Modbus TCP

showstack / protocols / modbus-tcp

Also called Modbus TCP/IP, MODBUS/TCP, Modbus over Ethernet.

The Modbus application protocol wrapped in a seven byte MBAP header and sent over TCP port 502, a plain register read and write protocol with no session and no security. In entertainment it is how show control talks to stage machinery PLCs, hoists, HVAC, house lights and building systems.

Machinery and motionOpenModbus OrganizationReported

Control Small, urgent, must arrive

Small messages that either repeat constantly or fire once. Bandwidth is almost never the problem.

What kills it. Latency and loss on the messages that fire once. A repeating level survives a dropped packet; a GO does not.

The four flows, and why the model is worth having →

Ports

tcp/502 MODBUS/TCP application data units
The implementation guide states that all MODBUS/TCP ADUs are sent to registered port 502.

What goes wrong

Register numbering is the classic error. Vendor documentation usually uses 1-based reference numbers like 40001, while the wire protocol uses 0-based addresses, so 40001 on paper is address 0 in the packet.

There is no authentication and no encryption on port 502. Anything that can reach it can command the machine. A TLS variant exists (Modbus/TCP Security, registered on TCP 802) but field devices rarely implement it, so the answer is still a dedicated VLAN with no route off it.

The standard only defines 16-bit registers. Word order for 32-bit floats and integers is entirely up to the vendor, so the same value can appear as nonsense until you swap the two registers.

The unit identifier is typically 0xFF for a native TCP/IP device but is significant when you are talking through a serial gateway. Send 0xFF into a gateway and you are addressing nothing.

Many devices accept only a small number of simultaneous TCP connections. A second polling client, or a reconnect before the old socket has timed out, can lock the first one out with no error message anywhere.

Modbus has no concept of "the machine is moving". It is a poll and answer protocol, so safety interlocks must live in the PLC, never in the show control cue that reads the registers.

What speaks Modbus TCP (4)

Product	Direction	Notes
CODESYS CODESYS Group	bidirectional	Standard.
Medialon Control System Medialon (Barco)	bidirectional	Modbus for building and ride systems.
TwinCAT Beckhoff Automation	bidirectional	Via supplementary functions.
Beckhoff CX5140 Embedded PC Beckhoff Automation	bidirectional	Supplementary.

Open source implementations

libmodbus — C, LGPL-2.1-or-later
pymodbus — Python, BSD-3-Clause

Typical use

Show control to stage machinery and winch control PLCs
Reading limit switches, e-stop state and drive faults into a show system
Building integration for HVAC, house lights, motorised drapes and doors
Power and energy monitoring gear in racks and distros

Sources

MODBUS Messaging on TCP/IP Implementation Guide V1.0b — Modbus Organization primary
MODBUS/TCP Security Protocol Specification (TLS on registered port 802) — Modbus Organization primary

Understand the mechanism

Robots, animatronics and connected things Code on a show

Something wrong, or missing?

Known gaps on this entry: first_published. If you can source one of them, that is a ten minute pull request.

Edit this entry on GitHub — one file, editable in your browser, and your handle goes on it permanently.

Work at Modbus Organization? Confirm or correct this entry — it is free, it stays free, and nothing about it is for sale.