● Beta opens 1 July 2026 · v0.9.4Modbus TCP · RTU/ASCII in progressClient · Server · Scan · Script · Network · Traffic
Coilware Modbus

A modern Modbus toolkit.
Client, server, scanner, traffic and scripting — one app.

Diagnose, debug, commission and document any Modbus TCP device with a tool that doesn't look or feel like it was written in 2004. Client, server simulator, network scanner, traffic analyser and Python scripting - one application.

Beta opens 1 July 2026 · perpetual licence £99 · 30-day refund, no questions

Coilware Modbus - Default workspace
Coilware Modbus/Modbus TCP ClientSE
Polling · 500 ms
Search registers
FCAddressNameDisplay asValueUnitTrend
FC03Voltages - line to neutral40001 – 40006
FC0340001Voltage L1–NF32230.48V
FC0340003Voltage L2–NF32229.72V
FC0340005Voltage L3–NF32230.94V
FC03Power & energy40013 – 40020
FC0340013Active Power TotalF329813.75W
Byte-order decode · 2-register FLOAT32
OrderFloat32UInt32Int32
ABCD9813.751,176,065,7931,176,065,793
CDAB1.42e+141,459,701,2731,459,701,273
BADC1.02e-23424,018,263424,018,263
DCBA3.95e-3822,485,31822,485,318

Highlighted orders decode to a plausible value - click to apply.

Register · 40013
Function code
0x03 · Read Holding Registers
Word count
2
Display type
F32 · ABCD
Polled
every 500 ms
FC0340015Power FactorF320.97-
FC0340017FrequencyF3250.05Hz
FC0340019kWh ImportU32184,272Wh
FC04Line currents30001 – 30006
FC0430001Current L1F3214.72A
FC0430003Current L2F3213.91A
FC0430005Current L3F3214.07A
FC01Relay outputs00001 – 00002
FC0100001Relay K1 - TripBit0--
FC0100002Relay K2 - AlarmBit1--
FC02Interlocks10001 – 10002
FC0210001Door interlockBit1--
FC0210002Earth-fault inputBit0--
Connected·tcp://10.34.18.221:502·RTT 8 ms·41 ops/sWorkspaceDefault·v0.9.4
Client screen

Client

Talk to any Modbus TCP device - typed reads, in-place writes, live quality flags, and many connections at once.

  • Holding · input · coil · discrete - all four spaces, one view
  • UInt/Int 16·32·64, Float32, Double64, Hex, Binary, BCD, ASCII; per-register byte order
  • Engineering units & scaling - raw 5000 shows as 50.0 Hz, and writes back
  • Quality flags: live, stale, exception, timeout - with inline sparklines
Features

Built around how you actually debug.

01 · LIVE REGISTERS

Holding, input, coil, discrete - all four spaces, one view.

Typed register reads with auto-scaling, engineering units, and quality indicators. Edit cells in place to write back to the device. Polled at configurable intervals. Sortable by address, name, last change, or quality.

  • UInt/Int 16·32·64, Float32, Double64, Hex, Binary, BCD, ASCII
  • Per-register byte order - override the global default (ABCD/CDAB/BADC/DCBA)
  • Quality flags: live, stale, exception, timeout
  • Read groups polled at configurable intervals (100 ms - 5 s)
01
02 · FRAME INSPECTOR

Every byte on the wire, decoded.

A capture timeline of every TX/RX frame, with the function code named, the MBAP/transaction-ID checked, and the payload interpreted in plain English. Export the whole capture to .pcapng and open it in Wireshark. The first tool you reach for when something silent goes wrong.

  • Raw TX/RX trace with per-exchange timestamps and RTT pairing
  • Function-code-aware payload decode + plain-English exception text
  • MBAP / transaction-ID validation with mismatch highlighting
  • Export to .pcapng - open the full capture in Wireshark
02
03 · DECODER

Endianness, finally, visible.

Expand any register and see it as FLOAT32, INT32, UINT32 and packed BCD under all four byte orders - ABCD, CDAB, BADC, DCBA - at once. The “1.3 × 10⁻¹³ instead of 230 V” bug, solved in eight seconds.

  • Expand any register to compare all four orderings side by side
  • Hex · decimal uint16 · signed int16 · binary, simultaneously
  • Plausible orderings highlighted; click one to apply it inline
  • Per-register override - the rest of the map keeps the global default
03
04 · SERVER SIMULATOR

A device fleet, no hardware required.

Host one or more simulated slaves behind a single TCP listener and let your own client read and write them as if they were real PLCs. Drive registers with live animators so your HMI sees moving data, and inject exceptions on demand to test how your master handles faults.

  • Multiple unit IDs, all four banks - holding, input, coils, discrete
  • Live animators: sine, ramp, random-walk, counter
  • Injection rules - return any exception (0x01-0x0B) on demand
  • Editable device identity (FC17 + FC43); live clients, req/s, p50/p95/p99
04
05 · NETWORK SCANNER

Find what's on the wire.

Three scan modes to map an unfamiliar network: sweep the unit IDs behind a host, walk a register range and classify each address, or discover every host across a subnet with vendor identification.

  • Unit-ID scan + register sweep with live heatmap progress
  • Classify each address: live, illegal, or exception
  • Subnet discovery with MAC/OUI vendor lookup (Schneider, Rockwell, Siemens…)
  • Export results to CSV as a starting point
05
06 · REGISTER-MAP LIBRARY

Define a device once, reuse it everywhere.

Capture register names, types, units and scaling as a reusable map. Apply it to the Client for instant, fully-labelled read groups - or to the Server for an instant simulated device.

  • Built-in starter templates: generic VFD, power meter, solar inverter
  • Save your current setup as a map; duplicate and tweak
  • Apply to the Client or the Server in one click
  • Open formats - your maps aren't trapped in a binary blob
06
07 · PYTHON SCRIPTING

Automate it in real Python.

An embedded CPython 3.12 runtime with the full standard library and a pre-bound client object - connect, read and write in a few lines. Syntax-highlighted editor, a live console, and stop a run instantly.

  • Real CPython 3.12 (pythonnet) - not a toy DSL or macro recorder
  • Pre-bound client: read_holding_registers, write_register, write_coil…
  • Bundled examples; save and load your own .py files
  • Live stdout console with level-coloured output
07
Specs

No surprises in the readme.

Platforms
Windows
10, 11 · x64
Runtime
.NET 8 · self-contained build
Distribution
Portable zip · or signed installer
Roadmap
macOS + Linux under evaluation
Protocols
Modbus TCP
Stable
Modbus RTU
In progress
Modbus ASCII
In progress
Function codes
Read
FC01 · FC02 · FC03 · FC04
Write
FC05 · FC06 · FC15 · FC16
Read + Write
FC23 - Read/Write Multiple Registers
Mask
FC22 - Mask Write Register
Diagnostics
FC08
Identify
FC17 · FC43 / MEI-0x0E
Licensing
Trial
14 days, full features, offline
Personal
£99 · 1 engineer · up to 2 machines
Team
£329 · 5 seats
Site
POA · unlimited seats per site
Students
Free · with academic ID
Anti-features

What it won't do to you.

✕ NO

No subscription

One price. Perpetual. You own the licence. No-network mode supported indefinitely.

✕ NO

No USB dongle

We mean it. No HASP, no Aladdin, no SafeNet. Activation by licence file or offline key.

✕ NO

No admin install

Portable zip - unzip and run, no admin rights. Runs on the locked-down plant laptop your IT team set up in 2017. (Signed installer also available.)

✕ NO

No telemetry

No analytics, no crash reporters phoning home, no ‘help us improve’ dialogs. Logs stay on your machine.

✕ NO

No cloud lock-in

Config files are open formats. Captures export to .pcapng for Wireshark. Leave anytime.

✕ NO

No AI features (yet)

We're not gluing an LLM to the dialog box this year. If we do, it'll be optional and local.

Beta access

Want a free perpetual licence?

First twenty beta testers get a free perpetual licence - for life - in exchange for using it on real work and telling us what's broken.