils (0xxxx) | 01 | 05 / 15 |
| Discrete Inputs (1xxxx) | 02 | — (read-only) |
| Input Registers (3xxxx) | 04 | — (read-only) |
| Holding Registers (4xxxx) | 03 | 06 / 16 |
[!NOTE] The reference number ranges (0xxxx, 1xxxx, etc.) are Modicon conventions. Actual PDU addresses are always 0-based. See Modbus Addressing & Register Reference for details.
Diagnostic and Special Function Codes
| Code | Name | Use |
|---|---|---|
| 07 | Read Exception Status | Serial diagnostic (8 exception bits) |
| 08 | Diagnostics | Serial loopback and bus diagnostics |
| 11 | Get Comm Event Counter | Serial event counting |
| 17 | Report Server ID | Device identification |
| 23 | Read/Write Multiple Registers | Combined read+write in one transaction |
| 43 | Read Device Identification | MEI transport — device metadata |
Exception Responses
When a function code fails, the server returns an exception response with the function code OR’d with 0x80 and an exception code:
| Exception Code | Meaning |
|---|---|
| 01 | Illegal Function — FC not supported |
| 02 | Illegal Data Address — register doesn’t exist |
| 03 | Illegal Data Value — value out of range |
| 04 | Server Device Failure — internal device error |
| 06 | Server Device Busy — retry later |
[!TIP] Exception code 02 (Illegal Data Address) paired with FC03 or FC04 is the most common error in integration work — it usually means the register address is off by one. See Modbus Addressing & Register Reference.