Modbus Monitor XPF application allows communication using a Windows-based Personal Computer to Modbus devices. The application is distributed in the Microsoft Store and can be downloaded from The application can be downloaded and installed on a trial basis to try the features before purchasing the full license.

 The Modbus Monitor XPF application contains two applications in one. The application contains Modbus Client and Modbus Server.  In addition, the application supports Serial and TCP protocol options for each option. 

This guide helps you start the essential operation and covers some advanced scripting commands for purchased applications.

Main UI

The Main Screen is divided into three parts (1)  Control Panel  (2) Navigation Panel (3) Monitor Point List Table

  1. Control Panel
    • Shows Options for Tab chosen in Navigation Panel
    • Details for each option in the control panel can be found in later sections of this document. 
  2. Navigation Panel
    • Shows Main Features of the application as Tabs (Shows ListMasterServer, etc.) similar to File Menu in classic Windows Application.
    • Details of each Tab or feature can be found in sections listed in this document
  3. Monitor Points List Table
    • Shows all monitor points defined for Modbus Master and/or Server mode
    • Add or Remove monitor points in the List Tab

Home Tab






Monitor Points – Columns

  1. Name
    • Text or String value of the Register for easy cross reference. Example: “Water Temperature”
    • Extra Magic Key Codes can be added to enhance polling and processing further. Add these Extra codes at the end of the string with action.
      • String Length: “:” (Colon + RegCounts)
      • Add Colon and Number of Registers
      • Poll Update Rate: “@” (at symbol + milliseconds)
      • For example: Name = Model Name@1000 (poll at 1000 milliseconds)
      • @0 (don’t poll), @-1 (poll once).  See Poll Rate – Poll Section (below) for additional combinations and explanations
      • Bit Fields or Mask Bit Write: ” . ”  (Period or Point + bit number)
      • Add “.n” to the end of the Register name. n is a bit number from 0 to 15.
  2. Address
    • 6 Digit Modbus register value 
    • Integer Value (0 to 465536)
    • Address is 0 based or 1 based depending on the “One Based” check-mark in the List Tab
    • Example: 000001 or 100001 or 400001 or 300001 
    • 4x Example: 400001 (One based checked, 1st Register, Function 3, Read/Write)
    • 4x Example: 400000 (One based un-checked, 1st Register, Function 3, Read/Write)
    • 3x Example: 300001 (One based checked, 1st Register, Function 4, Read-Only)
    • 0x Example: 000001 (One based checked, 1st Register, Function 1)
    • 1x Example: 100001 (One based checked, 1st Register, Function 2)
  3. Unit ID
    • Unit ID or Slave ID of the register for Master and Server 
    • Byte Value (1-247)
    • Example: 1
  4. Gain, Offset
  1. Value to be multiplied and Offset Added to result obtained from the Server
  2. Server Mode: Gain and Offset will be applied before the value is sent to remote Master 
  3. Float Value Column = Gain x [Modbus Value Obtained] + Offset  (Linear Formula)
  4. Example: 1.00 (default Gain, Multiple 1), 0.00 (Default, no Offset)
  1. Data Type
    • Converted Data Value from Modbus poll
    • Example: BIT
    • 2 Registers are polled for 32-bit Data Type 
    • 4 Registers are polled for 64-bit Data Type
    • Displays value based on the selection:
    • BIT = Binary value
      • [Bit Fields] See Name column above to set Bit Fields or Masked Read/Write
      • INT16 = Display as 16-bit Signed value
      • UINT16 = Display as 16-bit Unsigned value (Default)
      • INT32 = Display as Signed 32-bit value
        • Two Registers are automatically polled
      • UINT32 = Display as Signed 32-bit value
      • FLOAT32 = Display as 32-bit Float
      • INT64 = Display as 64-bit Integer
      • UNIT64 = Display as 64-bit Unsigned Integer
      • DOUBLE64 = 64-bit Double Float
      • HEX = Display as Hex value (16-bits)
      • STRING = Display as Text Value
  2. Swap Type
    • Byte and Word Swap when multiple registers are polled based on the Data Type 
    • Swaps multiple Registers based on the selection:
      • ABCD_BE: ABCD swap or Big-Endian (Default)
      • CDBA_LE: CDBA swap or Little-Endian
      • BADC_BEBS: BADC swap or Big-Endian Byte Swap
      • CDAB_LEBS: CDAB swap or Little-Endian Word swap
  3. Value
    • Red Border shows on error or special message from the scanner. Click on the cell (edit) to see the special message.
    • Display Value from Master based on Data Type
    • Send Value to Server based on the Data Type 
    • Modbus Master: Shows value polled from the remote device after applying Swap type, Gain/Offset, and Data Type
    • Modbus Server: Value to send to the remote Master device. Click a cell to change send the new value to send to remote Master (All conversions are applied per settings before sending the new value) 

Modbus Client (Tab)

The Modbus Master or Client Mode (tab) polls remote Modbus TCP or RTU devices and displays data in the selected format.

Interface – Settings

  1. Interface
    • TCP
      • DEFAULT: Modbus TCP over TCP/IP
      • RTU: Modbus RTU over TCP/IP
      • ASCII: Modbus ASCII over TCP/IP
    • UDP
      • DEFAULT: Modbus TCP over UDP
      • RTU: Modbus RTU over UDP/IP
      • ASCII: Modbus ASCII over UDP/IP
    • Serial
      • DEFAULT or RTU: Modbus RTU over serial COM port
      • ASCII: Modbus ASCII over serial COM port
      • Set Serial Ports related Settings


  1. IP Address  
    • IP Address or Hostname of remote TCP server 
    • Connection Timeout: Timeout before reconnecting to the remote host after connection is lost
  2. Port Modbus 
    • Port: Modbus Port for remote server 
  3. Timeout – TCP Connection
    • Time in milliseconds before closing the current TCP connection

Time Out – Modbus Packets Timing

  1. Response Time out
    • Modbus Frame waiting time to gather all bytes from the remote server
    • For example: Wait 3000ms or 3 seconds to gather all bytes up to CRC or tag short frame error
  2. Inter-Frame
    • Delay before sending the next frame or time to wait between each item in the list, in milliseconds. 
    • For example: Wait 20ms before polling the next item in the list
  3. Poll Rate
    • Delay before starting full list scan or time to wait before polling full list, in milliseconds.
    • For example, Wait for 1 second before polling the entire list again
    • Poll Rate for each Monitor Point can be controlled by adding “@” followed by a millisecond numeric value to the Name Column (at the end of the string). For example, if the text value in the Name field cell contains “Logistic String @-1,” it means
      • @-1 = Poll Once the Start button is pushed
      • @0 = Always skip monitor points during polling
      • @3000 = Poll Monitor point at 3000ms poll
      • Combining String Length + Poll Rate
      • “Logistic String @-1:31″ = Poll Once during the start with a string length of 32 registers (64 bytes or characters)

Write – Modbus Write Function Codes Settings

  1. Auto
    • Atomically Select Single or Multiple Coil or Registers based on the Data Type selected
  2. Enable
    • Enable Write from Value Column
  3. Coil Write
    • Manually select function code for Write for Coil(s) from 5 (0x05) or 15 (0x0f)
  4. Register Write
    • Manually select function code for Write for Register(s) from 6 (0x06) or 16 (0x10)

Scanner – Settings

Poll remote server to discover new Modbus Addresses or build Modbus Map for devices without public Modbus Maps.

  1. Start – Start Address to start scanner in 6-digit format
  2. Regs – Number of registers or polls to serially scan
  3. Data – Assumed Data Type. The program automatically calculates the number of registers (1, 2, 4) to request depending on the Data Type selected
  4. Swap – Data Swap for 32 or 64-bit data values
  5. ID – Server ID to start scanning


Writes current Modbus Maps to a remote server by sending a write request for each Monitor Point in the Modbus Map list.  Be careful using this feature when using critical systems, as it may operate unintendedly.


Clears the data in the Value Columns before starting the poll. 


Modbus Server or Slave can simulate devices. The Modbus Server can be started simultaneously on both Interfaces (TCP and Serial).

TCP Section (Modbus/TCP or UDP server)

Serial Section (Modbus RTU)

Note: Modbus RTU Server can start on multiple COM ports simultaneously. 

Server (Start/Stop) 

Capture (Modbus Maps Wizard)

Modbus Sniff

Sniffs Modbus Map traffic and automatically builds Modbus Maps when Clients are making requests to this Server. This is a great feature to use when Modbus Maps are unknown or not available from Manufacturers.  

  • Capture Button
    1. On: Add the Modbus Monitoring points based on the Modbus Request Requests.  The Server must be running for this feature to work.
    2. Off: Turn off Capture or Modbus Traffic sniffer.
  • Default Value 0: Fill “0” as the value into the newly created Modbus Map or use the Modbus Register address as the fill value