Communications and protocols used in industrial automation

This guide is a map of the links and protocols you find around a PLC: what each one does, how far and how fast it goes, which one to choose, and which interfaces the Industrial Shields M-Duino, Ardbox, ESP32 PLC and Raspberry PLC families have.

What are the main communication protocols in industrial automation?

The question mixes two things that are often confused. RS-485 or Ethernet do not define the content of a message: they only move bytes from one device to another. Modbus, MQTT or OPC UA define the content: addresses, registers, topics, data types and who talks when. You choose them separately, and one protocol can run over several links. Modbus RTU, for example, runs over RS-485 or RS-232, and MQTT runs over Ethernet, Wi-Fi or a 4G modem.

Industrial communication protocols compared

For a detailed comparison of the three most common choices, read Modbus RTU vs Modbus TCP vs OPC UA. To choose the control network of a new line, read EtherNet/IP vs PROFINET vs Modbus TCP.

Ethernet and Wi-Fi in industrial PLCs

Ethernet (IEEE 802.3) is the wired base of most plant networks. It carries Modbus TCP, MQTT, OPC UA, HTTP and the industrial Ethernet protocols on the same cable, through switches, with speeds from 10 Mbit/s to 1 Gbit/s and more. The M-Duino PLCs use the W5500 Ethernet controller: a 10/100 Mbit/s chip with the TCP/IP stack in hardware, 8 sockets and a 32 KB buffer for packets, connected to the microcontroller by SPI. Your program opens sockets, and the chip handles TCP and IP.

Wi-Fi (IEEE 802.11) gives the same IP network without a cable, through access points. It is useful for machines that move, for retrofits where a new cable is expensive and for data that is not time critical. The ESP32 PLC and the Raspberry PLC have Wi-Fi on board. The ESP32 radio works only on the 2.4 GHz band. Keep the control loop on wired links when a lost packet stops the machine.

More: What is industrial Ethernet? and Ethernet connection with an ESP32 PLC or an M-Duino PLC.

RS-485 and RS-232 serial links

RS-485 (TIA/EIA-485) sends each bit as the voltage difference between two wires, A and B. Noise affects both wires in the same way, so the bus works in noisy cabinets and over long cables: about 1200 m at 100 kbit/s or less, with up to 32 unit loads on one segment. Many devices share the same twisted pair (a multidrop bus), which is why Modbus RTU and most field devices use it.

RS-232 (TIA-232-F) is a point to point link between two devices, for example a PLC and one instrument, a barcode reader or a modem. It uses single-ended signals referred to ground, so it is limited to short cables, about 15 m.

RS-232 crosses the data lines: the TX of one device goes to the RX of the other. With DB9 connectors, a straight cable joins a computer (DTE) to a modem (DCE), and a crossover or null-modem cable joins two DTE devices, for example two computers.

TTL serial (UART) is the plain serial port of a microcontroller: bits sent one after another at a fixed baud rate, with start and stop bits instead of a clock, at 0 V and 5 V or 3.3 V. It only covers short links on the same board or between boards next to each other. A transceiver converts it to RS-485 or RS-232 before it leaves the PLC.

RS-485 in M-Duino and Ardbox PLCs

The M-Duino and Ardbox PLCs use a MAX481CSA transceiver for RS-485 communication. It converts TTL level to RS-485 level.

On the M-Duino, a switch selects half duplex (one pair, A+ and B-) or full duplex (two pairs, with Y+ and Z-):

Wiring, distance and code: Basics of RS-485 in an industrial PLC and RS-485 with Arduino and ESP32 based PLCs.

I2C, SPI and CAN bus at board and machine level

I2C (Inter-Integrated Circuit) is a synchronous serial bus with two lines: SDA for data and SCL for the clock, both with pull-up resistors. A master addresses each slave by a 7-bit address. It connects chips, displays and sensors over short distances, inside a board or a cabinet, not across a plant.

SPI (Serial Peripheral Interface) is faster than I2C and uses separate lines for data in, data out, clock and chip select. In a PLC it connects internal peripherals such as the Ethernet controller, and external modules.

CAN bus (ISO 11898) is a differential bus with message priority and error handling in hardware. It comes from vehicles and is used in mobile machines and motion control, often with the CANopen protocol on top.

Guides: I2C bus on an Arduino based PLC, CAN over SPI on the ESP32 PLC 14 and CAN bus with a Raspberry PLC.

Cellular and LoRa links for remote sites

When a site has no network cable, the PLC can use a mobile network or a long range radio.

• Cellular (2G GPRS, 4G LTE, LTE-M, NB-IoT). The PLC gets an IP connection through a modem and a SIM card, so it can send MQTT or HTTP from anywhere with coverage. GPRS (2G) gives tens of kbit/s and was the first option for remote PLCs, with SMS for alarms. Many operators have switched off or plan to switch off their 2G and 3G networks, so check coverage before you choose GPRS for a new project. The ESP32 PLC accepts a 4G option board.
• LoRa and LoRaWAN. Low data rate radio with a range of kilometres and very low power. It fits battery sensors and small amounts of data, not control loops. The ESP32 PLC accepts a LoRa option board.

More: What is LoRaWAN?, LoRaWAN with a PLC controller and the railway carriage monitoring case study with an ESP32 PLC on 4G LTE-M.

Modbus RTU and Modbus TCP

Modbus is an open application protocol, created by Modicon in 1979. A master (client) reads and writes four types of data in a slave (server): coils, discrete inputs, input registers and holding registers. It is simple, it has no data types or tag names, and almost every meter, drive and PLC supports it.

Modbus TCP is not a Modbus RTU frame inside a TCP packet: it drops the slave address and the CRC and adds the MBAP header. A gateway converts between the two. The unit identifier of the MBAP header tells the gateway which RTU slave to address.

Implementation guides: Modbus RTU frame, function codes and CRC, Modbus RTU with Arduino and ESP32 based PLCs and Modbus TCP master with Arduino and ESP32 based PLCs.

MQTT, OPC UA and HTTP for SCADA and the cloud

MQTT (ISO/IEC 20922) is a light publish and subscribe protocol. The PLC publishes values on topics to a broker, and any client that subscribes to a topic receives them. The PLC does not need to know who reads the data, and the messages are small, so MQTT works well on 4G and slow links. It uses TCP port 1883, or 8883 with TLS.

OPC UA (IEC 62541) describes the data, not only the values: each variable has a name, a type, units and a place in an information model. It has security built in (certificates, signing and encryption) and is the usual choice to connect controllers with SCADA and MES. It uses TCP port 4840.

HTTP sends requests and responses over TCP port 80. HTTPS is HTTP inside an encrypted TLS connection, on port 443. On a PLC it serves a local web page or calls the REST API of a cloud service. Use HTTPS when the data leaves the plant network.

MQTT, OPC UA and HTTP all run over TCP/IP, so they work on Ethernet, Wi-Fi and cellular links. More: MQTT security fundamentals, MQTT over TLS on an ESP32 PLC and OPC UA server on a Raspberry PLC with Node-RED.

PROFINET and EtherNet/IP, the industrial Ethernet of large PLC vendors

PROFINET (Siemens ecosystem) and EtherNet/IP (Rockwell ecosystem) exchange cyclic I/O data between a controller and its devices over Ethernet, with defined update times. They are the control network of many lines, and the device must be certified for the protocol. When the plant specification names one of them as the control network, the PLC on that network should support it natively. For data exchange next to that network, Modbus TCP, MQTT or OPC UA are usually enough.

More: PROFINET with a Raspberry PLC on Linux.

Communication interfaces of each Industrial Shields PLC family

Data from the product sheets. Each family has several models: check the product page of the exact model.

On all of them, the protocols (Modbus RTU, Modbus TCP, MQTT, HTTP) are software: Arduino libraries on M-Duino, Ardbox and ESP32 PLC, and Python, Node-RED or CODESYS on the Raspberry PLC. To compare controller types, read Choosing an industrial controller.

How to choose the link and the protocol for a PLC network

1. Field devices with a serial port (meters, drives, temperature controllers): Modbus RTU over RS-485, one line with 120 Ω at both ends.
2. Controllers, HMIs and SCADA in the same plant: Modbus TCP over Ethernet, or the industrial Ethernet that the plant standard requires.
3. Data to dashboards, databases or the cloud: MQTT, or OPC UA when the client needs typed, described data.
4. Sites without cable: 4G or LTE-M with MQTT for regular data, LoRaWAN for low power sensors.
5. Short links inside the cabinet: I2C or SPI for modules next to the PLC.

FAQ about industrial communication protocols

Is RS-485 a protocol?

No. RS-485 is a physical layer: it defines voltages and wiring. Modbus RTU, BACnet MS/TP and many other protocols run on top of it.

What is the most used protocol in industrial automation?

Modbus (RTU and TCP) is the most widely supported, because it is open and simple. In large lines the control network is often PROFINET or EtherNet/IP, and data to IT systems goes more and more over OPC UA and MQTT.

What is the difference between Modbus TCP and MQTT?

Modbus TCP is request and response: a client asks a server for registers. MQTT is publish and subscribe: the PLC sends values to a broker and the clients receive them. Modbus TCP fits PLC to PLC and SCADA polling. MQTT fits telemetry to many clients and to the cloud.

Is MQTT or OPC UA better for a PLC?

MQTT is lighter and simpler for sending values over slow or mobile links. OPC UA describes the data and has security and an information model, which SCADA and MES systems use. Many systems use both: OPC UA inside the plant and MQTT to the cloud.

Can one PLC use several protocols at the same time?

Yes. A common setup is a PLC that is Modbus RTU master on RS-485 for the field devices, Modbus TCP server on Ethernet for the HMI, and MQTT client to a broker for remote data.

Which protocol works over 4G?

Any protocol over TCP/IP: MQTT, HTTPS, Modbus TCP or OPC UA. MQTT is the usual choice because the messages are small and the PLC opens the connection, so it works behind the private IP addresses of mobile networks.

More about PLC communications

• Modbus RTU vs Modbus TCP vs OPC UA: which to use
• What is industrial Ethernet?
• Basics of RS-485 in an industrial PLC
• How to send data through Ethernet HTTP with an Arduino based PLC

Planning a PLC network with several protocols? Ask an engineer with your device list and distances.