Symptom
Polled values from a device are correct and updating; a write from SCADA or from a controller to that device returns an exception, a timeout on writes only, or a success with no effect; the failure is on all writes, on one register, or on one type of write.
The short answer
Read Works but Write Fails
Reads and writes travel over the same link and the same protocol, so a write that fails while reads succeed is being refused or ignored at the device, or is arriving and being overwritten. The exception code returned by the device, if it returns one, names the refusal: an illegal function means the device does not support that write command, an illegal address means the register is outside the writable range or on the wrong table, an illegal value means the data does not fit the register, and a device failure means the device accepted the format and could not act. A write that returns success and changes nothing has been accepted and then overwritten by the device logic, blocked by a local or remote mode, or written to a register that is not the one the logic reads. Read the exception, then check what the device does with the register.
Key points
- The exception code is the diagnosis; log it rather than just the failure.
- Illegal function means the wrong command; illegal address means the wrong register or table; illegal value means the wrong data type or size.
- A write that succeeds with no effect is being overwritten by logic or blocked by a mode.
- Many devices ship write-protected, or with a write-enable parameter, a keyswitch, or a remote mode that must be set.
- Single-register writes and multiple-register writes are different function codes, and a device may support only one.
Possible causes and what to check
| Possible cause | What to check |
|---|---|
| Device write protection | A parameter, a jumper, a keyswitch, or a security setting that blocks writes; every write fails with an illegal function or a device-specific error. Check the device manual for write enable. |
| Register is read-only | A write to an input register, a status word, or a measured value; an illegal address or illegal function exception. Use the holding register or the command register the manual specifies. |
| Wrong function code | The master uses a multiple-register write and the device supports only single writes, or the reverse; an illegal function exception. Change the write type in the driver. |
| Wrong address, offset, or table | The master writes to the read address, which is a different table; or the one-based and zero-based offset is wrong by one. Compare with the register map and a known-good read. |
| Data type or size mismatch | A 32-bit value written to one 16-bit register, a float to an integer register, or a word order the device rejects; an illegal value exception or a wrong value in the device. |
| Device logic overwrites the value | The write succeeds and the value reverts within a scan; the device program writes the register from its own source. Find the logic that owns the register. |
| Local or remote mode | A drive or a controller in local, hand, or program mode ignores remote writes; a mode register or a keyswitch. Set remote or auto mode. |
| Wrong device address or unit identifier for the write | The write goes to a gateway or another unit; the read used a different unit. Match the unit identifier. |
| Firewall or gateway blocks writes | A deep packet inspection rule or a gateway configured read-only for security; the write times out or is rejected without an exception. Check the security policy; it may be intentional. |
| Write outside the permitted range | A setpoint above the device limit; the device returns an illegal value or clamps silently. Check the limits. |
Read the exception
| Modbus exception | Name | Meaning for a write | Fix |
|---|---|---|---|
| 01 | Illegal function | The device does not support this write function code | Use the function the device supports: 06 single, 16 multiple, 05 single coil, 15 multiple coils |
| 02 | Illegal data address | The register is not writable, does not exist, or is in a different table | Check the map, the table, and the offset convention |
| 03 | Illegal data value | The value or the count does not fit the register | Check data type, word count, and range |
| 04 | Slave device failure | The device accepted the request and failed to act | Device state, mode, or an internal fault |
| 05, 06 | Acknowledge, busy | The device is processing or busy | Retry after a delay; slow the master |
| Timeout on writes only | No exception | A gateway or firewall dropping writes, or a device that does not answer writes | The gateway configuration and the security policy |
Working it
- 1
Capture the exchange
The driver diagnostic or a protocol analyzer: the exact request, the function code, the address, the count, the data, and the response. A failure without the response is a guess.
- 2
Classify
An exception is a refusal; a timeout is a drop; a success with no effect is an overwrite or a mode.
- 3
Check the device
Write enable, security, mode, and the register map for the target: is it writable, what type, what range.
- 4
Test with a tool
A standalone master on a laptop writing the same register, single and then multiple. If the tool succeeds, the difference between its request and the driver request is the fault.
- 5
Watch the value
For a success with no effect, read the register immediately after the write and again a second later. A value that changes and reverts is being overwritten.
- 6
Find the owner
The device program, a second master, or a local mode that owns the register. Change the design so that one thing writes it.
Success with no effect
A device that answers a write with success and then shows the old value is not lying: it accepted the write, and then something else wrote the register. In a drive, that is usually the local mode, in which the keypad reference wins; in a controller, it is the program writing the register from its own logic every scan; in a gateway, it is a mapping that copies the register from the wrong side. The register the write goes to must be the one the logic reads, and only the remote master should write it. A controller program that needs to accept remote writes reads the register into its own variable and clears or leaves the register alone, rather than writing it back.
Frequently asked questions
- Reads work with function 03 and writes fail with exception 01.
- The device does not support the write function the driver is using. Most drivers default to function 16 for holding register writes; many small devices support only function 06. Change the driver to single-register writes.
- The write succeeds but the value comes back wrong, not old.
- The data type or the word order differs: a float written in the wrong byte or word order, or a scaled integer written unscaled. Compare the raw bytes in the request with what the device manual says the register expects.
- Writes worked until we added the firewall.
- The firewall or its inspection rules are blocking writes, probably by design. The security policy for the zone decides whether the write should cross; if it should, a rule for that function code, register range, and master is written and documented.
- The drive accepts the speed reference but ignores the start command.
- The drive is not in the mode that takes remote commands, or the command word needs a sequence such as a ready bit before a run bit. The drive manual describes the control word sequence and the mode parameter.
Related topics
- Modbus TCPModbus over Ethernet: what the MBAP header changes, why the CRC disappears, how the unit identifier works, and what does not get easier just because it is on Ethernet.
- Modbus RTUSerial Modbus over RS-485: function codes, register addressing, the off-by-one that catches everyone, and the physical layer details that decide whether a bus is stable.
- Wrong Register DataThe poll succeeds and the numbers are nonsense: an offset by one, the wrong table, swapped words in a 32-bit value, a float read as an integer, signed read as unsigned, a scale factor not applied, a stale gateway value, or the wrong unit answering.
- Device Times OutA polled device that answers late or not at all: how to read the driver counters, tell a dead device from a slow one, and find the timeout setting, the bus loading, the radio latency, the duplicate address, or the device that is simply too busy to answer.
- How to Configure a Modbus ConnectionSet up a Modbus RTU or TCP link between a controller and a device: get the register map, match the physical and protocol settings, build the reads and writes, handle data types and the addressing offset, and verify with a protocol tool before trusting a value.
- Deep Packet InspectionWhat a firewall can do when it understands the control protocols: allowing reads and blocking writes, permitting programming only from one workstation in a window, rejecting malformed messages, and alerting on function codes that should never appear.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.