Host Link error responses E0–E6: meaning and fixes

What the error responses a KEYENCE KV series PLC returns over Host Link (E0, E1, E2, E4, E5, E6) mean and what usually causes them, based on the manual and on tests with real hardware.

Updated 2026-10-11

When a Host Link command cannot be processed, the PLC returns an error code, an E followed by one digit, instead of a value or OK.

Command

RD Command

␣

DM65535 Device out of range

CR Terminator

Error response 4 chars

E0 Error code device number error

CR LF Terminator

An error response is just the two-character code and CR LF. It does not tell you which command or which field was wrong.

Error codes

Code	Meaning	Common causes
`E0`	Device number error	A device, bank, unit or address number is out of range. A T, C, CTH or CTC number that the program does not use was specified. `MBR` / `MWR` was sent without registering a monitor
`E1`	Command error	An unsupported command was sent, or the command format is wrong
`E2`	Program not registered	`M1` (switch to RUN) was sent while no program is registered or while the RUN/PROG switch is at PROG
`E4`	Write protected	Tried to change a T, C or CTC set value of a write-protected program
`E5`	CPU error	`M1` was sent without clearing the CPU error
`E6`	No comment	`RDC` found no comment, or could not read it under heavy load

E3 is not defined.

Where E0 ends and E1 begins

An out-of-range device number does not always return E0. On a real KV-7500 we saw:

Command	Result	Why
`RD DM65535`	`E0`	one past the DM range (00000–65534)
`RD DM65536`	`E1`	a number that does not fit in 16 bits is treated as a format error

The KV-7500 also returned E1 for the high-speed counters CTH / CTC. Devices that a model does not have can come back as a format error.

E0 from timers and counters

Reading a T or C that the ladder program does not use returns E0, even for a single-point RD T0. The current values TC / CC and the set values TS / CS could be read even for unused numbers.

E0 and E1 from monitors

Monitor reads (MBR / MWR) require registering devices first with MBS / MWS. Reading without registering returns E0, as does reading after the registration is lost, for example when the PLC is power-cycled.

The KV STUDIO simulator returned E1 for the monitor commands even when they were correctly formatted. Assume monitors are not available on the simulator.

Catching error codes with KcpX

In KcpX, an error response raises a HostLinkException. Its ErrorCode property (a HostLinkErrorCode enum) gives you the code, so you can handle each code separately.

using KcpXLib;
using KcpXLib.Enums;
using KcpXLib.Exceptions;

try
{
    short[] dm = kcpx.BatchRead<short>(Prefix.DM, "65000", 1000);
}
catch (HostLinkException ex) when (ex.ErrorCode == HostLinkErrorCode.E0)
{
    // Device number out of range, or an unused T / C
}
catch (HostLinkException ex) when (ex.ErrorCode == HostLinkErrorCode.E1)
{
    // Format error, or a command / device the PLC does not support
}

KcpX also checks how the number is written before sending. Passing a non-hexadecimal number for a hexadecimal device such as B, or a relay bit number of 16 or more, raises a DeviceAddressException before anything is sent to the PLC. When the PLC does not respond, you get a TimeoutException.

The next article looks at the device ranges and the maximum number of points per command.

Host Link devices and point limits

Sources

KEYENCE KV-EP21V/KV-8000(A)/KV-7500/KV-5500/KV-NC1EP User's Manual, EtherNet/IP Functions (Japanese edition) chapter 8 pp.8-9, 8-15–8-17, 8-23, 8-36
Tests with KcpX on a real KV-7500 and the KV STUDIO simulator (2026-10-11)