Connecting PLCs, Drives and HMIs

Before you connect anything

The ideas of the earlier pages (matching settings, unique addresses, the right register map) are the same on every brand; what changes is where you type them. This page gives a recipe for the common controllers. Menu names, instruction names and file types are typical for current software versions and change between releases: treat the steps as a map, and check the manual for your exact model and firmware.

• Collect the facts first: the device’s address (station number, or IP address, mask and port), the serial settings, the protocol, and the register or tag map from the manual.
• Prove the device with a PC before blaming the PLC: see Sniffers, Analyzers and Serial Tools.
• Save a backup of the PLC project before you add a communication module or change the hardware configuration.
• Change one thing at a time and note the result.
• Know which end is the master (client or scanner). Usually the PLC polls; the other device answers.

Allen-Bradley: Logix and Micro800

EtherNet/IP to a drive or I/O block (ControlLogix, CompactLogix)

• 1. Set the device’s IP address. Use the device’s display or switches, a BOOTP/DHCP tool, or Studio 5000’s “Who Active”/RSLinx; put it on the controller’s subnet. Turn BOOTP off afterwards so the address stays.
• 2. Check the PC and the PLC can reach each other: ping both.
• 3. Add the device to the I/O tree. Right-click the Ethernet network, choose New Module. If the vendor supplies an Add-On Profile or an EDS file (installed with the EDS Hardware Installation Tool), choose the device by name. Otherwise choose a Generic Ethernet Module.
• 4. Fill in the connection. Name, IP address, communication format (Data – INT or SINT), the assembly instance numbers and sizes for input, output and configuration (from the manual), and the RPI (10 ms is typical; slower for slow devices).
• 5. Download and go online. The module shows a green running icon; a yellow triangle means a connection fault, and the module properties page gives the reason.
• 6. Use the tags. The device’s data appears as controller tags such as Drive1:I.Data[0] and Drive1:O.Data[0]; map them to descriptive program tags.
• 7. Handle failure. Use the module’s connection-fault bit in the program, and decide what the machine should do when the device is lost.

Modbus on Allen-Bradley

• Micro800 (Connected Components Workbench). Configure the embedded serial port as Modbus RTU, set baud rate, parity, stop bits and the role (master or slave), then use the MSG_MODBUS function block with the slave address, function code (1 to 6, 15, 16), starting address and a data array. Modbus TCP uses MSG_MODBUS2 and an IP address and port.
• ControlLogix, CompactLogix. No built-in Modbus TCP client. Options: a Modbus gateway on EtherNet/IP; an add-on instruction (Rockwell publishes Modbus examples and an AOI library); a communication module (for example ProSoft MVI); or EtherNet/IP directly if the device supports it. Serial Modbus needs a 1756-EN2/serial module, a gateway or an ASCII port with add-on code.
• MicroLogix, SLC 500 (legacy). DF1 serial and Ethernet (MSG instructions). Modbus is possible on some models with an add-on module.
• Common settings: in Logix, address Modbus registers as the manual says (base 0 or 1: test with a known value).

DF1 serial (legacy)

DF1 is Allen-Bradley’s older serial protocol: full-duplex point to point or half-duplex master/slave. Set the controller’s serial port driver to DF1, match the baud rate and parity (often 19 200, no parity, with CRC error checking), and in RSLinx configure an RS-232 DF1 driver on the PC’s COM port with the same settings. A null modem cable may be needed. If RSLinx cannot see the controller, try “Auto-configure” on the driver.

Siemens: S7-1200 and S7-1500

PROFINET devices in TIA Portal

• 1. Install the GSD file of the device (Options, Manage general station description files) if it is not in the catalog.
• 2. Add the device in the Network view: drag it from the hardware catalog and drag a line from its PROFINET port to the PLC’s port, forming an IO system.
• 3. Set the IP address and the device name in the device’s properties. The name must be a valid, unique PROFINET name; the IP is assigned by the controller at start-up.
• 4. Assign the name to the real device. Go online, choose Accessible devices, then Online and diagnostics, Assign PROFINET device name for the device (or use the free PRONETA tool). The device’s name must match the project exactly.
• 5. Choose the modules and the data (the device’s module list) and the update time.
• 6. Compile, download and check the diagnostics icons in the Device view: green means connected; red or a wrench shows the reason in the diagnostics buffer.

Modbus TCP and RTU

• Modbus TCP client: use the MB_CLIENT instruction. Its connection data (device IP address, port 502, connection ID) goes in a TCON_IP_v4 structure. MB_MODE 0 reads and 1 writes; MB_DATA_ADDR is the Modbus address (the instruction takes the 40001-style number, check the help); MB_DATA_LEN is the quantity; MB_DATA_PTR points to a data block array. Pulse REQ; watch DONE, BUSY, ERROR and STATUS. Use one MB_CLIENT per connection and queue requests.
• Modbus TCP server: MB_SERVER lets other devices (an HMI, SCADA) read and write the PLC’s data blocks.
• Modbus RTU master: needs a serial module (CM 1241 RS-485 or RS-232, or a CB 1241 signal board). Configure the port (baud rate, parity, stop bits) in the device properties and use Modbus_Comm_Load once and Modbus_Master for each request, with the slave address and the data pointer. Modbus_Slave makes the PLC a slave.
• Open user communication (TCON, TSEND, TRCV) carries raw TCP or UDP data for custom protocols and barcode readers.
• S7 communication and PUT/GET: to let another S7 PLC, an HMI or an external driver read and write your CPU, enable “Permit access with PUT/GET communication from remote partner” in the CPU’s protection and security settings, and set the data block to non-optimized access if you address it by offset.
• OPC UA (S7-1500 and newer S7-1200): enable the OPC UA server in the CPU’s properties, choose the endpoints and security, and select which tags to publish (a server interface). Trust the client certificate.

Mitsubishi: iQ-F and iQ-R

• Ethernet. In GX Works3 set the module’s IP address, mask and gateway in Module Parameters, then write to the PLC and power-cycle if requested. The built-in Ethernet port of the iQ-F carries SLMP, the MC protocol, Modbus TCP and CC-Link IE Field Basic; enable the ones you use in the parameters and set the port numbers.
• MC protocol / SLMP: HMIs and PCs read device ranges (D registers, M relays) using the device name and number. Choose the frame (3E for current systems), binary or ASCII, and the port; the PLC then answers requests with no program.
• Modbus RTU (iQ-F). Add a communication adapter (FX5-485ADP) or use the built-in RS-485 terminals, set the protocol to Modbus RTU in the serial parameters (baud rate, parity, stop bits, station number), and use the ADPRW instruction (or the Modbus master configuration in GX Works3) to read and write the slave’s registers.
• Computer link and non-protocol (serial). A text-based protocol for PCs and instruments; the non-protocol mode sends and receives arbitrary bytes (for example from a barcode reader) with the RS2 instruction.
• Addressing. Inputs X and outputs Y are in octal (X0 to X7, then X10); D registers and M relays in decimal. Timers like T0 K50 depend on the timer base (typically 100 ms, so K50 is 5 s).

Omron: CP, CJ, NX and NJ

• Serial. The CP1 series takes serial option boards (RS-232C or RS-485); the CJ series has built-in ports. In CX-Programmer set the PLC Settings for the port: mode (Host Link, NT Link, Serial Gateway, No-protocol), baud rate, data bits, parity, stop bits and unit number. Host Link (7 data bits, even parity, 2 stop bits at 9 600 is the default on many units) is the command protocol used by HMIs and PCs.
• Modbus RTU master (CP/CJ). Use the MODBUS (CP/CJ) or serial communications function blocks, or the Serial Gateway with a Modbus master, as described in the manual of the port or unit.
• Ethernet. Set the IP address in the Ethernet unit settings (or in Sysmac Studio for NX/NJ). FINS/UDP and FINS/TCP use port 9600 and a node number (often the last octet of the IP address, assigned by an automatic setting). HMIs, SCADA and programming tools use FINS.
• EtherNet/IP (NJ, NX). In Sysmac Studio, add the device from an EDS file in the EtherNet/IP builder, set the RPI (the packet interval) and tag sets; the data appears as variables.
• EtherCAT (NX, NJ). The controller is the master: scan the network from the Sysmac Studio EtherCAT editor, assign node addresses and process data.
• Addressing. Inputs like 0.00 (word.bit), outputs 100.00, work bits in W, data memory D (DM). Timers are written TIM 0000 #0050 (5 s at 0.1 s units).

IDEC, Unitronics and AutomationDirect

Platform	Software	Serial Modbus	Ethernet	Notes
IDEC FC6A	WindLDR	In Configure, Communication: set a COM port to Modbus master or slave (baud, parity, stop bits, unit number); use the MSG/Modbus master instructions or the “user communication” instructions (TXD, RXD) for custom protocols	Modbus TCP client and server on the Ethernet unit; set the IP address in the settings	Addresses I, Q, M, D; data registers are 16 bits
Unitronics Vision and UniStream	VisiLogic, Unilogic	In Hardware Configuration, COM Port: choose Modbus master or slave; add Modbus configuration with the slave ID, function, address, and the operand to hold the data (MI, MB). Serial gateway to an Ethernet port is possible	Modbus TCP (Ethernet card or built-in), EtherNet/IP on UniStream; set the IP with SetIP	The PLC and the HMI are one unit: the screen can read other PLCs directly
AutomationDirect Click	Click Programming Software	Port 2 (RS-485): Modbus RTU master or slave; set in Communication Setup, then use the Modbus Send and Receive instructions with the slave address and registers	Built-in Ethernet on C0-1x models: Modbus TCP client and server; set the IP in the same setup	Free software; the Modbus address ranges map to X, Y, C, DS, DD and others, listed in the manual
AutomationDirect Productivity	Productivity Suite	Modbus RTU master/slave on a serial port	Modbus TCP, EtherNet/IP (adapter); set the IP in the CPU settings	Tag-based; the Modbus map is generated from the tags you choose

These small controllers commonly act as Modbus masters to VFDs and meters. The method is always the same: choose the port role, match the serial settings to the device, write one read per block of registers, and look at the status or error register while testing.

CODESYS-based controllers

CODESYS is the programming environment inside many brands (Wago, Beckhoff TwinCAT 3 in part, Festo, Schneider, Eaton, Turck, and many others). Network configuration is done in the device tree of the project.

• Modbus TCP master. Right-click the Ethernet adapter, Add Device, Modbus TCP Master, then add a Modbus TCP Slave underneath with the slave’s IP address and port 502 (unit ID in its settings). Add channels (read holding registers, write multiple registers, and so on) with an address, a length, a poll cycle and the variable they map to in the I/O Mapping tab.
• Modbus RTU master. Add Modbus Serial Master under the COM port (baud rate, parity, stop bits) and slaves with their station numbers, then channels as above.
• EtherNet/IP, PROFINET, EtherCAT, CANopen. Add the stack as a device (scanner, controller or master) and import the device file (EDS, GSDML, ESI); the I/O Mapping tab links the data to variables.
• OPC UA server. Add the symbol configuration, tick the variables to publish, and enable the OPC UA server in the device settings.
• Tip. The device tree shows a green dot for a working device and a red one for a fault; right-click and choose “Diagnostics” for the details. The result of every channel can be monitored in the program.

Connecting HMIs and SCADA

An HMI or SCADA is normally the client; the PLC is the server. The HMI software has a driver for each brand and protocol, and the connection needs the address of the PLC, the protocol, and a tag list.

PLC	Common HMI driver names	What to set in the PLC
Allen-Bradley Logix	EtherNet/IP (CIP) tags; DF1 for older controllers	Nothing beyond the IP address; tag names are read by name (keep them readable)
Siemens S7-1200/1500	S7 (ISO-on-TCP), PROFINET, OPC UA	PUT/GET access enabled; data blocks non-optimized for address-based drivers; or OPC UA
Mitsubishi	MC protocol (SLMP), Ethernet, computer link	The Ethernet port and protocol enabled in the parameters; the device ranges
Omron	FINS (UDP or TCP), Host Link, EtherNet/IP	Node number and the FINS port; Host Link settings
Modbus devices	Modbus RTU or TCP master	Station address, register map
Any OPC UA server	OPC UA client	The server enabled, endpoint, security and the published tags

• Count the connections. A PLC supports a limited number of simultaneous client connections; many HMIs plus SCADA plus engineering can exhaust them.
• Poll groups. HMIs read blocks of tags at a screen-update rate; many tags on a fast screen load the PLC.
• Use the right byte order and data types when the driver addresses raw memory.
• Time. If the HMI or SCADA logs events, synchronize time with NTP.

Connecting variable frequency drives

Almost every drive has a communication option or an embedded Modbus RTU port, and several take EtherNet/IP, PROFINET or EtherCAT as an add-on module. The control and speed commands are then sent as data instead of wires.

Step	What to do	Why
1. Choose the network	Use the one your PLC supports natively	Fewest gateways and the best tools
2. Set the parameters	Address (or IP), baud rate, parity, protocol, and the control and reference source (the drive must accept commands from the network, not only the keypad or terminals)	A drive left in “terminal control” ignores the network commands
3. Map the registers	Control word (start, stop, reset, direction), speed reference, status word, actual speed; use the manual’s table or the drive profile (for example PROFIdrive or the AC drive profile of CIP)	Every drive differs in register numbers and bits
4. Scale the reference	Often in tenths of Hz or a percent of maximum; for example 450 for 45 Hz in tenths	A mis-scaled reference sets a wrong speed
5. Read the status	Ready, running, fault, at speed, and the fault code	Show the cause on the HMI
6. Define the loss-of-communication action	Stop, ramp down or keep the last speed; set the comms timeout (for example 1 s)	A drive that continues at the last speed when the PLC dies is dangerous
7. Keep the safety wiring separate	Safe torque off (STO) and emergency stop by wiring or a safety network, not by an ordinary command bit	See the PLC guide

The Motors, Drives and PID Control page in the PLC guide explains the control logic around the drive, and Motion Control covers servo drives.

Platform comparison

Platform	Serial Modbus	Modbus TCP	Native Ethernet protocol	Address style
Allen-Bradley Logix	Via module, gateway or add-on	Via gateway or add-on	EtherNet/IP (CIP)	Tags
Allen-Bradley Micro800	MSG_MODBUS	MSG_MODBUS2	EtherNet/IP	Tags
Siemens S7-1200/1500	CM 1241, Modbus_Master / Slave	MB_CLIENT / MB_SERVER	PROFINET, S7	%I0.0, %Q0.0, tags
Mitsubishi iQ-F, iQ-R	ADPRW or Modbus config	Built in	SLMP, MC protocol, CC-Link IE	X0, Y0 (octal), D, M
Omron CP/CJ	Serial Gateway, MODBUS function	Via unit	FINS, EtherNet/IP	0.00, 100.00, D
Omron NX/NJ	Serial option	Library	EtherNet/IP, EtherCAT, FINS	Variables
IDEC FC6A	Master/slave in WindLDR	Built in	Modbus TCP	I, Q, M, D
Unitronics	COM port in Hardware Config	Built in	Modbus TCP, EtherNet/IP	I, O, MB, MI
AutomationDirect Click	Port 2	Built in	Modbus TCP	X001, Y001, C1, DS1
CODESYS	Modbus Serial Master	Modbus TCP Master	EtherNet/IP, PROFINET, EtherCAT stacks	Variables

A connection checklist

Step	Serial	Ethernet
1. Physical	Cable type; pins 2/3/5 or A/B/common; terminators at both ends; bias once	Cable, link LED, switch port, patch cord
2. Settings	Baud, data bits, parity, stop bits and address the same on every device	IP address unique, mask the same, gateway if needed, device names
3. Test with a PC	A terminal or Modbus master and a USB adapter	Ping and a protocol tool
4. Configure the PLC	Port settings and the instruction or master table	IP settings, connection or message instruction, RPI, device files
5. Check the data	Addresses (0 or 1 base), scaling, word order, units	The same, plus data typing
6. Handle faults	Timeouts, retries, a “comm OK” bit and an alarm	Connection status bits and an alarm
7. Document	Record settings, register map, wiring	Record addresses, ports, names, files, firmware

Common mistakes

Mistake	What you see	Fix
Wrong EDS or GSD for the device revision	Keying mismatch or module fault	Install the file for the exact firmware
PROFINET device name mismatch	Device not found, BF/SF LED on	Assign the name again
PUT/GET not enabled on S7	HMI or driver cannot read the PLC	Enable it in the CPU protection settings
Serial settings entered in the wrong port	Silent port	Select the correct port in the hardware configuration
Modbus master reads one register at a time	Slow response, delays	Read blocks
Drive in local control	Commands ignored	Set the control source to the network
RPI too fast for the PLC task	Connection timeouts, PLC overload	Set the RPI to the process need
Two scanners writing to one device	Conflicting outputs	One controller owns the outputs
No handling of lost communication	The machine continues on stale data	Test the connection-status bit and force a safe state

Related

• Industrial Communication: the overview of this guide.
• Modbus RTU, ASCII and TCP: the protocol behind most of these recipes.
• Industrial Ethernet: EtherNet/IP, PROFINET and EtherCAT and IP Addressing, Subnets and VLANs: addresses, names and protocols.
• Sniffers, Analyzers and Serial Tools: proving the device before the PLC.
• PLC & Logic Control: the programming side of each platform.
• Modbus Frame and CRC Calculator.

FAQ

Which controller is easiest to connect to Modbus devices?

The small controllers (Click, FC6A, Unitronics, Micro800) have Modbus master built in and need only a few settings. Siemens needs a communication module for serial; Logix needs a gateway or an add-on.

Why can I connect with the programming software but not read from the HMI?

They use different protocols and permissions. For Siemens check PUT/GET; for Rockwell, the tag names; for others, the protocol enabled on the Ethernet port.

Do I need the GSD or EDS file?

For EtherNet/IP and PROFINET I/O connections, yes, or add the device as a generic module with the correct assembly sizes. For Modbus, no file is needed, only the register map.

Can the PLC be both a client and a server?

Yes: for example a Modbus TCP client to the drives and a Modbus TCP server to the SCADA at the same time. Watch the connection limits.

How do I find the right register for a drive command?

In the drive’s communication manual: it lists the control word, status word, reference and actual-value registers with units. Test with a small safe change before connecting a real machine.

References

• Rockwell Automation, EtherNet/IP Network Configuration (ENET-UM001), Logix 5000 Controllers Messages (1756-PM012) and Connected Components Workbench help for MSG_MODBUS.
• Siemens, S7-1200 System Manual, S7-1200 Modbus TCP and Modbus RTU documentation and PROFINET with STEP 7.
• Mitsubishi Electric, MELSEC iQ-F FX5 User’s Manual (Serial Communication) and (Ethernet Communication); SLMP Reference Manual.
• Omron, CP1H/CP1L Operation Manual, SYSMAC CS/CJ Series Communications Commands Reference (FINS, Host Link).
• IDEC, FC6A Series MICROSmart User’s Manual; Unitronics, Vision and UniStream Communication Guides; AutomationDirect, Click PLC User Manual.
• CODESYS Group, CODESYS Online Help: Modbus, EtherNet/IP, PROFINET.

Last reviewed: October 2026. Speeds, lengths, node counts and menu names are typical: confirm against the specification and the manufacturer’s documentation for the devices you use.