Treat the function code as part of the address
The pair ‘FC03, PDU 0’ identifies a different location from ‘FC04, PDU 0’. Do not copy a printed register number into a client and change function codes until one responds. Start with the table heading and function stated by the manufacturer.
Use the data model, not read-only folklore
Input registers are read with FC04. Holding registers are read with FC03 and may be writable through FC06 or FC16, but readability does not prove writability. Many devices expose measurements in holding registers and many expose configuration values alongside status words; the manual remains authoritative.
Verify the complete request
Record the Unit ID, function, PDU start address, quantity, response byte count, and raw words. If the device returns Exception 01, the function is unsupported. Exception 02 normally means the function exists but the requested address or range does not.
Read the table heading before the register number
A vendor table may label a column simply Register while the surrounding section identifies it as input or holding data. Capture that heading with the row. The number alone is incomplete because FC03 and FC04 can carry the same two-byte start offset while selecting different logical tables inside the server.
If the manual uses 3xxxx and 4xxxx notation, the leading digit is documentation shorthand and is not transmitted. If it uses raw offsets, the function may appear in a separate column or chapter. Avoid converting the number until you know which notation the document uses.
Do not infer write safety from the table name
Holding registers are the target of standard register-write functions, but that does not make every FC03-readable location writable. Devices routinely expose measurements, status, counters, and reserved values in the holding-register space. The access column and operation notes decide whether FC06 or FC16 is permitted.
Likewise, an input register may reflect a value configured elsewhere. If a measurement must be changed for a simulator or test fixture, locate the documented configuration object rather than attempting to write the FC04 address.
- FC03 selects holding registers
- FC04 selects input registers
- FC06 writes one holding register
- FC16 writes a holding-register block
- The vendor map determines access for each location
Use exceptions to narrow the diagnosis
Exception 01 suggests that the server does not implement or permit the selected function. Exception 02 suggests that the function exists but the requested start, quantity, or complete range is invalid. A timeout does not establish either conclusion because the request may not have reached the intended server at all.
Once one function and address are proven, preserve the raw frame as a reference. Create separate sources for FC03 and FC04 even when their offsets overlap. That keeps later traffic inspection unambiguous and prevents a UI label from concealing which data model produced the value.