Phase 3 PR 51 -- DL260 X-input FC02 discrete-input mapping end-to-end test. Integration test DL205XInputTests reads FC02 at the DirectLogicAddress.XInputToDiscrete-resolved address and asserts two behaviors against the dl205.json pymodbus profile: (1) X20 octal (=decimal 16 = Modbus DI 16) reads ON, proving the helper correctly octal-parses the trailing number and adds it to the 0 base; (2) X21 octal reads OFF (not exception) -- per docs/v2/dl205.md §I/O-mapping, 'reading a non-populated X input returns zero, not an exception' on DL260, because the CPU sizes the discrete-input table to the configured I/O not the installed hardware. Pymodbus models this by returning the default 0 value for any DI bit in the configured 'di size' range that wasn't explicitly seeded, matching real DL260 behaviour. Test uses X20 rather than X0 to sidestep a shared-blocks conflict: pymodbus places FC01/FC02 bit-address 0..15 into cell 0, but cell 0 is already uint16-typed (V0 marker = 0xCAFE) per the register-zero quirk test, and shared-blocks semantics allow only one type per cell. X20 octal = DI 16 lands in cell 1 which is free, so both the V0 quirk AND the X-input quirk can coexist in one profile. dl205.json: bits cell 1 seeded value=9 (bits 0 and 3 set -> X20, X23 octal = ON), write-range extended to include cell 1 (though X-inputs are read-only; the write-range entry is required by pymodbus for ANY cell referenced in a bits section even if only reads are expected -- pymodbus validates write-access uniformly). 10/10 DL205 integration tests pass with MODBUS_SIM_PROFILE=dl205. No driver code changes -- the XInputToDiscrete helper + FC02 read path already landed in PRs 50 and 21 respectively. This PR closes the integration-test gap that docs/v2/dl205.md called out under test name DL205_Xinput_unpopulated_reads_as_zero.

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/DirectLogicAddress.cs

@@ -0,0 +1,165 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     AutomationDirect DirectLOGIC address-translation helpers. DL205 / DL260 / DL350 CPUs
+///     address V-memory in OCTAL while the Modbus wire uses DECIMAL PDU addresses — operators
+///     see "V2000" in the PLC ladder-logic editor but the Modbus client must write PDU 0x0400.
+///     The formulas differ between user V-memory (simple octal-to-decimal) and system V-memory
+///     (fixed bank mappings), so the two cases are separate methods rather than one overloaded
+///     "ToPdu" call.
+/// </summary>
+/// <remarks>
+///     See <c>docs/v2/dl205.md</c> §V-memory for the full CPU-family matrix + rationale.
+///     References: D2-USER-M appendix (DL205/D2-260), H2-ECOM-M §6.5 (absolute vs relative
+///     addressing), AutomationDirect forum guidance on V40400 system-base.
+/// </remarks>
+public static class DirectLogicAddress
+{
+    /// <summary>
+    ///     Convert a DirectLOGIC user V-memory address (octal) to a 0-based Modbus PDU address.
+    ///     Accepts bare octal (<c>"2000"</c>) or <c>V</c>-prefixed (<c>"V2000"</c>). Range
+    ///     depends on CPU model — DL205 D2-260 user memory is V1400-V7377 + V10000-V17777
+    ///     octal, DL260 extends to V77777 octal.
+    /// </summary>
+    /// <exception cref="ArgumentException">Input is null / empty / contains non-octal digits (8,9).</exception>
+    /// <exception cref="OverflowException">Parsed value exceeds ushort.MaxValue (0xFFFF).</exception>
+    public static ushort UserVMemoryToPdu(string vAddress)
+    {
+        if (string.IsNullOrWhiteSpace(vAddress))
+            throw new ArgumentException("V-memory address must not be empty", nameof(vAddress));
+        var s = vAddress.Trim();
+        if (s[0] == 'V' || s[0] == 'v') s = s.Substring(1);
+        if (s.Length == 0)
+            throw new ArgumentException($"V-memory address '{vAddress}' has no digits", nameof(vAddress));
+
+        // Octal conversion. Reject 8/9 digits up-front — int.Parse in the obvious base would
+        // accept them silently because .NET has no built-in base-8 parser.
+        uint result = 0;
+        foreach (var ch in s)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"V-memory address '{vAddress}' contains non-octal digit '{ch}' — DirectLOGIC V-addresses are octal (0-7)",
+                    nameof(vAddress));
+            result = result * 8 + (uint)(ch - '0');
+            if (result > ushort.MaxValue)
+                throw new OverflowException(
+                    $"V-memory address '{vAddress}' exceeds the 16-bit Modbus PDU address range");
+        }
+        return (ushort)result;
+    }
+
+    /// <summary>
+    ///     DirectLOGIC system V-memory starts at octal V40400 on DL260 / H2-ECOM100 in factory
+    ///     "absolute" addressing mode. Unlike user V-memory, the mapping is NOT a simple
+    ///     octal-to-decimal conversion — the CPU relocates the system bank to Modbus PDU 0x2100
+    ///     (decimal 8448). This helper returns the CPU-family base plus a user-supplied offset
+    ///     within the system bank.
+    /// </summary>
+    public const ushort SystemVMemoryBasePdu = 0x2100;
+
+    /// <param name="offsetWithinSystemBank">
+    ///     0-based register offset within the system bank. Pass 0 for V40400 itself; pass 1 for
+    ///     V40401 (octal), and so on. NOT an octal-decoded value — the system bank lives at
+    ///     consecutive PDU addresses, so the offset is plain decimal.
+    /// </param>
+    public static ushort SystemVMemoryToPdu(ushort offsetWithinSystemBank)
+    {
+        var pdu = SystemVMemoryBasePdu + offsetWithinSystemBank;
+        if (pdu > ushort.MaxValue)
+            throw new OverflowException(
+                $"System V-memory offset {offsetWithinSystemBank} maps past 0xFFFF");
+        return (ushort)pdu;
+    }
+
+    // Bit-memory bases per DL260 user manual §I/O-configuration.
+    // Numbers after X / Y / C / SP are OCTAL in DirectLOGIC notation. The Modbus base is
+    // added to the octal-decoded offset; e.g. Y017 = Modbus coil 2048 + octal(17) = 2048 + 15 = 2063.
+
+    /// <summary>
+    ///     DL260 Y-output coil base. Y0 octal → Modbus coil address 2048 (0-based).
+    /// </summary>
+    public const ushort YOutputBaseCoil = 2048;
+
+    /// <summary>
+    ///     DL260 C-relay coil base. C0 octal → Modbus coil address 3072 (0-based).
+    /// </summary>
+    public const ushort CRelayBaseCoil = 3072;
+
+    /// <summary>
+    ///     DL260 X-input discrete-input base. X0 octal → Modbus discrete input 0.
+    /// </summary>
+    public const ushort XInputBaseDiscrete = 0;
+
+    /// <summary>
+    ///     DL260 SP special-relay discrete-input base. SP0 octal → Modbus discrete input 1024.
+    ///     Read-only; writing SP relays is rejected with Illegal Data Address.
+    /// </summary>
+    public const ushort SpecialBaseDiscrete = 1024;
+
+    /// <summary>
+    ///     Translate a DirectLOGIC Y-output address (e.g. <c>"Y0"</c>, <c>"Y17"</c>) to its
+    ///     0-based Modbus coil address on DL260. The trailing number is OCTAL, matching the
+    ///     ladder-logic editor's notation.
+    /// </summary>
+    public static ushort YOutputToCoil(string yAddress) =>
+        AddOctalOffset(YOutputBaseCoil, StripPrefix(yAddress, 'Y'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC C-relay address (e.g. <c>"C0"</c>, <c>"C1777"</c>) to its
+    ///     0-based Modbus coil address.
+    /// </summary>
+    public static ushort CRelayToCoil(string cAddress) =>
+        AddOctalOffset(CRelayBaseCoil, StripPrefix(cAddress, 'C'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC X-input address (e.g. <c>"X0"</c>, <c>"X17"</c>) to its
+    ///     0-based Modbus discrete-input address. Reading an unpopulated X returns 0, not an
+    ///     exception — the CPU sizes the table to configured I/O, not installed modules.
+    /// </summary>
+    public static ushort XInputToDiscrete(string xAddress) =>
+        AddOctalOffset(XInputBaseDiscrete, StripPrefix(xAddress, 'X'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC SP-special-relay address (e.g. <c>"SP0"</c>) to its 0-based
+    ///     Modbus discrete-input address. Accepts <c>"SP"</c> prefix case-insensitively.
+    /// </summary>
+    public static ushort SpecialToDiscrete(string spAddress)
+    {
+        if (string.IsNullOrWhiteSpace(spAddress))
+            throw new ArgumentException("SP address must not be empty", nameof(spAddress));
+        var s = spAddress.Trim();
+        if (s.Length >= 2 && (s[0] == 'S' || s[0] == 's') && (s[1] == 'P' || s[1] == 'p'))
+            s = s.Substring(2);
+        return AddOctalOffset(SpecialBaseDiscrete, s);
+    }
+
+    private static string StripPrefix(string address, char expectedPrefix)
+    {
+        if (string.IsNullOrWhiteSpace(address))
+            throw new ArgumentException("Address must not be empty", nameof(address));
+        var s = address.Trim();
+        if (s.Length > 0 && char.ToUpperInvariant(s[0]) == char.ToUpperInvariant(expectedPrefix))
+            s = s.Substring(1);
+        return s;
+    }
+
+    private static ushort AddOctalOffset(ushort baseAddr, string octalDigits)
+    {
+        if (octalDigits.Length == 0)
+            throw new ArgumentException("Address has no digits", nameof(octalDigits));
+        uint offset = 0;
+        foreach (var ch in octalDigits)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"Address contains non-octal digit '{ch}' — DirectLOGIC I/O addresses are octal (0-7)",
+                    nameof(octalDigits));
+            offset = offset * 8 + (uint)(ch - '0');
+        }
+        var result = baseAddr + offset;
+        if (result > ushort.MaxValue)
+            throw new OverflowException($"Address {baseAddr}+{offset} exceeds 0xFFFF");
+        return (ushort)result;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -171,11 +171,14 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
             {
                 var quantity = RegisterCount(tag);
                 var fc = tag.Region == ModbusRegion.HoldingRegisters ? (byte)0x03 : (byte)0x04;
-                var pdu = new byte[] { fc, (byte)(tag.Address >> 8), (byte)(tag.Address & 0xFF),
+                // Auto-chunk when the tag's register span exceeds the caller-configured cap.
-                                       (byte)(quantity >> 8), (byte)(quantity & 0xFF) };
+                // Affects long strings (FC03/04 > 125 regs is spec-forbidden; DL205 caps at 128,
-                var resp = await transport.SendAsync(_options.UnitId, pdu, ct).ConfigureAwait(false);
+                // Mitsubishi Q caps at 64). Non-string tags max out at 4 regs so the cap never
-                // resp = [fc][byte-count][data...]
+                // triggers for numerics.
-                var data = new ReadOnlySpan<byte>(resp, 2, resp[1]);
+                var cap = _options.MaxRegistersPerRead == 0 ? (ushort)125 : _options.MaxRegistersPerRead;
+                var data = quantity <= cap
+                    ? await ReadRegisterBlockAsync(transport, fc, tag.Address, quantity, ct).ConfigureAwait(false)
+                    : await ReadRegisterBlockChunkedAsync(transport, fc, tag.Address, quantity, cap, ct).ConfigureAwait(false);
                 return DecodeRegister(data, tag);
             }
             default:
@@ -183,6 +186,33 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         }
     }
 
+    private async Task<byte[]> ReadRegisterBlockAsync(
+        IModbusTransport transport, byte fc, ushort address, ushort quantity, CancellationToken ct)
+    {
+        var pdu = new byte[] { fc, (byte)(address >> 8), (byte)(address & 0xFF),
+                               (byte)(quantity >> 8), (byte)(quantity & 0xFF) };
+        var resp = await transport.SendAsync(_options.UnitId, pdu, ct).ConfigureAwait(false);
+        // resp = [fc][byte-count][data...]
+        var data = new byte[resp[1]];
+        Buffer.BlockCopy(resp, 2, data, 0, resp[1]);
+        return data;
+    }
+
+    private async Task<byte[]> ReadRegisterBlockChunkedAsync(
+        IModbusTransport transport, byte fc, ushort address, ushort totalRegs, ushort cap, CancellationToken ct)
+    {
+        var assembled = new byte[totalRegs * 2];
+        ushort done = 0;
+        while (done < totalRegs)
+        {
+            var chunk = (ushort)Math.Min(cap, totalRegs - done);
+            var chunkBytes = await ReadRegisterBlockAsync(transport, fc, (ushort)(address + done), chunk, ct).ConfigureAwait(false);
+            Buffer.BlockCopy(chunkBytes, 0, assembled, done * 2, chunkBytes.Length);
+            done += chunk;
+        }
+        return assembled;
+    }
+
     // ---- IWritable ----
 
     public async Task<IReadOnlyList<WriteResult>> WriteAsync(
@@ -239,8 +269,13 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 }
                 else
                 {
-                    // FC 16 (Write Multiple Registers) for 32-bit types
+                    // FC 16 (Write Multiple Registers) for 32-bit types.
                     var qty = (ushort)(bytes.Length / 2);
+                    var writeCap = _options.MaxRegistersPerWrite == 0 ? (ushort)123 : _options.MaxRegistersPerWrite;
+                    if (qty > writeCap)
+                        throw new InvalidOperationException(
+                            $"Write of {qty} registers to {tag.Name} exceeds MaxRegistersPerWrite={writeCap}. " +
+                            $"Split the tag (e.g. shorter StringLength) — partial FC16 chunks would lose atomicity.");
                     var pdu = new byte[6 + 1 + bytes.Length];
                     pdu[0] = 0x10;
                     pdu[1] = (byte)(tag.Address >> 8); pdu[2] = (byte)(tag.Address & 0xFF);
@@ -404,8 +439,8 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
     /// </summary>
     internal static ushort RegisterCount(ModbusTagDefinition tag) => tag.DataType switch
     {
-        ModbusDataType.Int16 or ModbusDataType.UInt16 or ModbusDataType.BitInRegister => 1,
+        ModbusDataType.Int16 or ModbusDataType.UInt16 or ModbusDataType.BitInRegister or ModbusDataType.Bcd16 => 1,
-        ModbusDataType.Int32 or ModbusDataType.UInt32 or ModbusDataType.Float32 => 2,
+        ModbusDataType.Int32 or ModbusDataType.UInt32 or ModbusDataType.Float32 or ModbusDataType.Bcd32 => 2,
         ModbusDataType.Int64 or ModbusDataType.UInt64 or ModbusDataType.Float64 => 4,
         ModbusDataType.String => (ushort)((tag.StringLength + 1) / 2), // 2 chars per register
         _ => throw new InvalidOperationException($"Non-register data type {tag.DataType}"),
@@ -435,6 +470,17 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         {
             case ModbusDataType.Int16: return BinaryPrimitives.ReadInt16BigEndian(data);
             case ModbusDataType.UInt16: return BinaryPrimitives.ReadUInt16BigEndian(data);
+            case ModbusDataType.Bcd16:
+            {
+                var raw = BinaryPrimitives.ReadUInt16BigEndian(data);
+                return (int)DecodeBcd(raw, nibbles: 4);
+            }
+            case ModbusDataType.Bcd32:
+            {
+                var b = NormalizeWordOrder(data, tag.ByteOrder);
+                var raw = BinaryPrimitives.ReadUInt32BigEndian(b);
+                return (int)DecodeBcd(raw, nibbles: 8);
+            }
             case ModbusDataType.BitInRegister:
             {
                 var raw = BinaryPrimitives.ReadUInt16BigEndian(data);
@@ -510,6 +556,21 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 var v = Convert.ToUInt16(value);
                 var b = new byte[2]; BinaryPrimitives.WriteUInt16BigEndian(b, v); return b;
             }
+            case ModbusDataType.Bcd16:
+            {
+                var v = Convert.ToUInt32(value);
+                if (v > 9999) throw new OverflowException($"BCD16 value {v} exceeds 4 decimal digits");
+                var raw = (ushort)EncodeBcd(v, nibbles: 4);
+                var b = new byte[2]; BinaryPrimitives.WriteUInt16BigEndian(b, raw); return b;
+            }
+            case ModbusDataType.Bcd32:
+            {
+                var v = Convert.ToUInt32(value);
+                if (v > 99_999_999u) throw new OverflowException($"BCD32 value {v} exceeds 8 decimal digits");
+                var raw = EncodeBcd(v, nibbles: 8);
+                var b = new byte[4]; BinaryPrimitives.WriteUInt32BigEndian(b, raw);
+                return NormalizeWordOrder(b, tag.ByteOrder);
+            }
             case ModbusDataType.Int32:
             {
                 var v = Convert.ToInt32(value);
@@ -579,9 +640,46 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         ModbusDataType.Float32 => DriverDataType.Float32,
         ModbusDataType.Float64 => DriverDataType.Float64,
         ModbusDataType.String => DriverDataType.String,
+        ModbusDataType.Bcd16 or ModbusDataType.Bcd32 => DriverDataType.Int32,
         _ => DriverDataType.Int32,
     };
 
+    /// <summary>
+    ///     Decode an N-nibble binary-coded-decimal value. Each nibble of <paramref name="raw"/>
+    ///     encodes one decimal digit (most-significant nibble first). Rejects nibbles &gt; 9 —
+    ///     the hardware sometimes produces garbage during transitions and silent non-BCD reads
+    ///     would quietly corrupt the caller's data.
+    /// </summary>
+    internal static uint DecodeBcd(uint raw, int nibbles)
+    {
+        uint result = 0;
+        for (var i = nibbles - 1; i >= 0; i--)
+        {
+            var digit = (raw >> (i * 4)) & 0xF;
+            if (digit > 9)
+                throw new InvalidDataException(
+                    $"Non-BCD nibble 0x{digit:X} at position {i} of raw=0x{raw:X}");
+            result = result * 10 + digit;
+        }
+        return result;
+    }
+
+    /// <summary>
+    ///     Encode a decimal value as N-nibble BCD. Caller is responsible for range-checking
+    ///     against the nibble capacity (10^nibbles - 1).
+    /// </summary>
+    internal static uint EncodeBcd(uint value, int nibbles)
+    {
+        uint result = 0;
+        for (var i = 0; i < nibbles; i++)
+        {
+            var digit = value % 10;
+            result |= digit << (i * 4);
+            value /= 10;
+        }
+        return result;
+    }
+
     private IModbusTransport RequireTransport() =>
         _transport ?? throw new InvalidOperationException("ModbusDriver not initialized");
 

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverOptions.cs

@@ -25,6 +25,26 @@ public sealed class ModbusDriverOptions
     ///     <see cref="IHostConnectivityProbe"/>.
     /// </summary>
     public ModbusProbeOptions Probe { get; init; } = new();
+
+    /// <summary>
+    ///     Maximum registers per FC03 (Read Holding Registers) / FC04 (Read Input Registers)
+    ///     transaction. Modbus-TCP spec allows 125; many device families impose lower caps:
+    ///     AutomationDirect DL205/DL260 cap at <c>128</c>, Mitsubishi Q/FX3U cap at <c>64</c>,
+    ///     Omron CJ/CS cap at <c>125</c>. Set to the lowest cap across the devices this driver
+    ///     instance talks to; the driver auto-chunks larger reads into consecutive requests.
+    ///     Default <c>125</c> — the spec maximum, safe against any conforming server. Setting
+    ///     to <c>0</c> disables the cap (discouraged — the spec upper bound still applies).
+    /// </summary>
+    public ushort MaxRegistersPerRead { get; init; } = 125;
+
+    /// <summary>
+    ///     Maximum registers per FC16 (Write Multiple Registers) transaction. Spec maximum is
+    ///     <c>123</c>; DL205/DL260 cap at <c>100</c>. Matching caller-vs-device semantics:
+    ///     exceeding the cap currently throws (writes aren't auto-chunked because a partial
+    ///     write across two FC16 calls is no longer atomic — caller must explicitly opt in
+    ///     by shortening the tag's <c>StringLength</c> or splitting it into multiple tags).
+    /// </summary>
+    public ushort MaxRegistersPerWrite { get; init; } = 123;
 }
 
 public sealed class ModbusProbeOptions
@@ -89,6 +109,18 @@ public enum ModbusDataType
     BitInRegister,
     /// <summary>ASCII string packed 2 chars per register, <see cref="ModbusTagDefinition.StringLength"/> characters long.</summary>
     String,
+    /// <summary>
+    ///     16-bit binary-coded decimal. Each nibble encodes one decimal digit (0-9). Register
+    ///     value <c>0x1234</c> decodes as decimal <c>1234</c> — NOT binary <c>0x04D2 = 4660</c>.
+    ///     DL205/DL260 and several Mitsubishi / Omron families store timers, counters, and
+    ///     operator-facing numerics as BCD by default.
+    /// </summary>
+    Bcd16,
+    /// <summary>
+    ///     32-bit (two-register) BCD. Decodes 8 decimal digits. Word ordering follows
+    ///     <see cref="ModbusTagDefinition.ByteOrder"/> the same way <see cref="Int32"/> does.
+    /// </summary>
+    Bcd32,
 }
 
 /// <summary>

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205BcdQuirkTests.cs

@@ -0,0 +1,56 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies DL205/DL260 binary-coded-decimal register handling against the
+///     <c>dl205.json</c> pymodbus profile. HR[1072] = 0x1234 on the profile represents
+///     decimal 1234 (BCD nibbles). Reading it as <see cref="ModbusDataType.Int16"/> would
+///     return 0x1234 = 4660; the <see cref="ModbusDataType.Bcd16"/> path decodes 1234.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205BcdQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_BCD16_decodes_HR1072_as_decimal_1234()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed HR[1072]).");
+        }
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_Count_Bcd",
+                    ModbusRegion.HoldingRegisters, Address: 1072,
+                    DataType: ModbusDataType.Bcd16, Writable: false),
+                new ModbusTagDefinition("DL205_Count_Int16",
+                    ModbusRegion.HoldingRegisters, Address: 1072,
+                    DataType: ModbusDataType.Int16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-bcd");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_Count_Bcd", "DL205_Count_Int16"],
+            TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(1234, "DL205 BCD register 0x1234 represents decimal 1234 per the DirectLOGIC convention");
+
+        results[1].StatusCode.ShouldBe(0u);
+        results[1].Value.ShouldBe((short)0x1234, "same register read as Int16 returns the raw 0x1234 = 4660 value — proves BCD path is distinct");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205CoilMappingTests.cs

@@ -0,0 +1,109 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies DL260 I/O-memory coil mappings against the <c>dl205.json</c> pymodbus profile.
+///     DirectLOGIC Y-outputs and C-relays are exposed to Modbus as FC01/FC05 coils, but at
+///     non-zero base addresses that confuse operators used to "Y0 is the first coil". The sim
+///     seeds Y0 → coil 2048 = ON and C0 → coil 3072 = ON as fixed markers.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205CoilMappingTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL260_Y0_maps_to_coil_2048()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        var coil = DirectLogicAddress.YOutputToCoil("Y0");
+        coil.ShouldBe((ushort)2048);
+
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_Y0",
+                ModbusRegion.Coils, Address: coil,
+                DataType: ModbusDataType.Bool, Writable: false),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-y0");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL260_Y0"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(true, "dl205.json seeds coil 2048 (Y0) = ON");
+    }
+
+    [Fact]
+    public async Task DL260_C0_maps_to_coil_3072()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        var coil = DirectLogicAddress.CRelayToCoil("C0");
+        coil.ShouldBe((ushort)3072);
+
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_C0",
+                ModbusRegion.Coils, Address: coil,
+                DataType: ModbusDataType.Bool, Writable: false),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-c0");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL260_C0"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(true, "dl205.json seeds coil 3072 (C0) = ON");
+    }
+
+    [Fact]
+    public async Task DL260_scratch_Crelay_supports_write_then_read()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // Scratch C-relay at coil 4000 (per dl205.json _quirk note) is writable. Write=true then
+        // read back to confirm FC05 round-trip works against the DL-mapped coil bank.
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_C_Scratch",
+                ModbusRegion.Coils, Address: 4000,
+                DataType: ModbusDataType.Bool, Writable: true),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-cscratch");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var writeResults = await driver.WriteAsync(
+            [new(FullReference: "DL260_C_Scratch", Value: true)],
+            TestContext.Current.CancellationToken);
+        writeResults[0].StatusCode.ShouldBe(0u);
+
+        var readResults = await driver.ReadAsync(["DL260_C_Scratch"], TestContext.Current.CancellationToken);
+        readResults[0].StatusCode.ShouldBe(0u);
+        readResults[0].Value.ShouldBe(true);
+    }
+
+    private static ModbusDriverOptions BuildOptions(ModbusSimulatorFixture sim, IReadOnlyList<ModbusTagDefinition> tags)
+        => new()
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags = tags,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205FloatCdabQuirkTests.cs

@@ -0,0 +1,64 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies DL205/DL260 CDAB word ordering for 32-bit floats against the
+///     <c>dl205.json</c> pymodbus profile. DirectLOGIC stores IEEE-754 singles with the low
+///     word at the lower register address (CDAB) rather than the high word (ABCD). Reading
+///     <c>HR[1056..1057]</c> with <see cref="ModbusByteOrder.BigEndian"/> produces a tiny
+///     denormal (~5.74e-41) instead of the intended 1.5f — a silent "value is 0" bug in the
+///     field unless the caller opts into <see cref="ModbusByteOrder.WordSwap"/>.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205FloatCdabQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_Float32_CDAB_decodes_1_5f_from_HR1056()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed HR[1056..1057]).");
+        }
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_Float_CDAB",
+                    ModbusRegion.HoldingRegisters, Address: 1056,
+                    DataType: ModbusDataType.Float32, Writable: false,
+                    ByteOrder: ModbusByteOrder.WordSwap),
+                // Control: same address, BigEndian — proves the default decode produces garbage.
+                new ModbusTagDefinition("DL205_Float_ABCD",
+                    ModbusRegion.HoldingRegisters, Address: 1056,
+                    DataType: ModbusDataType.Float32, Writable: false,
+                    ByteOrder: ModbusByteOrder.BigEndian),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-cdab");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_Float_CDAB", "DL205_Float_ABCD"],
+            TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(1.5f, "DL205 Float32 with WordSwap (CDAB) must decode HR[1056..1057] as 1.5f");
+
+        // The BigEndian read of the same wire bytes should differ — not asserting the exact
+        // denormal value (that couples the test to IEEE-754 bit math) but the two decodes MUST
+        // disagree, otherwise the word-order flag is a no-op.
+        results[1].StatusCode.ShouldBe(0u);
+        results[1].Value.ShouldNotBe(1.5f);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205VMemoryQuirkTests.cs

@@ -0,0 +1,91 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the DL205/DL260 V-memory octal addressing quirk end-to-end: use
+///     <see cref="DirectLogicAddress.UserVMemoryToPdu"/> to translate <c>V2000</c> octal into
+///     the Modbus PDU address actually dispatched, then read the marker the dl205.json profile
+///     placed at that address. HR[0x0400] = 0x2000 proves the translation was performed
+///     correctly — a naïve caller treating "V2000" as decimal 2000 would read HR[2000] (which
+///     the profile leaves at 0) and miss the marker entirely.
+/// </summary>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205VMemoryQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_V2000_user_memory_resolves_to_PDU_0x0400_marker()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed V-memory markers).");
+        }
+
+        var pdu = DirectLogicAddress.UserVMemoryToPdu("V2000");
+        pdu.ShouldBe((ushort)0x0400);
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_V2000",
+                    ModbusRegion.HoldingRegisters, Address: pdu,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-vmem");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_V2000"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe((ushort)0x2000, "dl205.json seeds HR[0x0400] with marker 0x2000 (= V2000 value)");
+    }
+
+    [Fact]
+    public async Task DL205_V40400_system_memory_resolves_to_PDU_0x2100_marker()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // V40400 is system memory on DL260 / H2-ECOM100 absolute mode; it does NOT follow the
+        // simple octal-to-decimal formula (40400 octal = 16640 decimal, which would read HR[0x4100]).
+        // The CPU places the system bank at PDU 0x2100 instead. Proving the helper routes there.
+        var pdu = DirectLogicAddress.SystemVMemoryToPdu(0);
+        pdu.ShouldBe((ushort)0x2100);
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition("DL205_V40400",
+                    ModbusRegion.HoldingRegisters, Address: pdu,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-sysv");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_V40400"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe((ushort)0x4040, "dl205.json seeds HR[0x2100] with marker 0x4040 (= V40400 value)");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205XInputTests.cs

@@ -0,0 +1,71 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the DL260 X-input discrete-input mapping against the <c>dl205.json</c>
+///     pymodbus profile. X-inputs are FC02 discrete-input-only (Modbus doesn't allow writes
+///     to discrete inputs), and the DirectLOGIC convention is X0 → DI 0 with octal offsets
+///     for subsequent addresses. The sim seeds X20 octal (= DI 16) = ON so the test can
+///     prove the helper routes through to the right cell.
+/// </summary>
+/// <remarks>
+///     X0 / X1 / …X17 octal all share cell 0 (DI 0-15 → cell 0 bits 0-15) which conflicts
+///     with the V0 uint16 marker; we can't seed both types at cell 0 under shared-blocks
+///     semantics. So the test uses X20 octal (first address beyond the cell-0 boundary) which
+///     lands cleanly at cell 1 bit 0 and leaves the V0 register-zero quirk intact.
+/// </remarks>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205XInputTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL260_X20_octal_maps_to_DiscreteInput_16_and_reads_ON()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping.");
+        }
+
+        // X20 octal = decimal 16 = DI 16 per the DL260 convention (X-inputs start at DI 0).
+        var di = DirectLogicAddress.XInputToDiscrete("X20");
+        di.ShouldBe((ushort)16);
+
+        var options = BuildOptions(sim, [
+            new ModbusTagDefinition("DL260_X20",
+                ModbusRegion.DiscreteInputs, Address: di,
+                DataType: ModbusDataType.Bool, Writable: false),
+            // Unpopulated-X control: pymodbus returns 0 (not exception) for any bit in the
+            // configured DI range that wasn't explicitly seeded — per docs/v2/dl205.md
+            // "Reading a non-populated X input ... returns zero, not an exception".
+            new ModbusTagDefinition("DL260_X21_off",
+                ModbusRegion.DiscreteInputs, Address: DirectLogicAddress.XInputToDiscrete("X21"),
+                DataType: ModbusDataType.Bool, Writable: false),
+        ]);
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-xinput");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL260_X20", "DL260_X21_off"], TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe(true, "dl205.json seeds cell 1 bit 0 (X20 octal = DI 16) = ON");
+
+        results[1].StatusCode.ShouldBe(0u, "unpopulated X inputs must read cleanly — DL260 does NOT raise an exception");
+        results[1].Value.ShouldBe(false);
+    }
+
+    private static ModbusDriverOptions BuildOptions(ModbusSimulatorFixture sim, IReadOnlyList<ModbusTagDefinition> tags)
+        => new()
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags = tags,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/dl205.json

@@ -36,9 +36,10 @@
         [1280, 1282],
         [1343, 1343],
         [1407, 1407],
-        [2048, 2050],
+        [1, 1],
-        [3072, 3074],
+        [128, 128],
-        [4000, 4007],
+        [192, 192],
+        [250, 250],
         [8448, 8448]
       ],
 
@@ -88,25 +89,17 @@
       ],
 
       "bits": [
-        {"_quirk": "Y0 marker. DL260 maps Y0 to coil 2048 (0-based). Coil 2048 = ON proves the mapping.",
+        {"_quirk": "X-input bank marker cell. X0 -> DI 0 conflicts with uint16 V0 at cell 0, so this marker covers X20 octal (= decimal 16 = DI 16 = cell 1 bit 0). X20=ON, X23 octal (DI 19 = cell 1 bit 3)=ON -> cell 1 value = 0b00001001 = 9.",
-         "addr": 2048, "value": 1},
+         "addr": 1, "value": 9},
-        {"addr": 2049, "value": 0},
-        {"addr": 2050, "value": 1},
 
-        {"_quirk": "C0 marker. DL260 maps C0 to coil 3072 (0-based). Coil 3072 = ON proves the mapping.",
+        {"_quirk": "Y-output bank marker cell. pymodbus's simulator maps Modbus FC01/02/05 bit-addresses to cell index = bit_addr / 16; so Modbus coil 2048 lives at cell 128 bit 0. Y0=ON (bit 0), Y1=OFF (bit 1), Y2=ON (bit 2) -> value=0b00000101=5 proves DL260 mapping Y0 -> coil 2048.",
-         "addr": 3072, "value": 1},
+         "addr": 128, "value": 5},
-        {"addr": 3073, "value": 0},
-        {"addr": 3074, "value": 1},
 
-        {"_quirk": "Scratch C-relays for write-roundtrip tests against the writable C range.",
+        {"_quirk": "C-relay bank marker cell. Modbus coil 3072 -> cell 192 bit 0. C0=ON (bit 0), C1=OFF (bit 1), C2=ON (bit 2) -> value=5 proves DL260 mapping C0 -> coil 3072.",
-         "addr": 4000, "value": 0},
+         "addr": 192, "value": 5},
-        {"addr": 4001, "value": 0},
+
-        {"addr": 4002, "value": 0},
+        {"_quirk": "Scratch cell for coil 4000..4015 write round-trip tests. Cell 250 holds Modbus coils 4000-4015; all bits start at 0 and tests set specific bits via FC05.",
-        {"addr": 4003, "value": 0},
+         "addr": 250, "value": 0}
-        {"addr": 4004, "value": 0},
-        {"addr": 4005, "value": 0},
-        {"addr": 4006, "value": 0},
-        {"addr": 4007, "value": 0}
       ],
 
       "uint32":  [],

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/DirectLogicAddressTests.cs

@@ -0,0 +1,139 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class DirectLogicAddressTests
+{
+    [Theory]
+    [InlineData("V0", (ushort)0x0000)]
+    [InlineData("V1", (ushort)0x0001)]
+    [InlineData("V7", (ushort)0x0007)]
+    [InlineData("V10", (ushort)0x0008)]
+    [InlineData("V2000", (ushort)0x0400)]  // canonical DL205/DL260 user-memory start
+    [InlineData("V7777", (ushort)0x0FFF)]
+    [InlineData("V10000", (ushort)0x1000)]
+    [InlineData("V17777", (ushort)0x1FFF)]
+    public void UserVMemoryToPdu_converts_octal_V_prefix(string v, ushort expected)
+        => DirectLogicAddress.UserVMemoryToPdu(v).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("0", (ushort)0)]
+    [InlineData("2000", (ushort)0x0400)]
+    [InlineData("v2000", (ushort)0x0400)]   // lowercase v
+    [InlineData(" V2000 ", (ushort)0x0400)] // surrounding whitespace
+    public void UserVMemoryToPdu_accepts_bare_or_prefixed_or_padded(string v, ushort expected)
+        => DirectLogicAddress.UserVMemoryToPdu(v).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("V8")]     // 8 is not a valid octal digit
+    [InlineData("V19")]
+    [InlineData("V2009")]
+    public void UserVMemoryToPdu_rejects_non_octal_digits(string v)
+    {
+        Should.Throw<ArgumentException>(() => DirectLogicAddress.UserVMemoryToPdu(v))
+            .Message.ShouldContain("octal");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("V")]
+    public void UserVMemoryToPdu_rejects_empty_input(string? v)
+        => Should.Throw<ArgumentException>(() => DirectLogicAddress.UserVMemoryToPdu(v!));
+
+    [Fact]
+    public void UserVMemoryToPdu_overflow_rejected()
+    {
+        // 200000 octal = 0x10000 — one past ushort range.
+        Should.Throw<OverflowException>(() => DirectLogicAddress.UserVMemoryToPdu("V200000"));
+    }
+
+    [Fact]
+    public void SystemVMemoryBasePdu_is_0x2100_for_V40400()
+    {
+        // V40400 on DL260 / H2-ECOM100 absolute mode → PDU 0x2100 (decimal 8448), NOT 0x4100
+        // which a naive octal-to-decimal of 40400 octal would give (= 16640).
+        DirectLogicAddress.SystemVMemoryBasePdu.ShouldBe((ushort)0x2100);
+        DirectLogicAddress.SystemVMemoryToPdu(0).ShouldBe((ushort)0x2100);
+    }
+
+    [Fact]
+    public void SystemVMemoryToPdu_offsets_within_bank()
+    {
+        DirectLogicAddress.SystemVMemoryToPdu(1).ShouldBe((ushort)0x2101);
+        DirectLogicAddress.SystemVMemoryToPdu(0x100).ShouldBe((ushort)0x2200);
+    }
+
+    [Fact]
+    public void SystemVMemoryToPdu_rejects_overflow()
+    {
+        // ushort wrap: 0xFFFF - 0x2100 = 0xDEFF; anything above should throw.
+        Should.NotThrow(() => DirectLogicAddress.SystemVMemoryToPdu(0xDEFF));
+        Should.Throw<OverflowException>(() => DirectLogicAddress.SystemVMemoryToPdu(0xDF00));
+    }
+
+    // --- Bit memory: Y-output, C-relay, X-input, SP-special ---
+
+    [Theory]
+    [InlineData("Y0", (ushort)2048)]
+    [InlineData("Y1", (ushort)2049)]
+    [InlineData("Y7", (ushort)2055)]
+    [InlineData("Y10", (ushort)2056)]    // octal 10 = decimal 8
+    [InlineData("Y17", (ushort)2063)]    // octal 17 = decimal 15
+    [InlineData("Y777", (ushort)2559)]   // top of DL260 Y range per doc table
+    public void YOutputToCoil_adds_octal_offset_to_2048(string y, ushort expected)
+        => DirectLogicAddress.YOutputToCoil(y).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("C0", (ushort)3072)]
+    [InlineData("C1", (ushort)3073)]
+    [InlineData("C10", (ushort)3080)]
+    [InlineData("C1777", (ushort)4095)]  // top of DL260 C range
+    public void CRelayToCoil_adds_octal_offset_to_3072(string c, ushort expected)
+        => DirectLogicAddress.CRelayToCoil(c).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("X0", (ushort)0)]
+    [InlineData("X17", (ushort)15)]
+    [InlineData("X777", (ushort)511)]    // top of DL260 X range
+    public void XInputToDiscrete_adds_octal_offset_to_0(string x, ushort expected)
+        => DirectLogicAddress.XInputToDiscrete(x).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("SP0", (ushort)1024)]
+    [InlineData("SP7", (ushort)1031)]
+    [InlineData("sp0", (ushort)1024)]     // lowercase prefix
+    [InlineData("SP777", (ushort)1535)]
+    public void SpecialToDiscrete_adds_octal_offset_to_1024(string sp, ushort expected)
+        => DirectLogicAddress.SpecialToDiscrete(sp).ShouldBe(expected);
+
+    [Theory]
+    [InlineData("Y8")]
+    [InlineData("C9")]
+    [InlineData("X18")]
+    public void Bit_address_rejects_non_octal_digits(string bad)
+        => Should.Throw<ArgumentException>(() =>
+        {
+            if (bad[0] == 'Y') DirectLogicAddress.YOutputToCoil(bad);
+            else if (bad[0] == 'C') DirectLogicAddress.CRelayToCoil(bad);
+            else DirectLogicAddress.XInputToDiscrete(bad);
+        });
+
+    [Theory]
+    [InlineData("Y")]
+    [InlineData("C")]
+    [InlineData("")]
+    public void Bit_address_rejects_empty(string bad)
+        => Should.Throw<ArgumentException>(() => DirectLogicAddress.YOutputToCoil(bad));
+
+    [Fact]
+    public void YOutputToCoil_accepts_lowercase_prefix()
+        => DirectLogicAddress.YOutputToCoil("y0").ShouldBe((ushort)2048);
+
+    [Fact]
+    public void CRelayToCoil_accepts_bare_octal_without_C_prefix()
+        => DirectLogicAddress.CRelayToCoil("0").ShouldBe((ushort)3072);
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusCapTests.cs

@@ -0,0 +1,165 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class ModbusCapTests
+{
+    /// <summary>
+    ///     Records every PDU sent so tests can assert request-count and per-request quantity —
+    ///     the only observable behaviour of the auto-chunking path.
+    /// </summary>
+    private sealed class RecordingTransport : IModbusTransport
+    {
+        public readonly ushort[] HoldingRegisters = new ushort[1024];
+        public readonly List<(ushort Address, ushort Quantity)> Fc03Requests = new();
+        public readonly List<(ushort Address, ushort Quantity)> Fc16Requests = new();
+
+        public Task ConnectAsync(CancellationToken ct) => Task.CompletedTask;
+
+        public Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
+        {
+            var fc = pdu[0];
+            if (fc == 0x03)
+            {
+                var addr = (ushort)((pdu[1] << 8) | pdu[2]);
+                var qty = (ushort)((pdu[3] << 8) | pdu[4]);
+                Fc03Requests.Add((addr, qty));
+                var byteCount = (byte)(qty * 2);
+                var resp = new byte[2 + byteCount];
+                resp[0] = 0x03;
+                resp[1] = byteCount;
+                for (var i = 0; i < qty; i++)
+                {
+                    resp[2 + i * 2] = (byte)(HoldingRegisters[addr + i] >> 8);
+                    resp[3 + i * 2] = (byte)(HoldingRegisters[addr + i] & 0xFF);
+                }
+                return Task.FromResult(resp);
+            }
+            if (fc == 0x10)
+            {
+                var addr = (ushort)((pdu[1] << 8) | pdu[2]);
+                var qty = (ushort)((pdu[3] << 8) | pdu[4]);
+                Fc16Requests.Add((addr, qty));
+                for (var i = 0; i < qty; i++)
+                    HoldingRegisters[addr + i] = (ushort)((pdu[6 + i * 2] << 8) | pdu[7 + i * 2]);
+                return Task.FromResult(new byte[] { 0x10, pdu[1], pdu[2], pdu[3], pdu[4] });
+            }
+            return Task.FromException<byte[]>(new ModbusException(fc, 0x01, $"fc={fc} unsupported"));
+        }
+
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
+    [Fact]
+    public async Task Read_within_cap_issues_single_FC03_request()
+    {
+        var tag = new ModbusTagDefinition("S", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 40); // 20 regs — fits in default cap (125).
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        _ = await drv.ReadAsync(["S"], TestContext.Current.CancellationToken);
+
+        transport.Fc03Requests.Count.ShouldBe(1);
+        transport.Fc03Requests[0].Quantity.ShouldBe((ushort)20);
+    }
+
+    [Fact]
+    public async Task Read_above_cap_splits_into_two_FC03_requests()
+    {
+        // 240-char string = 120 regs. Cap = 100 (a typical sub-spec device cap). Expect 100 + 20.
+        var tag = new ModbusTagDefinition("LongString", ModbusRegion.HoldingRegisters, 100, ModbusDataType.String,
+            StringLength: 240);
+        var transport = new RecordingTransport();
+        // Seed cells so the re-assembled payload is stable — confirms chunks are stitched in order.
+        for (ushort i = 100; i < 100 + 120; i++)
+            transport.HoldingRegisters[i] = (ushort)((('A' + (i - 100) % 26) << 8) | ('A' + (i - 100) % 26));
+
+        var opts = new ModbusDriverOptions
+        {
+            Host = "fake",
+            Tags = [tag],
+            MaxRegistersPerRead = 100,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.ReadAsync(["LongString"], TestContext.Current.CancellationToken);
+        results[0].StatusCode.ShouldBe(0u);
+
+        transport.Fc03Requests.Count.ShouldBe(2, "120 regs / cap 100 → 2 requests");
+        transport.Fc03Requests[0].ShouldBe(((ushort)100, (ushort)100));
+        transport.Fc03Requests[1].ShouldBe(((ushort)200, (ushort)20));
+
+        // Payload continuity: re-assembled string starts where register 100 does and keeps going.
+        var s = (string)results[0].Value!;
+        s.Length.ShouldBeGreaterThan(0);
+        s[0].ShouldBe('A'); // register[100] high byte
+    }
+
+    [Fact]
+    public async Task Read_cap_honors_Mitsubishi_lower_cap_of_64()
+    {
+        // 200-char string = 100 regs. Mitsubishi Q cap = 64. Expect: 64, 36.
+        var tag = new ModbusTagDefinition("MitString", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 200);
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], MaxRegistersPerRead = 64, Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        _ = await drv.ReadAsync(["MitString"], TestContext.Current.CancellationToken);
+
+        transport.Fc03Requests.Count.ShouldBe(2);
+        transport.Fc03Requests[0].Quantity.ShouldBe((ushort)64);
+        transport.Fc03Requests[1].Quantity.ShouldBe((ushort)36);
+    }
+
+    [Fact]
+    public async Task Write_exceeding_cap_throws_instead_of_splitting()
+    {
+        // Partial FC16 across two transactions is not atomic. Forcing an explicit exception so the
+        // caller knows their tag definition is incompatible with the device cap rather than silently
+        // writing half a string and crashing between chunks.
+        var tag = new ModbusTagDefinition("LongStringWrite", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 220); // 110 regs.
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], MaxRegistersPerWrite = 100, Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("LongStringWrite", new string('A', 220))],
+            TestContext.Current.CancellationToken);
+
+        // Driver catches the internal exception and surfaces BadInternalError — the Fc16Requests
+        // list must still be empty because nothing was sent.
+        results[0].StatusCode.ShouldNotBe(0u);
+        transport.Fc16Requests.Count.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task Write_within_cap_proceeds_normally()
+    {
+        var tag = new ModbusTagDefinition("ShortStringWrite", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 40); // 20 regs.
+        var transport = new RecordingTransport();
+        var opts = new ModbusDriverOptions { Host = "fake", Tags = [tag], MaxRegistersPerWrite = 100, Probe = new ModbusProbeOptions { Enabled = false } };
+        await using var drv = new ModbusDriver(opts, "modbus-1", _ => transport);
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("ShortStringWrite", "HELLO")],
+            TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);
+        transport.Fc16Requests.Count.ShouldBe(1);
+        transport.Fc16Requests[0].Quantity.ShouldBe((ushort)20);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusDataTypeTests.cs

@@ -219,4 +219,97 @@ public sealed class ModbusDataTypeTests
         ModbusDriver.DecodeRegister(wire, hi).ShouldBe("He");
         ModbusDriver.DecodeRegister(wire, lo).ShouldBe("eH");
     }
+
+    // --- BCD (binary-coded decimal, DL205/DL260 default numeric encoding) ---
+
+    [Theory]
+    [InlineData(0x0000u, 0u)]
+    [InlineData(0x0001u, 1u)]
+    [InlineData(0x0009u, 9u)]
+    [InlineData(0x0010u, 10u)]
+    [InlineData(0x1234u, 1234u)]
+    [InlineData(0x9999u, 9999u)]
+    public void DecodeBcd_16_bit_decodes_expected_decimal(uint raw, uint expected)
+        => ModbusDriver.DecodeBcd(raw, nibbles: 4).ShouldBe(expected);
+
+    [Fact]
+    public void DecodeBcd_rejects_nibbles_above_nine()
+    {
+        Should.Throw<InvalidDataException>(() => ModbusDriver.DecodeBcd(0x00A5u, nibbles: 4))
+            .Message.ShouldContain("Non-BCD nibble");
+    }
+
+    [Theory]
+    [InlineData(0u, 0x0000u)]
+    [InlineData(5u, 0x0005u)]
+    [InlineData(42u, 0x0042u)]
+    [InlineData(1234u, 0x1234u)]
+    [InlineData(9999u, 0x9999u)]
+    public void EncodeBcd_16_bit_encodes_expected_nibbles(uint value, uint expected)
+        => ModbusDriver.EncodeBcd(value, nibbles: 4).ShouldBe(expected);
+
+    [Fact]
+    public void Bcd16_decodes_DL205_register_1234_as_decimal_1234()
+    {
+        // HR[1072] = 0x1234 on the DL205 profile represents decimal 1234. A plain Int16 decode
+        // would return 0x04D2 = 4660 — proof the BCD path is different.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        ModbusDriver.DecodeRegister(new byte[] { 0x12, 0x34 }, tag).ShouldBe(1234);
+
+        var int16Tag = tag with { DataType = ModbusDataType.Int16 };
+        ModbusDriver.DecodeRegister(new byte[] { 0x12, 0x34 }, int16Tag).ShouldBe((short)0x1234);
+    }
+
+    [Fact]
+    public void Bcd16_encode_round_trips_with_decode()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        var wire = ModbusDriver.EncodeRegister(4321, tag);
+        wire.ShouldBe(new byte[] { 0x43, 0x21 });
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe(4321);
+    }
+
+    [Fact]
+    public void Bcd16_encode_rejects_out_of_range_values()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        Should.Throw<OverflowException>(() => ModbusDriver.EncodeRegister(10000, tag))
+            .Message.ShouldContain("4 decimal digits");
+    }
+
+    [Fact]
+    public void Bcd32_decodes_8_digits_big_endian()
+    {
+        // 0x12345678 as BCD = decimal 12_345_678.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32);
+        ModbusDriver.DecodeRegister(new byte[] { 0x12, 0x34, 0x56, 0x78 }, tag).ShouldBe(12_345_678);
+    }
+
+    [Fact]
+    public void Bcd32_word_swap_handles_CDAB_layout()
+    {
+        // PLC stored 12_345_678 with word swap: low-word 0x5678 first, high-word 0x1234 second.
+        // Wire bytes [0x56, 0x78, 0x12, 0x34] + WordSwap → decode to decimal 12_345_678.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32,
+            ByteOrder: ModbusByteOrder.WordSwap);
+        ModbusDriver.DecodeRegister(new byte[] { 0x56, 0x78, 0x12, 0x34 }, tag).ShouldBe(12_345_678);
+    }
+
+    [Fact]
+    public void Bcd32_encode_round_trips_with_decode()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32);
+        var wire = ModbusDriver.EncodeRegister(87_654_321u, tag);
+        wire.ShouldBe(new byte[] { 0x87, 0x65, 0x43, 0x21 });
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe(87_654_321);
+    }
+
+    [Fact]
+    public void Bcd_RegisterCount_matches_underlying_width()
+    {
+        var b16 = new ModbusTagDefinition("A", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd16);
+        var b32 = new ModbusTagDefinition("B", ModbusRegion.HoldingRegisters, 0, ModbusDataType.Bcd32);
+        ModbusDriver.RegisterCount(b16).ShouldBe((ushort)1);
+        ModbusDriver.RegisterCount(b32).ShouldBe((ushort)2);
+    }
 }