Phase 3 PR 52 -- Modbus exception-code -> OPC UA StatusCode translation. Before this PR every server-side Modbus exception AND every transport-layer failure collapsed to BadInternalError (0x80020000) in the driver's Read/Write results, making field diagnosis 'is this a tag misconfig or a driver bug?' impossible from the OPC UA client side. PR 52 adds a MapModbusExceptionToStatus helper that translates per spec: 01 Illegal Function -> BadNotSupported (0x803D0000); 02 Illegal Data Address -> BadOutOfRange (0x803C0000); 03 Illegal Data Value -> BadOutOfRange; 04 Server Failure -> BadDeviceFailure (0x80550000); 05/06 Acknowledge/Busy -> BadDeviceFailure; 0A/0B Gateway -> BadCommunicationError (0x80050000); unknown -> BadInternalError fallback. Non-Modbus failures (socket drop, timeout, malformed frame) in ReadAsync are now distinguished from tag-level faults: they map to BadCommunicationError so operators check network/PLC reachability rather than tag definitions. Why per-DL205: docs/v2/dl205.md documents DL205/DL260 returning only codes 01-04 with specific triggers -- exception 04 specifically means 'CPU in PROGRAM mode during a protected write', which is operator-recoverable by switching the CPU to RUN; surfacing it as BadDeviceFailure (not BadInternalError) makes the fix obvious. Changes in ModbusDriver: Read catch-chain now ModbusException first (-> mapper), generic Exception second (-> BadCommunicationError); Write catch-chain same pattern but generic Exception stays BadInternalError because write failures can legitimately come from EncodeRegister (out-of-range value) which is a driver-layer fault. Unit tests: MapModbusExceptionToStatus theory exercising every code in the table including the 0xFF fallback; Read_surface_exception_02_as_BadOutOfRange with an ExceptionRaisingTransport that forces code 02; Write_surface_exception_04_as_BadDeviceFailure for CPU-mode faults; Read_non_modbus_failure_maps_to_BadCommunicationError with a NonModbusFailureTransport that raises EndOfStreamException. 115/115 Modbus.Tests pass. Integration test: DL205ExceptionCodeTests.DL205_FC03_at_unmapped_register_returns_BadOutOfRange reads HR[16383] which is beyond the seeded uint16 cells on the dl205.json profile; pymodbus returns exception 02 and the driver surfaces BadOutOfRange. 11/11 DL205 integration tests pass with MODBUS_SIM_PROFILE=dl205.

Three substantive issues caught + fixed during the validation pass:
1. pymodbus rejects unknown keys at device-list / setup level. My PR 43 commit had `_layout_note`, `_uint16_layout`, `_bits_layout`, `_write_note` device-level JSON-comment fields that crashed pymodbus startup with `INVALID key in setup`. Removed all device-level _* fields. Inline `_quirk` keys WITHIN individual register entries are tolerated by pymodbus 3.13.0 — kept those in dl205.json since they document the byte math per quirk and the README + git history aren't enough context for a hand-author reading raw integer values. Documented the constraint in the top-level _comment of each profile.
2. pymodbus rejects sweeping `write` ranges that include any cell not assigned a type. My initial standard.json had `write: [[0, 2047]]` but only seeded HR[0..31] + HR[100] + HR[200..209] + bits[1024..1109] — pymodbus blew up on cell 32 (gap between HR[31] and HR[100]). Fixed by listing per-block write ranges that exactly mirror the seeded ranges. Same fix in dl205.json (was `[[0, 16383]]`).
3. pymodbus simulator stores all 4 standard Modbus tables in ONE underlying cell array — each cell can only be typed once (BITS or UINT16, not both). My initial standard.json had `bits[0..31]` AND `uint16[0..31]` overlapping at the same addresses; pymodbus crashed with `ERROR "uint16" <Cell> used`. Fixed by relocating coils to address 1024+, well clear of the uint16 entries at 0..209. Documented the layout constraint in the standard.json top-level _comment.
Substantive driver bug fixed: ModbusTcpTransport.ConnectAsync was using `new TcpClient()` (default constructor — dual-stack, IPv6 first) then `ConnectAsync(host, port)` with the user's hostname. .NET's TcpClient default-resolves "localhost" to ::1 first, fails to connect to pymodbus (which binds 0.0.0.0 IPv4-only), and only then retries IPv4 — the failure surfaces as the entire ConnectAsync timeout (2s by default) before the IPv4 attempt even starts. PR 30's smoke test silently SKIPPED because the fixture's TCP probe hit the same dual-stack ordering and timed out. Both fixed: ModbusSimulatorFixture probe now resolves Dns.GetHostAddresses, prefers AddressFamily.InterNetwork, dials IPv4 explicitly. ModbusTcpTransport does the same — resolves first, prefers IPv4, falls back to whatever Dns returns (handles IPv6-only hosts in the future). This is a real production-readiness fix because most Modbus PLCs are IPv4-only — a generic dual-stack TcpClient would burn the entire connect timeout against any IPv4-only PLC, masquerading as a connection failure when the PLC is actually fine.
Smoke-test address shifted HR[100] -> HR[200]. Standard.json's HR[100] is the auto-incrementing register that drives subscribe-and-receive tests, so write-then-read against it would race the increment. HR[200] is the first cell of a writable scratch range present in BOTH simulator profiles. DL205Profile.cs xml-doc updated to explain the shift; tag name "DL205_Smoke_HReg100" -> "Smoke_HReg200" + smoke test references updated. dl205.json gains a matching scratch HR[200..209] range so the smoke test runs identically against either profile.
Validation matrix:
- standard.json boot: clean (TCP 5020 listening within ~3s of pymodbus.simulator launch).
- dl205.json boot: clean.
- pymodbus client direct FC06 to HR[200]=1234 + FC03 read: round-trip OK.
- raw-bytes PowerShell TcpClient FC06 + 12-byte response: matches FC06 spec (echo of address + value).
- DL205SmokeTest against standard.json: 1/1 pass (was failing as 'BadInternalError' due to the dual-stack timeout + tag-name typo — both fixed).
- DL205SmokeTest against dl205.json: 1/1 pass.
- Modbus.Tests Unit suite: 52/52 pass — dual-stack transport fix is non-breaking.
- Solution build clean.
Memory + future-PR setup: pymodbus install + activation pattern is now bullet-pointed at the top of Pymodbus/README.md so future PRs (the per-quirk DL205_<behavior> tests in PR 44+) don't have to repeat the trial-and-error of getting the simulator + integration tests cooperating. The three bugs above are documented inline in the JSON profiles + ModbusTcpTransport so they don't bite again.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/v2/modbus-test-plan.md

@@ -13,22 +13,30 @@ confirmed DL205 quirk lands in a follow-up PR as a named test in that project.
 
 ## Harness
 
-**Chosen simulator: ModbusPal** (Java, scriptable). Rationale:
-- Scriptable enough to mimic device-specific behaviors (non-standard register
-  layouts, custom exception codes, intentional response delays).
-- Runs locally, no CI dependency. Tests skip when `localhost:502` (or the configured
-  simulator endpoint) isn't reachable.
-- Free + long-maintained — physical PLC bench is unavailable in most dev
-  environments, and renting cloud PLCs isn't worth the per-test cost.
+**Chosen simulator: pymodbus 3.13.0** (`pip install 'pymodbus[simulator]==3.13.0'`).
+Replaced ModbusPal in PR 43 — see `tests/.../Pymodbus/README.md` for the
+trade-off rationale. Headline reasons:
 
-**Setup pattern** (not yet codified in a script — will land alongside the integration
-test project):
-1. Install ModbusPal, load the per-device `.xmpp` profile from
-   `tests/Driver.Modbus.IntegrationTests/ModbusPal/` (TBD directory).
-2. Start the simulator listening on `localhost:502` (or override via
-   `MODBUS_SIM_ENDPOINT` env var).
-3. `dotnet test` the integration project — tests auto-skip when the endpoint is
-   unreachable, so forgetting to start the simulator doesn't wedge CI.
+- **Headless** pure-Python CLI; no Java GUI, runs cleanly on a CI runner.
+- **Maintained** — current stable 3.13.0; ModbusPal 1.6b is abandoned.
+- **All four standard tables** (HR, IR, coils, DI) configurable; ModbusPal
+  1.6b only exposed HR + coils.
+- **Built-in actions** (`increment`, `random`, `timestamp`, `uptime`) +
+  optional custom-Python actions for declarative dynamic behaviors.
+- **Per-register raw uint16 seeding** — encoding the DL205 string-byte-order
+  / BCD / CDAB-float quirks stays explicit (the quirk math lives in the
+  `_quirk` JSON-comment fields next to each register).
+- Pip-installable on Windows; sidesteps the privileged-port admin
+  requirement by defaulting to TCP **5020** instead of 502.
+
+**Setup pattern**:
+1. `pip install "pymodbus[simulator]==3.13.0"`.
+2. Start the simulator with one of the in-repo profiles:
+   `tests\.../Pymodbus\serve.ps1 -Profile standard` (or `-Profile dl205`).
+3. `dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` —
+   tests auto-skip when the endpoint is unreachable. Default endpoint is
+   `localhost:5020`; override via `MODBUS_SIM_ENDPOINT` for a real PLC on its
+   native port 502.
 
 ## Per-device quirk catalog
 
@@ -87,20 +95,27 @@ vendors get promoted into driver defaults or opt-in options:
   protocol end-to-end. The in-memory `FakeTransport` from the unit test suite is
   deliberately not used here — its value is speed + determinism, which doesn't
   help reproduce device-specific issues.
-- **Don't depend on ModbusPal state between tests.** Each test resets the
+- **Don't depend on simulator state between tests.** Each test resets the
   simulator's register bank or uses a unique address range. Avoid relying on
   "previous test left value at register 10" setups that flake when tests run in
-  parallel or re-order.
+  parallel or re-order. Either the test mutates the scratch ranges and restores
+  on finally, or it uses pymodbus's REST API to reset state between facts.
 
 ## Next concrete PRs
 
 - **PR 30 — Integration test project + DL205 profile scaffold** — **DONE**.
   Shipped `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` with
   `ModbusSimulatorFixture` (TCP-probe, skips with a clear `SkipReason` when the
-  endpoint is unreachable), `DL205/DL205Profile.cs` (tag map stub — one
-  writable holding register at address 100), and `DL205/DL205SmokeTests.cs`
-  (write-then-read round-trip). `ModbusPal/` directory holds the README
-  pointing at the to-be-committed `DL205.xmpp` profile.
-- **PR 31+**: one PR per confirmed DL205 quirk, landing the named test + any
-  driver-side adjustment (e.g., retry on dropped TxId) needed to pass it. Drop
-  the `DL205.xmpp` profile into `ModbusPal/` alongside the first quirk PR.
+  endpoint is unreachable), `DL205/DL205Profile.cs` (tag map stub), and
+  `DL205/DL205SmokeTests.cs` (write-then-read round-trip).
+- **PR 41 — DL205 quirk catalog doc** — **DONE**. `docs/v2/dl205.md`
+  documents every DL205/DL260 Modbus divergence with primary-source citations.
+- **PR 42 — ModbusPal `.xmpp` profiles** — **SUPERSEDED by PR 43**. Replaced
+  with pymodbus JSON because ModbusPal 1.6b is abandoned, GUI-only, and only
+  exposes 2 of the 4 standard tables.
+- **PR 43 — pymodbus JSON profiles** — **DONE**. `Pymodbus/standard.json` +
+  `Pymodbus/dl205.json` + `Pymodbus/serve.ps1` runner. Both bind TCP 5020.
+- **PR 44+**: one PR per confirmed DL205 quirk, landing the named test + any
+  driver-side adjustment (string byte order, BCD decoder, V-memory address
+  helper, FC16 cap-per-device-family) needed to pass it. Each quirk's value
+  is already pre-encoded in `Pymodbus/dl205.json`.

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/DirectLogicAddress.cs

@@ -0,0 +1,165 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     AutomationDirect DirectLOGIC address-translation helpers. DL205 / DL260 / DL350 CPUs
+///     address V-memory in OCTAL while the Modbus wire uses DECIMAL PDU addresses — operators
+///     see "V2000" in the PLC ladder-logic editor but the Modbus client must write PDU 0x0400.
+///     The formulas differ between user V-memory (simple octal-to-decimal) and system V-memory
+///     (fixed bank mappings), so the two cases are separate methods rather than one overloaded
+///     "ToPdu" call.
+/// </summary>
+/// <remarks>
+///     See <c>docs/v2/dl205.md</c> §V-memory for the full CPU-family matrix + rationale.
+///     References: D2-USER-M appendix (DL205/D2-260), H2-ECOM-M §6.5 (absolute vs relative
+///     addressing), AutomationDirect forum guidance on V40400 system-base.
+/// </remarks>
+public static class DirectLogicAddress
+{
+    /// <summary>
+    ///     Convert a DirectLOGIC user V-memory address (octal) to a 0-based Modbus PDU address.
+    ///     Accepts bare octal (<c>"2000"</c>) or <c>V</c>-prefixed (<c>"V2000"</c>). Range
+    ///     depends on CPU model — DL205 D2-260 user memory is V1400-V7377 + V10000-V17777
+    ///     octal, DL260 extends to V77777 octal.
+    /// </summary>
+    /// <exception cref="ArgumentException">Input is null / empty / contains non-octal digits (8,9).</exception>
+    /// <exception cref="OverflowException">Parsed value exceeds ushort.MaxValue (0xFFFF).</exception>
+    public static ushort UserVMemoryToPdu(string vAddress)
+    {
+        if (string.IsNullOrWhiteSpace(vAddress))
+            throw new ArgumentException("V-memory address must not be empty", nameof(vAddress));
+        var s = vAddress.Trim();
+        if (s[0] == 'V' || s[0] == 'v') s = s.Substring(1);
+        if (s.Length == 0)
+            throw new ArgumentException($"V-memory address '{vAddress}' has no digits", nameof(vAddress));
+
+        // Octal conversion. Reject 8/9 digits up-front — int.Parse in the obvious base would
+        // accept them silently because .NET has no built-in base-8 parser.
+        uint result = 0;
+        foreach (var ch in s)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"V-memory address '{vAddress}' contains non-octal digit '{ch}' — DirectLOGIC V-addresses are octal (0-7)",
+                    nameof(vAddress));
+            result = result * 8 + (uint)(ch - '0');
+            if (result > ushort.MaxValue)
+                throw new OverflowException(
+                    $"V-memory address '{vAddress}' exceeds the 16-bit Modbus PDU address range");
+        }
+        return (ushort)result;
+    }
+
+    /// <summary>
+    ///     DirectLOGIC system V-memory starts at octal V40400 on DL260 / H2-ECOM100 in factory
+    ///     "absolute" addressing mode. Unlike user V-memory, the mapping is NOT a simple
+    ///     octal-to-decimal conversion — the CPU relocates the system bank to Modbus PDU 0x2100
+    ///     (decimal 8448). This helper returns the CPU-family base plus a user-supplied offset
+    ///     within the system bank.
+    /// </summary>
+    public const ushort SystemVMemoryBasePdu = 0x2100;
+
+    /// <param name="offsetWithinSystemBank">
+    ///     0-based register offset within the system bank. Pass 0 for V40400 itself; pass 1 for
+    ///     V40401 (octal), and so on. NOT an octal-decoded value — the system bank lives at
+    ///     consecutive PDU addresses, so the offset is plain decimal.
+    /// </param>
+    public static ushort SystemVMemoryToPdu(ushort offsetWithinSystemBank)
+    {
+        var pdu = SystemVMemoryBasePdu + offsetWithinSystemBank;
+        if (pdu > ushort.MaxValue)
+            throw new OverflowException(
+                $"System V-memory offset {offsetWithinSystemBank} maps past 0xFFFF");
+        return (ushort)pdu;
+    }
+
+    // Bit-memory bases per DL260 user manual §I/O-configuration.
+    // Numbers after X / Y / C / SP are OCTAL in DirectLOGIC notation. The Modbus base is
+    // added to the octal-decoded offset; e.g. Y017 = Modbus coil 2048 + octal(17) = 2048 + 15 = 2063.
+
+    /// <summary>
+    ///     DL260 Y-output coil base. Y0 octal → Modbus coil address 2048 (0-based).
+    /// </summary>
+    public const ushort YOutputBaseCoil = 2048;
+
+    /// <summary>
+    ///     DL260 C-relay coil base. C0 octal → Modbus coil address 3072 (0-based).
+    /// </summary>
+    public const ushort CRelayBaseCoil = 3072;
+
+    /// <summary>
+    ///     DL260 X-input discrete-input base. X0 octal → Modbus discrete input 0.
+    /// </summary>
+    public const ushort XInputBaseDiscrete = 0;
+
+    /// <summary>
+    ///     DL260 SP special-relay discrete-input base. SP0 octal → Modbus discrete input 1024.
+    ///     Read-only; writing SP relays is rejected with Illegal Data Address.
+    /// </summary>
+    public const ushort SpecialBaseDiscrete = 1024;
+
+    /// <summary>
+    ///     Translate a DirectLOGIC Y-output address (e.g. <c>"Y0"</c>, <c>"Y17"</c>) to its
+    ///     0-based Modbus coil address on DL260. The trailing number is OCTAL, matching the
+    ///     ladder-logic editor's notation.
+    /// </summary>
+    public static ushort YOutputToCoil(string yAddress) =>
+        AddOctalOffset(YOutputBaseCoil, StripPrefix(yAddress, 'Y'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC C-relay address (e.g. <c>"C0"</c>, <c>"C1777"</c>) to its
+    ///     0-based Modbus coil address.
+    /// </summary>
+    public static ushort CRelayToCoil(string cAddress) =>
+        AddOctalOffset(CRelayBaseCoil, StripPrefix(cAddress, 'C'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC X-input address (e.g. <c>"X0"</c>, <c>"X17"</c>) to its
+    ///     0-based Modbus discrete-input address. Reading an unpopulated X returns 0, not an
+    ///     exception — the CPU sizes the table to configured I/O, not installed modules.
+    /// </summary>
+    public static ushort XInputToDiscrete(string xAddress) =>
+        AddOctalOffset(XInputBaseDiscrete, StripPrefix(xAddress, 'X'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC SP-special-relay address (e.g. <c>"SP0"</c>) to its 0-based
+    ///     Modbus discrete-input address. Accepts <c>"SP"</c> prefix case-insensitively.
+    /// </summary>
+    public static ushort SpecialToDiscrete(string spAddress)
+    {
+        if (string.IsNullOrWhiteSpace(spAddress))
+            throw new ArgumentException("SP address must not be empty", nameof(spAddress));
+        var s = spAddress.Trim();
+        if (s.Length >= 2 && (s[0] == 'S' || s[0] == 's') && (s[1] == 'P' || s[1] == 'p'))
+            s = s.Substring(2);
+        return AddOctalOffset(SpecialBaseDiscrete, s);
+    }
+
+    private static string StripPrefix(string address, char expectedPrefix)
+    {
+        if (string.IsNullOrWhiteSpace(address))
+            throw new ArgumentException("Address must not be empty", nameof(address));
+        var s = address.Trim();
+        if (s.Length > 0 && char.ToUpperInvariant(s[0]) == char.ToUpperInvariant(expectedPrefix))
+            s = s.Substring(1);
+        return s;
+    }
+
+    private static ushort AddOctalOffset(ushort baseAddr, string octalDigits)
+    {
+        if (octalDigits.Length == 0)
+            throw new ArgumentException("Address has no digits", nameof(octalDigits));
+        uint offset = 0;
+        foreach (var ch in octalDigits)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"Address contains non-octal digit '{ch}' — DirectLOGIC I/O addresses are octal (0-7)",
+                    nameof(octalDigits));
+            offset = offset * 8 + (uint)(ch - '0');
+        }
+        var result = baseAddr + offset;
+        if (result > ushort.MaxValue)
+            throw new OverflowException($"Address {baseAddr}+{offset} exceeds 0xFFFF");
+        return (ushort)result;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -141,9 +141,16 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 results[i] = new DataValueSnapshot(value, 0u, now, now);
                 _health = new DriverHealth(DriverState.Healthy, now, null);
             }
+            catch (ModbusException mex)
+            {
+                results[i] = new DataValueSnapshot(null, MapModbusExceptionToStatus(mex.ExceptionCode), null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, mex.Message);
+            }
             catch (Exception ex)
             {
-                results[i] = new DataValueSnapshot(null, StatusBadInternalError, null, now);
+                // Non-Modbus-layer failure: socket dropped, timeout, malformed response. Surface
+                // as communication error so callers can distinguish it from tag-level faults.
+                results[i] = new DataValueSnapshot(null, StatusBadCommunicationError, null, now);
                 _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
             }
         }
@@ -171,11 +178,14 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
             {
                 var quantity = RegisterCount(tag);
                 var fc = tag.Region == ModbusRegion.HoldingRegisters ? (byte)0x03 : (byte)0x04;
-                var pdu = new byte[] { fc, (byte)(tag.Address >> 8), (byte)(tag.Address & 0xFF),
-                                       (byte)(quantity >> 8), (byte)(quantity & 0xFF) };
-                var resp = await transport.SendAsync(_options.UnitId, pdu, ct).ConfigureAwait(false);
-                // resp = [fc][byte-count][data...]
-                var data = new ReadOnlySpan<byte>(resp, 2, resp[1]);
+                // Auto-chunk when the tag's register span exceeds the caller-configured cap.
+                // Affects long strings (FC03/04 > 125 regs is spec-forbidden; DL205 caps at 128,
+                // Mitsubishi Q caps at 64). Non-string tags max out at 4 regs so the cap never
+                // triggers for numerics.
+                var cap = _options.MaxRegistersPerRead == 0 ? (ushort)125 : _options.MaxRegistersPerRead;
+                var data = quantity <= cap
+                    ? await ReadRegisterBlockAsync(transport, fc, tag.Address, quantity, ct).ConfigureAwait(false)
+                    : await ReadRegisterBlockChunkedAsync(transport, fc, tag.Address, quantity, cap, ct).ConfigureAwait(false);
                 return DecodeRegister(data, tag);
             }
             default:
@@ -183,6 +193,33 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         }
     }
 
+    private async Task<byte[]> ReadRegisterBlockAsync(
+        IModbusTransport transport, byte fc, ushort address, ushort quantity, CancellationToken ct)
+    {
+        var pdu = new byte[] { fc, (byte)(address >> 8), (byte)(address & 0xFF),
+                               (byte)(quantity >> 8), (byte)(quantity & 0xFF) };
+        var resp = await transport.SendAsync(_options.UnitId, pdu, ct).ConfigureAwait(false);
+        // resp = [fc][byte-count][data...]
+        var data = new byte[resp[1]];
+        Buffer.BlockCopy(resp, 2, data, 0, resp[1]);
+        return data;
+    }
+
+    private async Task<byte[]> ReadRegisterBlockChunkedAsync(
+        IModbusTransport transport, byte fc, ushort address, ushort totalRegs, ushort cap, CancellationToken ct)
+    {
+        var assembled = new byte[totalRegs * 2];
+        ushort done = 0;
+        while (done < totalRegs)
+        {
+            var chunk = (ushort)Math.Min(cap, totalRegs - done);
+            var chunkBytes = await ReadRegisterBlockAsync(transport, fc, (ushort)(address + done), chunk, ct).ConfigureAwait(false);
+            Buffer.BlockCopy(chunkBytes, 0, assembled, done * 2, chunkBytes.Length);
+            done += chunk;
+        }
+        return assembled;
+    }
+
     // ---- IWritable ----
 
     public async Task<IReadOnlyList<WriteResult>> WriteAsync(
@@ -208,6 +245,10 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 await WriteOneAsync(transport, tag, w.Value, cancellationToken).ConfigureAwait(false);
                 results[i] = new WriteResult(0u);
             }
+            catch (ModbusException mex)
+            {
+                results[i] = new WriteResult(MapModbusExceptionToStatus(mex.ExceptionCode));
+            }
             catch (Exception)
             {
                 results[i] = new WriteResult(StatusBadInternalError);
@@ -239,8 +280,13 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 }
                 else
                 {
-                    // FC 16 (Write Multiple Registers) for 32-bit types
+                    // FC 16 (Write Multiple Registers) for 32-bit types.
                     var qty = (ushort)(bytes.Length / 2);
+                    var writeCap = _options.MaxRegistersPerWrite == 0 ? (ushort)123 : _options.MaxRegistersPerWrite;
+                    if (qty > writeCap)
+                        throw new InvalidOperationException(
+                            $"Write of {qty} registers to {tag.Name} exceeds MaxRegistersPerWrite={writeCap}. " +
+                            $"Split the tag (e.g. shorter StringLength) — partial FC16 chunks would lose atomicity.");
                     var pdu = new byte[6 + 1 + bytes.Length];
                     pdu[0] = 0x10;
                     pdu[1] = (byte)(tag.Address >> 8); pdu[2] = (byte)(tag.Address & 0xFF);
@@ -404,8 +450,8 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
     /// </summary>
     internal static ushort RegisterCount(ModbusTagDefinition tag) => tag.DataType switch
     {
-        ModbusDataType.Int16 or ModbusDataType.UInt16 or ModbusDataType.BitInRegister => 1,
-        ModbusDataType.Int32 or ModbusDataType.UInt32 or ModbusDataType.Float32 => 2,
+        ModbusDataType.Int16 or ModbusDataType.UInt16 or ModbusDataType.BitInRegister or ModbusDataType.Bcd16 => 1,
+        ModbusDataType.Int32 or ModbusDataType.UInt32 or ModbusDataType.Float32 or ModbusDataType.Bcd32 => 2,
         ModbusDataType.Int64 or ModbusDataType.UInt64 or ModbusDataType.Float64 => 4,
         ModbusDataType.String => (ushort)((tag.StringLength + 1) / 2), // 2 chars per register
         _ => throw new InvalidOperationException($"Non-register data type {tag.DataType}"),
@@ -435,6 +481,17 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         {
             case ModbusDataType.Int16: return BinaryPrimitives.ReadInt16BigEndian(data);
             case ModbusDataType.UInt16: return BinaryPrimitives.ReadUInt16BigEndian(data);
+            case ModbusDataType.Bcd16:
+            {
+                var raw = BinaryPrimitives.ReadUInt16BigEndian(data);
+                return (int)DecodeBcd(raw, nibbles: 4);
+            }
+            case ModbusDataType.Bcd32:
+            {
+                var b = NormalizeWordOrder(data, tag.ByteOrder);
+                var raw = BinaryPrimitives.ReadUInt32BigEndian(b);
+                return (int)DecodeBcd(raw, nibbles: 8);
+            }
             case ModbusDataType.BitInRegister:
             {
                 var raw = BinaryPrimitives.ReadUInt16BigEndian(data);
@@ -472,13 +529,21 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
             }
             case ModbusDataType.String:
             {
-                // ASCII, 2 chars per register, packed high byte = first char.
-                // Respect the caller's StringLength (truncate nul-padded regions).
+                // ASCII, 2 chars per register. HighByteFirst (standard) packs the first char in
+                // the high byte of each register; LowByteFirst (DL205/DL260) packs the first char
+                // in the low byte. Respect StringLength (truncate nul-padded regions).
                 var chars = new char[tag.StringLength];
                 for (var i = 0; i < tag.StringLength; i++)
                 {
-                    var b = data[i];
-                    if (b == 0) { return new string(chars, 0, i); }
+                    var regIdx = i / 2;
+                    var highByte = data[regIdx * 2];
+                    var lowByte  = data[regIdx * 2 + 1];
+                    byte b;
+                    if (tag.StringByteOrder == ModbusStringByteOrder.HighByteFirst)
+                        b = (i % 2 == 0) ? highByte : lowByte;
+                    else
+                        b = (i % 2 == 0) ? lowByte : highByte;
+                    if (b == 0) return new string(chars, 0, i);
                     chars[i] = (char)b;
                 }
                 return new string(chars);
@@ -502,6 +567,21 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 var v = Convert.ToUInt16(value);
                 var b = new byte[2]; BinaryPrimitives.WriteUInt16BigEndian(b, v); return b;
             }
+            case ModbusDataType.Bcd16:
+            {
+                var v = Convert.ToUInt32(value);
+                if (v > 9999) throw new OverflowException($"BCD16 value {v} exceeds 4 decimal digits");
+                var raw = (ushort)EncodeBcd(v, nibbles: 4);
+                var b = new byte[2]; BinaryPrimitives.WriteUInt16BigEndian(b, raw); return b;
+            }
+            case ModbusDataType.Bcd32:
+            {
+                var v = Convert.ToUInt32(value);
+                if (v > 99_999_999u) throw new OverflowException($"BCD32 value {v} exceeds 8 decimal digits");
+                var raw = EncodeBcd(v, nibbles: 8);
+                var b = new byte[4]; BinaryPrimitives.WriteUInt32BigEndian(b, raw);
+                return NormalizeWordOrder(b, tag.ByteOrder);
+            }
             case ModbusDataType.Int32:
             {
                 var v = Convert.ToInt32(value);
@@ -543,7 +623,14 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 var s = Convert.ToString(value) ?? string.Empty;
                 var regs = (tag.StringLength + 1) / 2;
                 var b = new byte[regs * 2];
-                for (var i = 0; i < tag.StringLength && i < s.Length; i++) b[i] = (byte)s[i];
+                for (var i = 0; i < tag.StringLength && i < s.Length; i++)
+                {
+                    var regIdx = i / 2;
+                    var destIdx = tag.StringByteOrder == ModbusStringByteOrder.HighByteFirst
+                        ? (i % 2 == 0 ? regIdx * 2 : regIdx * 2 + 1)
+                        : (i % 2 == 0 ? regIdx * 2 + 1 : regIdx * 2);
+                    b[destIdx] = (byte)s[i];
+                }
                 // remaining bytes stay 0 — nul-padded per PLC convention
                 return b;
             }
@@ -564,15 +651,77 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         ModbusDataType.Float32 => DriverDataType.Float32,
         ModbusDataType.Float64 => DriverDataType.Float64,
         ModbusDataType.String => DriverDataType.String,
+        ModbusDataType.Bcd16 or ModbusDataType.Bcd32 => DriverDataType.Int32,
         _ => DriverDataType.Int32,
     };
 
+    /// <summary>
+    ///     Decode an N-nibble binary-coded-decimal value. Each nibble of <paramref name="raw"/>
+    ///     encodes one decimal digit (most-significant nibble first). Rejects nibbles &gt; 9 —
+    ///     the hardware sometimes produces garbage during transitions and silent non-BCD reads
+    ///     would quietly corrupt the caller's data.
+    /// </summary>
+    internal static uint DecodeBcd(uint raw, int nibbles)
+    {
+        uint result = 0;
+        for (var i = nibbles - 1; i >= 0; i--)
+        {
+            var digit = (raw >> (i * 4)) & 0xF;
+            if (digit > 9)
+                throw new InvalidDataException(
+                    $"Non-BCD nibble 0x{digit:X} at position {i} of raw=0x{raw:X}");
+            result = result * 10 + digit;
+        }
+        return result;
+    }
+
+    /// <summary>
+    ///     Encode a decimal value as N-nibble BCD. Caller is responsible for range-checking
+    ///     against the nibble capacity (10^nibbles - 1).
+    /// </summary>
+    internal static uint EncodeBcd(uint value, int nibbles)
+    {
+        uint result = 0;
+        for (var i = 0; i < nibbles; i++)
+        {
+            var digit = value % 10;
+            result |= digit << (i * 4);
+            value /= 10;
+        }
+        return result;
+    }
+
     private IModbusTransport RequireTransport() =>
         _transport ?? throw new InvalidOperationException("ModbusDriver not initialized");
 
     private const uint StatusBadInternalError = 0x80020000u;
     private const uint StatusBadNodeIdUnknown = 0x80340000u;
     private const uint StatusBadNotWritable = 0x803B0000u;
+    private const uint StatusBadOutOfRange = 0x803C0000u;
+    private const uint StatusBadNotSupported = 0x803D0000u;
+    private const uint StatusBadDeviceFailure = 0x80550000u;
+    private const uint StatusBadCommunicationError = 0x80050000u;
+
+    /// <summary>
+    ///     Map a server-returned Modbus exception code to the most informative OPC UA
+    ///     StatusCode. Keeps the driver's outward-facing status surface aligned with what a
+    ///     Modbus engineer would expect when reading the spec: exception 02 (Illegal Data
+    ///     Address) surfaces as BadOutOfRange so clients can distinguish "tag wrong" from
+    ///     generic BadInternalError, exception 04 (Server Failure) as BadDeviceFailure so
+    ///     operators see a CPU-mode problem rather than a driver bug, etc. Per
+    ///     <c>docs/v2/dl205.md</c>, DL205/DL260 returns only codes 01-04 — no proprietary
+    ///     extensions.
+    /// </summary>
+    internal static uint MapModbusExceptionToStatus(byte exceptionCode) => exceptionCode switch
+    {
+        0x01 => StatusBadNotSupported,     // Illegal Function — FC not in supported list
+        0x02 => StatusBadOutOfRange,       // Illegal Data Address — register outside mapped range
+        0x03 => StatusBadOutOfRange,       // Illegal Data Value — quantity over per-FC cap
+        0x04 => StatusBadDeviceFailure,    // Server Failure — CPU in PROGRAM mode during protected write
+        0x05 or 0x06 => StatusBadDeviceFailure, // Acknowledge / Server Busy — long-running op / busy
+        0x0A or 0x0B => StatusBadCommunicationError, // Gateway path unavailable / target failed to respond
+        _ => StatusBadInternalError,
+    };
 
     public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
     public async ValueTask DisposeAsync()

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverOptions.cs

@@ -25,6 +25,26 @@ public sealed class ModbusDriverOptions
     ///     <see cref="IHostConnectivityProbe"/>.
     /// </summary>
     public ModbusProbeOptions Probe { get; init; } = new();
+
+    /// <summary>
+    ///     Maximum registers per FC03 (Read Holding Registers) / FC04 (Read Input Registers)
+    ///     transaction. Modbus-TCP spec allows 125; many device families impose lower caps:
+    ///     AutomationDirect DL205/DL260 cap at <c>128</c>, Mitsubishi Q/FX3U cap at <c>64</c>,
+    ///     Omron CJ/CS cap at <c>125</c>. Set to the lowest cap across the devices this driver
+    ///     instance talks to; the driver auto-chunks larger reads into consecutive requests.
+    ///     Default <c>125</c> — the spec maximum, safe against any conforming server. Setting
+    ///     to <c>0</c> disables the cap (discouraged — the spec upper bound still applies).
+    /// </summary>
+    public ushort MaxRegistersPerRead { get; init; } = 125;
+
+    /// <summary>
+    ///     Maximum registers per FC16 (Write Multiple Registers) transaction. Spec maximum is
+    ///     <c>123</c>; DL205/DL260 cap at <c>100</c>. Matching caller-vs-device semantics:
+    ///     exceeding the cap currently throws (writes aren't auto-chunked because a partial
+    ///     write across two FC16 calls is no longer atomic — caller must explicitly opt in
+    ///     by shortening the tag's <c>StringLength</c> or splitting it into multiple tags).
+    /// </summary>
+    public ushort MaxRegistersPerWrite { get; init; } = 123;
 }
 
 public sealed class ModbusProbeOptions
@@ -55,6 +75,12 @@ public sealed class ModbusProbeOptions
 /// <param name="ByteOrder">Word ordering for multi-register types. Ignored for Bool / Int16 / UInt16 / BitInRegister / String.</param>
 /// <param name="BitIndex">For <c>DataType = BitInRegister</c>: which bit of the holding register (0-15, LSB-first).</param>
 /// <param name="StringLength">For <c>DataType = String</c>: number of ASCII characters (2 per register, rounded up).</param>
+/// <param name="StringByteOrder">
+///     Per-register byte order for <c>DataType = String</c>. Standard Modbus packs the first
+///     character in the high byte (<see cref="ModbusStringByteOrder.HighByteFirst"/>).
+///     AutomationDirect DirectLOGIC (DL205/DL260) and a few legacy families pack the first
+///     character in the low byte instead — see <c>docs/v2/dl205.md</c> §strings.
+/// </param>
 public sealed record ModbusTagDefinition(
     string Name,
     ModbusRegion Region,
@@ -63,7 +89,8 @@ public sealed record ModbusTagDefinition(
     bool Writable = true,
     ModbusByteOrder ByteOrder = ModbusByteOrder.BigEndian,
     byte BitIndex = 0,
-    ushort StringLength = 0);
+    ushort StringLength = 0,
+    ModbusStringByteOrder StringByteOrder = ModbusStringByteOrder.HighByteFirst);
 
 public enum ModbusRegion { Coils, DiscreteInputs, InputRegisters, HoldingRegisters }
 
@@ -82,6 +109,18 @@ public enum ModbusDataType
     BitInRegister,
     /// <summary>ASCII string packed 2 chars per register, <see cref="ModbusTagDefinition.StringLength"/> characters long.</summary>
     String,
+    /// <summary>
+    ///     16-bit binary-coded decimal. Each nibble encodes one decimal digit (0-9). Register
+    ///     value <c>0x1234</c> decodes as decimal <c>1234</c> — NOT binary <c>0x04D2 = 4660</c>.
+    ///     DL205/DL260 and several Mitsubishi / Omron families store timers, counters, and
+    ///     operator-facing numerics as BCD by default.
+    /// </summary>
+    Bcd16,
+    /// <summary>
+    ///     32-bit (two-register) BCD. Decodes 8 decimal digits. Word ordering follows
+    ///     <see cref="ModbusTagDefinition.ByteOrder"/> the same way <see cref="Int32"/> does.
+    /// </summary>
+    Bcd32,
 }
 
 /// <summary>
@@ -95,3 +134,17 @@ public enum ModbusByteOrder
     BigEndian,
     WordSwap,
 }
+
+/// <summary>
+///     Per-register byte order for ASCII strings packed 2 chars per register. Standard Modbus
+///     convention is <see cref="HighByteFirst"/> — the first character of each pair occupies
+///     the high byte of the register. AutomationDirect DirectLOGIC (DL205, DL260, DL350) and a
+///     handful of legacy controllers pack <see cref="LowByteFirst"/>, which inverts that within
+///     each register. Word ordering across multiple registers is always ascending address for
+///     strings — only the byte order inside each register flips.
+/// </summary>
+public enum ModbusStringByteOrder
+{
+    HighByteFirst,
+    LowByteFirst,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTcpTransport.cs

@@ -28,10 +28,20 @@ public sealed class ModbusTcpTransport : IModbusTransport
 
     public async Task ConnectAsync(CancellationToken ct)
     {
-        _client = new TcpClient();
+        // Resolve the host explicitly + prefer IPv4. .NET's TcpClient default-constructor is
+        // dual-stack (IPv6 first, fallback to IPv4) — but most Modbus TCP devices (PLCs and
+        // simulators like pymodbus) bind 0.0.0.0 only, so the IPv6 attempt times out and we
+        // burn the entire ConnectAsync budget before even trying IPv4. Resolving first +
+        // dialing the IPv4 address directly sidesteps that.
+        var addresses = await System.Net.Dns.GetHostAddressesAsync(_host, ct).ConfigureAwait(false);
+        var ipv4 = System.Linq.Enumerable.FirstOrDefault(addresses,
+            a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork);
+        var target = ipv4 ?? (addresses.Length > 0 ? addresses[0] : System.Net.IPAddress.Loopback);
+
+        _client = new TcpClient(target.AddressFamily);
         using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
         cts.CancelAfter(_timeout);
-        await _client.ConnectAsync(_host, _port, cts.Token).ConfigureAwait(false);
+        await _client.ConnectAsync(target, _port, cts.Token).ConfigureAwait(false);
         _stream = _client.GetStream();
     }
 

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205BcdQuirkTests.cs

@@ -0,0 +1,56 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies DL205/DL260 binary-coded-decimal register handling against the
+///     <c>dl205.json</c> pymodbus profile. HR[1072] = 0x1234 on the profile represents
+///     decimal 1234 (BCD nibbles). Reading it as <see cref="ModbusDataType.Int16"/> would
+///     return 0x1234 = 4660; the <see cref="ModbusDataType.Bcd16"/> path decodes 1234.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205BcdQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_BCD16_decodes_HR1072_as_decimal_1234()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed HR[1072]).");
+        }
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_Count_Bcd",
+                    ModbusRegion.HoldingRegisters, Address: 1072,
+                    DataType: ModbusDataType.Bcd16, Writable: false),
+                new ModbusTagDefinition("DL205_Count_Int16",
+                    ModbusRegion.HoldingRegisters, Address: 1072,
+                    DataType: ModbusDataType.Int16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-bcd");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_Count_Bcd", "DL205_Count_Int16"],
+            TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(1234, "DL205 BCD register 0x1234 represents decimal 1234 per the DirectLOGIC convention");
+
+        results[1].StatusCode.ShouldBe(0u);
+        results[1].Value.ShouldBe((short)0x1234, "same register read as Int16 returns the raw 0x1234 = 4660 value — proves BCD path is distinct");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205CoilMappingTests.cs

@@ -0,0 +1,109 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies DL260 I/O-memory coil mappings against the <c>dl205.json</c> pymodbus profile.
+///     DirectLOGIC Y-outputs and C-relays are exposed to Modbus as FC01/FC05 coils, but at
+///     non-zero base addresses that confuse operators used to "Y0 is the first coil". The sim
+///     seeds Y0 → coil 2048 = ON and C0 → coil 3072 = ON as fixed markers.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205CoilMappingTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL260_Y0_maps_to_coil_2048()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        var coil = DirectLogicAddress.YOutputToCoil("Y0");
+        coil.ShouldBe((ushort)2048);
+
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_Y0",
+                ModbusRegion.Coils, Address: coil,
+                DataType: ModbusDataType.Bool, Writable: false),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-y0");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL260_Y0"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(true, "dl205.json seeds coil 2048 (Y0) = ON");
+    }
+
+    [Fact]
+    public async Task DL260_C0_maps_to_coil_3072()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        var coil = DirectLogicAddress.CRelayToCoil("C0");
+        coil.ShouldBe((ushort)3072);
+
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_C0",
+                ModbusRegion.Coils, Address: coil,
+                DataType: ModbusDataType.Bool, Writable: false),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-c0");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL260_C0"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(true, "dl205.json seeds coil 3072 (C0) = ON");
+    }
+
+    [Fact]
+    public async Task DL260_scratch_Crelay_supports_write_then_read()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // Scratch C-relay at coil 4000 (per dl205.json _quirk note) is writable. Write=true then
+        // read back to confirm FC05 round-trip works against the DL-mapped coil bank.
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_C_Scratch",
+                ModbusRegion.Coils, Address: 4000,
+                DataType: ModbusDataType.Bool, Writable: true),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-cscratch");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var writeResults = await driver.WriteAsync(
+            [new(FullReference: "DL260_C_Scratch", Value: true)],
+            TestContext.Current.CancellationToken);
+        writeResults[0].StatusCode.ShouldBe(0u);
+
+        var readResults = await driver.ReadAsync(["DL260_C_Scratch"], TestContext.Current.CancellationToken);
+        readResults[0].StatusCode.ShouldBe(0u);
+        readResults[0].Value.ShouldBe(true);
+    }
+
+    private static ModbusDriverOptions BuildOptions(ModbusSimulatorFixture sim, IReadOnlyList<ModbusTagDefinition> tags)
+        => new()
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags = tags,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205ExceptionCodeTests.cs

@@ -0,0 +1,53 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the driver's Modbus-exception → OPC UA StatusCode translation end-to-end
+///     against the dl205.json pymodbus profile. pymodbus returns exception 02 (Illegal Data
+///     Address) for reads outside the configured register ranges, matching real DL205/DL260
+///     firmware behavior per <c>docs/v2/dl205.md</c> §exception-codes. The driver must surface
+///     that as <c>BadOutOfRange</c> (0x803C0000) — not <c>BadInternalError</c> — so the
+///     operator sees a tag-config diagnosis instead of a generic driver-fault message.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205ExceptionCodeTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_FC03_at_unmapped_register_returns_BadOutOfRange()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // Address 16383 is the last cell of hr-size=16384 in dl205.json; address 16384 is
+        // beyond the configured HR range. pymodbus validates and returns exception 02
+        // (Illegal Data Address).
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("Unmapped",
+                    ModbusRegion.HoldingRegisters, Address: 16383,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-exc");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["Unmapped"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0x803C0000u,
+            "DL205 returns exception 02 for an FC03 at an unmapped register; driver must translate to BadOutOfRange (not BadInternalError)");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205FloatCdabQuirkTests.cs

@@ -0,0 +1,64 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies DL205/DL260 CDAB word ordering for 32-bit floats against the
+///     <c>dl205.json</c> pymodbus profile. DirectLOGIC stores IEEE-754 singles with the low
+///     word at the lower register address (CDAB) rather than the high word (ABCD). Reading
+///     <c>HR[1056..1057]</c> with <see cref="ModbusByteOrder.BigEndian"/> produces a tiny
+///     denormal (~5.74e-41) instead of the intended 1.5f — a silent "value is 0" bug in the
+///     field unless the caller opts into <see cref="ModbusByteOrder.WordSwap"/>.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205FloatCdabQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_Float32_CDAB_decodes_1_5f_from_HR1056()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed HR[1056..1057]).");
+        }
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_Float_CDAB",
+                    ModbusRegion.HoldingRegisters, Address: 1056,
+                    DataType: ModbusDataType.Float32, Writable: false,
+                    ByteOrder: ModbusByteOrder.WordSwap),
+                // Control: same address, BigEndian — proves the default decode produces garbage.
+                new ModbusTagDefinition("DL205_Float_ABCD",
+                    ModbusRegion.HoldingRegisters, Address: 1056,
+                    DataType: ModbusDataType.Float32, Writable: false,
+                    ByteOrder: ModbusByteOrder.BigEndian),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-cdab");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_Float_CDAB", "DL205_Float_ABCD"],
+            TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(1.5f, "DL205 Float32 with WordSwap (CDAB) must decode HR[1056..1057] as 1.5f");
+
+        // The BigEndian read of the same wire bytes should differ — not asserting the exact
+        // denormal value (that couples the test to IEEE-754 bit math) but the two decodes MUST
+        // disagree, otherwise the word-order flag is a no-op.
+        results[1].StatusCode.ShouldBe(0u);
+        results[1].Value.ShouldNotBe(1.5f);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205Profile.cs

@@ -1,26 +1,30 @@
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
 
 /// <summary>
-///     Tag map for the AutomationDirect DL205 device class. Mirrors what the ModbusPal
-///     <c>.xmpp</c> profile in <c>ModbusPal/DL205.xmpp</c> exposes (or the real PLC, when
+///     Tag map for the AutomationDirect DL205 device class. Mirrors what the pymodbus
+///     <c>dl205.json</c> profile in <c>Pymodbus/dl205.json</c> exposes (or the real PLC, when
 ///     <see cref="ModbusSimulatorFixture"/> is pointed at one).
 /// </summary>
 /// <remarks>
 ///     This is the scaffold — each tag is deliberately generic so the smoke test has stable
 ///     addresses to read. Device-specific quirk tests (word order, max-register, register-zero
 ///     access, etc.) will land in their own test classes alongside this profile as the user
-///     validates each behavior in ModbusPal; see <c>docs/v2/modbus-test-plan.md</c> §per-device
+///     validates each behavior in pymodbus; see <c>docs/v2/modbus-test-plan.md</c> §per-device
 ///     quirk catalog for the checklist.
 /// </remarks>
 public static class DL205Profile
 {
-    /// <summary>Holding register the smoke test reads. Address 100 sidesteps the DL205
-    /// register-zero quirk (pending confirmation) — see modbus-test-plan.md.</summary>
-    public const ushort SmokeHoldingRegister = 100;
+    /// <summary>
+    ///     Holding register the smoke test writes + reads. Address 200 is the first cell of the
+    ///     scratch HR range in both <c>Pymodbus/standard.json</c> (HR[200..209] = 0) and
+    ///     <c>Pymodbus/dl205.json</c> (HR[4096..4103] added in PR 43 for the same purpose), so
+    ///     the smoke test runs identically against either simulator profile. Originally
+    ///     targeted HR[100] — moved to HR[200] when the standard profile claimed HR[100] as
+    ///     the auto-incrementing register that drives subscribe-and-receive tests.
+    /// </summary>
+    public const ushort SmokeHoldingRegister = 200;
 
-    /// <summary>Expected value the ModbusPal profile seeds into register 100. When running
-    /// against a real DL205 (or a ModbusPal profile where this register is writable), the smoke
-    /// test seeds this value first, then reads it back.</summary>
+    /// <summary>Value the smoke test writes then reads back to assert round-trip integrity.</summary>
     public const short SmokeHoldingValue = 1234;
 
     public static ModbusDriverOptions BuildOptions(string host, int port) => new()
@@ -32,7 +36,7 @@ public static class DL205Profile
         Tags =
         [
             new ModbusTagDefinition(
-                Name: "DL205_Smoke_HReg100",
+                Name: "Smoke_HReg200",
                 Region: ModbusRegion.HoldingRegisters,
                 Address: SmokeHoldingRegister,
                 DataType: ModbusDataType.Int16,

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205SmokeTests.cs

@@ -38,13 +38,13 @@ public sealed class DL205SmokeTests(ModbusSimulatorFixture sim)
         // zeroed at simulator start, and tests must not depend on prior-test state per the
         // test-plan conventions.
         var writeResults = await driver.WriteAsync(
-            [new(FullReference: "DL205_Smoke_HReg100", Value: (short)DL205Profile.SmokeHoldingValue)],
+            [new(FullReference: "Smoke_HReg200", Value: (short)DL205Profile.SmokeHoldingValue)],
             TestContext.Current.CancellationToken);
         writeResults.Count.ShouldBe(1);
         writeResults[0].StatusCode.ShouldBe(0u, "write must succeed against the ModbusPal DL205 profile");
 
         var readResults = await driver.ReadAsync(
-            ["DL205_Smoke_HReg100"],
+            ["Smoke_HReg200"],
             TestContext.Current.CancellationToken);
         readResults.Count.ShouldBe(1);
         readResults[0].StatusCode.ShouldBe(0u);

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205StringQuirkTests.cs

@@ -0,0 +1,81 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the DL205/DL260 low-byte-first ASCII string packing quirk against the
+///     <c>dl205.json</c> pymodbus profile. Standard Modbus packs the first char of each pair
+///     in the high byte of the register; DirectLOGIC packs it in the low byte instead. Without
+///     <see cref="ModbusStringByteOrder.LowByteFirst"/> the driver decodes "eHllo" garbage
+///     even though the bytes on the wire are identical.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Requires the dl205 profile (<c>Pymodbus\serve.ps1 -Profile dl205</c>). The standard
+///         profile does not seed HR[1040..1042] with string bytes, so running this against the
+///         standard profile returns <c>"\0\0\0\0\0"</c> and the test fails. Skip when the env
+///         var <c>MODBUS_SIM_PROFILE</c> is not set to <c>dl205</c>.
+///     </para>
+/// </remarks>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205StringQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_string_low_byte_first_decodes_Hello_from_HR1040()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed HR[1040..1042]).");
+        }
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition(
+                    Name: "DL205_Hello_Low",
+                    Region: ModbusRegion.HoldingRegisters,
+                    Address: 1040,
+                    DataType: ModbusDataType.String,
+                    Writable: false,
+                    StringLength: 5,
+                    StringByteOrder: ModbusStringByteOrder.LowByteFirst),
+                // Control: same address, HighByteFirst, to prove the driver would have decoded
+                // garbage without the quirk flag.
+                new ModbusTagDefinition(
+                    Name: "DL205_Hello_High",
+                    Region: ModbusRegion.HoldingRegisters,
+                    Address: 1040,
+                    DataType: ModbusDataType.String,
+                    Writable: false,
+                    StringLength: 5,
+                    StringByteOrder: ModbusStringByteOrder.HighByteFirst),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-string");
+        await driver.InitializeAsync(driverConfigJson: "{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_Hello_Low", "DL205_Hello_High"],
+            TestContext.Current.CancellationToken);
+
+        results.Count.ShouldBe(2);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe("Hello", "DL205 low-byte-first ordering must produce 'Hello' from HR[1040..1042]");
+
+        // The high-byte-first read of the same wire bytes should differ — not asserting the
+        // exact garbage string (that would couple the test to the ASCII byte math) but the two
+        // decodes MUST disagree, otherwise the quirk flag is a no-op.
+        results[1].StatusCode.ShouldBe(0u);
+        results[1].Value.ShouldNotBe("Hello");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205VMemoryQuirkTests.cs

@@ -0,0 +1,91 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the DL205/DL260 V-memory octal addressing quirk end-to-end: use
+///     <see cref="DirectLogicAddress.UserVMemoryToPdu"/> to translate <c>V2000</c> octal into
+///     the Modbus PDU address actually dispatched, then read the marker the dl205.json profile
+///     placed at that address. HR[0x0400] = 0x2000 proves the translation was performed
+///     correctly — a naïve caller treating "V2000" as decimal 2000 would read HR[2000] (which
+///     the profile leaves at 0) and miss the marker entirely.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205VMemoryQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_V2000_user_memory_resolves_to_PDU_0x0400_marker()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed V-memory markers).");
+        }
+
+        var pdu = DirectLogicAddress.UserVMemoryToPdu("V2000");
+        pdu.ShouldBe((ushort)0x0400);
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_V2000",
+                    ModbusRegion.HoldingRegisters, Address: pdu,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-vmem");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_V2000"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe((ushort)0x2000, "dl205.json seeds HR[0x0400] with marker 0x2000 (= V2000 value)");
+    }
+
+    [Fact]
+    public async Task DL205_V40400_system_memory_resolves_to_PDU_0x2100_marker()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // V40400 is system memory on DL260 / H2-ECOM100 absolute mode; it does NOT follow the
+        // simple octal-to-decimal formula (40400 octal = 16640 decimal, which would read HR[0x4100]).
+        // The CPU places the system bank at PDU 0x2100 instead. Proving the helper routes there.
+        var pdu = DirectLogicAddress.SystemVMemoryToPdu(0);
+        pdu.ShouldBe((ushort)0x2100);
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_V40400",
+                    ModbusRegion.HoldingRegisters, Address: pdu,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-sysv");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_V40400"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe((ushort)0x4040, "dl205.json seeds HR[0x2100] with marker 0x4040 (= V40400 value)");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205XInputTests.cs

@@ -0,0 +1,71 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the DL260 X-input discrete-input mapping against the <c>dl205.json</c>
+///     pymodbus profile. X-inputs are FC02 discrete-input-only (Modbus doesn't allow writes
+///     to discrete inputs), and the DirectLOGIC convention is X0 → DI 0 with octal offsets
+///     for subsequent addresses. The sim seeds X20 octal (= DI 16) = ON so the test can
+///     prove the helper routes through to the right cell.
+/// </summary>
+/// <remarks>
+///     X0 / X1 / …X17 octal all share cell 0 (DI 0-15 → cell 0 bits 0-15) which conflicts
+///     with the V0 uint16 marker; we can't seed both types at cell 0 under shared-blocks
+///     semantics. So the test uses X20 octal (first address beyond the cell-0 boundary) which
+///     lands cleanly at cell 1 bit 0 and leaves the V0 register-zero quirk intact.
+/// </remarks>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205XInputTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL260_X20_octal_maps_to_DiscreteInput_16_and_reads_ON()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // X20 octal = decimal 16 = DI 16 per the DL260 convention (X-inputs start at DI 0).
+        var di = DirectLogicAddress.XInputToDiscrete("X20");
+        di.ShouldBe((ushort)16);
+
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_X20",
+                ModbusRegion.DiscreteInputs, Address: di,
+                DataType: ModbusDataType.Bool, Writable: false),
+            // Unpopulated-X control: pymodbus returns 0 (not exception) for any bit in the
+            // configured DI range that wasn't explicitly seeded — per docs/v2/dl205.md
+            // "Reading a non-populated X input ... returns zero, not an exception".
+            new ModbusTagDefinition("DL260_X21_off",
+                ModbusRegion.DiscreteInputs, Address: DirectLogicAddress.XInputToDiscrete("X21"),
+                DataType: ModbusDataType.Bool, Writable: false),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-xinput");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL260_X20", "DL260_X21_off"], TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(true, "dl205.json seeds cell 1 bit 0 (X20 octal = DI 16) = ON");
+
+        results[1].StatusCode.ShouldBe(0u, "unpopulated X inputs must read cleanly — DL260 does NOT raise an exception");
+        results[1].Value.ShouldBe(false);
+    }
+
+    private static ModbusDriverOptions BuildOptions(ModbusSimulatorFixture sim, IReadOnlyList<ModbusTagDefinition> tags)
+        => new()
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags = tags,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusPal/README.md

@@ -1,30 +0,0 @@
-# ModbusPal simulator profiles
-
-Drop device-specific `.xmpp` profiles here. The integration tests connect to the
-endpoint in `MODBUS_SIM_ENDPOINT` (default `localhost:502`) and expect the
-simulator to already be running — tests do not launch ModbusPal themselves,
-because its Java GUI + JRE requirement is heavier than the harness is worth.
-
-## Getting started
-
-1. Download ModbusPal from SourceForge (`modbuspal.jar`).
-2. `java -jar modbuspal.jar` to launch the GUI.
-3. Load a profile from this directory (or configure one manually) and start the
-   simulator on TCP port 502.
-4. `dotnet test tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` — tests
-   auto-skip with a clear `SkipReason` if the TCP probe at the configured
-   endpoint fails within 2 seconds.
-
-## Profile files
-
-- `DL205.xmpp` — _to be added_ — register map reflecting the AutomationDirect
-  DL205 quirks tracked in `docs/v2/modbus-test-plan.md`. The scaffolded smoke
-  test in `DL205/DL205SmokeTests.cs` needs holding register 100 writable and
-  present; a minimal ModbusPal profile with a single holding-register bank at
-  address 100 is sufficient.
-
-## Environment variables
-
-- `MODBUS_SIM_ENDPOINT` — override the simulator endpoint. Accepts `host:port`;
-  defaults to `localhost:502`. Useful when pointing the suite at a real PLC on
-  the bench.

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusSimulatorFixture.cs

@@ -3,8 +3,9 @@ using System.Net.Sockets;
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
 
 /// <summary>
-///     Reachability probe for a Modbus TCP simulator (ModbusPal or a real PLC). Parses
-///     <c>MODBUS_SIM_ENDPOINT</c> (default <c>localhost:502</c>) and TCP-connects once at
+///     Reachability probe for a Modbus TCP simulator (pymodbus-driven, see
+///     <c>Pymodbus/serve.ps1</c>) or a real PLC. Parses
+///     <c>MODBUS_SIM_ENDPOINT</c> (default <c>localhost:5020</c> per PR 43) and TCP-connects once at
 ///     fixture construction. Each test checks <see cref="SkipReason"/> and calls
 ///     <c>Assert.Skip</c> when the endpoint was unreachable, so a dev box without a running
 ///     simulator still passes `dotnet test` cleanly — matches the Galaxy live-smoke pattern in
@@ -25,7 +26,11 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
 /// </remarks>
 public sealed class ModbusSimulatorFixture : IAsyncDisposable
 {
-    private const string DefaultEndpoint = "localhost:502";
+    // PR 43: default port is 5020 (pymodbus convention) instead of 502 (Modbus standard).
+    // Picking 5020 sidesteps the privileged-port admin requirement on Windows + matches the
+    // port baked into the pymodbus simulator JSON profiles in Pymodbus/. Override with
+    // MODBUS_SIM_ENDPOINT to point at a real PLC on its native port 502.
+    private const string DefaultEndpoint = "localhost:5020";
     private const string EndpointEnvVar = "MODBUS_SIM_ENDPOINT";
 
     public string Host { get; }
@@ -41,18 +46,30 @@ public sealed class ModbusSimulatorFixture : IAsyncDisposable
 
         try
         {
-            using var client = new TcpClient();
-            var task = client.ConnectAsync(Host, Port);
+            // Force IPv4 family on the probe — pymodbus's TCP server binds 0.0.0.0 (IPv4 only)
+            // while .NET's TcpClient default-resolves "localhost" → IPv6 ::1 first, fails to
+            // connect, and only then tries IPv4. Under .NET 10 the IPv6 fail surfaces as a
+            // 2s timeout (no graceful fallback by default), so the C# probe times out even
+            // though a PowerShell probe of the same endpoint succeeds. Resolving + dialing
+            // explicit IPv4 sidesteps the dual-stack ordering.
+            using var client = new TcpClient(System.Net.Sockets.AddressFamily.InterNetwork);
+            var task = client.ConnectAsync(
+                System.Net.Dns.GetHostAddresses(Host)
+                    .FirstOrDefault(a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
+                    ?? System.Net.IPAddress.Loopback,
+                Port);
             if (!task.Wait(TimeSpan.FromSeconds(2)) || !client.Connected)
             {
                 SkipReason = $"Modbus simulator at {Host}:{Port} did not accept a TCP connection within 2s. " +
-                             $"Start ModbusPal (or override {EndpointEnvVar}) and re-run.";
+                             $"Start the pymodbus simulator (Pymodbus\\serve.ps1 -Profile standard) " +
+                             $"or override {EndpointEnvVar}, then re-run.";
             }
         }
         catch (Exception ex)
         {
             SkipReason = $"Modbus simulator at {Host}:{Port} unreachable: {ex.GetType().Name}: {ex.Message}. " +
-                         $"Start ModbusPal (or override {EndpointEnvVar}) and re-run.";
+                         $"Start the pymodbus simulator (Pymodbus\\serve.ps1 -Profile standard) " +
+                             $"or override {EndpointEnvVar}, then re-run.";
         }
     }
 

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/README.md

@@ -0,0 +1,163 @@
+# pymodbus simulator profiles
+
+Two JSON-config profiles for pymodbus's `ModbusSimulatorServer`. Replaces the
+ModbusPal `.xmpp` profiles that lived here in PR 42 — pymodbus is headless,
+maintained, semantic about register layout, and pip-installable on Windows.
+
+| File | What it simulates | Test category |
+|---|---|---|
+| [`standard.json`](standard.json) | Generic Modbus TCP server — HR[0..31] = address-as-value, HR[100] declarative auto-increment via `"action": "increment"`, alternating coils, scratch ranges for write tests. | `Trait=Standard` |
+| [`dl205.json`](dl205.json) | AutomationDirect DirectLOGIC DL205 / DL260 quirks per [`docs/v2/dl205.md`](../../../docs/v2/dl205.md): low-byte-first string packing, CDAB Float32, BCD numerics, V-memory address markers, Y/C coil mappings. Inline `_quirk` comments per register name the behavior. | `Trait=DL205` |
+
+Both bind TCP **5020** (pymodbus convention; sidesteps the Windows admin
+requirement for privileged port 502). The integration-test fixture
+(`ModbusSimulatorFixture`) defaults to `localhost:5020` to match — override
+via `MODBUS_SIM_ENDPOINT` to point at a real PLC on its native port 502.
+
+Run only **one profile at a time** (they share TCP 5020).
+
+## Install
+
+```powershell
+pip install "pymodbus[simulator]==3.13.0"
+```
+
+The `[simulator]` extra pulls in `aiohttp` for the optional web UI / REST API.
+Pinned to 3.13.0 for reproducibility — avoid 4.x dev releases until stabilized.
+Requires Python ≥ 3.10. Windows Firewall will prompt on first bind; allow
+Private network.
+
+## Run
+
+Foreground (Ctrl+C to stop). Use the `serve.ps1` wrapper:
+
+```powershell
+.\serve.ps1 -Profile standard
+.\serve.ps1 -Profile dl205
+```
+
+Or invoke pymodbus directly:
+
+```powershell
+pymodbus.simulator `
+    --modbus_server srv `
+    --modbus_device dev `
+    --json_file .\standard.json `
+    --http_port 8080
+```
+
+Web UI at `http://localhost:8080` lets you inspect + poke registers manually.
+Pass `--no_http` (or `-HttpPort 0` to `serve.ps1`) to disable.
+
+## Run the integration tests
+
+In a separate shell, with the simulator running:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests
+```
+
+Tests auto-skip with a clear `SkipReason` if `localhost:5020` isn't reachable
+within 2 seconds. Filter by trait when both profiles' tests coexist:
+
+```powershell
+dotnet test ... --filter "Trait=Standard"
+dotnet test ... --filter "Trait=DL205"
+```
+
+## What's encoded in each profile
+
+### standard.json
+
+- HR[0..31]: each register's value equals its address. Easy mental map.
+- HR[100]: `"action": "increment"` ticks 0..65535 on every register access — drives subscribe-and-receive tests so they have a register that changes without a write.
+- HR[200..209]: scratch range for write-roundtrip tests.
+- Coils[0..31]: alternating on/off (even=on).
+- Coils[100..109]: scratch.
+- All addresses 0..1023 are writable (`"write": [[0, 1023]]`).
+
+### dl205.json (per `docs/v2/dl205.md`)
+
+| HR address | Quirk demonstrated | Raw value | Decoded |
+|---|---|---|---|
+| `0` (V0) | Register 0 is valid (rejects-register-0 rumour disproved) | `51966` (0xCAFE) | marker |
+| `1024` (V2000 octal) | V-memory octal-to-decimal mapping | `8192` (0x2000) | marker |
+| `8448` (V40400 octal) | V40400 → PDU 0x2100 (NOT register 0) | `16448` (0x4040) | marker |
+| `1040..1042` | String "Hello" packed first-char-low-byte | `25928, 27756, 111` | `"Hello"` |
+| `1056..1057` | Float32 1.5f in CDAB word order | `0, 16320` | `1.5f` |
+| `1072` | Decimal 1234 in BCD encoding | `4660` (0x1234) | `1234` |
+| `1280..1407` | 128-register block (FC03 cap = 128 above spec's 125) | first/last/mid markers; rest defaults to 0 | for FC03 cap test |
+
+| Coil address | Quirk demonstrated |
+|---|---|
+| `2048` | Y0 maps to coil 2048 (DL260 layout) |
+| `3072` | C0 maps to coil 3072 (DL260 layout) |
+| `4000..4007` | Scratch C-relay range for write-roundtrip tests |
+
+The DL260 X-input markers (FC02 discrete inputs) **are not encoded separately**
+because the profile uses `shared blocks: true` (matches DL series memory
+model) — coils/DI/HR/IR overlay the same word address space. Tests that
+target FC02 against this profile end up reading the same bit positions as
+the coils they share with.
+
+## What's IN pymodbus that wasn't in ModbusPal
+
+- **All four standard tables** (HR, IR, coils, DI) configurable via `co size` / `di size` / `hr size` / `ir size` setup keys.
+- **Per-register raw uint16 seeding** — `{"addr": 1040, "value": 25928}` puts exactly that 16-bit value on the wire. No interpretation.
+- **Built-in actions**: `increment`, `random`, `timestamp`, `reset`, `uptime` for declarative dynamic registers. No Python script alongside the config required.
+- **Custom actions** — point `--custom_actions_module` at a `.py` file exposing callables to express anything more complex (per-second wall-clock ticks, BCD synthesis, etc.).
+- **Headless** — pure CLI process, no Java, no Swing. Pip-installable. Plays well with CI runners.
+- **Web UI / REST API** — `--http_port 8080` adds an aiohttp server for live inspection. Optional.
+- **Maintained** — current stable 3.13.0 (April 2026), active development on 4.0 dev branch.
+
+## Trade-offs vs the hand-authored ModbusPal profiles
+
+- pymodbus's built-in `float32` type stores in pymodbus's word order; for explicit DL205 CDAB control we seed two raw `uint16` entries instead. Documented inline in `dl205.json`.
+- `increment` action ticks per-access, not wall-clock. A 250ms-poll integration test sees variation either way; for strict 1Hz cadence add `--custom_actions_module my_actions.py` with a `time.time()`-based callable.
+- `dl205.json` uses `shared blocks: true` because it matches DL series memory model; `standard.json` uses `shared blocks: false` so coils and HR address spaces are independent (more like a textbook PLC).
+
+## File format reference
+
+```json
+{
+  "server_list": {
+    "<server-name>": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5020,
+      "framer": "socket",
+      "device_id": 1
+    }
+  },
+  "device_list": {
+    "<device-name>": {
+      "setup": {
+        "co size": N, "di size": N, "hr size": N, "ir size": N,
+        "shared blocks": false,
+        "type exception": false,
+        "defaults": { "value": {...}, "action": {...} }
+      },
+      "invalid": [],
+      "write": [[<from>, <to>]],
+      "bits":    [{"addr": N, "value": 0|1}],
+      "uint16":  [{"addr": N, "value": <0..65535>, "action"?: "increment", "parameters"?: {...}}],
+      "uint32":  [{"addr": N, "value": <int>}],
+      "float32": [{"addr": N, "value": <float>}],
+      "string":  [{"addr": N, "value": "<text>"}],
+      "repeat":  []
+    }
+  }
+}
+```
+
+The CLI args `--modbus_server <server-name> --modbus_device <device-name>`
+pick which entries the simulator binds.
+
+## References
+
+- [pymodbus on PyPI](https://pypi.org/project/pymodbus/) — install, version pin
+- [Simulator config docs](https://pymodbus.readthedocs.io/en/dev/source/library/simulator/config.html) — full schema reference
+- [Simulator REST API](https://pymodbus.readthedocs.io/en/latest/source/library/simulator/restapi.html) — for the optional web UI
+- [`docs/v2/dl205.md`](../../../docs/v2/dl205.md) — what each DL205 profile entry simulates
+- [`docs/v2/modbus-test-plan.md`](../../../docs/v2/modbus-test-plan.md) — the `DL205_<behavior>` test naming convention

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/dl205.json

@@ -0,0 +1,111 @@
+{
+  "_comment": "DL205.json — DirectLOGIC DL205/DL260 quirk simulator. Models docs/v2/dl205.md as concrete register values. NOTE: pymodbus rejects unknown keys at device-list / setup level; explanatory comments live at top-level _comment + in README + git. Inline _quirk keys WITHIN individual register entries are accepted by pymodbus 3.13.0 (it only validates addr / value / action / parameters per entry). Each quirky uint16 is a pre-computed raw 16-bit value; pymodbus serves it verbatim. shared blocks=true matches DL series memory model. write list mirrors each seeded block — pymodbus rejects sweeping write ranges that include undefined cells.",
+
+  "server_list": {
+    "srv": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5020,
+      "framer": "socket",
+      "device_id": 1
+    }
+  },
+
+  "device_list": {
+    "dev": {
+      "setup": {
+        "co size":    16384,
+        "di size":     8192,
+        "hr size":    16384,
+        "ir size":     1024,
+        "shared blocks": true,
+        "type exception": false,
+        "defaults": {
+          "value":  {"bits": 0, "uint16": 0, "uint32": 0, "float32": 0.0, "string": " "},
+          "action": {"bits": null, "uint16": null, "uint32": null, "float32": null, "string": null}
+        }
+      },
+      "invalid": [],
+      "write": [
+        [0, 0],
+        [200, 209],
+        [1024, 1024],
+        [1040, 1042],
+        [1056, 1057],
+        [1072, 1072],
+        [1280, 1282],
+        [1343, 1343],
+        [1407, 1407],
+        [1, 1],
+        [128, 128],
+        [192, 192],
+        [250, 250],
+        [8448, 8448]
+      ],
+
+      "uint16": [
+        {"_quirk": "V0 marker. HR[0]=0xCAFE proves register 0 is valid on DL205/DL260 (rejects-register-0 was a DL05/DL06 relative-mode artefact). 0xCAFE = 51966.",
+         "addr": 0,    "value": 51966},
+
+        {"_quirk": "Scratch HR range 200..209 — mirrors the standard.json scratch range so the smoke test (DL205Profile.SmokeHoldingRegister=200) round-trips identically against either profile.",
+         "addr": 200, "value": 0},
+        {"addr": 201, "value": 0},
+        {"addr": 202, "value": 0},
+        {"addr": 203, "value": 0},
+        {"addr": 204, "value": 0},
+        {"addr": 205, "value": 0},
+        {"addr": 206, "value": 0},
+        {"addr": 207, "value": 0},
+        {"addr": 208, "value": 0},
+        {"addr": 209, "value": 0},
+
+        {"_quirk": "V2000 marker. V2000 octal = decimal 1024 = PDU 0x0400. Marker 0x2000 = 8192.",
+         "addr": 1024, "value": 8192},
+
+        {"_quirk": "V40400 marker. V40400 octal = decimal 8448 = PDU 0x2100 (NOT register 0). Marker 0x4040 = 16448.",
+         "addr": 8448, "value": 16448},
+
+        {"_quirk": "String 'Hello' first char in LOW byte. HR[0x410] = 'H'(0x48) lo + 'e'(0x65) hi = 0x6548 = 25928.",
+         "addr": 1040, "value": 25928},
+        {"_quirk": "String 'Hello' second char-pair: 'l'(0x6C) lo + 'l'(0x6C) hi = 0x6C6C = 27756.",
+         "addr": 1041, "value": 27756},
+        {"_quirk": "String 'Hello' third char-pair: 'o'(0x6F) lo + null(0x00) hi = 0x006F = 111.",
+         "addr": 1042, "value": 111},
+
+        {"_quirk": "Float32 1.5f in CDAB word order. IEEE 754 1.5 = 0x3FC00000. CDAB = low word first: HR[0x420]=0x0000, HR[0x421]=0x3FC0=16320.",
+         "addr": 1056, "value": 0},
+        {"_quirk": "Float32 1.5f CDAB high word.",
+         "addr": 1057, "value": 16320},
+
+        {"_quirk": "BCD register. Decimal 1234 stored as BCD nibbles 0x1234 = 4660. NOT binary 1234 (= 0x04D2).",
+         "addr": 1072, "value": 4660},
+
+        {"_quirk": "FC03 cap test marker — first cell of a 128-register span the FC03 cap test reads. Other cells in the span aren't seeded explicitly, so reads of HR[1283..1342] / 1344..1406 return the default 0; the seeded markers at 1280, 1281, 1282, 1343, 1407 prove the span boundaries.",
+         "addr": 1280, "value": 0},
+        {"addr": 1281, "value": 1},
+        {"addr": 1282, "value": 2},
+        {"addr": 1343, "value": 63},
+        {"addr": 1407, "value": 127}
+      ],
+
+      "bits": [
+        {"_quirk": "X-input bank marker cell. X0 -> DI 0 conflicts with uint16 V0 at cell 0, so this marker covers X20 octal (= decimal 16 = DI 16 = cell 1 bit 0). X20=ON, X23 octal (DI 19 = cell 1 bit 3)=ON -> cell 1 value = 0b00001001 = 9.",
+         "addr": 1, "value": 9},
+
+        {"_quirk": "Y-output bank marker cell. pymodbus's simulator maps Modbus FC01/02/05 bit-addresses to cell index = bit_addr / 16; so Modbus coil 2048 lives at cell 128 bit 0. Y0=ON (bit 0), Y1=OFF (bit 1), Y2=ON (bit 2) -> value=0b00000101=5 proves DL260 mapping Y0 -> coil 2048.",
+         "addr": 128, "value": 5},
+
+        {"_quirk": "C-relay bank marker cell. Modbus coil 3072 -> cell 192 bit 0. C0=ON (bit 0), C1=OFF (bit 1), C2=ON (bit 2) -> value=5 proves DL260 mapping C0 -> coil 3072.",
+         "addr": 192, "value": 5},
+
+        {"_quirk": "Scratch cell for coil 4000..4015 write round-trip tests. Cell 250 holds Modbus coils 4000-4015; all bits start at 0 and tests set specific bits via FC05.",
+         "addr": 250, "value": 0}
+      ],
+
+      "uint32":  [],
+      "float32": [],
+      "string":  [],
+      "repeat":  []
+    }
+  }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/serve.ps1

@@ -0,0 +1,60 @@
+<#
+.SYNOPSIS
+    Launches the pymodbus simulator with one of the integration-test profiles
+    (Standard or DL205). Foreground process — Ctrl+C to stop.
+
+.PARAMETER Profile
+    Which simulator profile to run: 'standard' or 'dl205'. Both bind TCP 5020 by
+    default so they can't run simultaneously on the same box.
+
+.PARAMETER HttpPort
+    Port for pymodbus's optional web UI / REST API. Default 8080. Pass 0 to
+    disable (passes --no_http).
+
+.EXAMPLE
+    .\serve.ps1 -Profile standard
+    Starts the standard server on TCP 5020 with web UI on 8080.
+
+.EXAMPLE
+    .\serve.ps1 -Profile dl205 -HttpPort 0
+    Starts the DL205 server on TCP 5020, no web UI.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [ValidateSet('standard', 'dl205')] [string]$Profile,
+    [int]$HttpPort = 8080
+)
+
+$ErrorActionPreference = 'Stop'
+$here = $PSScriptRoot
+
+# Confirm pymodbus.simulator is on PATH — clearer message than the
+# 'CommandNotFoundException' dotnet style.
+$cmd = Get-Command pymodbus.simulator -ErrorAction SilentlyContinue
+if (-not $cmd) {
+    Write-Error "pymodbus.simulator not found. Install with: pip install 'pymodbus[simulator]==3.13.0'"
+    exit 1
+}
+
+$jsonFile = Join-Path $here "$Profile.json"
+if (-not (Test-Path $jsonFile)) {
+    Write-Error "Profile config not found: $jsonFile"
+    exit 1
+}
+
+$args = @(
+    '--modbus_server', 'srv',
+    '--modbus_device', 'dev',
+    '--json_file',     $jsonFile
+)
+
+if ($HttpPort -gt 0) {
+    $args += @('--http_port', $HttpPort)
+    Write-Host "Web UI will be at http://localhost:$HttpPort"
+} else {
+    $args += '--no_http'
+}
+
+Write-Host "Starting pymodbus simulator: profile=$Profile  TCP=localhost:5020"
+Write-Host "Ctrl+C to stop."
+& pymodbus.simulator @args

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/standard.json

@@ -0,0 +1,97 @@
+{
+  "_comment": "Standard.json — generic Modbus TCP server for the integration suite. See ../README.md. NOTE: pymodbus rejects unknown keys at device-list / setup level; explanatory comments live in the README + git history. Layout: HR[0..31]=address-as-value, HR[100]=auto-increment, HR[200..209]=scratch, coils 1024..1055=alternating, coils 1100..1109=scratch. Coils live at 1024+ because pymodbus stores all 4 standard tables in ONE underlying cell array — bits and uint16 at the same address conflict (each cell can only be typed once).",
+
+  "server_list": {
+    "srv": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5020,
+      "framer": "socket",
+      "device_id": 1
+    }
+  },
+
+  "device_list": {
+    "dev": {
+      "setup": {
+        "co size": 2048,
+        "di size": 2048,
+        "hr size": 2048,
+        "ir size": 2048,
+        "shared blocks": true,
+        "type exception": false,
+        "defaults": {
+          "value":  {"bits": 0, "uint16": 0, "uint32": 0, "float32": 0.0, "string": " "},
+          "action": {"bits": null, "uint16": null, "uint32": null, "float32": null, "string": null}
+        }
+      },
+      "invalid": [],
+      "write": [
+        [0, 31],
+        [100, 100],
+        [200, 209],
+        [1024, 1055],
+        [1100, 1109]
+      ],
+
+      "uint16": [
+        {"addr":  0, "value":  0}, {"addr":  1, "value":  1},
+        {"addr":  2, "value":  2}, {"addr":  3, "value":  3},
+        {"addr":  4, "value":  4}, {"addr":  5, "value":  5},
+        {"addr":  6, "value":  6}, {"addr":  7, "value":  7},
+        {"addr":  8, "value":  8}, {"addr":  9, "value":  9},
+        {"addr": 10, "value": 10}, {"addr": 11, "value": 11},
+        {"addr": 12, "value": 12}, {"addr": 13, "value": 13},
+        {"addr": 14, "value": 14}, {"addr": 15, "value": 15},
+        {"addr": 16, "value": 16}, {"addr": 17, "value": 17},
+        {"addr": 18, "value": 18}, {"addr": 19, "value": 19},
+        {"addr": 20, "value": 20}, {"addr": 21, "value": 21},
+        {"addr": 22, "value": 22}, {"addr": 23, "value": 23},
+        {"addr": 24, "value": 24}, {"addr": 25, "value": 25},
+        {"addr": 26, "value": 26}, {"addr": 27, "value": 27},
+        {"addr": 28, "value": 28}, {"addr": 29, "value": 29},
+        {"addr": 30, "value": 30}, {"addr": 31, "value": 31},
+
+        {"addr": 100, "value": 0,
+         "action": "increment",
+         "parameters": {"minval": 0, "maxval": 65535}},
+
+        {"addr": 200, "value": 0}, {"addr": 201, "value": 0},
+        {"addr": 202, "value": 0}, {"addr": 203, "value": 0},
+        {"addr": 204, "value": 0}, {"addr": 205, "value": 0},
+        {"addr": 206, "value": 0}, {"addr": 207, "value": 0},
+        {"addr": 208, "value": 0}, {"addr": 209, "value": 0}
+      ],
+
+      "bits": [
+        {"addr": 1024, "value": 1}, {"addr": 1025, "value": 0},
+        {"addr": 1026, "value": 1}, {"addr": 1027, "value": 0},
+        {"addr": 1028, "value": 1}, {"addr": 1029, "value": 0},
+        {"addr": 1030, "value": 1}, {"addr": 1031, "value": 0},
+        {"addr": 1032, "value": 1}, {"addr": 1033, "value": 0},
+        {"addr": 1034, "value": 1}, {"addr": 1035, "value": 0},
+        {"addr": 1036, "value": 1}, {"addr": 1037, "value": 0},
+        {"addr": 1038, "value": 1}, {"addr": 1039, "value": 0},
+        {"addr": 1040, "value": 1}, {"addr": 1041, "value": 0},
+        {"addr": 1042, "value": 1}, {"addr": 1043, "value": 0},
+        {"addr": 1044, "value": 1}, {"addr": 1045, "value": 0},
+        {"addr": 1046, "value": 1}, {"addr": 1047, "value": 0},
+        {"addr": 1048, "value": 1}, {"addr": 1049, "value": 0},
+        {"addr": 1050, "value": 1}, {"addr": 1051, "value": 0},
+        {"addr": 1052, "value": 1}, {"addr": 1053, "value": 0},
+        {"addr": 1054, "value": 1}, {"addr": 1055, "value": 0},
+
+        {"addr": 1100, "value": 0}, {"addr": 1101, "value": 0},
+        {"addr": 1102, "value": 0}, {"addr": 1103, "value": 0},
+        {"addr": 1104, "value": 0}, {"addr": 1105, "value": 0},
+        {"addr": 1106, "value": 0}, {"addr": 1107, "value": 0},
+        {"addr": 1108, "value": 0}, {"addr": 1109, "value": 0}
+      ],
+
+      "uint32":  [],
+      "float32": [],
+      "string":  [],
+      "repeat":  []
+    }
+  }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj

@@ -24,7 +24,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <None Update="ModbusPal\**\*" CopyToOutputDirectory="PreserveNewest"/>
+        <None Update="Pymodbus\**\*" CopyToOutputDirectory="PreserveNewest"/>
         <None Update="DL205\**\*" CopyToOutputDirectory="PreserveNewest"/>
     </ItemGroup>
 

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/DirectLogicAddressTests.cs

@@ -0,0 +1,139 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class DirectLogicAddressTests
+{
+    [Theory]
+    [InlineData("V0", (ushort)0x0000)]
+    [InlineData("V1", (ushort)0x0001)]
+    [InlineData("V7", (ushort)0x0007)]
+    [InlineData("V10", (ushort)0x0008)]
+    [InlineData("V2000", (ushort)0x0400)]  // canonical DL205/DL260 user-memory start
+    [InlineData("V7777", (ushort)0x0FFF)]
+    [InlineData("V10000", (ushort)0x1000)]
+    [InlineData("V17777", (ushort)0x1FFF)]
+    public void UserVMemoryToPdu_converts_octal_V_prefix(string v, ushort expected)
+        => DirectLogicAddress.UserVMemoryToPdu(v).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("0", (ushort)0)]
+    [InlineData("2000", (ushort)0x0400)]
+    [InlineData("v2000", (ushort)0x0400)]   // lowercase v
+    [InlineData(" V2000 ", (ushort)0x0400)] // surrounding whitespace
+    public void UserVMemoryToPdu_accepts_bare_or_prefixed_or_padded(string v, ushort expected)
+        => DirectLogicAddress.UserVMemoryToPdu(v).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("V8")]     // 8 is not a valid octal digit
+    [InlineData("V19")]
+    [InlineData("V2009")]
+    public void UserVMemoryToPdu_rejects_non_octal_digits(string v)
+    {
+        Should.Throw<ArgumentException>(() => DirectLogicAddress.UserVMemoryToPdu(v))
+            .Message.ShouldContain("octal");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("V")]
+    public void UserVMemoryToPdu_rejects_empty_input(string? v)
+        => Should.Throw<ArgumentException>(() => DirectLogicAddress.UserVMemoryToPdu(v!));
+
+    [Fact]
+    public void UserVMemoryToPdu_overflow_rejected()
+    {
+        // 200000 octal = 0x10000 — one past ushort range.
+        Should.Throw<OverflowException>(() => DirectLogicAddress.UserVMemoryToPdu("V200000"));
+    }
+
+    [Fact]
+    public void SystemVMemoryBasePdu_is_0x2100_for_V40400()
+    {
+        // V40400 on DL260 / H2-ECOM100 absolute mode → PDU 0x2100 (decimal 8448), NOT 0x4100
+        // which a naive octal-to-decimal of 40400 octal would give (= 16640).
+        DirectLogicAddress.SystemVMemoryBasePdu.ShouldBe((ushort)0x2100);
+        DirectLogicAddress.SystemVMemoryToPdu(0).ShouldBe((ushort)0x2100);
+    }
+
+    [Fact]
+    public void SystemVMemoryToPdu_offsets_within_bank()
+    {
+        DirectLogicAddress.SystemVMemoryToPdu(1).ShouldBe((ushort)0x2101);
+        DirectLogicAddress.SystemVMemoryToPdu(0x100).ShouldBe((ushort)0x2200);
+    }
+
+    [Fact]
+    public void SystemVMemoryToPdu_rejects_overflow()
+    {
+        // ushort wrap: 0xFFFF - 0x2100 = 0xDEFF; anything above should throw.
+        Should.NotThrow(() => DirectLogicAddress.SystemVMemoryToPdu(0xDEFF));
+        Should.Throw<OverflowException>(() => DirectLogicAddress.SystemVMemoryToPdu(0xDF00));
+    }
+
+    // --- Bit memory: Y-output, C-relay, X-input, SP-special ---
+
+    [Theory]
+    [InlineData("Y0", (ushort)2048)]
+    [InlineData("Y1", (ushort)2049)]
+    [InlineData("Y7", (ushort)2055)]
+    [InlineData("Y10", (ushort)2056)]    // octal 10 = decimal 8
+    [InlineData("Y17", (ushort)2063)]    // octal 17 = decimal 15
+    [InlineData("Y777", (ushort)2559)]   // top of DL260 Y range per doc table
+    public void YOutputToCoil_adds_octal_offset_to_2048(string y, ushort expected)
+        => DirectLogicAddress.YOutputToCoil(y).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("C0", (ushort)3072)]
+    [InlineData("C1", (ushort)3073)]
+    [InlineData("C10", (ushort)3080)]
+    [InlineData("C1777", (ushort)4095)]  // top of DL260 C range
+    public void CRelayToCoil_adds_octal_offset_to_3072(string c, ushort expected)
+        => DirectLogicAddress.CRelayToCoil(c).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("X0", (ushort)0)]
+    [InlineData("X17", (ushort)15)]
+    [InlineData("X777", (ushort)511)]    // top of DL260 X range
+    public void XInputToDiscrete_adds_octal_offset_to_0(string x, ushort expected)
+        => DirectLogicAddress.XInputToDiscrete(x).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("SP0", (ushort)1024)]
+    [InlineData("SP7", (ushort)1031)]
+    [InlineData("sp0", (ushort)1024)]     // lowercase prefix
+    [InlineData("SP777", (ushort)1535)]
+    public void SpecialToDiscrete_adds_octal_offset_to_1024(string sp, ushort expected)
+        => DirectLogicAddress.SpecialToDiscrete(sp).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("Y8")]
+    [InlineData("C9")]
+    [InlineData("X18")]
+    public void Bit_address_rejects_non_octal_digits(string bad)
+        => Should.Throw<ArgumentException>(() =>
+        {
+            if (bad[0] == 'Y') DirectLogicAddress.YOutputToCoil(bad);
+            else if (bad[0] == 'C') DirectLogicAddress.CRelayToCoil(bad);
+            else DirectLogicAddress.XInputToDiscrete(bad);
+        });
+
+    [Theory]
+    [InlineData("Y")]
+    [InlineData("C")]
+    [InlineData("")]
+    public void Bit_address_rejects_empty(string bad)
+        => Should.Throw<ArgumentException>(() => DirectLogicAddress.YOutputToCoil(bad));
+
+    [Fact]
+    public void YOutputToCoil_accepts_lowercase_prefix()
+        => DirectLogicAddress.YOutputToCoil("y0").ShouldBe((ushort)2048);
+
+    [Fact]
+    public void CRelayToCoil_accepts_bare_octal_without_C_prefix()
+        => DirectLogicAddress.CRelayToCoil("0").ShouldBe((ushort)3072);
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusCapTests.cs

@@ -0,0 +1,165 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class ModbusCapTests
+{
+    /// <summary>
+    ///     Records every PDU sent so tests can assert request-count and per-request quantity —
+    ///     the only observable behaviour of the auto-chunking path.
+    /// </summary>
+    private sealed class RecordingTransport : IModbusTransport
+    {
+        public readonly ushort[] HoldingRegisters = new ushort[1024];
+        public readonly List<(ushort Address, ushort Quantity)> Fc03Requests = new();
+        public readonly List<(ushort Address, ushort Quantity)> Fc16Requests = new();
+
+        public Task ConnectAsync(CancellationToken ct) => Task.CompletedTask;
+
+        public Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
+        {
+            var fc = pdu[0];
+            if (fc == 0x03)
+            {
+                var addr = (ushort)((pdu[1] << 8) | pdu[2]);
+                var qty = (ushort)((pdu[3] << 8) | pdu[4]);
+                Fc03Requests.Add((addr, qty));
+                var byteCount = (byte)(qty * 2);
+                var resp = new byte[2 + byteCount];
+                resp[0] = 0x03;
+                resp[1] = byteCount;
+                for (var i = 0; i < qty; i++)
+                {
+                    resp[2 + i * 2] = (byte)(HoldingRegisters[addr + i] >> 8);
+                    resp[3 + i * 2] = (byte)(HoldingRegisters[addr + i] & 0xFF);
+                }
+                return Task.FromResult(resp);
+            }
+            if (fc == 0x10)
+            {
+                var addr = (ushort)((pdu[1] << 8) | pdu[2]);
+                var qty = (ushort)((pdu[3] << 8) | pdu[4]);
+                Fc16Requests.Add((addr, qty));
+                for (var i = 0; i < qty; i++)
+                    HoldingRegisters[addr + i] = (ushort)((pdu[6 + i * 2] << 8) | pdu[7 + i * 2]);
+                return Task.FromResult(new byte[] { 0x10, pdu[1], pdu[2], pdu[3], pdu[4] });
+            }
+            return Task.FromException<byte[]>(new ModbusException(fc, 0x01, $"fc={fc} unsupported"));
+        }
+
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
+    [Fact]
+    public async Task Read_within_cap_issues_single_FC03_request()
+    {
+        var tag = new ModbusTagDefinition("S", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 40); // 20 regs — fits in default cap (125).
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        _ = await drv.ReadAsync(["S"], TestContext.Current.CancellationToken);
+
+        transport.Fc03Requests.Count.ShouldBe(1);
+        transport.Fc03Requests[0].Quantity.ShouldBe((ushort)20);
+    }
+
+    [Fact]
+    public async Task Read_above_cap_splits_into_two_FC03_requests()
+    {
+        // 240-char string = 120 regs. Cap = 100 (a typical sub-spec device cap). Expect 100 + 20.
+        var tag = new ModbusTagDefinition("LongString", ModbusRegion.HoldingRegisters, 100, ModbusDataType.String,
+            StringLength: 240);
+        var transport = new RecordingTransport();
+        // Seed cells so the re-assembled payload is stable — confirms chunks are stitched in order.
+        for (ushort i = 100; i < 100 + 120; i++)
+            transport.HoldingRegisters[i] = (ushort)((('A' + (i - 100) % 26) << 8) | ('A' + (i - 100) % 26));
+
+        var opts = new ModbusDriverOptions
+        {
+            Host = "fake",
+            Tags = [tag],
+            MaxRegistersPerRead = 100,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.ReadAsync(["LongString"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+
+        transport.Fc03Requests.Count.ShouldBe(2, "120 regs / cap 100 → 2 requests");
+        transport.Fc03Requests[0].ShouldBe(((ushort)100, (ushort)100));
+        transport.Fc03Requests[1].ShouldBe(((ushort)200, (ushort)20));
+
+        // Payload continuity: re-assembled string starts where register 100 does and keeps going.
+        var s = (string)results[0].Value!;
+        s.Length.ShouldBeGreaterThan(0);
+        s[0].ShouldBe('A'); // register[100] high byte
+    }
+
+    [Fact]
+    public async Task Read_cap_honors_Mitsubishi_lower_cap_of_64()
+    {
+        // 200-char string = 100 regs. Mitsubishi Q cap = 64. Expect: 64, 36.
+        var tag = new ModbusTagDefinition("MitString", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 200);
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], MaxRegistersPerRead = 64, Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        _ = await drv.ReadAsync(["MitString"], TestContext.Current.CancellationToken);
+
+        transport.Fc03Requests.Count.ShouldBe(2);
+        transport.Fc03Requests[0].Quantity.ShouldBe((ushort)64);
+        transport.Fc03Requests[1].Quantity.ShouldBe((ushort)36);
+    }
+
+    [Fact]
+    public async Task Write_exceeding_cap_throws_instead_of_splitting()
+    {
+        // Partial FC16 across two transactions is not atomic. Forcing an explicit exception so the
+        // caller knows their tag definition is incompatible with the device cap rather than silently
+        // writing half a string and crashing between chunks.
+        var tag = new ModbusTagDefinition("LongStringWrite", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 220); // 110 regs.
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], MaxRegistersPerWrite = 100, Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("LongStringWrite", new string('A', 220))],
+            TestContext.Current.CancellationToken);
+
+        // Driver catches the internal exception and surfaces BadInternalError — the Fc16Requests
+        // list must still be empty because nothing was sent.
+        results[0].StatusCode.ShouldNotBe(0u);
+        transport.Fc16Requests.Count.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task Write_within_cap_proceeds_normally()
+    {
+        var tag = new ModbusTagDefinition("ShortStringWrite", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 40); // 20 regs.
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], MaxRegistersPerWrite = 100, Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("ShortStringWrite", "HELLO")],
+            TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        transport.Fc16Requests.Count.ShouldBe(1);
+        transport.Fc16Requests[0].Quantity.ShouldBe((ushort)20);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusDataTypeTests.cs

@@ -172,4 +172,144 @@ public sealed class ModbusDataTypeTests
         wire[1].ShouldBe((byte)'i');
         for (var i = 2; i < 8; i++) wire[i].ShouldBe((byte)0);
     }
+
+    // --- DL205 low-byte-first strings (AutomationDirect DirectLOGIC quirk) ---
+
+    [Fact]
+    public void String_LowByteFirst_decodes_DL205_packed_Hello()
+    {
+        // HR[1040] = 0x6548 (wire BE bytes [0x65, 0x48]) decodes first char from low byte = 'H',
+        // second from high byte = 'e'. HR[1041] = 0x6C6C → 'l','l'. HR[1042] = 0x006F → 'o', nul.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 5, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        var wire = new byte[] { 0x65, 0x48, 0x6C, 0x6C, 0x00, 0x6F };
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe("Hello");
+    }
+
+    [Fact]
+    public void String_LowByteFirst_decode_truncates_at_first_nul()
+    {
+        // Low-byte-first with only 2 real chars in register 0 (lo='H', hi='i') and the rest nul.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 6, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        var wire = new byte[] { 0x69, 0x48, 0x00, 0x00, 0x00, 0x00 };
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe("Hi");
+    }
+
+    [Fact]
+    public void String_LowByteFirst_encode_round_trips_with_decode()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 5, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        var wire = ModbusDriver.EncodeRegister("Hello", tag);
+        // Expect exactly the DL205-documented byte sequence.
+        wire.ShouldBe(new byte[] { 0x65, 0x48, 0x6C, 0x6C, 0x00, 0x6F });
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe("Hello");
+    }
+
+    [Fact]
+    public void String_HighByteFirst_and_LowByteFirst_differ_on_same_wire()
+    {
+        // Same wire buffer, different byte order → first char switches 'H' vs 'e'.
+        var wire = new byte[] { 0x48, 0x65 };
+        var hi = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 2, StringByteOrder: ModbusStringByteOrder.HighByteFirst);
+        var lo = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 2, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        ModbusDriver.DecodeRegister(wire, hi).ShouldBe("He");
+        ModbusDriver.DecodeRegister(wire, lo).ShouldBe("eH");
+    }
+
+    // --- BCD (binary-coded decimal, DL205/DL260 default numeric encoding) ---
+
+    [Theory]
+    [InlineData(0x0000u, 0u)]
+    [InlineData(0x0001u, 1u)]
+    [InlineData(0x0009u, 9u)]
+    [InlineData(0x0010u, 10u)]
+    [InlineData(0x1234u, 1234u)]
+    [InlineData(0x9999u, 9999u)]
+    public void DecodeBcd_16_bit_decodes_expected_decimal(uint raw, uint expected)
+        => ModbusDriver.DecodeBcd(raw, nibbles: 4).ShouldBe(expected);
+
+    [Fact]
+    public void DecodeBcd_rejects_nibbles_above_nine()
+    {
+        Should.Throw<InvalidDataException>(() => ModbusDriver.DecodeBcd(0x00A5u, nibbles: 4))
+            .Message.ShouldContain("Non-BCD nibble");
+    }
+
+    [Theory]
+    [InlineData(0u, 0x0000u)]
+    [InlineData(5u, 0x0005u)]
+    [InlineData(42u, 0x0042u)]
+    [InlineData(1234u, 0x1234u)]
+    [InlineData(9999u, 0x9999u)]
+    public void EncodeBcd_16_bit_encodes_expected_nibbles(uint value, uint expected)
+        => ModbusDriver.EncodeBcd(value, nibbles: 4).ShouldBe(expected);
+
+    [Fact]
+    public void Bcd16_decodes_DL205_register_1234_as_decimal_1234()
+    {
+        // HR[1072] = 0x1234 on the DL205 profile represents decimal 1234. A plain Int16 decode
+        // would return 0x04D2 = 4660 — proof the BCD path is different.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        ModbusDriver.DecodeRegister(new byte[] { 0x12, 0x34 }, tag).ShouldBe(1234);
+
+        var int16Tag = tag with { DataType = ModbusDataType.Int16 };
+        ModbusDriver.DecodeRegister(new byte[] { 0x12, 0x34 }, int16Tag).ShouldBe((short)0x1234);
+    }
+
+    [Fact]
+    public void Bcd16_encode_round_trips_with_decode()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        var wire = ModbusDriver.EncodeRegister(4321, tag);
+        wire.ShouldBe(new byte[] { 0x43, 0x21 });
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe(4321);
+    }
+
+    [Fact]
+    public void Bcd16_encode_rejects_out_of_range_values()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        Should.Throw<OverflowException>(() => ModbusDriver.EncodeRegister(10000, tag))
+            .Message.ShouldContain("4 decimal digits");
+    }
+
+    [Fact]
+    public void Bcd32_decodes_8_digits_big_endian()
+    {
+        // 0x12345678 as BCD = decimal 12_345_678.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32);
+        ModbusDriver.DecodeRegister(new byte[] { 0x12, 0x34, 0x56, 0x78 }, tag).ShouldBe(12_345_678);
+    }
+
+    [Fact]
+    public void Bcd32_word_swap_handles_CDAB_layout()
+    {
+        // PLC stored 12_345_678 with word swap: low-word 0x5678 first, high-word 0x1234 second.
+        // Wire bytes [0x56, 0x78, 0x12, 0x34] + WordSwap → decode to decimal 12_345_678.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32,
+            ByteOrder: ModbusByteOrder.WordSwap);
+        ModbusDriver.DecodeRegister(new byte[] { 0x56, 0x78, 0x12, 0x34 }, tag).ShouldBe(12_345_678);
+    }
+
+    [Fact]
+    public void Bcd32_encode_round_trips_with_decode()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32);
+        var wire = ModbusDriver.EncodeRegister(87_654_321u, tag);
+        wire.ShouldBe(new byte[] { 0x87, 0x65, 0x43, 0x21 });
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe(87_654_321);
+    }
+
+    [Fact]
+    public void Bcd_RegisterCount_matches_underlying_width()
+    {
+        var b16 = new ModbusTagDefinition("A", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        var b32 = new ModbusTagDefinition("B", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32);
+        ModbusDriver.RegisterCount(b16).ShouldBe((ushort)1);
+        ModbusDriver.RegisterCount(b32).ShouldBe((ushort)2);
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusExceptionMapperTests.cs

@@ -0,0 +1,88 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+/// <summary>
+///     Unit tests for the Modbus-exception-code → OPC UA StatusCode mapping added in PR 52.
+///     Before PR 52 every server exception + every transport failure collapsed to
+///     BadInternalError (0x80020000), which made field diagnosis "is this a bad tag or a bad
+///     driver?" impossible. These tests lock in the translation table documented on
+///     <see cref="ModbusDriver.MapModbusExceptionToStatus"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class ModbusExceptionMapperTests
+{
+    [Theory]
+    [InlineData((byte)0x01, 0x803D0000u)] // Illegal Function → BadNotSupported
+    [InlineData((byte)0x02, 0x803C0000u)] // Illegal Data Address → BadOutOfRange
+    [InlineData((byte)0x03, 0x803C0000u)] // Illegal Data Value → BadOutOfRange
+    [InlineData((byte)0x04, 0x80550000u)] // Server Failure → BadDeviceFailure
+    [InlineData((byte)0x05, 0x80550000u)] // Acknowledge (long op) → BadDeviceFailure
+    [InlineData((byte)0x06, 0x80550000u)] // Server Busy → BadDeviceFailure
+    [InlineData((byte)0x0A, 0x80050000u)] // Gateway path unavailable → BadCommunicationError
+    [InlineData((byte)0x0B, 0x80050000u)] // Gateway target failed to respond → BadCommunicationError
+    [InlineData((byte)0xFF, 0x80020000u)] // Unknown code → BadInternalError fallback
+    public void MapModbusExceptionToStatus_returns_informative_status(byte code, uint expected)
+        => ModbusDriver.MapModbusExceptionToStatus(code).ShouldBe(expected);
+
+    private sealed class ExceptionRaisingTransport(byte exceptionCode) : IModbusTransport
+    {
+        public Task ConnectAsync(CancellationToken ct) => Task.CompletedTask;
+        public Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
+            => Task.FromException<byte[]>(new ModbusException(pdu[0], exceptionCode, $"fc={pdu[0]} code={exceptionCode}"));
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
+    [Fact]
+    public async Task Read_surface_exception_02_as_BadOutOfRange_not_BadInternalError()
+    {
+        var transport = new ExceptionRaisingTransport(exceptionCode: 0x02);
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Int16);
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.ReadAsync(["T"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0x803C0000u, "FC03 at an unmapped register must bubble out as BadOutOfRange so operators can spot a bad tag config");
+    }
+
+    [Fact]
+    public async Task Write_surface_exception_04_as_BadDeviceFailure()
+    {
+        var transport = new ExceptionRaisingTransport(exceptionCode: 0x04);
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Int16);
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var writes = await drv.WriteAsync(
+            [new WriteRequest("T", (short)42)],
+            TestContext.Current.CancellationToken);
+
+        writes[0].StatusCode.ShouldBe(0x80550000u, "FC06 returning exception 04 (CPU in PROGRAM mode) maps to BadDeviceFailure");
+    }
+
+    private sealed class NonModbusFailureTransport : IModbusTransport
+    {
+        public Task ConnectAsync(CancellationToken ct) => Task.CompletedTask;
+        public Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
+            => Task.FromException<byte[]>(new EndOfStreamException("socket closed mid-response"));
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
+    [Fact]
+    public async Task Read_non_modbus_failure_maps_to_BadCommunicationError_not_BadInternalError()
+    {
+        // Socket drop / timeout / malformed frame → transport-layer failure. Should surface
+        // distinctly from tag-level faults so operators know to check the network, not the config.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Int16);
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => new NonModbusFailureTransport());
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.ReadAsync(["T"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0x80050000u);
+    }
+}