How to Fix Modbus Error 01 (Illegal Function) on Eastron & REAL Registers

Tx: [01] [03] [00] [00] [00] [02] [C4] [0B]  (Master querying Address 30001 with FC 03)
Rx: [01] [83] [01] [80] [F0]                 (Slave rejects with Exception 01)

System Fault: Modbus Exception Code 01 (Illegal Function Code)
Siemens TIA Portal Status: 16#8186 (MB_MASTER: Function code not supported by remote device)

Why Does This Happen? (The Protocol Trap)

Modbus RTU standards describe memory as four separate tables. Most modern devices allow you to read all registers using Function Code 03 (Holding Registers). IEC compliant power meters like Eastron are very strict about the traditional Modbus boundaries.

They define dynamic electrical measurements (Voltage, Current, Power, Energy) strictly as read-only Input Registers. When your PLC or SCADA software sends a standard FC 03 query for a floating-point address, the meter’s firmware immediately aborts the transaction and returns Exception Code 01. You must query these specific registers using Function Code 04 (Read Input Registers).

Option A: The Free Engineering Fix (Step-by-Step)

You do not need new hardware to fix a standalone meter. You must configure your polling master to route float queries through Function Code 04.

Step 1: Verify with Modbus Poll (PC Verification)

Before modifying PLC logic, isolate the hardware. Open Modbus Poll or Modscan on your laptop:

1. Go to Setup -> Read/Write Definition.
2. Change Function from 03 Read Holding Registers to 04 Read Input Registers.
3. Set Address to 0 (for Eastron SDM630 Phase 1 Voltage) and Length to 2.
4. The error 01 will instantly disappear, confirming the physical layer is healthy.

Step 2: Siemens TIA Portal (ST) Code Modification

In Siemens PLCs, the MB_MASTER or Modbus_Master instruction block relies on memory offsets to dictate the outgoing Function Code.

// WRONG: 4xxxx address offset forces TIA Portal to generate Function Code 03
// MB_MASTER.DATA_ADDR := 40001; -> Causes 16#8186 Error on Eastron floats

// CORRECT: Forcing Function Code 04 via 3xxxx address offset
MB_MASTER_Instance(
    REQ := Read_Trig,
    MB_ADDR := 1,                  // Slave ID
    MODE := 0,                     // Mode 0 = Read
    DATA_ADDR := 30001,            // CRITICAL: 30000 + Register 1 = Forces FC 04
    DATA_LEN := 2,                 // 2 Words = 32-bit Floating Point (REAL)
    DATA_PTR := P#DB10.DBX0.0 REAL // Target REAL buffer in Data Block 10
);

Step 3: The Next Trap — Solving Garbled Float Numbers (Endianness)

As soon as you switch to Function Code 04, Error 01 will go away. But 90% of engineers face a new problem immediately: the read value is a meaningless string of garbage data (like -1.854e+30 instead of 230.5V).

This is a Word Order / Endianness mismatch. A 32-bit REAL float consists of two 16-bit Modbus registers. Eastron transmits the high word first (CDAB or Big-Endian), while your PLC or SCADA might expect little-endian (ABCD or BADC).