Modbus TCP

A Phantom gateway can act as a Modbus TCP/IP server, storing sensor data in holding registers that your Modbus client reads.

The gateway listens on the well-known port 502, at the IP address shown on its own LED display. It never initiates contact — it only responds to requests, sending its register contents to the client.

Static IP is required

Modbus clients identify the gateway by IP address, not by hostname, so DHCP is not viable. Configure a static IP before setting this up.

In a repeater network, only the Main gateway is configured as a Modbus server. All Modbus data from subordinate gateways is stored in the Main gateway.

Register layout

Data is exported through holding registers. You map each sensor to a register block in the Modbus tab of the Gateway Admin Console.

Each sensor’s block starts at a multiple of 50. The first mapped sensor starts at register 0, the second at 50, the third at 100, and so on.

Within a block:

Offset	Size	Contents
0	32-bit, little endian	PHANTOM® node ID (e.g. 189245456)
2	16-bit	Phantom type — see below
3+	varies	Determined by the Phantom type

Triggering a measurement

Gateway firmware version 56 and later lets a Modbus client trigger a collection on a V10/V11 vibration sensor — the same thing as pressing Collect Waveform Now in the Live State screen.

Write	Into register	Effect
1	0	Trigger a waveform collection
1	2	Send an RMS update

Configuring it

1. Open the Modbus tab of the Gateway Admin Console
2. Create a register entry for each sensor
3. Select the sensor value to expose, and press ADD for each additional value on that sensor
4. Press SAVE

Sensor type codes

The value at offset 2:

Code	Sensor
3	Triaxial accelerometer
5	V10/E triaxial
6	V11/E triaxial
8	V83 triaxial
9	V82 triaxial
10	Thermographic camera
14	V81 PHANTOM® Max
15	V80 PHANTOM® Max
20	Thermocouple temperature
25	Infrared temperature
26	4-20 mA sensor node
27	0-10 V sensor
30	Triphasic current
31	Dry contact
40	Speed (RPM)
50	Low noise biaxial accelerometer
60	General purpose node

Not the same table as the Web Service uses

These are gateway-side codes, shared with the Management API. They are not the phantomType codes of the PHANTOM® Web Service, where triaxial sensors are 10/11 rather than 3/5/6.

Gateway-side and service-side appear to be two deliberate encodings, but that is pending confirmation. Never reuse one table for the other.

Register layouts by sensor type

The registers after offset 2 depend on the sensor type. All values are little endian.

Triaxial accelerometer

Value	Units	Type	Offset
VRMS channel 1	mm/s	32-bit	3
VRMS channel 2	mm/s	32-bit	5
VRMS channel 3	mm/s	32-bit	7
Battery voltage	centivolt	32-bit	9
Firmware version	—	32-bit	13
Sensor temperature	°C × 100	32-bit	15
ARMS channels 1-3	g	32-bit	see note

Note

The source table lists ARMS for the three channels without offsets. They are left blank here rather than guessed. Pending confirmation.

Thermocouple temperature (20)

Value	Units	Type	Offset
Temperature	°C × 100	32-bit	3
Battery voltage	centivolt	32-bit	5
Sensor internal temperature	°C × 100	32-bit	7
Firmware version	—	32-bit	9

Thermocouple temperature v2 (21)

Value	Units	Type	Offset
Channel 1 temperature	°C × 100	32-bit	3
Battery voltage	centivolt	32-bit	5
Sensor internal temperature	°C × 100	32-bit	7
Firmware version	—	32-bit	9
Channel 2 temperature	°C × 100	32-bit	13
Channel 3 temperature	°C × 100	32-bit	15

Infrared temperature (25)

Value	Units	Type	Offset
Infrared temperature	°C × 100	32-bit	3
Battery voltage	centivolt	32-bit	5
Sensor internal temperature	°C × 100	32-bit	7
Room temperature	°C × 100	32-bit	9
Firmware version	—	32-bit	13

Current v2

Value	Units	Type	Offset
Battery voltage	centivolt	32-bit	3
Sensor internal temperature	°C × 100	32-bit	5
Firmware version	—	32-bit	7
Sequence	—	32-bit	9
Average current, channels 1-4	centiampere	16-bit	11-14
Minimum current, channels 1-4	centiampere	16-bit	15-18
Maximum current, channels 1-4	centiampere	16-bit	19-22

Units read as published

Temperatures are reported as °C × 100 and currents in centiamperes, so divide by 100. The source labels the Sequence field’s units as “centiVolt”, which is almost certainly a copy-paste error in the original table.