Help with Received response with ExceptionCode: 0x02 (IllegalDataAddress)

This error is clogging up my log files and I can’t see much useful info about it other than the driver it’s coming from (hovering over the looking glass); there are no details offered; no specific tag.

How do I get to the bottom of this?

I turned on TRACE level for drivers.ModbusDriver2.ReadCoilsRequest in the logger settings and now see a little more info before the error event:

Received message: [ 05 1C 00 00 00 03 00 81 02 ]
Sending message: [ 05 1C 00 00 00 06 00 01 00 14 03 36 ]

The Sending/Received [DATA] is different before each error event.

Looking at the Modicon Modbus Protocol Reference Guild, I’m not sure how to decode this.

This is a request for 822 coils starting from coil 20.

In the logs on the gateway is there a little magnifying glass thing on the right of the log entry that shows a “device-name” key and value?

Yes, so it just shows me which PLC/Device this is: device-name RTU01.

So how can I know exactly which tag?

You can’t, but you know the range now.

You probably have one tag defined as C20, another as C842, and maybe some in between. The driver is trying to read all of these coils in a single request instead of multiple requests, but whatever device you’re talking to is saying that some or all of these addresses are invalid.

You can disable this grouping behavior by disabling the “Span Gaps” option on the device at the cost of some performance due to increased request count.

So if I turn off Span Gaps, each error message should resolve to a specific coil?

If so, can you give me the secret decoder ring for the response byte codes?

The first 7 bytes are a header, the rest are a request or response.

So that’s better than the manual I have.

Let me see if I can make sense of it.

I found a handy online secret decoder ring here: Online Modbus RTU Parser & Modbus TCP Parser

Parses the Modbus byte codes.

I exported my tag list, searched through it, and found none of the offending addresses. Furthermore, I have very few Coils (located EBOOL’s) ; only 20 - 52. Most of my addressing is through HR’s located at the start of some UDT, and any bit I need inside of that is read usning the HR.BIT notation.

So I’m really stumped at how to connect these errors so some offending tag.

What are the coil addresses you do have?

I can’t be sure this is the complete list, as it’s just a pain to go through this, but what I’ve seen so far are:


Unless you’re lucky and 841 or 842 is just past the boundary of valid values in that device you may have to turn the Span Gaps settings to false.

I already tried that.

When it was disabled did you find any bad quality coil tags?

Is there some easy,fast way to check without expanding every darned UDT?

I used Tag Search … searched all tags, none with bad quality.

Also, if I try to locate offending addresses in the PLC, it will not let me; saying address not configurable.

Not sure of any shortcut to finding them.

Sanity check: with Span Gaps disabled the error messages stop or the request/response bytes at least change, right?

Is seems that even with Span Gaps disabled, the error messages do not stop and req/resp bytes do not change.

Well… the simplest explanation for that is that you disabled it for the wrong Modbus device.

Sorry, no simple explanation then. Let’s start looking for a more complicated explanation.