Modbus ExceptionCode 0x01 (IllegalFunction)

I have a gateway communicating to 3 Modicon Quantum PLCs. The console log is throwing 39,357 errors per hour currently with Logger ReadHoldingRegistersRequest and ReadCoilsRequest, with message Received response with ExceptionCode: 0x01 (IllegalFunction). I’m guessing my PLC type does not support a specific modbus function, but I have only seen that before with writing to bits or coils, not reading them. Is there any device advanced setting I should enable/disable to stop the error?

There are options to either force reading multiple register/coils or disable reading multiple registers/coils - try playing with those first.

The description on those settings explicitly states: Disable with caution. Which is why I came here first :slight_smile:

Yeah, you need to be careful because they can be detrimental to performance depending on how many tags you have and what address ranges they’re in. It’s mostly when disabling the multiple register/coil requests - instead of reading groups of registers/coils at once it forces the driver to read each one individually.

I disabled all read and write multiple register, coil, and input requests and the error messages are still flooding in. :frowning:

Try forcing multiples instead of disabling. The devices might not support the single register version of the request.

Enabled all multiple read/write requests and turned on forcing. Still flooding in… Strange.

Can you get a Wireshark capture?

Let me work on that. Our segmented network is pretty locked down. Stand by…

Are you writing to the zero address of any register range (i.e. 0x0, 1x0, 3x0, or 4x0)? If so make sure you have the advanced option “One-based Addressing” disabled. I use a Modicon M340 and when one-based addressing is enabled all my addresses are 1 address wrong, the 0x01 response code could be because you’re trying to read from/ write to an address outside of the device’s bounds caused by that box being checked.

Here’s a screenshot of my advanced settings when using the M340, I know it’s not a Quantum, but I should imagine since they’re both modicon that their settings should be very similar. The driver type I’m using is Modbus TCP

I’m not reading or writing to any tags with an address at 0, and my addresses are not off by 1. They match the PLC and previous SCADA system addresses and values. I also do not have any null or bad quality data on any of my tags, and the values brought back match the PLC.

It’s never the easy solution is it? While wireshark will reduce the guess work, another possibility would be to disabled the “Span Gaps” option. If you have an address unassigned in the middle of a several other addresses then the Quantum may be returning the 0x01 exception code as that address doesn’t exist. By disabling “Span Gaps”, Ignition should only read contiguous groups. The obvious downside is you are now having to do more read/write transactions to each device.

Edit: though now that I think about it, if this was the problem I believe it would be returning error code 0x02, not 0x01.

Right, not 0x01. I toggled the Span Gaps (actually I have played with all of the device settings now) and did not seem to change anything.

We have hundreds of Modicon PLCs throughout our field coming into numerous Ignition gateways. This is the first time I’ve ever had an issue or seen this error. Very strange.

Just a sanity check - you’re sure the errors your seeing belong to the devices you’ve been changing settings on?

This gateway only has 3 Modicon device connections, and I have been changing the settings across all 3 devices every time.

Unfortunately the the message doesn’t tell me exactly what device is causing the issue, and there is no stack trace :frowning:

If you turn the logger for ReadHoldingRegistersRequest to TRACE we can see which request(s) these exception responses are to. It’s a bit spammy though, so don’t leave it on longer than necessary.

Nice, the TRACE narrowed it down to 1 particular device. Let me get more info on that device.

Ok… The 2 PLCs with no issues are Modicon Quantums. The 1 PLC that is throwing the error actually happens to be a Modicon 984.

The Quantums are ethernet IP addressable devices; the 984 is not. The 984 at my facility is connected to a modbus-to-modbus-plus converter. The converter is then connected to a modbus-to-ethernet bridge. And Ignition is connecting to the bridge device.

Not sure if this is the reason for the errors, but that is the difference between it and the devices that are not throwing errors.

What are the request bytes that get sent when the exception response comes back? You should be able to see this in the TRACE logging.