What does Modbus Exception Code 04 (Slave Device Failure) mean?

Modbus Exception Code 04 (formally defined as 'Slave Device Failure' in legacy specifications and 'Server Device Failure' in modern Modbus Application Protocol V1.1b3) is returned when the slave device received a valid request with a supported function code and valid address/value, but encountered an unrecoverable internal hardware or firmware error while attempting to execute the operation.

How does Exception 04 differ from Exception 01, 02, and 03?

Exception 01 indicates an unsupported Function Code. Exception 02 indicates an invalid or unmapped Register Address. Exception 03 indicates an invalid Data Value (such as requesting too many registers or sending improper byte counts). In contrast, Exception 04 means the master's request was completely syntactically correct, but the physical slave hardware, I/O module, or gateway failed internally during execution.

Can a disconnected analog sensor cause Exception 04?

Yes. Many intelligent field instruments and PLC analog input cards (measuring 4–20mA loops, RTD Pt100, or thermocouples) execute hardware diagnostics. If a sensor wire is broken (open circuit) or an analog-to-digital converter (ADC) saturates, the PLC firmware may flag the corresponding holding register as faulted and reply with Exception 04 instead of returning erroneous telemetry.

What causes Exception 04 during Modbus write operations (FC 06 or FC 16)?

During write operations, Exception 04 typically indicates a non-volatile memory write failure (e.g., EEPROM write timeout or read-back checksum mismatch), an active hardware write-protect interlock switch on the instrument, or an application-level safety interlock (such as attempting to change a pump speed setpoint while the drive is in Emergency Stop mode).

How can I isolate whether Exception 04 is caused by master poll timing or hardware failure?

Use ModbusSimulator to run a local virtual slave on your laptop or server configured with identical register mappings. Point your SCADA or PLC master to the simulator. If the master communicates cleanly with zero exceptions, the issue is isolated to the physical field device's hardware, wiring, or gateway timeout settings.

How do I fix Modbus Exception 04 on a serial RS-485 bus?

Inspect the physical RS-485 wiring polarity (A/D+ and B/D-), verify 120-ohm bus termination resistors at both physical ends, check for common-mode ground voltage loops, increase the master or gateway polling timeout from 500ms to 1500ms, and verify that the polled slave device is powered and its status LED indicates RUN mode.

November 2, 2026 Protocol Diagnostics 8 min read

Modbus Exception Code 04 (Slave Device Failure): Root Causes & Step-by-Step Fixes

Q: Why do Modbus TCP-to-RTU gateways return Exception 04?

When a Modbus TCP client polls an IP gateway (such as a Moxa MGate or Advantech ADAM) that bridges to serial RS-485 multidrop instruments, the gateway responds with Exception 04 if the downstream RS-485 instrument fails to respond within the configured serial timeout window, or if the serial reply suffers from severe CRC corruption.

When a Modbus Master or SCADA system receives Exception Code 04, it means the query was structurally flawless, but the physical field device or gateway suffered an internal execution breakdown. Here is how industrial automation engineers diagnose and resolve it.

What Is Modbus Exception Code 04?

In the official Modbus Application Protocol Specification (V1.1b3), Exception Code 04 is designated as Slave Device Failure (or Server Device Failure). The specification defines it with strict precision:

Modbus Spec Definition: “An unrecoverable error occurred while the server (or slave) was attempting to perform the requested action.”

Unlike other standard Modbus exception responses where the master made a client-side polling error, Exception 04 signifies a server-side failure:

Exception 01 (Illegal Function): Master requested an unsupported function code (e.g., sending FC 05 to a read-only power meter).
Exception 02 (Illegal Data Address): Master queried a register offset not mapped in the slave memory table.
Exception 03 (Illegal Data Value): Master sent an out-of-range quantity (e.g., requesting 130 registers in one FC 03 block) or invalid byte count.
Exception 04 (Slave Device Failure): The function code was supported, the register address existed, and the data value was formatted correctly—yet the slave hardware or firmware failed internally during execution.

Hex Frame Anatomy of an Exception 04 Packet

When a Modbus slave returns an exception, it sets the most significant bit (MSB) of the function code byte (adding 0x80) and appends the 1-byte Exception Code (0x04). Let us inspect real packet captures from serial RS-485 and Modbus TCP networks.

1. Modbus RTU Exception 04 Frame

Suppose a Modbus Master queries Holding Register 40100 (offset 0x0063) from Slave ID 0x01 using Function Code 03:

Master Request:  01 03 00 63 00 01 74 15
                 |  |  |-----| |---| |---|
                 |  |  Addr    Qty   CRC-16
                 |  FC 03
                 Slave ID 1

Slave Exception: 01 83 04 40 F3
                 |  |  |  |---|
                 |  |  |  CRC-16
                 |  |  Exception Code 04 (Slave Device Failure)
                 |  Error Flag (0x03 + 0x80 = 0x83)
                 Slave ID 1

2. Modbus TCP Exception 04 Frame (MBAP Header)

Over Ethernet TCP/IP, the MBAP (Modbus Application Protocol) header reflects the transaction with Unit ID and Exception Code:

Client Request:  00 0A 00 00 00 06 01 03 00 63 00 01
                 |---| |---| |---| |  |  |-----| |---|
                 TxID  Proto Length UID FC  Address  Qty

Server Exception: 00 0A 00 00 00 03 01 83 04
                 |---| |---| |---| |  |  |
                 TxID  Proto Length UID Error Exception 04

The 4 Most Common Causes of Exception 04 in the Field

1. Modbus TCP-to-RTU Gateway Subnet Timeouts

By far the most frequent source of Exception 04 in modern industrial facilities is the use of Modbus TCP gateways (such as Moxa MGate, Advantech ADAM, or Phoenix Contact gateways). When your SCADA system polls the gateway's IP address for a serial slave (e.g., Unit ID 5 on Port 1):

The gateway accepts the TCP connection and forwards the request over RS-485.
If the physical RS-485 device is powered off, disconnected, or set to the wrong baud rate/parity, the serial device does not reply.
When the gateway's internal serial response timer (typically 1000ms) expires without hearing from the serial slave, the gateway cannot generate a normal response.
Rather than dropping the TCP socket, standard gateway firmware generates a synthetic Exception 04 (Slave Device Failure) back to the SCADA master.

2. Physical I/O Module & Sensor Channel Faults

In modular PLCs (such as Siemens S7-1200 with CM 1241, Schneider Modicon M221/M241, or WAGO 750), Modbus memory addresses are directly tied to physical analog or digital I/O slices:

Analog Wire Break / Open Loop: If a 4–20mA pressure transmitter cable is cut, the analog input card detects a loop current < 3.6mA. Firmware flags a channel diagnostic failure and replies with Exception 04.
Thermocouple / RTD Burnout: If an RTD Pt100 sensor suffers a broken lead, the temperature module detects open resistance and raises Exception 04.
Backplane Communication Loss: If an expansion rack loses 24V DC auxiliary power or experiences backplane ribbon cable interference, the main CPU cannot read the requested address block and returns Exception 04.

3. Non-Volatile Memory (EEPROM / Flash) Write Verification Failures

When sending write commands (FC 06 Write Single Register or FC 16 Write Multiple Registers) to configure device setpoints, calibration constants, or PID tuning gains:

The slave CPU must write the received payload into on-board non-volatile EEPROM or NOR flash memory. If the flash sector is worn out (exceeding 100,000 write cycles), the write verify checksum comparison fails. The slave rejects the operation and issues Exception Code 04 to prevent operating on corrupted memory.

4. Safety Hardware Interlocks & PLC Operating States

Certain industrial controllers enforce physical interlocks on register operations:

PLC in STOP / PROGRAM Mode: Writing to output coils or holding registers while the controller key switch is in STOP mode often triggers an internal processor fault response (Exception 04).
Hardware DIP Write Protection: Many energy meters and flow computers feature a physical calibration lock jumper. Attempting to write registers while the lock is active yields Exception 04.
Emergency Stop (E-Stop) State: A variable frequency drive (VFD) commanded over Modbus to write run-frequency registers will return Exception 04 if the hardware safe torque off (STO) circuit is open.

Step-by-Step Troubleshooting Checklist

Phase 1: Determine If You Are Polling Through a Gateway

If you are communicating over Modbus TCP to an IP gateway: Log into the gateway web management console. Inspect the serial port packet counters. Are TX packets incrementing while RX packets remain zero? If yes, the fault is entirely on the serial RS-485 side: verify baud rate (9600 vs 19200 vs 115200), parity (8-N-1 vs 8-E-1), and cable polarity (flip A and B lines).

Phase 2: Check Physical Hardware Status LEDs

Examine the physical slave controller or remote I/O rack. Look for the following LED indicators:

SF (System Fault) / BF (Bus Fault): Indicates hardware diagnostic errors on the PLC rack or expansion modules.
ERR / ALARM: Indicates sensor loop faults, power supply undervoltage, or firmware task overruns.
RUN LED: Ensure the CPU is in RUN mode rather than STOP or HALT.

Phase 3: Verify Master Polling Intervals & Timeouts

Over-polling a low-power microcontroller or field transmitter with aggressive poll cycles (< 20ms) can overwhelm the slave's single-threaded event loop. If the CPU is busy servicing internal ADC interrupts, it may miss Modbus buffer processing and return Exception 04. Increase polling cycle times to 250ms–500ms and extend the master response timeout to 1500ms.

Modbus Exception Codes Quick Reference

Code	Exception Name	Origin	Primary Root Cause
01	Illegal Function	Master Error	Slave does not implement or support the requested Function Code.
02	Illegal Data Address	Master Error	Requested register address offset does not exist in the slave mapping table.
03	Illegal Data Value	Master Error	Register quantity exceeds protocol limit (> 125 regs) or byte count mismatch.
04	Slave Device Failure	Slave Hardware Error	Unrecoverable hardware fault, gateway subnet timeout, or EEPROM write error.

Isolate Field Hardware Using ModbusSimulator

When commissioning SCADA platforms or PLC networks, determining whether an Exception 04 originates from the master's polling sequence or the field device's physical hardware can take hours of trial and error. ModbusSimulator provides an instantaneous software isolation layer:

Launch Modbus Slave Simulator on your test PC or industrial server.
Configure virtual slave IDs, holding registers, and input registers matching your device map.
Point your SCADA system, HMI, or Modbus Master to the simulator's IP address and port 502 (or virtual COM port via com0com).
Observe communications: If the master communicates cleanly with zero exceptions, your polling script, register offsets, and function codes are verified 100% correct. You can confidently isolate the physical field unit for wiring, sensor burnout, or hardware replacement.

Frequently Asked Questions

What does Modbus Exception Code 04 mean?

Modbus Exception Code 04 (Slave Device Failure) signifies that the target slave received a valid, properly formatted request, but encountered an unrecoverable internal hardware or firmware error while attempting to process the command.

Why do Modbus TCP-to-RTU gateways return Exception 04?

When a gateway forwards a TCP poll onto an RS-485 serial bus, it returns Exception 04 to the master if the serial slave fails to answer within the configured serial timeout period, or if the serial reply fails CRC checksum validation.

Can a disconnected sensor wire cause Exception 04?

Yes. If an intelligent PLC analog module detects an open-circuit wire break (< 3.6mA on a 4–20mA loop or infinite resistance on an RTD lead), the device firmware may return Exception 04 to prevent transmitting invalid process data.

How do write operations trigger Exception 04?

During FC 06 or FC 16 write commands, Exception 04 occurs when non-volatile EEPROM memory write verification fails, when an emergency stop interlock blocks parameter changes, or when physical hardware write-protection dip switches are enabled.

How do I isolate whether Exception 04 is a software or hardware issue?

Use ModbusSimulator to run a virtual slave with the same register mapping. If your master communicates with the simulator without error, your SCADA configuration is verified, proving the error is physical hardware or wiring failure on the field device.