Configuring PLC TCP/IP Communication on Industrial Ethernet LANs

1. Overview: Industrial Ethernet Protocols for PLC LAN Communication

Programmable Logic Controllers exchange I/O, peer data, and diagnostics over Local Area Networks using TCP/IP as the transport layer, with vendor-defined application protocols riding on top of User Datagram Protocol (UDP) and Transmission Control Protocol (TCP). Three protocol families dominate the installed base across Siemens, Allen-Bradley, and Schneider Electric platforms: PROFINET (PROFIBUS Nutzerorganisation, PI), EtherNet/IP (ODVA), and Modbus TCP (Modbus Organization). All three share the same physical layer (IEEE 802.3 100BASE-TX / 1000BASE-T over UTP/STP copper, or 100BASE-FX/1000BASE-LX fiber), but they diverge sharply in how they map data, schedule deterministic traffic, and expose diagnostics.

References: PROFINET specification and white papers, ODVA EtherNet/IP Technology, Modbus Messaging on TCP/IP Implementation Guide v1.0b, and the IEEE 802.3 Ethernet working group documentation.

2. Physical Layer, Cabling, and Topology

Industrial Ethernet over copper and fiber follows IEEE 802.3. Choose cabling based on segment length, EMI environment, and required bandwidth. PROFINET installation guide "PROFINET Cabling and Interconnection Technology" (PNO Order No. 8.072) and the ODVA EtherNet/IP Media Planning Guide both specify Cat 5e or better for new installations.

3. IP Address Planning and Subnet Design

Every PLC and field device on the LAN needs a unique IPv4 address and matching subnet mask. Industrial networks commonly use an RFC 1918 private range such as 10.0.0.0/8 or 192.168.1.0/24. Avoid DHCP on the control network; static addressing makes diagnosis predictable and removes a single point of failure during controller warm restarts.

Reserve a documented address range for PLCs (e.g., 10.10.10.10–10.10.10.99), HMI/SCADA (10.10.10.100–10.10.10.149), drives (10.10.10.150–10.10.10.199), and distributed I/O blocks (10.10.10.200–10.10.10.250). Reserve .1 as the gateway and .254 as engineering access.

4. PROFINET (Siemens) Configuration

PROFINET is engineered by PI and supported by Siemens, Phoenix Contact, Beckhoff, and most European PLC vendors. It runs on standard TCP/IP plus the RT (Real-Time) and IRT (Isochronous Real-Time) channels that bypass the OS for deterministic traffic. PROFINET classes (CC-A, CC-B, CC-C) define switch and topology behavior.

4.1 Device Roles

• IO Controller: the PLC (S7-1200, S7-1500, ET200S CPU, SINUMERIK) that runs the application program and configures the IO.
• IO Device: distributed field device (ET200SP, ET200MP, SINAMICS drive, Festo valve island).
• IO Supervisor: engineering or HMI tool (TIA Portal, PRONETA, SIMATIC Automation Tool).

4.2 TIA Portal Configuration Steps (S7-1500 ↔ ET200SP)

1. In Devices & Networks, add the S7-1500 CPU (e.g., 6ES7515-2AM02-0AB0, FW V2.9) and the ET200SP IM155-6 PN ST (6ES7155-6AU02-0BN0).
2. Connect their PROFINET ports with a drag from one port's green dot to the other; the topology editor will accept the connection.
3. On the ET200SP, set IP 10.10.10.20, subnet 255.255.255.0, and PROFINET device name et200sp-line1.
4. Drag slot modules from the catalog (DI 16×24VDC, DQ 16×24VDC/0.5A, AI 4×U/I/RTD) into the device view.
5. Compile HW Config and download to the CPU. The CPU assigns the IP via DCP during startup; the IM's "BF" LED should be off within a few seconds.

4.3 Port LEDs and Their Meaning (ET200SP IM155-6 PN)

Reference: Siemens SiePortal: PROFINET Configuration with TIA Portal and the Siemens Industry Online Support portal for S7-1500 manuals (entry ID 86140384) and ET200SP system manual (entry ID 58649293).

5. EtherNet/IP (Rockwell/ODVA) Configuration

EtherNet/IP is the ODVA-maintained CIP-on-Ethernet protocol. It is dominant in North American plants and supported by Allen-Bradley ControlLogix, CompactLogix, MicroLogix (with 1761-NET-ENI or 1761-NET-ENIW), and a large installed base of third-party I/O.

5.1 CIP Connection Types

• CIP Class 3 (Explicit Messaging): request/response used for configuration, MSG instructions in ladder or structured text.
• CIP Class 1 (I/O Messaging): scheduled cyclic I/O produced/consumed tags or rack-optimized connections.
• CIP Class 0 / UDP Implicit: broadcast for I/O discovery (used by AOI I/O assemblies).

5.2 Studio 5000 / Logix Designer Connection Setup

1. Add an Ethernet Module under the backplane: 1756-EN4TR (ControlLogix, 5069-AENTR (CompactLogix 5380), or 1734-AENTR (POINT I/O).
2. Open Module Properties, set IP address 10.10.10.30, subnet 255.255.255.0, gateway 10.10.10.1.
3. On another controller's Ethernet module, create a Produced Tag of datatype DINT[100] with scope Controller, set the connection RPI to 10 ms.
4. On the consumer controller, add a Consumed Tag, browse to 2_1756_15:Lincoln/ProducedTag, and accept the proposed RPI.
5. Verify the Connection tab status reads Running; otherwise the value of ProducedTag.ConnectionFaulted will be 1.

5.3 Connection Fault Codes (1756-EN4TR / 5069-AENTR)

Reference: ODVA EtherNet/IP Specification (PUB00048) and the Rockwell Automation EtherNet/IP Documentation Center.

6. Modbus TCP Configuration

Modbus TCP is the lightest of the three protocols: an MBAP header (7 bytes) wraps the familiar Modbus PDU. It is widely deployed on Schneider Modicon M340/M580, Modicon Momentum, AutomationDirect BRX/CLICK, and embedded SCADA I/O. The Modbus Organization publishes the protocol openly.

6.1 MBAP Header Layout

6.2 Common Function Codes

6.3 Exception Codes

6.4 Modbus TCP Code Skeleton (Structured Text)

// Poll Holding Registers 40001..40010 (UINT16) from Modbus TCP server 10.10.10.50
IF mb_tcp_connect(socket_id := s, server_ip := '10.10.10.50', port := 502) THEN
    mb_tcp_read(s := s, unit_id := 1, fc := 16#03, start_addr := 0, quantity := 10, dst := HR_buf);
ELSE
    mb_error_cnt := mb_error_cnt + 1;
END_IF;

Reference: Modbus Messaging on TCP/IP Implementation Guide v1.0b and the Modbus Application Protocol Specification V1.1b3.

7. Siemens S7 PUT/GET Communication (S7-1200/1500 ↔ S7-1500)

The PUT/GET instructions (part of the S7 communication package) allow two S7 CPUs to exchange a data block over ISO-on-TCP (port 102) or TCP. Enable the partner on each side first.

1. Open Properties → Communication on the S7-1500 CPU and tick "Permit access with PUT/GET from remote partner (PLC, HMI, OPC, ...)". This setting is disabled by default in firmware V2.6 and later for security reasons.
2. Insert a TSEND_C/TRCV_C pair or use PUT/GET from the Instructions → Communication → S7 Communication palette.
3. Define the connection in Connections → S7 Connection, set partner IP to 10.10.10.40, leave TSAP as 10.01 (rack 0, slot 1).
4. Download both CPUs; verify the connection status word STATUS is 0x0000 (idle) before triggering the read.

// SCL on the client CPU, triggered by a 200 ms cyclic OB
IF "send_clock".Q THEN
    "put_id".REQ := TRUE;
    "put_id".ID  := W#16#0001;
    "put_id".ADDR := P#DB100.DBX0.0 BYTE 200;   // local source 200 bytes
    // partner: DB200, starting at byte 0
    "put_id".RD_1 := P#DB200.DBX0.0 BYTE 200;
END_IF;

Reference: Siemens SiePortal: S7-1200/1500 Communication — Program Examples.

8. Allen-Bradley Produced/Consumed Tags

Logix Designer produced/consumed tags are the simplest cross-controller data exchange over EtherNet/IP; no MSG instruction needed, the engine handles the cyclic UDP connection at the requested RPI.

1. Create a User-Defined tag, e.g., Line1_Recipe[0..49], datatype SINT, scope Controller.
2. Open the tag, set Produce checkbox. Set the connection RPI to 10 ms (minimum for 5069-AENTR over copper).
3. On the consumer controller, add the same tag name and set Consume. Browse to the producer's path: 2_1756_85:Process/Line1_Recipe.
4. Download both controllers; the consumer tag populates within one RPI after connection is up. If the connection does not establish, the I.ConnectionFaulted bit goes true and the controller logs event 941.

9. Network Switches and Topology for Industrial Use

Managed industrial Ethernet switches provide port-level diagnostics, IGMP snooping, and VLAN segmentation; unmanaged switches work for simple star topologies. PROFINET Conformance Classes (CC-A, CC-B, CC-C) define minimum switch behavior for PROFINET networks.

Recommended managed switches: Siemens SCALANCE XC-200 / XC-300 / XR-500, Phoenix Contact FL SWITCH 2300 / 3300, Cisco IE-3300 / IE-3400, Hirschmann RSP / RSPE, Stratix 5700/5400 (Rockwell). Avoid consumer-grade switches in cabinets near drives; they lose packets during broadcast storms and lack the cut-through forwarding that CC-C requires.

9.1 Media Redundancy Protocols

10. Diagnostics, Status Words, and Error Codes

10.1 PROFINET Diagnostics Sources

• Port LED behavior: green steady = link, flashing green = activity, off = no link, red = port error or chassis fault.
• Web server of ET200SP: shows device name, IP, slot diagnostics, channel diagnostics, maintenance events, and PROFIenergy profile.
• TIA Portal → Online → Diagnostics: lists the IO Device status as OK, Maintenance required, Maintenance demanded, or Fault, with a hyperlinked diagnostic buffer entry.
• PRONETA: free-of-charge tool for network analysis, topology discovery, and signal-quality assessment on PROFINET nodes.

10.2 EtherNet/IP Diagnostics

• RSWho / RSLinx Classic / FactoryTalk Linx: browse the network; a yellow triangle = no connection, red X = connection fault.
• Module-fault AOI: exposes codes in ModuleFault (see Table 6) and counters in ModuleCIPErrors / ModuleMissedPackets.
• Embedded EDS / AOP files: publish per-channel fault data via the standard CIP "Alarm" object.

10.3 Modbus TCP Diagnostics

• Watch the MBAP exception codes from Table 9 in the response frame.
• Use Wireshark on TCP port 502 to confirm PDU size and timing; filter by tcp.port == 502 && modbus.
• Industrial Ethernet switches with port mirroring (e.g., SCALANCE SP mirroring) allow in-line capture without breaking the line.

11. Performance, Cycle Times, and Update Rates

11.1 Application Cycle Calculation

For an OB1 with a network latency of 5 ms and 32 bytes of process data, the total round-trip is:

T_total = T_cycle + T_profinet_RT + T_switch_latency
T_total = 1 ms   + 1 ms           + 0.1 ms
T_total = 2.1 ms

For tight motion loops (less than 1 ms), switch to PROFINET IRT with cut-through switches (Siemens SCALANCE XC-200 with IRT "high-performance" mode) and configure the send clock to 250 µs.

12. Security and Field Tips

• Disable unused ports on managed switches and use 802.1X where supported by the controller.
• VLAN-separate control (VLAN 10), SCADA/HMI (VLAN 20), and plant IT (VLAN 30). Trunk the uplink with dot1Q tags.
• Cell Protection with ACLs: only allow Modbus 502 between known peers; deny everything else by default.
• Disable router advertisements and unused services (SMTP, FTP, web, Telnet) on the PLC unless needed for diagnostics.
• Maintain firmware: keep PROFINET device firmware and CPU firmware matched to the GSD version to avoid slot-mismatch faults after device replacement.
• Lock the PROFINET name: in TIA Portal set the port assignment to "permanent" so a replaced spare device does not automatically get the old IP/role.

12.1 IEC 62443 Zones and Conduits

Segment the plant into zones (e.g., "Boiler Control", "Packaging Line") with defined conduits (single routing point) at every zone boundary. The PLC LAN belongs to a Security Level 1 (SL1) zone; the corporate intranet is SL2; the public internet is SL3. Apply the SL-T (target security level) from IEC 62443-3-3 to each conduit, not to the devices.

13. Practical Selection Guide

14. Troubleshooting Matrix

15. Reference Documentation

• Siemens SiePortal: PROFINET Configuration with TIA Portal
• Siemens Industry Online Support
• PROFINET specification and installation guide
• ODVA EtherNet/IP Technology
• Rockwell Automation Industrial Communications
• Modbus Organization specifications
• IEC 61918, IEC 62443 standards