Topic
Networking
Industrial communication: Modbus, EtherNet/IP, PROFINET, OPC UA, MQTT and Sparkplug, IO-Link, switches, and getting plant data into databases and the edge.
12 articles
MB_CLIENT in TIA Portal: Modbus TCP setup and STATUS codes
MB_CLIENT makes an S7-1200 or S7-1500 a Modbus TCP client. Give it a TCON_IP_v4 connection with a unique ID, the server's IP address and port 502, set MB_MODE, MB_DATA_ADDR and MB_DATA_LEN, and point MB_DATA_PTR at a buffer. STATUS 7000 to 7006 is progress, 80C8 means the server never answered, and 8381 to 8385 cover the server's exception replies.
11 min readModbus exception codes: what 01 to 0B mean and how to fix each
A Modbus exception is a reply carrying your function code plus 0x80 and a one-byte code saying why the server refused. 01 means the function is not supported, 02 the address range does not exist, 03 a value or quantity is not allowed, 04 the device failed, 05 and 06 mean wait, and 0A and 0B are gateway faults. No reply is a timeout, not an exception.
10 min readUnified namespace: the idea, and what it does not solve
A unified namespace is a single publish and subscribe layer, usually an MQTT broker, holding the current state of everything in the plant under an agreed hierarchy. Systems publish what they know and subscribe to what they need, instead of being wired to each other. It removes the point to point integration mesh; it does not remove the need for protocol drivers, data modelling, or somebody owning the naming.
8 min readMQTT Sparkplug or OPC UA: pick by where the data is going
OPC UA is a client server session with a rich browsable information model, and it suits reading structured data from a machine on a local network. MQTT with Sparkplug B is publish and subscribe through a broker, and it suits distributing values to many consumers across a site or over a poor link. Most real architectures use both: OPC UA at the equipment, MQTT for distribution.
8 min readDiagnosing a PROFINET network that mostly works
Start with the device name, not the IP address: PROFINET assigns addresses by name at start-up, so a name mismatch prevents connection entirely. For intermittent faults, look at discard counters on the switch ports and at the update time configured against the device's minimum. Most persistent PROFINET problems are cabling and topology rather than configuration, and a wire test plus a topology review finds them faster than a protocol analyser.
7 min readIO-Link: what it is, and the two reasons to use it
IO-Link is a point to point digital protocol over standard three wire sensor cable, between a master and a device. It replaces an analogue or switched signal with a data exchange, which brings two things ordinary sensors cannot: parameters stored on the master so a replacement device is configured automatically, and diagnostics from the sensor itself. It is not a fieldbus and devices are not networked to each other.
7 min readChoosing a switch for an industrial network
For PROFINET, yes in practice. A managed switch gives per port diagnostics, prioritisation of real time traffic, IGMP snooping to contain multicast, and participation in LLDP so the topology is visible. Unmanaged switches pass frames and report nothing, which turns every intermittent fault into a process of elimination by unplugging things.
7 min readGetting PLC data into a database without wrecking the controller
Do not have the controller talk to the database. Put a gateway between them: the PLC writes to a buffer or publishes changes, the gateway writes to the database, and the two are decoupled. A controller with an open database connection blocks its own scan when the database is slow, and loses data when the network drops, which is exactly when the data matters most.
7 min readEdge computing in automation, minus the marketing
Edge computing means running software on hardware near the machine rather than in a data centre: protocol conversion, buffering, aggregation, local analytics and sometimes inference. It belongs where latency, bandwidth or availability rule out a central system. It does not belong where a PLC already does the job, and every edge device is another computer somebody has to patch.
7 min readModbus, still everywhere after forty years
Modbus is a request-response protocol where a client asks a server for register values and the server replies. It defines four data areas: coils and discrete inputs for bits, holding and input registers for 16-bit words. It survives because it is trivial to implement, and it catches people out on register numbering, which is offset by one between documentation and the wire.
7 min readEtherNet/IP and PROFINET: same cable, different worlds
Both are industrial Ethernet protocols and they are not interoperable. EtherNet/IP is the Rockwell-aligned standard, encapsulating CIP over standard TCP and UDP so it runs on ordinary switches. PROFINET is the Siemens-aligned standard, with real-time classes that bypass the normal stack for deterministic traffic. The choice is almost always dictated by the controller.
7 min readOPC UA: what it is for, and what it is not for
OPC UA moves data between control systems and the software above them: historians, MES, ERP and analytics. It carries a self-describing information model, so a client can discover what a server offers rather than being told in advance. It is not a fieldbus and is generally too heavy for cyclic I/O, which remains the job of EtherNet/IP or PROFINET.
7 min read