classicdiy / modbustool

A modbus master and slave test tool with import and export functionality, supports TCP, UDP and RTU.

ModbusTool

A modbus TCP and RTU master and slave tool with import and export functionality.

Installation

There are two options available to download and install ModbusTool.

Option 1: Download from Github Releases

1. Visit the Github Releases page of ModbusTool.
2. Choose ModbusTool.msi to downloaad.
3. Once the file is downloaded, double-click on it to initiate the installation process.
4. Follow the on-screen instructions to complete the installation.

For detailed installation instructions and additional information, refer to the Github Wiki tutorial dedicated to this option.

Option 2: Install using winget

Winget is a command-line package manager for Windows that allows users to quickly and easily install, manage, and uninstall software applications from the terminal.

1. Ensure that you have winget installed on your system. If not, follow the instructions to install winget from the official Microsoft documentation.
2. Open a powershell or terminal window.
3. Execute the following command to install ModbusTool using winget:

winget install ClassicDIY.ModbusTool

4. Wait for the installation process to complete.

Once installed, you can launch ModbusTool and start using its master and slave test functionalities with import and export capabilities.

License

 Copyright (c) 2020. ClassicDIY

  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.

Release notes

---

version 2.0.1.1

• Merged PR to fix issue 17

---

version 2.0.1.0

• Removed function restrictions from ModbusSlave
• Fixed Slave Log of rx data
• Merged PR that adds polling and Float view

---

modbustool's Issues

ModbusTool

How do I send the command to the device?

I need to send 010301010040 command without bcc ..

Writing / Reading Coil not working

Im using the Lib as Slave and Reading coils wont work. If i write a coil from the master to this Slave the coil datavalue is 65280, but the master cannot read it back.

Question

Dear Graham,

Thanks a lot for writing a Software and making it available here.

Before I try and explore its capabilities I wanted to ask one question.

I am looking for a piece of Software that can read as a Master via Modbus TCP data from 3 Slaves each with its own IP address and that then can give out the read data via Modbus Slave (or Master if Slave is not possible) on a single IP address.

The idea is to bundle the information from 3 IP adresses to just 1 IP address.

Can you tell me if your Software can do this?
Or do you maybe know a Software that can do this? ( ;-) )

Your time of even reading this message is very much appreciated so thanks a lot again for your software and in advance also for your answer,

Chris

Established connection was aborted by host

Unfortunately, I am writing this issue at the office away from the machine on which this happened. Therefore, the only information i got is from my own memory. However, I am quite sure it was caused by something on my laptop.

What would happen is if I tried to read an input or holding register I would get the message "Established connection was aborted by host"
If I would set the action to poll (interval of 2000) and then reconnect, it would read the first 2 intervals fine and then return the same error.

Any idea on what might cause this?

Sending requests simultaneously to slave

Hey,
Is it possible to query slaves in parallel? The idea is that I am already connected and send two requests in parallel, then one request is not processed at all. Only if I make a delay between requests (min 95ms) then it will handle both requests. I've already set "Slave delay (ms)" to 0, but that didn't help. Is it a software fault or something on my side?

Throw exception when request has wrong quantity

Hey, I found a bug. When you try send request eg. with huge quantity then program will throw exception:

Application: ModbusSlave.exe Architecture version: v4.0.30319 Description: the process was 
aborted due to an unhandled exception. Exception information: 
System.OverflowException w 
ModbusLib.Protocols.ModbusCodecReadMultipleRegisters.ServerDecode(ModbusLib.Protocols.ModbusCommand, 
ModbusLib.ByteArrayReader) w 
ModbusLib.Protocols.ModbusTcpCodec.ModbusLib.Protocols.IProtocolCodec.ServerDecode(ModbusLib.CommDataBase) 
w ModbusLib.TcpServer.Worker() w 
System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, 
System.Threading.ContextCallback, System.Object, Boolean) w 
System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, 
System.Threading.ContextCallback, System.Object, Boolean) w 
System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, 
System.Threading.ContextCallback, System.Object) w 
System.Threading.ThreadHelper.ThreadStart()

Example request 000100000006010363c09c85

Master (RTU mode) becomes unresponsive when no slave response after clicking Read coils

I have Master in RTU mode. The UI becomes unresponsive (blocks) when there is no slave response after clicking Read coils or any other button. You should probably have a timeout as per Modbus spec.

feat(installer): Support update feature in installer

Would be really nice to have a update feature in the msi installer.

Installed version 2.0.2.2 to ModbusTool 2.0.3.0

Bug in modbusLib RTU Codec when message contains intermediate CRC

I found a weasily little bug in ModbusLib which can cause some data corruption, specifically ModbusLib.Protocols.ModbusRtuCodec.ClientDecode(), where, if by chance, the data of a register read happens to contain an intermediate CRC for the packet, the ClientDecode will return CommResponseAck early, which then causes the SerialPortClient.Query() to exit its reception loop early, and thereby missing the remains of the message.
ie, I have logs which look like the following:
TX: 01 04 00 00 00 1a 71 c1
RX: 01 04 34 bf 31 5d 78 41 9a ed 42 47 bf f8 97 41 d9

26 registers were requested, but, by chance, my noisy data happened to land such that
"41 d9"
is the CRC for
"01 04 34 bf 31 5d 78 41 9a ed 42 47 bf f8 97"
so it exited early, ignoring the last 20 registers and treating the 6th as the CRC

This appears to be because the Codec ClientDecode function does not take into account the bytecount in the 3rd byte of the read operations response, though I suspect it is possible to occur for writes as well, just far less likely.

Request: Entering addresses in hex

Most datasheets of modbus-capable devices show the addresses in hexadecimal. It would be nice if the same number base could be used in the tools.

写多个寄存器，buffer个数算错了，

public override void ServerDecode(
ModbusCommand command,
ByteArrayReader body)
{
ModbusCodecBase.PopRequestHeader(
command,
body);

        //var count = body.ReadByte() / 2;
        var count = body.ReadByte();
        command.Data = new ushort[count];
        command.QueryTotalLength += (count + 3);

        for (int i = 0; i < count; i++)
            command.Data[i] = body.ReadUInt16BE();
    }

Install instructions

I have installes the ModbusTool.msi file and double-clicked an icon. Nothing has happened.

I have Win 10 64bit, full update, dotnet framework 4.8.
What I am doing wrong?
Is there a user manual for non-coders?

Thank you!

Modbus slave "Write single coil" function returns invalid PDU

Hello @graham22!

First of all thank you for writing this tool, it's been very helpful during development of my own Modbus TCP implementation!

I came across something which deviates from the Modbus Protocol specification in the Modbus Slave tool (server):

When I write a single coil with value 0xFF00 at address 0x0000, the following message gets sent back to me (I have copied it from the Communication Log): TX: 00 10 00 00 00 06 01 05 00 00 00 01.

Manually decoding the message according to the Modbus Protocol spec using the "Modbus Application Protocol" document - section 6.5 "05 (0x05) Write Single Coil" leads to the following:

Transaction ID: 0x0010
Protocol ID: 0x0000
Length: 0x0006
Unit ID: 0x01

Function Code: 0x05
Output Address: 0x0000
Output Value: 0x0001

The part that's off is the "Output Value" field (the last 2 bytes of the message). According to spec this has to be either 0x0000 or 0xFF00 depending on what value was written to the coil. The returned value is neither of those two (and from my testing, is always 0x0001 regardless of whether a high or low value is written).

I have tried to figure out where this problem arises from, and I have been able to narrow it down to this file. Looking at the ServerEncode function, instead of the written value being pushed into the message, the message header is (using the PushRequestHeader function). This deviates from the specification.

Write Multiple Registers for slave not included

Function 0x10 (write multiple holding registers) is missing for the slave while function 0x06 (write single holding register) is there. Why? I mean, as long as you've chosen "03 Holding Register" at the "Function" section of the application, I think both functions should be available in order not to be a little bit too restricted when you're going to write registers as you are now.

How to make registers of different types?

When I try to make registers of different type it set all values to zero. How can I have multiple registers of different types in one simulator?

Dump log to file

Is it possible to dump the logs to a file?

Exception when Poll Checkbox selected

When I want to activate polling I get an Exception

Looking into the code I think the Timer never gets instantiated?

Modbus slave "Write Single Register" function returns invalid PDU

Hello once again, @graham22!

Similar to #4. A Non spec-compliant PDU is returned for the "Write Single Register" call when using the "Modbus Slave" tool.

Section 6.6 "06 (0x06) Write Single Register" of the Modbus Application Protocol document states the following:

The normal response is an echo of the request, returned after the register contents have been
written.

Writing a value 0xAAAA to address 0x0000 using the "Write Single Register" Modbus function, the Modbus Slave tool sends me the following response (copied from the Communication log): TX: 00 01 00 00 00 06 01 06 00 00 00 01

Manually decoding it leads to the following:

Transaction ID: 0x0001
Protocol ID: 0x0000
Length: 0x0006
Unit ID: 0x01

Function Code: 0x06
Register Address: 0x0000
Register Value: 0x0001

The Register Value field is not equal to the written value (0xAAAA).

Going through the code, the bug seems to be in this file in the ServerEncode method. Instead of the written register value being pushed into the message, the message header is (using the PushRequestHeader function). This deviates from the specification.

Failed to execute Write: Error Code 2

I'm having issue sending command to my slave. I got this error from the console.

The strange thing is that data on the slave are correctly writte on the register when I run the write multiple register.

For istance, if I try to write on the register 29 the number 5, the Modbus Master send the string over serial (I'm using MODBUS RTU with an USB-RS485 adapter)

01 10 00 1D 00 01 02 00 05 65 DE

And I got the response

00 7f f7 c5 ff fd dd c2 00

and the Error code 2

Why the write goes well as I can see the register get updated with the data I requested to write but I got this error?

ModbusTool Slave : Single and Multi Registers

Greetings,
There is probably a bug with the Modbus Slave Tool. We are not sure.
It seems that single write to the software is not standard Modbus, the feedback code is wrong.
And multi write got no response.
Can you confirm ?
Thanks

window size

the window size is bigger than my laptop screen and i can't show below side and can't scroll down!

readings became unavailable

Correctly connected to the slave device. Tried to read registers and everything was ok. Then I selected "write single register" without pressing "Apply" and from that moment I'm no more able to read anything more...not even in Home Assistant, all sensors are now unavailable!!!
Please help me to solve this issue

Datalength entry in hexadecimal form

Although DataTab.DataLength getter has code to handle hexadecimal entries, the MaxLength property of txtSize = 3 effectly blocks using that feature. The setter will use decimal representations only.

Can not enter IP Adress Version 2.1.0.0

I don´t know why, but there is nor field for entering an IP adress ?

Which Adresse i have to type into the field "start-Adress" and "size"?

Hello,
I have problems to know, what i have to type into the fields "start-Adress" and "size". I use the energy-meter-device B+G DS100 30B.
The Adresses are in the file. Which adresses i have to give in, when i want to get for example values for the first register (31025).
Is there a documentation?
Best regards
Thomas

I can't choose any port name

Both in master and salve ı cant choose the port name, what am ı doing wrong ?

Slave ignores writes to addresses other than 0

Writes are denied, slave says:

Received address is not within viewable range, Received address: 1

See https://github.com/graham22/ModbusTool/blob/master/ModbusSlave/SlaveForm.cs#L340
Checks are always denied, because it's using https://github.com/graham22/ModbusTool/blob/master/CommonControls/BaseForm.cs#L20 which is always 0

Unable to see Communication log in screen 1366x768

Hi Team,
My LCD 27 inch has resolution 1366x768.
I can not see the Communication log at the bottom.

Could we make the register list smaller? E.g to show 10 registers only.
Big register list is confusing.
Then we have some room to fit in the communication log.

Thanks a lot.

Feature request: Passive logging of modbus communication

I've connected two instances of modbusmaster to a single modbus slave like this:

• <-RS485 to USB converter(COM7) -> first Modbus master
  |
  +-> RS485 to USB converter(COM14) -> second Modbus master
  |
• Modbus slave

When I then do a read holding registers from the first modbus master, the log window of the second modbusmaster stays empty.

Can modbusmaster be changed to decode modbus communication, even when it wasn't generated by itself?

My versions:
Modbus master 2.1.0.0
Windows 10 Home 21H2

Modbus slave always returns value 0

Hi team,
Thanks for the lovely tool.
I suspect there is an issue in Modbus slave.
The address 4918 is 0x1336 in the communication log. So this is correct.

I did click Apply button.
However, the tool returns 00 00 instead of 12 34.
Please help to advice.
Thanks a lot.

Will RTU over TCP be included?

Hello, is there any Plan to include RTU over TCP?
See: https://www.simplymodbus.ca/TCP.htm
Or stephane/libmodbus#445

Best Regards,
Bernd