Timeout

What is a timeout?

A timeout is a preset maximum waiting time after which a system stops waiting for a response, message or event and treats the attempt as failed. In OT and industrial automation environments, the timeout is the basic mechanism for fault detection: without it, a PLC, SCADA server or O station would keep waiting forever for a device that failed long ago. The chosen value determines how quickly a fault is noticed and how often an alarm is raised for nothing. A timeout therefore has a direct bearing on availability and process safety in industrial processes.

🧠 How does a timeout work?

Every timeout is essentially a timer that starts on an expected event:

1. A system sends a request or expects a cyclic message.
2. A timer starts with the configured value.
3. If the answer arrives in time, the timer stops or restarts.
4. If the timer expires, a predefined reaction follows: retry, raise an alarm, use a substitute value or move to a safe state.

Two variants are common in OT. With request/response (for example Modbus polling), a master waits for the answer to a single request. With cyclic supervision (a watchdog), a receiver expects a new message every cycle and intervenes if it is missing for a number of cycles. PROFIsafe, ProfiNET I/O and CIP Safety work in this second way.

🔄 What is the difference between timeout, latency and jitter?

A timeout is a limit you configure, Latency is the actual delay you measure, and Jitter is the variation in that delay. A timeout only fires when latency plus jitter exceeds the limit, or when a message is lost entirely through packet loss or network congestion.

This is why deterministic networks matter so much for motion control and real-time control: with little jitter, the timeout can be set tightly without nuisance trips.

🔧 Which timeouts do TCP and UDP have?

TCP has built-in timers. The retransmission timeout (RTO) decides when an unacknowledged segment is sent again. Under RFC 6298 the RTO starts at 1 second, should not drop below 1 second and doubles on every failed attempt, so after a few attempts the waits quickly grow to tens of seconds. TCP keepalive is off by default and, when enabled, only checks after 2 hours of silence whether the other side is still alive. A “session timeout” does not exist in TCP itself: it lives in applications, firewalls and VPN gateways that clean up idle connections.

UDP has no acknowledgements and therefore no timeouts of its own. The application has to check for itself whether messages arrive. IP uses UDP for cyclic I/O and supervises each connection with its own timeout. PROFINET RT, EtherCAT and SERCOS III run directly on Ethernet, without IP and UDP, and have their own watchdog mechanisms.

For process supervision the TCP timers are too slow. Protocols on top of TCP therefore add their own supervision, such as the test frames of IEC 60870-5-104, the keep alive of MQTT and the keep-alive messages of OPC UA subscriptions.

🏭 Which timeout values are common in industrial protocols?

The cycle watchdog of a PLC is not a communication timeout, but it works the same way. The article on cycle time describes the differences per platform. For Modbus RTU the specification only prescribes a silence of 3.5 characters between frames; you set the response timeout yourself in the master. With Modbus TCP gateways, too many clients or too short a poll time quickly cause timeouts, because the gateway handles serial requests one at a time.

🎯 What happens in a plant when a timeout occurs?

• PLC and remote I/O - the I/O station sets its outputs to substitute values or zero, the PLC reports a station failure, and the program has to decide whether the process can continue.
• SCADA and HMI - tags get “bad” quality, trends and historian data show gaps, and operators see a communication alarm. Good alarm management prevents one lost connection from producing hundreds of alarms.
• Safety - a safety PLC that no longer receives a valid safety message moves the affected outputs to the safe state. That is an intended reaction and not an emergency stop in the sense of an operator function, but it does mean downtime.
• Motion - in motion control a timeout leads to a controlled stop of the axes and sometimes to loss of synchronisation or position.
• Wireless - Wifi, Bluetooth and WirelessHART show more variation in delay due to interference and roaming, so longer timeouts and buffering are needed here.
• Cloud and edge - a WAN outage must never affect local control. Edge systems buffer data and forward it once the link is restored.

🔧 How do you set a timeout correctly?

A timeout that is too short causes nuisance trips; one that is too long leaves a real fault unnoticed for too long. A practical approach:

1. Measure the actual response time under normal and peak load, and look at the worst values rather than the average.
2. Choose a margin - a common rule of thumb is a timeout of a few times the worst measured response time, within the limit the process or safety analysis allows.
3. Include retries - the detection time is timeout × (number of retries + 1). With a 1 s timeout and 3 retries it takes 4 s before a station is considered failed.
4. Align the layers - set the application timeout above the TCP retransmission time, and keep firewall idle timeouts longer than the poll interval, otherwise the firewall closes a connection the application still thinks is open.
5. Define the reaction - hold last value, substitute value, alarm or safe state.
6. Test failures deliberately - pull a cable or block traffic and measure how long detection and recovery take.

Worked example: a SCADA system polls 50 RTUs over radio with a 1 s timeout and 3 retries. If 5 stations fail, each poll round takes almost 5 × 4 s = 20 s longer, so the healthy stations are refreshed far less often. Many drivers therefore temporarily move a failed station to a lower poll rate.

🔐 How are timeouts related to cybersecurity?

A DDoS attack, a scan of the production network or a rogue device can load the network so heavily that watchdogs expire. Safety protocols then bring the plant to a safe state, but a stopped one. A denial of service in OT is therefore often an attack on availability through timeouts. Security measures themselves also add delay: deep packet inspection, TLS inspection, encryption in a VPN tunnel and overloaded firewalls. Segmentation and network segmentation limit the impact of such traffic.

At the same time, timeouts are a security control. IEC 62443-3-3 requires, through SR 2.5 (session lock) and SR 2.6 (remote session termination), that sessions are locked or terminated after inactivity. This applies, for example, to remote access to engineering stations. In OT cybersecurity, the aim is to keep session timeouts strict and process timeouts stable.

📈 How do you monitor timeouts?

A rising number of timeouts is often the first sign of poor cabling, overloaded switches, congestion or an attack. Useful metrics are the number of timeouts per connection, the response time (including worst values), the number of retries and the number of restarted connections. These metrics can be collected in InfluxDB and visualised with Grafana, alongside the diagnostics in SCADA and network monitoring. General monitoring of trends helps you spot drift before the process stops.

Recovery mechanisms that react to timeouts include retries, failover to a second connection, heartbeats and watchdogs. Redundancy in networks and servers, plus a clear recovery process, limit the consequences. With OT convergence, IIoT platforms and cloud connections, the number of layers with their own timeouts grows, and so does the importance of aligning them.

❓ Frequently asked questions

What is a good timeout value for Modbus polling?

A good timeout value for Modbus polling is a few times the worst measured response time of the device or gateway. The Modbus specification does not prescribe a value, so the engineer sets the timeout in the master. On serial lines behind a gateway, the waiting time caused by other clients must also be taken into account.

What is the difference between a timeout and a watchdog?

A timeout usually supervises one expected answer to a request, whereas a watchdog continuously checks that cyclic messages or program cycles keep arriving on time. Both are timers that intervene when time runs out. In PROFINET, PROFIsafe and PLC cycles the mechanism is called a watchdog; in polling protocols it is called a response timeout.

Why do I get timeouts while ping works fine?

Timeouts with a working ping often occur because the device itself responds too slowly, has reached its maximum number of connections, or because a firewall has closed an idle connection. A ping only tests network reachability, not the application. Occasional spikes in latency and jitter also go unnoticed in a handful of pings.

What happens on a PROFINET watchdog timeout?

On a PROFINET watchdog timeout, the I/O device receives no valid data within the watchdog time and sets its outputs to substitute values. The controller reports the station as failed. The watchdog time is the update time multiplied by the accepted number of missed cycles, which defaults to 3.

Should a timeout be short or long?

A timeout should be as short as fault detection requires and as long as needed to absorb normal variation in delay. Too short causes nuisance trips and unnecessary downtime; too long leaves a real fault unnoticed for too long. In OT, stability usually takes priority over maximum speed.

Can a cyber attack cause timeouts?

A cyber attack can cause timeouts by overloading the network or devices, for example with a DDoS or an aggressive scan. In OT this leads to loss of communication and can force safety systems into a safe stop. Segmentation, rate limiting and monitoring of timeout counters help to limit such an attack and spot it quickly.

📌 In summary

A timeout is the configured maximum waiting time that OT systems use to detect communication and processing faults. The value sets the balance between fast fault detection and nuisance trips. From TCP (RTO from 1 s) and IEC 104 (t1 = 15 s) to PROFINET watchdogs and PROFIsafe: if you measure, justify, align and monitor your timeouts, your plant stays both safe and available.