Modbus FC07 (Read Exception Status)
Function code 07 reads exception status, a short serial-line command that returns eight predefined status bits from a device in a single compact exchange. It is a legacy diagnostic that engineers often confuse with an exception response, which is a completely different thing. This reference explains what FC07 actually returns, why it is so terse, and how it differs from the exception codes that share the name.
Modbus Function Code 07 Read Exception Status in one line: Modbus function code 07 reads exception status: a serial-line diagnostic that returns eight predefined device-defined status bits in one byte. The request carries no data beyond the address and code, and the reply is a single status byte. It is deliberately short so it works even on a busy or lightly loaded device, and it is unrelated to the exception codes returned when a request fails.
What FC07 Returns and Why It Is So Short
Function code 07 is a serial-line command that carries no data in the request beyond the slave address and the function code itself. The device replies with a single byte containing eight status bits whose meaning is defined by the device or its documentation, often mapping to conditions like an internal fault, an overload, or a device-specific health flag. Because both the request and the reply are tiny, FC07 is a fast, low-overhead way to poll a device's overall health.
The brevity is intentional. FC07 predates the richer diagnostics of function code 08 and exists precisely so a master can get a quick health snapshot in the smallest possible exchange, which mattered on slow early serial links. Being a serial-line function, it belongs to the same family as the CRC-protected framing covered in the Modbus TCP vs RTU comparison, and it is not part of the register or coil tables.
FC07 Is Not an Exception Code
The name causes constant confusion. Function code 07 read exception status is a normal, successful request that returns status bits. An exception code, by contrast, is what a device sends back when any request fails, flagging the original function code and giving a reason byte. They share the word exception but are unrelated mechanisms. The failure-side meaning is covered in the Modbus exception code reference.
In practice FC07 is uncommon on modern equipment, which tends to expose health as ordinary registers you read with function code 03 or 04 instead, or through the structured diagnostics of function code 08. When you do meet FC07 on legacy serial gear, treat its status byte as device-defined and read the device's documentation for what each of the eight bits means, since the protocol only reserves the byte, not its interpretation.
Unpacking the Status Byte Into Usable Points
The FC07 reply is one byte, and the useful work is turning its eight bits into eight named discrete points. The arithmetic is trivial: for bit n of status byte B, the state is B shifted right by n positions, ANDed with 1. Read back a byte of hex 11, for example, and bits 0 and 4 are set while the others are clear. What is not trivial is naming: the protocol only reserves the byte, so each bit's tag name, alarm meaning, and severity must come from the specific device's documentation, and that mapping belongs in the point database next to the register map rather than in someone's memory.
Discipline matters on the undocumented bits. A bit the manual does not define may be unused, may float, or may change meaning between firmware versions, so alarming on it produces noise at best and false confidence at worst. Map the documented bits to alarms with the severity the manual justifies, expose the raw byte itself as a diagnostic value for the historian, and leave the undefined bits unalarmed.
FC07 Among the Serial-Line Diagnostics
FC07 is one member of a small family of serial-line functions that interrogate the device itself rather than its data tables:
| Code | Function |
|---|---|
| 07 | Read exception status - the eight predefined status bits |
| 08 | Diagnostics - subfunctions including loopback and counters |
| 11 (0x0B) | Get comm event counter |
| 12 (0x0C) | Get comm event log |
| 17 (0x11) | Report server ID |
Within that family, FC07 is the quick health poll and the richer function code 08 diagnostics is the troubleshooting tool, with its loopback test and communication counters. All of them are defined for the serial line; whether a TCP-attached device or a gateway honors them is device-specific, so treat any answer to them over TCP as a bonus rather than a guarantee.
Deciding Whether FC07 Belongs in the Scan
On a modern device the answer is usually no: health lives in ordinary registers, and one more request per cycle is pure overhead. The cases where FC07 earns its place are narrow but real. Legacy serial devices whose manuals document the eight bits are the obvious one. Tight bandwidth is another: on a very slow shared line, a one-byte health poll slotted between full data polls costs almost nothing and shortens the time to notice a device-declared fault. And during commissioning, a scripted FC07 sweep across the address range is a fast way to confirm which nodes respond at all before the full point map exists.
If FC07 does go into the scan, poll it at a slower cadence than the process data and treat its bits as status, not as a substitute for reading the device's real diagnostic registers where those exist. The short exchange was designed for links where every byte counted; on links where bytes are cheap, clarity beats brevity.
Frequently Asked Questions
Is function code 07 the same as a Modbus exception?
No, despite the shared word. FC07 read exception status is a normal successful request returning eight status bits. A Modbus exception is a failure response any request can trigger, flagging the function code and giving a reason such as illegal data address. They are entirely separate concepts that happen to share the term exception.
What do the eight bits from FC07 mean?
The interpretation is device-defined. The protocol reserves a single status byte of eight bits but does not fix what each bit represents, so you must consult the device's documentation. Common assignments include internal-fault, overload, or health flags, but there is no universal mapping across vendors, which limits how portable FC07 handling can be.
Should I use FC07 on modern devices?
Usually not. Most current equipment exposes health and status as ordinary holding or input registers you read with FC03 or FC04, or provides the structured diagnostics of function code 08. FC07 is a legacy serial-line command you will mostly meet on older devices, where it remains a valid quick health poll if the device supports it.
Does function code 07 work over Modbus TCP?
It is defined as a serial-line function, so support over TCP is not guaranteed by the specification. Some TCP devices and serial gateways answer it anyway, others return an illegal-function exception, and a gateway may pass it through to a serial device behind it. Treat FC07 over TCP as device-specific behavior to be tested during integration, and prefer ordinary register reads for health data on TCP equipment.
Can FC07 bit meanings be standardized across vendors?
No. The specification reserves the status byte but leaves every bit's meaning to the device, so the same bit can mean an internal fault on one product and nothing on another. Any multi-vendor deployment needs a per-device mapping table taken from each manual, and the safest habit is to name tags after the documented meaning rather than the bit number, so the meaning travels with the point.
Sources and verification
This page references the protocol specifications published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
- Modbus Application Protocol Specification - Modbus Organization
Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.