PortDock

PortDock Modbus Slave Guide

Modbus slave simulator (RTU and TCP) with register tables and fault injection

About this program

PortDock Modbus Slave makes the PC answer as a Modbus slave (server) device over serial (Modbus RTU), a TCP server (Modbus TCP) or a TCP server (RTU over TCP).

It replies to read and write requests from a master (PLC, HMI, controller, etc.) using the values in the register tables on screen. It also mimics 32-bit, float and string types with byte orders, cell names and automatically changing values (increment, random, sine…).

It can inject delays, no response, exceptions and CRC (MBAP) errors on purpose to test the master's error handling, targeted by Slave ID, function, address, every Nth request or probability.

Getting started

  • 1. Choose the «Connection» on the left. For serial, set «Port», «Baud rate», «Data bits», «Parity» and «Stop bits» exactly as on the master; for TCP, set the «Bind address» (usually 0.0.0.0) and «Port» (usually 502).
  • 2. Check that «Slave ID» contains the ID the master polls (default 1). If not, enter 1–247 and click «Add».
  • 3. Pick a table at the top (e.g. «Holding registers») and enter values. You can do this before connecting. For 32-bit values, floats or names, open «Cell settings» with a cell's ⋯ (or right-click). The «Typed…» entry in the «Format» list also opens «Cell settings» for the selected cell.
  • 4. Click «Connect» («Start» for TCP). Master requests are answered at once. Traffic and its decode («id1 FC03 HR 0..9 (10)») appear in «Traffic» at the bottom.
  • On first start these steps appear as a card in the empty «Traffic» area. On the card you can pick how addresses are numbered (0-based, 1-based, 40001 — same as «Addresses» at the top). «Fill example values» puts 1–8 into holding registers 0–7 and F32 CDAB 23.5 into 8–9 of this Slave ID, with names (Status, Setpoint, Temperature) and types (asks first if those registers hold values) — read from a master, you see at once whether addresses are shifted and the word order matches. «Import CSV…» reads a register map made in Excel (see «Export and import tables»). «Don't show again» hides it; afterwards only the line «When the master reads, it shows up here in «Traffic»» remains.

Screen layout

  • Left: «Connection», port (or address and port) settings, «Connect»/«Disconnect», status, «Slave ID». Below them «Fault injection (testing)», «Device identification (FC 2B/0E)» and «Statistics» are collapsed; click a title to expand it (the state is remembered). The collapsed «Fault injection» title shows «off», and «Statistics» shows «n requests · m exceptions».
  • Top: the four table buttons, the Slave ID being viewed («Slave ID 1»), «Fill», «Export table», «Import table». Below them «Start», «Count», «Format», «Addresses», the «Grid»/«List» view buttons and a grey «Answered range: HR 0–99» line.
  • Middle: the register table. «Grid» view shows compact cells (address · name · value · type · ◷ · ⋯); «List» view shows one row each with address, name, type, value and simulation.
  • Bottom: «Traffic» (RX ◀ requests, TX ▶ replies, EV events) with the find/filter bar, «Log to file» and «Clear».
  • Drag the bar between the table and «Traffic» up or down to change the traffic height; it is remembered (double-click to reset; with the bar focused, ↑/↓ work too). The default leaves plenty of table visible in a small 1000×640 window.
  • 📌 in the header: always on top — keeps this window above others (same as «Always on top» in Settings).
  • The window title shows the current state (e.g. «COM3 115200 8N1 · Connected ● REC — PortDock Serial»), so you can tell windows apart on the taskbar.
  • At 900 px wide or less (e.g. half-screen snap) the left connection panel folds away and a summary line with «⚙ Connection» and the connect button appears. «⚙ Connection» opens the panel; ✕ or clicking outside closes it.

Connection — serial (RTU)

  • «Port»: the COM port wired to the master. Only the port is locked while connected; other settings apply immediately.
  • If the saved port is not in the list, the same device is picked (by serial number, else VID:PID), otherwise the first port, with a note such as «Saved COM3 not found — switched to COM7».
  • If connecting fails, the status box turns red with «Connection failed · reason». For a busy port, check whether another program is using it.
  • «Baud rate»: pick from the list (1200 to 115200) or type a number.
  • «Data bits»: 8 or 7. Modbus RTU normally uses 8.
  • «Parity»: «None», «Even» or «Odd». The Modbus standard default is even, but devices differ, so match the master.
  • «Stop bits»: 1 or 2. Usually 2 with no parity and 1 with parity.
  • Baud rate, data bits, parity and stop bits can be changed while connected and apply without disconnecting (a SET line is logged).
  • Flow control is not used. If a USB adapter is unplugged the status becomes «Waiting for device», and the same device is reconnected automatically when it returns.
  • Framing is set to Modbus RTU and RX checking to CRC16 Modbus automatically. Requests split by a USB adapter (16 ms latency) are rejoined by their expected length (including 16, 17, 08 and 2B).

Connection — TCP server (Modbus TCP · RTU over TCP)

  • «TCP server (Modbus TCP)»: the PC becomes a Modbus TCP device. It reads the MBAP header (transaction ID · protocol ID 0 · length · Unit ID) and echoes the transaction ID and Unit ID in replies. The MBAP Unit ID field is the Slave ID. There is no CRC.
  • «TCP server (RTU over TCP)»: exchanges the same RTU frames as serial (ID + PDU + CRC) over TCP. Use it to mimic a device behind a serial device server (gateway).
  • «Bind address»: the local adapter to listen on. 0.0.0.0 listens on all adapters. On the master, enter this PC's IP (e.g. 192.168.0.10) and the port.
  • «Port»: 502 by default. 0 lets the OS pick a free port; the real address appears in the status box. If the port is taken, starting fails with «Port already in use».
  • After «Start» the status reads «Listening — waiting for the master to connect» with «n client(s) connected» below it (hover for the addresses). Several masters can connect at once and each is answered (up to 64).
  • «Ignore Slave ID (answer any, incl. 0/255)»: when on, any Slave ID is answered — from that Slave ID's tables if it is in the list, otherwise from the first one's — and the received Slave ID is echoed. When off, unlisted Slave IDs are ignored («IGNORED unit 5») and 0 is a broadcast (write only, no reply). It applies immediately, even while running.
  • Requests with a bad MBAP header (protocol ID not 0, length field different from the real length) are not answered; they are logged as «IGNORED bad MBAP header» and counted as «MBAP errors».
  • Two requests arriving in one TCP segment, or one request split across segments, are separated or joined using the MBAP length field.
  • Over TCP, new requests are accepted while a delayed reply is pending (BUSY ignoring is serial only).

Slave ID

  • The Slave ID is the device number the master puts at the start of each request (in Modbus TCP, the MBAP Unit ID field). The program can simulate several Slave IDs at once; each has its own four tables and cell settings.
  • Enter 1–247 and click «Add» (or press Enter) to add an ID. 0 (broadcast), 248 or more and duplicates turn the box red with the reason.
  • Click an ID button to view that Slave ID's tables. Remove one with × (at least one must remain); «Undo» in the notice restores it, table values and cell settings included, for 5 seconds.
  • Requests to Slave IDs not in the list are not answered and are counted as «Other Slave IDs» (unless «Ignore Slave ID» is on for TCP).

Tables and function codes

  • «Coils» 0x: read 01, write single 05, write multiple 0F. Values are on/off (checkboxes).
  • «Discrete inputs» 1x: read 02. Values are on/off (checkboxes). The master cannot write them.
  • «Holding registers» 4x: read 03, write single 06, write multiple 10, mask write 16, read/write multiple 17. Values 0–65535.
  • «Input registers» 3x: read 04. Values 0–65535. The master cannot write them.
  • 16 Mask Write Register: new value = (current AND and-mask) OR (or-mask AND NOT and-mask). The reply echoes the request.
  • 17 Read/Write Multiple Registers: as the standard requires, the write is done first, then the read (overlapping addresses read the new values). Read 1–125, write 1–121. If either range is outside the answered range, exception 02 is returned and nothing is written.
  • 08 Diagnostics: only sub-function 00 (Return Query Data — echoes the data back). Other sub-functions get exception 01.
  • 2B/0E Read Device Identification: basic level — object 0 vendor, 1 product code, 2 revision. Read codes 1 (stream), 2 and 3 (answered at this device's basic level) and 4 (individual). An unknown object read individually gives exception 02, codes 0 and 5+ give exception 03, a MEI type other than 0E gives exception 01. Edit the strings under «Device identification (FC 2B/0E)» on the left.
  • Any other function code gets exception 01 (Illegal Function).
  • Quantity limits per request: 01/02 1–2000, 03/04 1–125, 0F 1–1968, 10 1–123. Out of limits or malformed gives exception 03 (Illegal Data Value).
  • A 05 write accepts only «FF 00» (on) or «00 00» (off). Anything else gives exception 03.

Start, count, format and addresses

  • «Start» and «Count»: the address range this slave answers in this table. Default is 100 cells from 0. Changing them changes not only the view but also the range the master can read and write.
  • Reads or writes outside this range get exception 02 (Illegal Data Address). Use it to test how the master handles address errors.
  • Normally a grey line at the end of the toolbar shows the range being answered, e.g. «Answered range: HR 0–99» (in the current «Addresses» style). After you change it from the default (100 cells from 0), a yellow note «⚠ Changing this also changes the address range the master can read …» appears; «Got it» returns that range to the grey line.
  • «Addresses»: «0-based» is the address on the wire (protocol address), «1-based» counts from 1 like most manuals, «PLC (40001)» uses 40001/30001/10001/00001 notation (6 digits above 9999, e.g. 410000). It applies to cell addresses, the «Start» box, the fault address range and the traffic decode.
  • With «1-based» or «PLC», type the 1-based number into «Start» (e.g. 40001 = 1). The address column in CSV files is always 0-based.
  • Up to 2000 cells are shown on screen. Replies still cover the whole range.
  • «Format» (plain U16 register cells): U16 (0–65535), S16 (-32768–32767), HEX (4 digits), BIN (16 digits). Cells with a type (S16, F32, …) are shown in that type. «Format» is a view of the whole table; float, 32-bit and string types are set per cell — pick «Typed… (32-bit, float, string)» at the end of the list to open «Cell settings» for the last selected cell (or the first cell).
  • Type a value and press Enter or click elsewhere to apply it. Invalid input turns red and reverts. In integer cells a «0x» prefix is read as HEX.
  • When the master changes a value, the cell is highlighted briefly and its tooltip reads «Changed by master» (simulated cells are not highlighted).
  • «Fill»: fills the visible range with 0, 1, 2… (coils and discrete inputs get 0, 1, 0, 1…), one register at a time regardless of cell types.
  • «Grid»/«List» view buttons: «Grid» shows compact cells; «List» shows address, name, type, value and simulation on one row each. Values can be edited in both.
  • Table values and cell settings for every slave and every table (not just the visible cells) are kept when you restart the program. Both your edits and values written by the master are saved about 1 s after they change.

Cell settings — name, type, word/byte order

  • Every cell has a faint ⋯ on the right (it darkens on hover or when you enter the value box). Click ⋯, right-click the cell, or pick «Typed…» in «Format» to open «Cell settings». Esc, ✕ or clicking outside closes it.
  • «Name»: a label for the cell (e.g. Temperature). It appears next to the address in Grid view, in the «Name» column in List view, and in CSV exports.
  • «Type»: U16, S16, U32 (2 regs), S32 (2 regs), F32 float (2 regs), F64 double (4 regs) or String (1–250 bytes, 2 bytes per register). Multi-register types are shown as one wider cell and edited at once; a small tag such as «F32 CDAB» shows the type and order.
  • «Word/byte order»: ABCD = big end first (Modbus default), CDAB = word swap (low word first), BADC = byte swap, DCBA = both (little endian). Example: F32 123.456 → ABCD 42F6 E979, CDAB E979 42F6, BADC F642 79E9, DCBA 79E9 F642. It must match the master to read the same value. Strings only use the byte swap (BADC/DCBA).
  • Overlapping another typed cell gives «Overlaps the cell at …». Reset that cell to default first.
  • «Reset to default»: clears the name, type and simulation and returns to a plain U16 cell. The register values are kept.
  • A typed cell cut off by the end of the visible range is shown one register at a time (widen the range to see it grouped).
  • Many cells at once: click one cell, then Shift+click another to select the range (highlighted); a bar «n cells selected — Type, Order, [Apply to all]» appears above the table. 32-bit types (U32, S32, F32) group two registers each and F64 four, from the start; cells left over at the end stay as they are. Old types overlapping the range are removed and a name on a group's first cell is kept. Values do not change (the same registers are read in the new type). A plain click or «Clear selection» clears it.

Value simulation

  • Choose it under «Simulation» in «Cell settings». Simulated cells show ◷; hover it to see the settings (List view has a «Simulation» column).
  • Increment/decrement: adds or subtracts «Step» from the current value. On reaching «Max» («Min» for decrement) it wraps to the other end if «Wrap around at the end» is on, otherwise it stops there.
  • Random: any value between «Min» and «Max» (whole numbers for integer types). Sine: swings around «Offset» by ± «Amplitude» once per «Period (ms)». Ramp: rises from min to max over one period, then starts again. Toggle: 0 ↔ 1 (coils and discrete inputs allow toggle and random only).
  • The value changes every «Update every (ms)» (50–3,600,000), or, with «Change on every master read», each time the master reads that cell (01–04, 17).
  • It runs inside the program (backend), so values keep changing while the window is minimized. Typed cells (F32, CDAB, …) are written in their type. Strings cannot be simulated.
  • A value written by the master stays until the next change; increment/decrement continue from it. If the master writes a value outside the range, increment restarts from min (decrement from max).
  • Simulation settings are saved with the table values and included in JSON exports (CSV carries values, types and names only).

Export and import tables (CSV, JSON)

  • «Export table»: saves the whole range of the current Slave ID/table. A file name ending in .csv writes CSV (for Excel), .json writes JSON.
  • CSV layout: header «table,address,type,order,name,value», UTF-8 with BOM (Korean text opens correctly in Excel). address is 0-based, type is u16/s16/u32/s32/f32/f64/string(len)/bit, order is ABCD/CDAB/BADC/DCBA. A typed cell is one row (e.g. «holding-registers,10,f32,CDAB,Temp,23.5»).
  • «Import table»: pick a CSV or JSON file. CSV rows name their own table, so they can fill other tables of the current Slave ID too. Short table names (CO, DI, HR, IR, 4x…) and type names such as float, int32 or double are accepted, as are semicolon- or tab-separated files.
  • «Emulate device…»: pick one of the 10 built-in devices (LS ELECTRIC S100 and G100 inverters and GIMAC1000 power meter, Autonics TK and TX temperature controllers and MT4W panel meter, Hanyoung NUX VX temperature controller and LC counter/timer, Rootech Accura 3300E and 2300 power meters) to fill each table of the current Slave ID with its register names (unit and scale included), types and example values; answered ranges grow if needed. With «Also apply serial settings» the serial settings are set to the manual's factory baud, data bits, parity and stop bits (the Slave ID is not changed — check the default ID shown in the dialog). Values are examples (mostly 0; the range end if 0 is out of range; the first state for enumerations; the model name for strings), not real readings — use it to test a master or HMI program without the device.
  • An empty value keeps the register values and only sets type/name. A row without type and name turns that address back into a plain cell.
  • If any row is wrong (unknown table/type/order, address outside 0–65535, a value that does not fit the type, overlapping or repeated addresses), nothing is changed and the problems are listed with Excel row numbers, e.g. «Row 3: unknown type «f33» …» (first 6).
  • Rows outside the answered range («Start»/«Count») are loaded, with a reminder to widen the range so the master can read them.
  • JSON files from earlier versions still load. If the file's Slave ID/table differs from the one you are viewing, you are asked «The file targets Slave ID/table …, but you are viewing …. Load it into the current table?». A malformed file gives «Invalid table file (check start and values 0–65535).».

Broadcast (ID 0)

  • A request sent to ID 0 is a broadcast. Writes (05, 06, 0F, 10, 16, 17) are applied to every slave this program simulates.
  • As the Modbus standard requires, broadcasts are not answered. The log shows e.g. «BROADCAST fc 06 (no reply)».
  • Fault injection is not applied to broadcasts. Over TCP with «Ignore Slave ID» on, Slave ID 0 is answered like any other request.

Fault injection (testing)

These options test whether the master copes with bad replies (retry, alarm, communication error display, etc.). The panel is collapsed by default with «off» next to its title. When any fault is on, the title turns into a red «⚠ Fault injection ON» and the panel expands (if you collapse it, the active faults stay listed next to the title), «⚠ Fault injection (testing)» is shown below, followed by «— Target: Slave ID 1 · FC 03 …» when a target is set.

  • «Response delay (ms)»: sends each reply late by this time. Tests whether the master's timeout is set correctly.
  • On serial, a request that arrives during the delay (before the reply is sent) is ignored, like a real device that handles one request at a time. The log shows «BUSY …» and it counts as «Ignored (BUSY)».
  • «Do not respond (timeout test)»: requests are processed (writes go into the table) but nothing is sent. The log shows «NO-RESPONSE (fault)».
  • «Reply with exception»: answers with the chosen exception code (01, 02, 03, 04, 05, 06, 0A, 0B); nothing is written.
  • «Corrupt CRC» (serial, RTU over TCP): replies (including exception replies) are sent with a wrong CRC.
  • «Corrupt MBAP length» (Modbus TCP): the reply's MBAP length field is one too large. Tests whether the master waits for the missing byte and times out, or rejects the length.
  • Open «Advanced — target, every Nth, probability, delay range» for:
  • «Max delay (ms, 0 = fixed)»: when above 0, each reply is delayed by a random time between «Response delay» and this value (jitter), logged as «DELAY 350 ms (fault)».
  • «Only these Slave IDs» / «Only these function codes (hex)»: comma-separated; empty = all. «Only this address range»: only requests whose address range overlaps it (in the current «Addresses» base; an empty end means the first/last address). 08 and 2B requests have no address and are excluded when an address range is set.
  • «Every Nth request (1 = every)»: once every N matching requests (3 = 3rd, 6th, 9th…). «Probability (%)»: chance per matching request. Together, the probability applies to every Nth request.
  • An invalid box turns red with the reason, and the last valid value stays in use.
  • Fault settings are not saved. Every start begins with all faults off.

Device identification (FC 2B/0E)

  • When the master asks with 2B/0E (Read Device Identification), the reply uses «Vendor (object 0)», «Product code (object 1)» and «Revision (object 2)». All slaves share these values.
  • Each box holds up to 80 bytes (a Korean character takes 3). A longer value turns the box red and is not applied. The values are saved for the next start.

Statistics

  • Collapsed by default with «n requests · m exceptions» next to the title (red when there are exceptions or CRC errors). Click the title to expand the table.
  • «Requests to my Slave IDs»: requests to simulated Slave IDs (broadcasts included).
  • «OK replies» / «Exceptions»: normal replies and exception replies sent.
  • «Other Slave IDs»: requests to Slave IDs not in the list, not answered.
  • «CRC errors» («MBAP errors» for TCP): malformed frames that were ignored. If they grow, check baud rate, parity and wiring (for TCP, the master settings).
  • «Writes»: times the master changed a table. «Ignored (BUSY)», «No reply (fault)» and «Broadcasts» appear only when they occur.
  • «By function»: requests to my Slave IDs per function code, e.g. «FC03×12 · FC10×3».
  • «Reset»: sets the counts back to 0.

Traffic and event lines (EV)

The traffic view keeps up to «Lines kept on screen» in Settings (100,000 by default) and draws only the visible lines, so it stays fast. A request with a wrong CRC gets a red «CRC» badge and «CHECK FAIL n» appears in the toolbar (click it to show only those lines).

  • «Decode»: adds a Modbus decode to request and reply lines — requests «id1 FC03 HR 0..9 (10)», writes «id1 FC10 HR 100..101 ← 1, 2», replies «id1 FC03 HR 0..9 → OK: 1, 2, 3 …», exceptions «→ exception 02 Illegal Data Address» (in red). TCP lines start with the transaction number («#12»). Addresses follow «Addresses». Hovering a line shows it too.
  • Over TCP each line also shows the peer address (e.g. 192.168.0.20:51234).
  • Find/filter bar: search HEX («01 03») or text, and filter by «Matches only», «FAIL only» or direction (RX, TX, EV). Filtering changes the view only.
  • OPEN: the port was opened (with settings such as port, baud and 8N1). LISTEN, ACCEPT, CLOSE: the TCP server started listening, a master connected, a connection closed (with the reason).
  • FRAMING modbus-rtu-request @baud, RXCHECK crc16-modbus: the automatic framing and RX check.
  • SET: a setting changed while connected, e.g. «SET baud 9600→19200».
  • LOST: the device was removed or a read failed. RECONNECT: the same device was reopened. CLOSE: the port was closed.
  • LOG START: file logging started.
  • EXCEPTION 02 → id 1 fc 03: Slave ID 1 answered a function 03 request with exception 02.
  • BROADCAST fc 10 (no reply): a broadcast write was applied and not answered.
  • NO-RESPONSE (fault) id 1 fc 03: not answered because «Do not respond» is on. DELAY 350 ms (fault): the delay picked from the delay range.
  • IGNORED bad CRC: the request had a wrong CRC and was ignored. IGNORED bad MBAP header: the TCP request's protocol ID or length was wrong.
  • IGNORED id 5 (not simulated) / IGNORED unit 5: the Slave ID is not in the list, so it was ignored.
  • BUSY: a request that arrived before a delayed reply was sent was ignored (serial).
  • If our own reply comes straight back (RS-485 echo, etc.), it is not answered again.
  • «Log to file»: appends every line to the chosen file (an existing file is appended to). A line looks like «2026-10-17 21:05:03.123 RX 01 03 00 00 00 0A C5 CD [OK]». The decode is shown on screen only.
  • «Clear»: empties the on-screen traffic only.
  • Follow: new lines are followed only while you are at the bottom. Scroll up to pause (the view stays put) — «↓ Jump to latest (n new)» appears at the bottom right. Click it, press End or scroll to the bottom to follow again. The «Auto-scroll» checkbox shows whether it is following.
  • Selecting: click a line, Shift+click for a range, Ctrl+click to add or remove one. Clicking does not stop following.
  • Right-click menu: Copy lines · Copy HEX · Copy ASCII · Copy HEX + ASCII · Copy as C array ({0x01, 0x03}) · Find this. Data copies (HEX, ASCII, C array) skip event lines (EV), one frame per line.

Warning messages

  • «Delays of 1 s or more exceed most master timeouts (typically 1 s) and look like no response.»: the delay test may turn into a no-response test. Also shown when the max delay is 1 s or more.
  • «Max delay is below the delay, so a fixed delay (… ms) is used.»: to use a range, set «Max delay» above «Response delay».
  • ««Do not respond» is on, so the exception reply is not sent either.»: with both faults on, no response wins. Turn «Do not respond» off to test exceptions.
  • «⚠ Fault injection (testing)»: at least one fault is on. Turn them off before normal communication tests.
  • «⚠ Changing this also changes the address range the master can read — Answered range: … Reads outside this range get exception 02.» (yellow): shown only after «Start»/«Count» are changed from the default. They set both the view and the answered range. If the master receives exception 02, widen them. «Got it» dismisses it.
  • «Enter the bind address»: the TCP server's «Bind address» is empty, so it cannot start. Use 0.0.0.0 for all adapters.
  • Settings: «Automatic logging will not start until a folder is chosen.»: you turned on «Start file logging on connect»; pick a folder with «Choose».
  • Settings: «Stop the connection and logging before importing.»: «Disconnect» and «Stop logging» first.

Settings (⚙)

  • «Language»: 한국어 or English.
  • «Theme»: «Follow Windows», «Light» or «Dark».
  • «Font size (px)»: 11 to 18.
  • «Log timestamp»: «hh:mm:ss.ms», «Date + time», «UTC» or «Elapsed since start (Clear resets)». Applies to the traffic view (the file log always uses date + time).
  • «Lines kept on screen»: 1,000 to 1,000,000 (default 100,000). Older lines are dropped from the screen only.
  • «Auto-scroll on new lines»: follows the traffic to the bottom (not while you are scrolled up).
  • «Start file logging on connect»: with an «Auto-log folder» chosen, every connection logs to «portdock-modbus-slave-date-time.log».
  • «Ask before closing while connected or logging»: protects a running test from an accidental close.
  • «Export settings» and «Import settings»: move display settings, connection type, Slave IDs, ranges, table values, cell settings (names, types, simulation) and device identification as a JSON file (faults excluded). Files from other PortDock programs are refused.
  • «Reset to defaults»: resets display settings only.
  • «Always on top»: keeps this window above other windows (same as 📌 in the header).
  • «Expand all (expert view)»: shows the groups that are normally collapsed (advanced connection, receive settings, fault injection, statistics, scan options, triggers, auto-reply …) open. Folding one while it is on lasts only for this run. Turning it off returns each group to its remembered state.

Shortcuts and tips

  • F4: connect / disconnect (same as the button on the left).
  • Ctrl+L: clear the on-screen log (file logs are kept).
  • Ctrl+Shift+L: start / stop logging to file.
  • End: jump to the latest log line and follow again.
  • Ctrl+C: copy the selected log lines as «time direction data» (in the current view). Inside a text box it copies normally.
  • Ctrl+F: focus the log find box. In it, Enter next, Shift+Enter previous, Esc clear.
  • F1 or the ? button: this help. Close it with Esc.
  • Number boxes: ↑/↓ by 1, Shift+↑/↓ by 10, PageUp/PageDown by 100, or the mouse wheel once the box is focused. The baud box steps through the listed rates.
  • Shortcuts are ignored while a dialog or the right-click menu is open, or while composing Korean text.
  • Enter in the Slave ID box: «Add».
  • Value cells: Enter/↓ next cell, ↑/Shift+Enter previous (applies as you move), Esc cancels the edit. Right-click a cell: «Cell settings».
  • Paste several cells copied from Excel etc. (values separated by tabs, new lines or commas) into a value cell to fill consecutive cells at once. Each cell reads its value in its own type (plain U16 cells use the current «Format»); if any cannot be read nothing is pasted and a notice says why. Values beyond the range are dropped.
  • Values can be entered before connecting; changes while connected apply from the next request.
  • Keeping the master's screen next to this table and changing values while watching it is a quick way to check reads. If a 32-bit value reads strangely, try another order (CDAB etc.) in «Cell settings».

Troubleshooting

  • No port listed: check the COM port and adapter driver (CH340, FTDI, CP210x, etc.) in Device Manager. The list refreshes every 1.5 s.
  • «Already connected or connecting»: this program is already connected or connecting. «Disconnect» and try again.
  • «Access is denied»: another program is using the port. Close it.
  • Requests arrive but no reply: look at the EV lines. «IGNORED bad CRC» means baud rate, parity or stop bits differ from the master. «IGNORED id …» / «IGNORED unit …» means you should add that ID to «Slave ID» or (TCP) turn on «Ignore Slave ID».
  • No RX lines at all: check wiring (RS-485 A/B swapped, etc.) and the port. For TCP, check whether «clients connected» is 0 — if so, check the master's IP/port and Windows Firewall (allow this program).
  • TCP «Port already in use»: another Modbus program (or another PortDock window) uses that port. Close it or use another port.
  • The master gets exception 02: the address is outside «Start»/«Count». Also check whether the manual counts from 1 (40001) — set «Addresses» to «1-based» or «PLC» to see the same numbers as the manual.
  • 32-bit or float values read wrong: check that the type and «Word/byte order» in «Cell settings» match the master (ABCD vs CDAB is the most common mix-up).
  • The master times out: check whether a fault injection option is on («⚠ Fault injection»).
  • Windows 7 is not supported. Use Windows 10 or 11.
  • The program does not open: it needs Microsoft Edge WebView2. Windows 11 includes it; otherwise the installer downloads it (internet required). On an offline PC, install the WebView2 Runtime installer separately.