Modbus FC05 (Write Single Coil)

Back to Blog

The FF00 and 0000 On/Off Encoding

Function code 05 does not send a single bit. It sends a two-byte value where 0xFF00 means turn the coil on and 0x0000 means turn it off, and any other value is invalid and returns an illegal data value exception. This fixed encoding trips up newcomers who try to send 0x0001 for on. The request is simply the coil address followed by one of those two values.

On a successful write the device echoes the entire request back: the same coil address and the same value. That echo is the acknowledgment, so a master confirms the command took effect by matching the response to what it sent. Because FC05 acts on the coil table, it is the write partner of the coil read described in the Modbus function code overview.

When to Use FC05 Versus FC15

Function code 05 writes exactly one coil. When several coils must change together, or must change atomically as a group, function code 15 writes multiple coils in one request instead, which is faster and avoids a partially applied state. Use FC05 for a single discrete command like a pump start; use FC15 when setting a bank of outputs. The distinction mirrors the single-versus-multiple split on the register side.

A common failure is directing FC05 at a discrete input or a register address. Discrete inputs are read-only and are not coils, and registers are sixteen-bit words rather than bits, so either target returns an exception. If the value you intend to command is not actually a coil, no coil write will reach it. Confirm the target lives in the coil table using the Modbus register types reference before troubleshooting further.

The Request Frame, Byte by Byte

The FC05 request is one of the simplest frames in the protocol, and being able to read it raw pays off when staring at a capture:

Field	Size	Content
Server address	1 byte	Target device (RTU) or unit ID (TCP)
Function code	1 byte	0x05
Coil address	2 bytes	Zero-based address, high byte first
Output value	2 bytes	0xFF00 for on, 0x0000 for off
CRC	2 bytes	RTU only, low byte first

The address field is where the classic off-by-one lives: coil number 1 in vendor documentation is address 0 on the wire, because the traditional reference numbering is one-based while the protocol field is zero-based. When a write lands on the coil next to the one you intended, this is almost always why - check the numbering convention in the device manual before checking anything else.

Command Patterns: Pulses, Readback, and Permissions

An FC05 write sets a state; Modbus has no native momentary command. If a device needs a pulse - a start command that clears itself - that behavior lives in the device's logic, which may auto-reset the coil after acting on it. This matters for verification: writing 0xFF00, receiving a clean echo, and then reading the coil back as off can be perfectly correct behavior for a self-resetting command coil. Know which kind of coil you are commanding before declaring a fault.

For coils that hold state, the robust pattern is write-then-verify: send FC05, match the echo, then read the coil back with FC01 and confirm the state, because the echo proves the device accepted the request, not that the output ultimately changed. In supervisory systems, coil writes are the sharp end of remote control: write access should be restricted to the specific coils an operator legitimately commands, anything that starts or stops equipment must remain subordinate to the device's local interlocks and the site's operating procedures, and qualified personnel decide what may be commanded remotely at all. Where that command layer sits in a modern architecture is covered in the guide to connecting Modbus to cloud SCADA.

Reading FC05 Exception Replies

When FC05 fails, the device returns 0x85 - the function code with its high bit set - plus one exception byte. Exception 01, illegal function, means the device does not implement coil writes at all. Exception 02, illegal data address, means the coil address is not in the map; check the off-by-one first. Exception 03, illegal data value, is the FC05 special: you sent something other than 0xFF00 or 0x0000. Exception 04, server device failure, means the device accepted the frame but could not act, which on real equipment often means a local mode or a hardware fault. The general decoding habit is in the exception code reference; the FC05-specific heuristic is that 02 and 03 point at your configuration while 04 points at the device.

When a Successful Write Changes Nothing

The most confusing FC05 case is a clean echo with no effect on the physical output. The causes, in rough order of likelihood: the device's own logic immediately overwrites the coil (a PLC program that writes that bit every scan wins every time), the output is switched to local or hand mode, the coil maps to internal logic rather than a physical point, or you wrote the right address in the wrong device. The PLC program case deserves emphasis: a coil that running logic also writes is not remotely commandable in any meaningful sense, and the fix belongs in the program - a dedicated command bit the logic reads - rather than in the master retrying harder. And when several outputs must change as one, use function code 15 instead of a burst of FC05 requests.

Frequently Asked Questions