WinModbus Simulators

Modbus Master and Slave Simulators for Windows

Welcome to the new home of the WinModbus Simulators.

The first version of WinModbus, our modbus slave simulator, was released in March 2012 and has been in continuous development ever since.

If you need to test your modbus links or simulate modbus devices from Windows, our Winmodbus simulators are for you.

Based on years of modbus experience, they have been written to make modbus testing and simulation as easy and painless as possible. Get up and running in seconds, build your address map directly from the messages as they appear, see a field by field breakdown of each message and more.

The WinModbus simulators are everything you need to make developing and testing your modbus links as quick and easy as possible.

WinModbus is a Windows Desktop app and supports Windows Vista/7/8/10/11 and associated Windows Servers.

You can buy our slave and master simulators individually or get them both together for a much reduced price.

If you have already purchased WinModbus before 01/01/2022 and wish to buy WinModbus Master, just drop us an email at and we'll be happy to offer you a reduced price.


The Windows Modbus Slave Simulator

  • See and understand what’s going on : Get Message Explanations, Field Breakdowns and Custom Register Naming.
  • Ethernet TCP and Serial RS-232 / RS-485 support.
  • Protocol Simulator for Modbus RTU, TCP and ASCII.
  • Slave Failure Testing Functions – CRC Fails and Link Breaks
  • Link data to Excel or other packages that support DDE
  • Highly compact. Quick Windows Install/Uninstall.
  • Designed, written and tested in-house by Windows Programmers with years of Modbus experience.
  • “Simple, Elegant, Efficient & Reliable”


Try Now

Download the fully functional evaluation version here

  • The evaluation version is fully functional for 14 days. After this, a purchase must be made to continue use.
  • After download, just “Open” the file and it will install on your PC. Once installed, you can run it from the Windows Start Menu
  • If Windows SmartScreen shows a warning during installation, just click "More Info" and then "Run Anyway". The installer has been checked for viruses/malware and is clean but due to the relatively low volume of installations, Microsoft does not have it in its "clean apps" database.

Comms Setup

Create the connection to the modbus master

Select [Comms] from the [Setup] menu.

Enter the modbus address WinModbus should reply to. Your options are:

  • Leave it blank - Winmodbus will reply to ALL valid messages
  • A single address, e.g. 125
  • Multiple addresses separated by commas to limit the addresses to be replied to, e.g. 1, 2, 3.

Select the protocol:

  • ModbusTCP (6 byte header at the front of every message and no CRC on the end)
  • Modbus RTU (No Header, CRC on the end)
  • Modbus ASCII

Select Network or Serial and enter the relevant setup information for the transport you have chosen.

For network, the standard ModbusTCP listen port is 502. For serial, you can set baud, parity and stop bits here as well as serial port. Data bits is automatically set depending on whether you are using Modbus ASCII (7) or not (8).

WinModbus only displays the currently available serial ports.If your serial port isn’t appearing in the list, ensure it is not in use by something else.

Note: You can mix Modbus TCP/RTU with serial/ethernet links which is useful for scenarios where you may be using a network terminal server to talk to a serial device.

Using WinModbus

General usage information

Any traffic received will be shown in the traffic window (top right) marked with an RX. If a received message is detected as a valid modbus request, a reply will be sent back and this will be shown in the traffic window marked with a TX.

You can click on any message in the traffic window to see a breakdown of what it means (bottom right). WinModbus will attempt to parse any message as a valid Modbus message but will display an appropriate error message if this is not successful.

WinModbus will only reply to a modbus request that matches a corresponding Function Range. Function Ranges are shown top left and they each specify a modbus function code and a range of addresses. Supported modbus functions are : 1, 2, 3, 4, 5, 6, 15, 16, 65, 66, 67, 68 and some function ranges are added by default to answer all of these.

By default, WinModbus will reply to all value requests with 0. To specify some valid data, you can create data items in the Address map (bottom left).

Function Ranges

Specify how Winmodbus should reply to specific functions

You can add, delete and modify Function Ranges by right clicking in the top left window and selecting from the popup menu.

The function range setup window defines what messages WinModbus will attempt to answer. Each function range requires a Modbus function.

Optionally you can specify a range of addresses to restrict this message to. This is useful if you have an address map that returns data formatted differently depending on the address. e.g. you may have 100 integers followed by 100 floats, all available via function 3. As these are represented differently, they will need to be packed in the message differently and WinModus supports this by allowing you to add several Function Ranges per function. If you just have one data type no matter what the address, tick the “Any” box and this function range will be used to reply to all messages with the selected modbus function code.

When a message is received, it is tested against the function ranges from top to bottom so if more than 1 could potentially match, the topmost is used. To this end, you can move each range up and down in the list. You may want to have a resticted address range for a function, say 0 -> 1000, and then below that you could have a catch all with "Any" address set.

The address in the actual message can be between 0 and 65535 but you may want to map that to a different address in your data map. By default, address 0 in a message indicates address 0 in the data map. You can change this offset, specifying what address 0 in the message should map to in the data map, by putting that value in the “Address Offset” field.

Finally, you need to specify the format of the data you expect in the message. There are several commonly used formats in the Format Presets chooser so you should probably pick one of those. Each format has an implied byte ordering. e.g. SHORT10 expects a two byte short, MSB* first. SHORT01 is the same but LSB first. FLOAT3210 is a 4 byte float MSB first down to LSB. If none of the presets are suitable, you can manually specify the data format, addresses per item and whether to use the Count field in the message to specify the number of data items in the message, or the number of 2-byte modbus registers. e.g. If a message contains 3 floats, the count field may be set to 3 (Tick the box) or, because a float takes up two modbus registers, it may be set to 6. (Untick the box)

WinModbus recognises functions 1, 2, 3, 4, 5, 6, 15, 16, 65, 66, 67, 68. Winmodbus is currently unable to decode any function other than these and will show an error. If you poll it with one of these functions but don't have a message range defined for it, WinModbus will reply with a function exception (e.g. the function with the top bit set followed by the exception code 1)

* Most Significant Byte

Address Map

Populate registers with data to simulate real world scenarios

Right click on the Address window (Bottom left) and select [Add Addresses]. Specify the start and end address and an address step (e.g. an address step of 2 will create alternate addresses) and these addresses will appear in the window.

Double click on any address to set that address to a value. Note, you can select several addresses while holding the SHIFT key down, then right click and select [Edit Addresses] to set multiple addresses to a single value in one step.

Note that the address in the actual messages may not be the same as the ones in the data map. Modbus can apply an offset for each function. This mapping is done in the relevant function range and you’ll see that defaults are set up for you. (Top left window)

WinModbus has an autocreate function which will create the addresses in your datamap for you everytime you are polled (if they don't already exist). This way you can create your datamap quickly, just by being polled.


Read and update values from Excel or similar.

You can link to any data item in the address map using DDE.

The details are:

  • Server: “WinModbus”
  • Topic: Once a file is loaded, the topic is set to the file name, e.g loading myfile.wmb will set the topic name to "myfile". With no file loaded, the topic is just "Slave". In versions 1.1r16 and earlier, the topic is always just "Slave".
  • Data: the address of the data in the data map, padded to 5 digits, e.g. “00001”

So, for instance, in an Excel cell, you could get an updating value of register 10001 by inserting something like:


You can't do a DDE write directly within Excel but you can do it using the built in VB script.

If you wanted to update a fixed address 10001 with a value from cell “A1” in Excel, you could do it with the following bit of VB: 

Dim nDDEChannel As Long
nDDEChannel = DDEInitiate("WinModbus", "myfile")

If nDDEChannel = 0 Then
  MsgBox "Sorry, failed to open a DDE channel"
  DDEPoke nDDEChannel, "10001", Sheets(1).Range("A1")
DDETerminate (nDDEChannel)  
End If

Release Notes

Version History

WinModbus - Version History

- Built with VS2019

v1.1r17 - 23/12/2020

New features:
- Optional exception reply 2 if addresses polled for are not found.
- Exceptions handled by breakdown.
- Startup message ranges have no offsets.
- Message ranges can be moved up and down. First one to match (from the top) is
  used for the reply.
- Installer bundled with vcredist to make sure you have the right Microsoft dlls.
- If polled function is supported but doesn't have a message range defined, an
  exception reply 1 is sent.

- "Intermittent Checksum Error" menu enables correctly on load.
- "Too much data" error logged correctly.

- Built with VS2017

v1.1r16 - 08/10/2020

New features:
- DDE topic set to loaded file name, e.g. Loading myfile.wmb set type to myfile

- Specifiying unpadded dde address updates with changes correctly.

v1.1r15 - 21/08/2020

New features:

- Issue with bytecount in non-itemcount message formats fixed.

v1.1r14 - 14/07/2020

New features:

- Intermittent crash when a bad message expires from the message log fixed.

v1.1r13 - 23/05/2020

New features:
- Autocreate Datamap facility added.
- Update server redirected.

- Recover from some out of step scenarios using the inter message time.
- When traffic window full, try to maintain the scroll position if not at the

- Built with VS2015

v1.1r12 - 02/06/2017

New features:

- Traffic window not autoscrolling at some window heights fixed.

v1.1r11 - 26/01/2017

New features:
- Listening message in status bar shows port.
- Time/Date added to log file.


v1.1r10 - 22/07/2016

New features:

- Serial port reporting Open Fail fixed.

v1.1r09 - 26/05/2016

New features:
- Will open a file if it is associated and double clicked on.
- Serial port discovery in comms dialog improved.
- Window title shows current save file name.


v1.1r08 - 21/04/2016

New features:

- Response to write single coil (f5) corrected.
- Crash when asking for too much multi-reg data fixed.

v1.1r07 - 02/10/2015

New features:

- Splitter doesn't lose left side when minimised.
- Flicker reduced a little when resizing.

v1.1r06 - 11/09/2015

New features:

- Splitter causing right hand windows to lose scroll bars fixed.
- Incorrect TCPID if >255 fixed.
- Crash when the log window hits the limit fixed.
- Blank descriptions for RX messages fixed.

v1.1r05 - 24/03/2015

New features:
- Central splitter added.


v1.1r04 - 22/01/2015

New features:
- Description improved a little.
- Register address shows offset mapping in breakdown, if relevant.

- Closing a dialog with the close box doesn't lock the app.
- Function code 5 should report register count correctly in the breakdown.
- Function code 5 sends back the correct byte sequence ff 00 or 00 00 depending
  on the value in the address map.
- Incorrect register naming if offset present in function range fixed.

v1.1r03 - 22/01/2015

- Internal release.

v1.1r02 - 29/10/2014

New features:
- Name from address map shown against reg address in breakdown.
- Description column added to Traffic Window showing an explanation of each
  message. Time and TX/RX columns narrowed slightly. Errors added here instead
  of on a separate line.

- Modbus ASCII LRC computation fixed.

v1.1r01 - 16/10/2014

New features:
- Addresses can be annotated with a name to make it easier to find them.
- Popup menu on address map rearranged slightly. "Edit Addresses" renamed to "Set
- Edit/Setup menu renamed to Setup/Comms Parameters.

- Cancelling the edit address value box doesn't flag as needing to save.

v1.1r00 - 07/10/2014

New features:
- Traffic Log Size added to options, default 1000, to stop ever increasing
  memory usage over time.
- Popup menu added to traffic window. "Clear Log" implemented.
- "Copy" added to traffic window popup menu. CTRL+C also works.
- All main menus have an ALT shortcut.
- Autocreate data from message added. Right click on a message, select it and
  the data polled for will be added to the address map.
- The modbus address can be blank meaning "reply to any" or it can be a comma
  separated list of addresses, e.g. 1,2,3 (Don't leave spaces!)
- Handshaking added to serial driver.
- Log to File option added. Appends to winmodbus.log in [My Documents].
- Parse engine made more flexible. Daniel functions 65-68 supported.

- Unselecting all messages clears the breakdown window.
- Adding a function range dialog initial state made more sensible.

v1.0r9 - 21/08/2014

New features:

- Initial response to new incoming Modbus TCP connections sped up significantly.
- SO_REUSEADDR flag removed from listening socket as it doesn't make sense in
  this context. Running 2 WinModbus's will make the second show "Can't open port"
- Win8.1 crash due to not being able to initially open the server socket fixed.

v1.0r8 - 19/06/2014

New features:
- Tabbed interface added, ready for Modus Master function. Single tab for now.
- DDE Topic name is now fixed at "Slave", ready for Modbus Master function.
- Popup menu context enable/disable of items fixed.
- Breakdown columns reordered.
- Some TCP header field descriptions added to breakdown.

- File/New, dropping a .wmb on the app or using the RFL asks to save changes to
  current document, if there were any.
- Notifying external DDE connections of value changes fixed.
- Selecting a message range function fills in a suitable default format preset.

v1.0r7 - 27/04/2014

New features:
- Messages colour coded in the Traffic Window.

- Repeating Eval message fixed.
- Format dialog box fixed.
- Recovery from bad or incomplete message data improved.

v1.0r6 - 22/01/2014

New features:
- Tooltips added to the setup dialog.
- Version check performed at startup.
- Evaluation params changed slightly.

v1.0r5 - 21/01/2014

New features:
- Main window startup size optimised.
- XP compatible syslink reinstated on About box.
- Uses new glib simplified About box.
- Wait cursor shown on load.
- You can drop files on the running app to open them.
- Setup moved to Edit menu.

- Trying to open unavailable TCP port doesn't crash the code.
- Asking for too many registers doesn't crash the code.
- Recent file hidden if there isn't one.
- Serial/Network parameters are disabled based on selection in Setup box.
- DDE Advise forced after a successful DDE POKE to feed value back.
- Cancelling the save on a Save Changes? aborts the application quit.
- Serial port populated if available.

v1.0r4 - 11/07/2012

New features:
- Status bar added. Port status shown.
- Menu help text sent to status bar.
- Address range and offset separated in message window.
- Message Range renamed to Function Range in popup menu.
- Function Range edit dialog made larger and some help text added.
- Eval popup added at start.

v1.0r3 - 05/07/2012

New features:
- Port status messages logged.
- Eval timer set to 20 mins.

- Serial driver fixed.

v1.0r2 - 27/04/2012

New features:
- Marked as DPI aware.
- Base library minor optimisations.

- Problematic SYSLINK controls removed from about box for now.
- Installer doesn't require .NET 4 on XP.

v1.0r1 - 13/03/2012

New features:
- Failure Testing menu added. Stop replies and CRC fail options implemented.

v1.0r0 - 12/03/2012

New features:
- DDE Client added. Ask for WinModbus <filename> <address>, e.g, in Excel you
  can put =WinModbus|savefile!'40001' or =WinModbus|untitled!'00001'

v0.1r0 - 06/03/2012

- BETA release.

WinModbus Master

The Windows Modbus Master Simulator

  • See and understand what’s going on : Get Message Explanations, Field Breakdowns and Custom Register Naming.
  • Ethernet TCP support.
  • Protocol Simulator for Modbus RTU and TCP.
  • Link data to Excel or other packages that support DDE
  • Highly compact. Quick Windows Install/Uninstall
  • Designed, written and tested in-house by Windows Programmers with years of Modbus experience.
  • “Simple, Elegant, Efficient & Reliable”

Comms Setup

Communication channel options

Winmodbus Master current communicates over TCP/IP. (Serial support is coming).

From the main menu, select [Comms Parameters] from the [Setup] menu and you shoudl see a dialog allowing you to define the comms channel to the modbus slave.

IP address and port should be defined, using localhost or for the same machine. The protocol can be Modbus TCP (includes a 6 byte header) or Modbus RTU (No header but a 2 byte CRC on the end). The latter is useful for communicating with serial modbus devices using a terminal server or similar.

You must specify a modbus address to poll for and this shoudl correspond to the address of the slave you are connected to.

The Poll Rate is used when performing multiple polls and will be the time waited after receiving a reply until the next poll is issued

The Timout is the number of millliseconds waited for a reply after a poll is issued before giving up and either retrying or going on to the next poll.

The Retries specifies how may times a poll should be issued if it is timing out.

The Poll Definition Window

Working with Polls

The top left Window is the poll definition window.

To create a poll, right click in the top left window and select [Add Poll]. Pick the modbus function code to poll and the start address to poll. Enter the number of items to poll for (if the function code you chose supports it) and indicate what format the data should be sent as (for write function codes) or decoded as (for read function codes).

When you hit ok, this poll should appear in the top left window. You can do a one shot poll by right clicking on it and selecting [Do Poll]. This will open the communication channel, do the poll, receive the reply and close the communication channel. If the reply is not received, the message will be retried by the user retry count (comms setup).

If you select [run] from the toolbar or the main menu, each message in the top left window will be polled in turn starting at the top and moving down to the bottom. This will be continuous, wrapping back to the top until [run] is selected again to stop the polling. Polls can be reordered by moving them up and down in the list using the right click menu.

FInally, from the right click menu you can automatically add all the addresses polled by this poll to the address map (bottom right window).

The Address Map Window

Working with data

The Address Map Window is the bottom right window and shows a list of the addresses and their corresponding values. The address map is initially empty and addresses have to be manually added/defined although helpers exist to do this automatically for each poll/message shown in the other windows.

If you have to, addresses can be manually added, either singly or in bulk, using [Add Addresses] from the right click menu. You must specify a start address, the last address and the step (e.g. a step of 2 will add every alternate address. So 1000-1004 step 2 will add 1000, 1002 and 1004.

Each address in the map has a basic type, so BIT, DOUBLE, FLOAT, LONG or SHORT. These correspond to the types of data Winmodbus Master supports for modbus messages. Note: these are slightly different from the types specified in the poll definition as they do not need any indication of how they are encoded/decoded. They should correspond to the type polled for, so a poll for some sort of float (DANIEL, ROSEMOUNT, etc.) at 1000 indicates you should have FLOATs in the address map at the addresses covered by the poll.

Address values can be changed by double clicking on the address and entering a new value in the dialog that comes up.

Finally, addresses can be deleted from the right click menu. For this, multiple addresses can be selected using the mouse in conjunction with the SHIFT or CTRL key and all deleted at once.

Release Notes

Version History

01/01/2022 - First Working Version released


Purchase WinModbus

Winmodbus - A Windows Modbus Slave Simulator

Price: £62.50

Includes lifetime upgrade to all future versions and e-mail support.

Winmodbus Master - A Windows Modbus Master Simulator

Price: £62.50

Includes lifetime upgrade to all future versions and e-mail support.

Winmodbus Suite (Includes both WinModbus AND WinModbus Master)

Price: £99.50

Includes lifetime upgrade to all future versions and e-mail support.