Modbus Server

This target exposes variables from a forwarding group to an external Modbus master through Modbus TCP or Modbus RTU. The current Modbus type list has no ASCII option.

Configure the forwarding group and target through Data Forwarding. This page covers Modbus server properties, address mapping, client permissions, and protocol debug.

Open the plugin

Open Development Configuration → Data Forwarding and:

1. Save the forwarding-group variable range.
2. Add a target, choose Modbus Server, and fill in its basic target information.
3. Open Target properties, choose the Modbus type and channel, then configure protocol, permissions, serial, DTU, or TLS settings.
4. Save the target and configure a required Slave variable address for each exposed variable.
5. Enable the target and verify with an external Modbus master or the debug page.

Basic target information

Setting	Default	Configuration
Group	-	Select a saved forwarding group.
Target name	-	Required and unique within the group.
Enable	Enabled	Disable to stop listening.
Log level	Info	Temporarily use Debug for protocol diagnostics.
Start timeout	60 seconds	Valid range is 1 to 3600 seconds.

Target properties

Protocol

Setting	Default	Configuration
Modbus type	ModbusTcp	Current choices are ModbusTcp (MBAP) and ModbusRtu (binary RTU + CRC16). TCP normally uses TcpService; RTU normally uses SerialPort.
Default station	1	Used when an address has no S= prefix.
Multiple-station mode	Enabled	Allows multiple stations in one target.
Channel type	TcpService	Current choices are TcpService, TcpClient, UdpSession, and SerialPort; no Other transport.

Data format

Setting	Default	Configuration
Data format	ABCD	Select ABCD, BADC, CDAB, or DCBA to match the external master.
Reverse string bytes	Disabled	Reverse string bytes by word only when required by the external layout.

Permissions

Setting	Default	Configuration
Allow RPC write	Enabled	Target-level write switch. Disable for read-only monitoring.
Client permission list	Empty	Applies to TCP server mode. Empty does not restrict IPs; a non-empty list admits only matching AllowedClientIp entries, with AllowWrite also required for writes. Serial, UDP, and active TCP do not use this incoming-client IP list.

Runtime

Setting	Default	Configuration
Write to memory immediately	Enabled	Controls immediate protocol-memory update; turning it off does not disable the real variable RPC write.
Send delay	0 ms	Delay before a reply frame when required by the master.
Connection timeout	3000 ms	Connection-operation timeout; minimum 100 ms.
Heartbeat content	Empty	Optional application heartbeat in active TCP mode with a non-empty DTU ID.
Heartbeat is Hex	Disabled	Treats heartbeat content as hexadecimal when enabled.
Heartbeat interval	60000 ms	Active TCP heartbeat interval; zero disables periodic sends. It does not enable periodic heartbeats on a TCP server.

Connection

Setting	Default	Configuration
Remote address	127.0.0.1:502	Used only when the selected channel requires a remote endpoint.
Local bind address	0.0.0.0:502	TCP service listen address. Restrict it to a required interface in production.
Serial port	COM1	Used for serial channels.
DTU ID	Empty	Registration content sent after an active TCP connection is established.
DTU ID is Hex	Disabled	Encodes that outgoing registration as Hex bytes instead of UTF-8 text.
DTU service type	Default	Select DDP for a TCP server or UDP endpoint that requires DDP framing; keep Default for ordinary Modbus.

TLS

Setting	Default	Configuration
Enable SSL	Disabled	Enables TLS for TCP client or server channels. UDP and serial channels do not use these SSL settings.
SSL target host	Empty	Active TCP client's expected remote server name, matched against the server certificate.
SSL client certificate	Empty	Client certificate for mutual TLS.
SSL server certificate	Empty	Certificate presented by a server channel.
SSL CA certificate	Empty	CA used to validate peer certificates.
Allow untrusted certificate	Enabled	In TCP server mode, disabling this requires and validates the external master's client certificate; configure CA trust and give the master a valid certificate with its private key. The master must separately validate the gateway server. In active TCP mode this controls validation of the remote server; keep strict validation in production.
SSL protocol	None	Keep the system default unless the peer requires a specific TLS version.
Check certificate revocation	Disabled	Enable according to the security policy.

Serial port

Setting	Default	Configuration
Baud rate	9600	Must match the external master and serial device.
Data bits	8	Must match the external master.
Parity	None	Must match the external master.
Stop bits	One	Must match the external master.
DTR / RTS	Enabled / Enabled	Hardware flow-control switches.
Async stream	Enabled	Enables asynchronous serial I/O.
Handshake	Default	Serial handshake mode.
Input / output buffer	4096 / 2048 bytes	Increase only for long or continuous frames.

Capacity and reliability

Setting	Default	Configuration
Maximum concurrency	1	Shared channel property; passive service initialization uses a single-request limit. A larger form value does not establish equal network parallelism.
Maximum connections	10000	Maximum client connections.
Frame cache time	500 ms	Frame assembly cache window; minimum 100 ms.
Client cleanup time	120000 ms	Idle-client cleanup; zero disables it, otherwise use at least 10000 ms. Actual expiry depends on the cleanup schedule.

Target variable properties

Setting	Description
Slave variable address	Required. Modbus address exposed to the external master.
Data type	Default Int16. Data type used for this target mapping.
Allow RPC write	Requires target, target-variable, and source-variable write permission. In TCP server mode, a configured client list must also admit the client with AllowWrite.

The variable must already be inside the forwarding group's range. Adding a target variable property does not add a member to the group.

Address rules

Address	Data area	Common read function
00001	Coils	FC1
10001	Discrete inputs	FC2
30001	Input registers	FC4
40001	Holding registers	FC3

Addresses use one-based notation. S=2;40001 exposes holding register 40001 at station 2; F=3;0 explicitly uses FC3 with zero-based offset 0; 40001.3 exposes bit 3 of the register.

Within one target, station, function, and start-address combinations must not overlap. Match the data type and register size to the external master's point list.

Contiguous writes and complete values

For a master's contiguous write, the gateway checks every variable intersecting the requested range. Each must be fully covered and pass target, client, mapped-variable, and source-variable write permissions before device writes begin.

A Float mapped at 40001 occupies two registers. Writing only 40001 or 40002 partially covers the value and is rejected. Both registers are required. A request spanning multiple mapped variables must fully cover each one. Strings, arrays, and multi-register integers use their actual occupied length.

First write and read back complete values. Then test partial coverage and a range containing a nonwritable variable; rejected requests should cause no device writes for that batch. Once range and permission checks pass, verify each device's execution result separately. Writes across devices are not a single atomic transaction.

Target debug

Open Development Configuration → Data Forwarding, select the forwarding group and target, and open Debug.

Read and write

Read a mapped address first. Before writing, confirm target, channel, client, and variable write permissions.

Forwarding pipeline

Use the pipeline view to confirm how a group variable becomes an exposed Modbus value.

Protocol service

Check the listening endpoint, connected clients, and protocol-service state.

Functions

Function	Purpose
Read and write	Read a confirmed point and write only to an approved test point.
Forwarding pipeline	Inspect group membership and variables entering the service mapping.
Protocol service	Inspect listening endpoints, connected clients, and service state.

Protocol memory and field verification

Local debug reads/writes inspect service memory. They do not establish an external master's network access or a real field write. Check the external address mapping independently of the collection address: holding 40001 maps to offset 0, 40011 to offset 10.

For a first test, map one working Int16 variable to 40001 at station 1, format ABCD. Use an independent master with unit ID 1, FC3, offset 0, and count 1. Move the service address to 40011 and read offset 10; the collection address stays unchanged. Input-register mapping 30001 requires FC4. For a permitted holding-register write, check the protocol result, actual source readback, and a later external read, then disable each write switch separately and confirm reads continue while writes fail.

Byte writes can leave the neighboring register byte unchanged. Decimal occupies sixteen bytes/eight registers; Object has no universal register mapping. For UInt32 2345, layouts are ABCD 00 00 09 29, BADC 00 00 29 09, CDAB 09 29 00 00, and DCBA 29 09 00 00. Match the remote master's type and order, then verify two values and real source feedback.

An active TCP connection still serves the Modbus slave role. RTU over TCP, UDP, and DDP add different transport/framing requirements. Passive concurrency cannot be inferred solely from the form. Idle cleanup 0 disables expiry; a nonzero value must be at least 10000 ms. Framing and TLS handshake budgets apply to different stages.

Verify the target

1. Start the target and confirm the server is listening.
2. Connect an external Modbus master.
3. Read one mapped variable in each configured data area.
4. If writing is enabled, write one safe value and confirm the gateway variable changes as expected.

Troubleshooting

Symptom	Check
Master cannot read a value	Listening channel, bind address, station, function code, target variable property, and data type.
Client cannot connect	Channel type, local bind address, port, firewall, maximum connections, and client permission list.
Value has wrong byte order	Data format, string-byte setting, target data type, and external master format.
Write is rejected	Target RPC write, variable RPC write, client permission, and the external master's function code.
Serial server has no response	Port ownership, baud rate, data bits, parity, stop bits, flow control, and frame timing.

Related links

• Data Forwarding: Forwarding groups, triggers, cache, redundancy, and common target operations.
• Plugin Manual Index: Other collection and data-forwarding plugins.