PortDock

PortDock Modbus Master Guide

Modbus RTU/TCP master (poll tool) — typed values, writes, Slave ID scan

About

PortDock Modbus Master is a Modbus «master» (poll tool) that asks devices — PLCs, drives, meters, sensors — for data, instead of an HMI. It speaks serial RTU, Modbus TCP and RTU over TCP.

  • Several tables (tabs), each with its own Slave ID, function (01/02/03/04), addresses and poll interval.
  • Values as U16, S16, U32, S32, F32, F64 or strings with word/byte order (ABCD, CDAB, BADC, DCBA), HEX/BIN, and a name per address.
  • Double-click a cell to write (05/06/0F/10). Slave ID and address range scans, request/response HEX with decoding, per-table statistics, CSV value logging and trend lines.
  • Free (GPL-3.0), Korean and English UI.

Getting started

  • On first start a «What kind of device?» card appears above the value cells. [Modbus TCP (Ethernet)] or [Modbus RTU (serial)] sets the connection type and moves to the next box to fill (device address or port). You can also pick the address notation (0-based, 1-based, PLC 40001) there. It hides once you connect or click «Don't show again». On the first connection a one-time notice explains double-click to write and right-click for types.
  • 1. Pick the «Connection» on the left. For serial, match the port, baud, parity and stop bits to the device; for TCP enter the device IP and port (usually 502).
  • 2. «Connect» (F4). Tables are read at their «Every (ms)» interval.
  • 3. In the table settings set «Slave ID», «Function», «Start» and «Count» from the device manual. The last read (✓ time and response time, or ⚠ the reason) shows above the cells.
  • 4. «+ Table» adds another table. The number on a tab counts that table's errors so far (timeouts, CRC, exceptions) — red while it is failing now, grey once reads succeed again (Statistics «Reset» clears it).
  • 5. To change a value, double-click its cell (coil and holding register tables only).

Layout

  • Left: connection and port (or IP), the «Communication details» section (response timeout, retries, delay between polls, «write single values with write multiple»), connect button and status, «Pause all polling», «Scan…», the «Statistics (all)» section. The value log (CSV) is «Value log ▾» on the table toolbar. Drag the bar above the traffic to resize it (remembered; double-click to reset).
  • «Communication details» and «Statistics» are collapsed with a summary next to the title («timeout 1000 ms · retries 0 · delay 20 ms», «n requests · m errors»). Communication details start expanded when they differ from the defaults; the open state is remembered.
  • Top middle: table tabs (⏸ = not polling, ● = last read failed, number = errors so far — red while failing now, grey otherwise), table settings (name, Slave ID, function, start, count, interval, poll, read once) and view settings (display, addresses, grid/list, 📈 trend, CSV).
  • Middle: value cells. Cells that changed since the previous read flash briefly. If the last read failed, the cells are dimmed (previous values) and the reason is shown above.
  • Bottom: trends (when added) and the traffic log.
  • 📌 in the header: always on top — keeps this window above others (same as «Always on top» in Settings).
  • The window title shows the current state (e.g. «COM3 115200 8N1 · Connected ● REC — PortDock Serial»), so you can tell windows apart on the taskbar.
  • At 900 px wide or less (e.g. half-screen snap) the left connection panel folds away and a summary line with «⚙ Connection» and the connect button appears. «⚙ Connection» opens the panel; ✕ or clicking outside closes it.

40001 notation — addresses

Addresses on the wire start at 0 («0-based»). Device manuals often count from 1 («1-based») or use PLC notation where the first digit names the table (00001, 10001, 30001, 40001).

  • Set «Addresses» to match the manual and the cells, the start box and the traffic decoding all use it. The address actually sent is the same.
  • PLC notation: 0xxxx coils (01/05/0F), 1xxxx discrete inputs (02), 3xxxx input registers (04), 4xxxx holding registers (03/06/10). 40001 = holding register 0, 40010 = 9. From the 10000th on it has six digits (410000).
  • In PLC notation, typing an address with another prefix such as «30001» in the start box also switches the function to that table (04). A short number like «15» means the 15th (1-based) of the current table.
  • In 0-based or 1-based mode, typing something that looks like PLC notation («40001», «30001») into the start box reads it as typed (0-based: address 40001) but shows a yellow notice — «in PLC notation it is address 0 (FC03)» — with [Switch to PLC notation], which switches the notation and sets the start and function to that address.
  • If you get exception 02 (illegal address) or values look shifted by one, 0-based and 1-based are usually mixed up — move the start by one.

Value types and byte order

  • Right-click a cell (or use cell settings) to set its name, type and order. U32/S32/F32 use 2 registers, F64 4 and strings length/2; they show as one cell.
  • Order names place the value's bytes A (most significant)… into registers. ABCD = big end first (Modbus default), CDAB = word swap (the «little-endian word» of many PLCs and meters), BADC = byte swap, DCBA = both.
  • How to choose: set a cell whose value you know (e.g. a temperature of 21.5) to F32 and try the four orders until the value makes sense. Use U32 the same way for integers.
  • «Display» (U16, S16, HEX, BIN) applies to plain U16 cells; S16, U32 and S32 cells show in that base (unsigned) when HEX/BIN is chosen. Floats and strings always show as their type.
  • «Typed… (32-bit, float, string)» at the end of «Display» opens the type dialog for the selected cell (or the first) — the same as right-clicking a cell.
  • Save/Load CSV uses the same register map format as Modbus Slave (table,address,type,order,name,value). Load a map made in Slave to apply names and types (the value column is never written to the device). Rows for other tables (e.g. IR) are skipped.
  • «Device profile…»: pick one of the 10 built-in devices (LS ELECTRIC S100 and G100 inverters and GIMAC1000 power meter, Autonics TK and TX temperature controllers and MT4W panel meter, Hanyoung NUX VX temperature controller and LC counter/timer, Rootech Accura 3300E and 2300 power meters; facts confirmed in the maker's manual only) to add polling tables of contiguous registers per function code, with names (unit and scale included, e.g. «Output frequency (×0.01 Hz)»), types, word order and Slave ID. With «Also apply serial settings» the serial settings are set to the manual's factory baud, data bits, parity and stop bits (TCP address and port are left alone). Many devices answer exception 02 for unused addresses, so only contiguous registers are grouped by default. Values on screen are raw — multiply by the scale — and check the device manual before writing. The same data is on the website under «Devices» as tables and JSON (CC BY 4.0).

Writing

  • Double-click (or press Enter on) a cell in a coil (01) or holding register (03) table to open the write dialog. Tables 02/04 are read-only.
  • Coils: «ON»/«OFF» writes at once (FC05). Several values like «1 0 1» write consecutive coils with FC0F.
  • Registers: enter a value in the cell's type (you can change the type/order for this write only). For U16, «10, 20, 30» writes consecutive registers with FC10. 0x means HEX; negatives are read as S16.
  • One register uses 06 (coils 05); several registers or 32/64-bit values use 10 (0F). If the device rejects 06/05, turn on «Write single values with «write multiple» (FC15/16) too» under «Communication details».
  • The dialog previews the function and the exact bytes (RTU with CRC, TCP with transaction ID 0). After a write the table is read again at once.
  • Writing to ID 0 (broadcast) makes every device write and none reply (result «Broadcast»).

Timeout, retries and delay

  • «Response timeout (ms)»: how long to wait for the whole reply. At 9600 bps a 125-register reply takes about 270 ms just to transmit, so keep it generous (1000 ms default). Gateways and radio links need more.
  • «Retries»: resend after a timeout, CRC error or malformed reply. Exceptions are not retried (the answer would be the same). Retries count as requests in the statistics.
  • «Delay between polls (ms)»: pause after a reply before the next request. Increase it if the device misses back-to-back requests (scattered timeouts) or answers exception 06 (busy). 20–50 ms suits RS-485 lines with several devices.
  • A table's «Every (ms)»: how often it is read; 0 = only with «Read once» (F6). There is one bus, so tables are read in turn; if the device is too slow for the interval, missed polls are not bunched up.
  • Replies that arrive in pieces (USB adapters) are joined using the length expected from the request. Local echo from RS-485 adapters is skipped (for 05/06 the reply equals the request and is taken as the reply).
  • Modbus TCP matches replies by transaction ID; late replies to earlier requests are discarded.

Exceptions and errors

  • Exception 01 Illegal Function: the device has no such function code (e.g. 03 on a device with input registers only).
  • Exception 02 Illegal Data Address: start/count outside the device's range. Check 0/1-based numbering and try a smaller count.
  • Exception 03 Illegal Data Value: the count or written value is outside what the device accepts.
  • Exception 04 device failure · 06 busy · 0A/0B gateway (no path / target did not respond).
  • Timeout: wrong Slave ID, baud/parity mismatch, A/B swapped or the device is off. No RX at all in the traffic log points to wiring/settings; RX with CRC errors points to baud, parity or noise.
  • Malformed: the Slave ID, function code or byte count differs from the request, or the reply was cut short — e.g. another master on the line or a non-conforming device.

Scan — Slave IDs and address ranges

  • «Slave ID scan» in «Scan…»: reads one address with the chosen function from every ID and lists the IDs that answer. An exception still counts as «a device is there». It takes timeout (200 ms default) × number of IDs.
  • «Address range scan»: reads From–To in blocks and collects the readable ranges. A block that fails is re-checked one address at a time (turn off to skip whole blocks). It stops on exception 01 or three silent requests in a row.
  • «New table for this ID» / «New table for this range» creates a table from a result.
  • Polling pauses while scanning (requests are not mixed on one line). Closing the dialog keeps the scan running; progress shows in the status box on the left.

Statistics, logs and trends

  • The line above the cells: this table's requests, OK, timeouts, CRC, exceptions and average/maximum response time. «Statistics (all)» on the left includes scans and writes. «Reset» clears them.
  • Response time runs from sending the request to receiving the whole reply (including serial transmission and a few ms of USB latency).
  • Traffic log: request (TX) and reply (RX) HEX with decoding («id1 FC03 HR 0..9 (10)», «→ OK: 1, 2 …», exception names); timeouts, broadcasts and send failures as event (EV) lines. Red decoding marks a failed reply.
  • Follow: new lines are followed only while you are at the bottom. Scroll up to pause (the view stays put) — «↓ Jump to latest (n new)» appears at the bottom right. Click it, press End or scroll to the bottom to follow again. The «Auto-scroll» checkbox shows whether it is following.
  • Selecting: click a line, Shift+click for a range, Ctrl+click to add or remove one. Clicking does not stop following.
  • Right-click menu: Copy lines · Copy HEX · Copy ASCII · Copy HEX + ASCII · Copy as C array ({0x01, 0x03}) · Find this. Data copies (HEX, ASCII, C array) skip event lines (EV), one frame per line.
  • «Log to file» (Ctrl+Shift+L) keeps writing the bytes sent and received with timestamps (the auto-log folder in Settings works too).
  • Value log (CSV): in «Value log ▾» on the table toolbar, «Start log…» appends time,table,address,name,value «Every poll» or «On change». Values are written as shown (type and display) and open directly in Excel.
  • Trend: click a cell and press «📈 Trend» to draw its value below (up to 6, the latest 600 values), with last and min–max.

Testing with Modbus Slave

To learn this program without a device, or to rehearse the master's settings and error handling, use PortDock Modbus Slave as the other end.

  • TCP on one PC: start Slave as «TCP server (Modbus TCP)» on port 502 (or 1502) and connect here with «TCP (Modbus TCP)» to 127.0.0.1.
  • Serial: connect two USB-RS485 adapters A-A and B-B, or create a virtual COM pair (e.g. com0com), and open one side in Slave and the other here with the same baud and parity.
  • Use Slave's «Fault injection» (delay, no reply, exceptions, bad CRC) to see how timeouts, retries and statistics look here. Save Slave's cell settings (e.g. F32 CDAB) as CSV and load them here to match names and types.

Settings (⚙)

  • Language, theme, font size, log timestamp format and the number of lines kept on screen.
  • «Start file log automatically» and the auto-log folder: each connection writes «portdock-modbus-master-date-time.log».
  • «Export / Import settings» move the connection, tables (IDs, addresses, cell names and types) and trends as a JSON file.
  • «Always on top»: keeps this window above other windows (same as 📌 in the header).
  • «Expand all (expert view)»: shows the groups that are normally collapsed (advanced connection, receive settings, fault injection, statistics, scan options, triggers, auto-reply …) open. Folding one while it is on lasts only for this run. Turning it off returns each group to its remembered state.

Shortcuts and tips

  • F4: connect / disconnect (same as the button on the left).
  • Ctrl+L: clear the on-screen log (file logs are kept).
  • Ctrl+Shift+L: start / stop logging to file.
  • End: jump to the latest log line and follow again.
  • Ctrl+C: copy the selected log lines as «time direction data» (in the current view). Inside a text box it copies normally.
  • Ctrl+F: focus the log find box. In it, Enter next, Shift+Enter previous, Esc clear.
  • F1 or the ? button: this help. Close it with Esc.
  • Number boxes: ↑/↓ by 1, Shift+↑/↓ by 10, PageUp/PageDown by 100, or the mouse wheel once the box is focused. The baud box steps through the listed rates.
  • Shortcuts are ignored while a dialog or the right-click menu is open, or while composing Korean text.
  • Ctrl+S: save the current table as CSV.
  • F6: read the current table once. F8: pause/resume all polling.
  • Cells: click to select (for trends), double-click or Enter to write, right-click for cell settings.
  • Deleting a table shows «Undo» for 5 seconds instead of a confirmation dialog.

Troubleshooting

  • Every request times out: check the Slave ID, baud/parity/stop bits, A/B wiring, termination and the device's «Modbus RTU slave» setting. For TCP check IP, port and firewall, and whether the device already has the maximum number of masters connected.
  • Occasional timeouts: raise «Delay between polls» and set «Retries» to 1–2. USB adapters can deliver replies late — raise «Response timeout».
  • Frequent CRC errors: check baud/parity, noise (shielding, grounding) and other masters on the line.
  • Odd values: check the type and byte order («Value types and byte order») and 0/1-based numbering («40001 notation»).
  • Cannot open the port: another program (another master, terminal or PortDock window) may have it.
  • The program does not open: Microsoft Edge WebView2 is required (included in Windows 11).