How to use a Modbus simulator to test a PLC or SCADA client

When should you use a Modbus simulator?

Simulation is especially valuable during FAT, software development, panel testing and integration work where the real meter, drive, inverter or remote I/O is not yet available. It lets you validate addressing, function codes, scaling logic, alarms and communication handling earlier.

How do you test a Modbus TCP client with a simulator?

1. Open Tools > Modbus Simulator (slave) and select TCP.
2. Enter the listening port (502, or 5020 if 502 is in use or needs admin rights) and click Start. TCP and UDP listen on all network interfaces.
3. Add the unit IDs your client polls and fill in the coils and registers it expects (Data tab).
4. Assign deterministic test values—for example 2300 for a 0.1 V-scaled voltage or two registers representing a Float32 value—or add value generators for moving data.
5. Point the PLC/SCADA/client at the simulator IP and port.
6. Confirm the client reads the correct values, then change values, add exception rules or a response delay to verify live updates, alarm logic and error handling.

How do you simulate a Modbus RTU or ASCII slave?

For RTU or ASCII, the simulator behaves as a serial slave. Select the COM port and match the master’s baud rate, data bits, parity and stop bits. RTU requires 8 data bits; ASCII usually uses 7. For software-to-software testing on one PC, use a virtual COM-port pair (the master on one port, the simulator on the other). For external hardware, use a physical RS-485 or RS-232 interface.

Can one simulator answer several slave IDs?

Yes. In ModbusBB 2.0, add unit IDs in the Unit IDs panel (1-247; 0 and 248-255 are allowed for testing). Each unit has its own data store, so a single TCP port or serial line can stand in for a gateway with several downstream devices or a bus with several meters. Select a unit on the Data tab to view and edit its holding registers, input registers, coils and discrete inputs in any format and byte order.

How do you make simulated values move?

Static values prove addressing, but trends, alarms and deadbands need changing data. On the Generators tab, each generator drives one address of one unit and table, with Min, Max, period and step settings:

A generator can write any register format, for example Float32 or Float64 in a chosen byte order, and fills the right number of registers. Add demo set creates a ready-made mix (sine, ramp, counter, random, square wave and a toggling coil).

Click to enlarge

How do you test exceptions and slow responses?

Error handling is where many integrations fail, and real devices rarely fail on demand. On the Exceptions tab you create rules. Each rule matches a unit ID (or any unit), a function code (or any) and an address range, and it answers matching requests with the exception code you choose, such as 02 Illegal Data Address or 06 Slave Device Busy. Function codes the simulator does not implement (it answers FC 01-06, 08, 15, 16 and 23) get 01 Illegal Function, just as a real device would.

A response delay plus random jitter (in ms) slows every answer down, so you can check the master’s timeout, retry and reconnect behaviour. The Request log lists every request with the unit, function, address, quantity, result and delay applied.

Click to enlarge

What should you test beyond normal reads?

Good simulation should validate failures as well as normal reads. Try values at engineering limits, status-bit changes, exception replies, slow responses, communication interruptions and recovery after reconnect. If your system uses 32-bit or 64-bit data, verify the exact byte order and scaling expected by both sides.

Can you run the simulator from the command line?

Yes. ModbusBB.CLI simulate runs the same simulator until Ctrl+C or --duration. It listens with --tcp <port>, --udp <port>, --rtu COM4 or --ascii COM4 (with --baud, --parity, --databits and --stopbits), serves one or more units (--unit 1,2 or 1-4) and accepts --delay and --jitter. Generators use the spec [unit@]type:address:kind[:min:max[:periodMs[:format[:byteorder]]]], and --set presets values:

Exception-injection rules are available in the GUI simulator only. See the simulate command reference.

Can ModbusBB act as a Modbus slave simulator?

Yes. ModbusBB 2.0 is a Modbus master and a slave simulator in the same application, and you can point its own master at the simulator on 127.0.0.1. On the master side it supports TCP, UDP, RTU, ASCII and RTU-over-TCP, several connections at once, a raw traffic monitor, live trends, watchdog alerts and CSV logging. See the simulator documentation.