Industrial Networking

The industrial protocol landscape

Industrial communication protocols can be roughly divided into three generations: serial fieldbuses (1980s–2000s), industrial Ethernet protocols (2000s–present), and cloud/IIoT protocols (2010s–present). Most active facilities use all three simultaneously, which is why integration — bridging protocols using gateways, OPC servers, and edge devices — is a core skill for controls engineers.

Modbus — the universal legacy protocol

Modbus was published by Modicon in 1979 and remains one of the most widely supported industrial protocols, found in VFDs, power meters, temperature controllers, PLCs, and sensors from virtually every manufacturer. Its longevity comes from simplicity: a single master polls slaves in sequence, reading and writing coils (bits) and registers (16-bit words).

Modbus data model

Modbus defines four data tables per device:

• Coils (0x): Read/write single-bit outputs. Function codes 01 (read), 05 (write single), 15 (write multiple).
• Discrete Inputs (1x): Read-only single-bit inputs. Function code 02.
• Input Registers (3x): Read-only 16-bit analogue inputs. Function code 04.
• Holding Registers (4x): Read/write 16-bit registers. Function codes 03 (read), 06 (write single), 16 (write multiple).

Multi-register data types (32-bit floats, 32-bit integers) are stored across two consecutive holding registers. The byte order (big-endian / little-endian) and word order (high word first / low word first) vary by device — always check the slave device's register map documentation.

Modbus RTU

Modbus RTU uses RS-485 (balanced differential serial, up to 247 slaves per segment, up to 1200 m at lower baud rates, 100 m at 115200 baud) or RS-232 (point-to-point only). Frames are binary with CRC-16 error checking. The "silent interval" between frames (at least 3.5 character times) is how devices distinguish frame boundaries.

Modbus TCP

Modbus TCP encapsulates Modbus RTU frames in TCP/IP (port 502) over standard Ethernet. It removes the RS-485 device address limit and allows multiple simultaneous masters. A 6-byte MBAP header replaces the CRC. TCP handles error detection; the application does not add its own CRC. Modbus TCP does not guarantee real-time delivery — it is not suitable for time-critical motion control but is excellent for supervisory data collection.

PROFINET

PROFINET is the Ethernet-based fieldbus from Profibus International, defined in IEC 61158/61784, and is the dominant protocol in Siemens installations and widely supported by third-party devices. PROFINET IO is the most common variant: a controller (PLC acting as IO controller) exchanges cyclic I/O data with IO devices (drives, remote I/O, instruments) over standard Ethernet.

PROFINET defines three communication classes: NRT (Non-Real-Time, for acyclic data and parameterisation), RT (Real-Time, for cyclic I/O with ~1–10 ms cycle times using standard Ethernet), and IRT (Isochronous Real-Time, for sub-1 ms deterministic motion control requiring hardware scheduling in managed switches).

EtherNet/IP

EtherNet/IP (Ethernet Industrial Protocol) is developed by the ODVA and is the dominant protocol in Allen-Bradley installations and widely supported by Rockwell ecosystem devices. It uses standard TCP/IP and UDP/IP transport, with the Common Industrial Protocol (CIP) application layer. I/O data uses UDP multicast for efficient distribution; explicit messaging (configuration, diagnostics) uses TCP.

OPC UA

OPC Unified Architecture (IEC 62541) is a platform-independent, service-oriented communication standard designed to be the universal language for industrial data exchange — from PLC to cloud. Unlike earlier OPC (which required Windows DCOM), OPC UA runs on Linux, embedded systems, and cloud environments.

OPC UA provides a structured data model: every server exposes a node hierarchy describing its data. Clients navigate this hierarchy, subscribe to data changes, and call methods. Built-in security (certificate-based authentication, encrypted channels, role-based access control) makes OPC UA suitable for connections across network boundaries that older protocols cannot cross safely.

MQTT in industrial applications

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe protocol originally designed for IoT. A central broker receives messages published by field devices (or edge gateways) and distributes them to any subscriber. Its main advantages are low overhead (suitable for bandwidth-constrained connections) and loose coupling (publishers and subscribers do not know about each other).

In industrial IIoT, MQTT is often combined with OPC UA: edge gateways collect data from PLCs via OPC UA and publish it to an MQTT broker for cloud applications. The OPC UA PubSub specification standardises this pattern by defining MQTT as a transport for OPC UA data.

Network architecture: the Purdue model

The Purdue Enterprise Reference Architecture (PERA) provides a layered model for ICS network segmentation: Level 0 (field devices), Level 1 (PLCs and controllers), Level 2 (SCADA/HMI), Level 3 (site operations), DMZ (demilitarised zone), and Level 4/5 (enterprise IT). Each level boundary should have a firewall or data diode; traffic should only flow according to documented communication requirements.

Merging OT (Operational Technology) networks with IT networks — even with the best intentions — is a cybersecurity risk. The 2010 Stuxnet worm and the 2021 Oldsmar water treatment attack both exploited inadequate segmentation between IT-accessible networks and OT control systems. Network segmentation and access controls are the most impactful controls available at the network layer.