August 11, 2026 · How-To

How to Write Modbus Registers: FC06, FC16, and Coils FC05/FC15

Reading gets the data out; writing is how you push a setpoint, command a VFD, or trip a digital output. Modbus gives you four write function codes covering single and multiple writes to both 16-bit registers and single-bit coils. They are simple on the wire, but a careless write to the wrong register can start a motor or open a valve — so the mechanics matter and so does the discipline around them.

This guide covers FC05, FC06, FC15, and FC16: what each frame looks like, when to choose one over another, and the exception codes that tell you a write was rejected. For read operations, see reading holding registers.

The Four Write Function Codes

• FC05 — Write Single Coil. Set one coil ON or OFF. ON is transmitted as 0xFF00, OFF as 0x0000 (not 0x0001 — a common mistake).
• FC06 — Write Single Register. Write one 16-bit holding register. The slave echoes the request back as confirmation.
• FC15 — Write Multiple Coils. Set a block of coils in one transaction.
• FC16 — Write Multiple Registers. Write a contiguous block of holding registers. The efficient choice for multi-register values and atomic block updates.

FC06 — Write Single Register

To write the value 1000 (0x03E8) to holding register 40010 (protocol address 0x0009) on slave 1:

Slave ID:   01
Function:   06
Address:    0009
Value:      03E8   (1000)

The slave replies with an exact echo of the request — same function code, address, and value. That echo is the confirmation; there is no separate "OK". If the value is out of range or the address is invalid, the slave returns an exception response instead (function code with the high bit set, 0x86, plus an exception code).

FC16 — Write Multiple Registers

When a value spans two registers (a 32-bit float or integer) you must write both atomically. FC16 does that. To write two registers starting at address 0x0009:

Slave ID:   01
Function:   10  (16)
Start addr: 0009
Quantity:   0002
Byte count: 04
Data:       43 48  00 00   (two registers)

The slave replies with the function code, start address, and quantity — confirming the block. The same byte-order rules that apply to reads (ABCD/DCBA/BADC/CDAB) apply to writes: you must pack the bytes the way the device expects.

FC05 and FC15 — Writing Coils

Coils are single-bit booleans — digital outputs, run/stop commands, resets, alarm acknowledgements. FC05 writes one coil; FC15 writes a block. The ON wire value for a single coil is 0xFF00; for FC15, coils are packed one per bit.

Exception Codes on Write

When a write is rejected, the slave returns an exception. The three you will see most:

• 01 Illegal Function — the slave does not support that function code (e.g. a device that has no coils rejecting FC05).
• 02 Illegal Data Address — the register is read-only, or you wrote past the end of the writable range. The most common write error.
• 03 Illegal Data Value — the address exists but the value is out of the accepted range (e.g. a 0–100% setpoint receiving 200).

See Modbus Exception Codes Explained for the full list.

Safe Write Practice

1. Test against a simulator first. Write to a slave simulator before the real device so you confirm addresses and scaling without risk.
2. Confirm read-only vs writable. Most register maps mark setpoints as RW and measurements as RO. Writes to RO registers return exception 02.
3. Double-check coil ON value. It is 0xFF00, not 0x0001.
4. Segment the network. Modbus has no authentication — anyone who can reach the device can write. Keep TCP/502 off the public internet. See Modbus TCP security risks.

Frequently Asked Questions

What is the difference between FC06 and FC16 in Modbus?

FC06 (Write Single Register) writes exactly one 16-bit holding register; the slave echoes the request back as confirmation. FC16 (Write Multiple Registers) writes a contiguous block of registers in one transaction, which is more efficient when you need to update several values atomically. Use FC06 for a single setpoint, FC16 for a block or for values larger than 16 bits that span two registers.

How do I write a coil in Modbus?

Use function code 05 (Write Single Coil) to set one coil to ON (value 0xFF00) or OFF (value 0x0000). Use function code 15 (Write Multiple Coils) to set a block of coils. Coils are single-bit booleans used for digital outputs, start/stop commands, and resets. Note the ON value is 0xFF00, not 0x0001.

Why does my Modbus write return exception code 02?

Exception code 02 is Illegal Data Address. It means the register or coil address you tried to write is not implemented on the slave, or you wrote past the end of the writable range. Some devices make registers read-only or only accept writes to specific setpoint ranges. Verify the address against the vendor's register map and confirm the register is writable.

Is writing to a Modbus device safe?

It depends what the register controls. Modbus has no authentication, so any client on the network can write. A setpoint write is usually safe; a start/stop coil write to a VFD or breaker is not. Always confirm the register map, write-test against a simulator first, and segment the Modbus network behind a firewall so untrusted clients cannot issue writes.

Further Reading

• How to Read Modbus Holding Registers (FC03)
• Modbus Function Codes Explained: FC01–FC06, FC15, FC16
• Modbus Exception Codes Explained
• Modbus TCP Security Risks