Industrial communications

Level: Advanced 6 min read 31 questions

A modern machine is a network: the PLC talks to the HMI, to I/O modules spread around the machine, to the drives, to a robot and to the factory’s production system. When any of that fails, the machine stops just as if a sensor cable had broken, and the technician has to be able to diagnose it. This topic explains the most common networks, how they are addressed and how to find the typical faults.

Who talks to whom

A typical machine network. All the devices are on the same subnet (192.168.0.x) so they can communicate directly.

Industry talks about a pyramid of levels: at the bottom, sensors and actuators; above them, the PLCs; then supervision (HMIs and SCADA); and at the top, manufacturing execution systems (MES) and business systems (ERP). Each level uses different networks, and the lower you go, the more real time matters.

IP addresses: what you must master

Almost all current industrial networks run over Ethernet and use IPv4 addresses: four numbers from 0 to 255 separated by dots, such as 192.168.0.1. Alongside the address goes the subnet mask, which shows which part of the address is the network and which part is the device.

With the usual mask 255.255.255.0 (also written /24), the first three numbers are the network and the last one identifies the device. Two devices communicate directly if they share the first three: 192.168.0.1 and 192.168.0.2 do; 192.168.0.1 and 192.168.1.2 do not.
On that network, the address ending in .0 identifies the network itself and the one ending in .255 is the broadcast address: they are not assigned to devices.
Every address must be unique on the network. Two devices with the same IP cause intermittent and very confusing communication faults.
The gateway is the device that lets you reach other networks. On an isolated machine network it is often not needed.

On siteTo connect your laptop to a PLC with IP 192.168.0.1, your network card must be on the same subnet, for example 192.168.0.50 with mask 255.255.255.0, without repeating the address of any device on the machine.

PROFINET

PROFINET is the industrial Ethernet network most used with Siemens PLCs. Its key concepts:

IO controller: normally the PLC. It exchanges data cyclically with the devices.
IO devices: remote I/O, drives, valve terminals, robots.
Device name: in PROFINET, each device is identified by its name, for example et200-station2. The controller looks for that name on the network and assigns it its IP address. A new or replacement device arrives without a name and must be given one.
GSDML file: describes a device from another manufacturer so it can be added to the PLC project.
Topology: line, star with switches, or ring. With a redundancy protocol such as MRP, a ring keeps working even if a cable is cut.

Typical mistakeReplacing a faulty remote I/O station with a new one and not assigning it the device name. The PLC cannot find it and reports a communication error even though the cable is perfect. In TIA Portal it is assigned from the online functions (“Assign device name”), or the PLC does it by itself if device replacement without exchangeable medium is enabled and the topology is configured.

Modbus: the universal language

Modbus is a simple and very widespread protocol for connecting equipment from different manufacturers: power meters, drives, temperature controllers. It comes in two variants:

Modbus RTU, over a serial line, normally RS-485: a master asks and each slave, with its address (from 1 to 247), answers. All the devices on the bus must have the same baud rate, parity and stop bits.
Modbus TCP, over Ethernet: a client asks and a server answers, using IP addresses.

The data is organised in four tables:

Table	Contents	Usual numbering
Coils	Read/write bits	0xxxx
Discrete inputs	Read-only bits	1xxxx
Input registers	Read-only 16-bit words	3xxxx
Holding registers	Read/write 16-bit words	4xxxx

Typical mistakeThe off-by-one register offset. Many manuals call the first holding register 40001, but in the Modbus message its address is 0. If you read “40010” and get the value next to it, try one register lower. Another classic: 32-bit values take up two registers, and each manufacturer may order the two words the other way round.

On RS-485, the bus is wired in a line (not a star), with 120 Ω termination resistors at both ends, and with twisted, shielded cable. Without termination, or with long stubs, errors appear that depend on length and speed.

OPC UA: going upwards

OPC UA is a vendor-independent standard for connecting machines to supervision systems, MES or office applications. As well as the data, it describes what it means (names, units, structure) and includes security with certificates and encryption. It is the usual way of taking production data, such as OEE, from the PLCs to the company’s systems.

Cybersecurity on machines

A badly protected machine network is a real risk: a virus from the office or uncontrolled remote access can stop a line. The basics:

Separate networks: the machine network is not mixed with the office network; if they must be connected, it is through a firewall.
Never expose a PLC directly to the internet.
Controlled remote access: over a VPN, with the customer’s permission, only when needed and logged.
Protect the CPU: password-protected access levels so nobody can download or modify the program without authorisation.
Standards: the IEC 62443 series is the reference for cybersecurity in industrial automation systems.

Diagnosing a communication fault

Look at the LEDs on the port and the module: link, activity and error.
Check the cable and the connector, especially in areas with movement or knocks.
Ping the device’s IP from the laptop, with your network card on the same subnet.
On PROFINET, check that the device has the right name and that there are no duplicate names or IPs. TIA Portal shows the accessible devices and their online diagnostics.
On Modbus RTU, check the slave address, baud rate, parity, terminations and the order of wires A and B.

Summary

With mask 255.255.255.0, two devices communicate directly if they share the first three numbers of the IP. Every IP must be unique.
PROFINET identifies devices by their name; a replacement device needs its name.
Modbus: master and slave (or client and server on TCP), four data tables and watch out for the off-by-one offset.
RS-485: line bus with 120 Ω termination at both ends.
OPC UA takes machine data to the company’s systems, securely.
Machine networks separate from the office, no PLCs on the internet and controlled remote access.

Test what you have learned

31 practical questions with explained answers. Free, no sign-up.

Start the test

← All topics Next: Commissioning with the programmer →