Industrial Ethernet: EtherNet/IP, PROFINET and EtherCAT
The Ethernet physical layer, the real-time protocols, switches, VLANs, multicast and ring redundancy.
On this page
The Ethernet physical layer
Industrial Ethernet uses the same IEEE 802.3 hardware as an office network, in tougher packaging, with real-time protocols on top. Everything on the plant floor that is fast and deterministic today (EtherNet/IP, PROFINET, EtherCAT, POWERLINK, Sercos III, CC-Link IE) shares the Ethernet frame and the cable; they differ in how they use them.
| Standard | Speed | Medium | Pairs used | Max segment | Notes |
|---|---|---|---|---|---|
| 10BASE-T | 10 Mbit/s | Cat3 or better | 2 | 100 m | Old devices; half-duplex hubs |
| 100BASE-TX | 100 Mbit/s | Cat5e or better | 2 (pins 1, 2, 3, 6) | 100 m | The standard for field devices; 4-pin M12 D-coded |
| 1000BASE-T | 1 Gbit/s | Cat5e or better | 4 | 100 m | Uplinks, vision, servers; 8-pin M12 X-coded |
| 100BASE-FX / 1000BASE-SX / LX | 100 Mbit/s to 1 Gbit/s | Fiber (multimode or single-mode) | one fiber per direction | 2 km, 550 m, 10 km | Between cabinets and buildings; immune to noise |
| Single-pair Ethernet (10BASE-T1L, 100BASE-T1) | 10 or 100 Mbit/s | One twisted pair | 1 | 1 000 m (T1L) or 15 to 40 m | Field-level Ethernet and Ethernet-APL for process instruments |
The cable pinouts and the M12 connector are on Cabling, Grounding and Noise. Whatever the speed, the 100 m limit is for a channel with at most about 90 m of fixed cable and the rest as patch cords; flexible industrial cable has higher loss, so its limit is shorter.
Frames, addresses and switches
| Device | Works at | What it does | Notes |
|---|---|---|---|
| Hub | Layer 1 | Repeats every bit to every port | Obsolete: one collision domain, half duplex |
| Unmanaged switch | Layer 2 | Learns which MAC address is on which port and forwards frames only there | Fine for small networks; no diagnostics; floods multicast |
| Managed switch | Layer 2 | As above, plus VLANs, multicast filtering, port mirroring, redundancy, SNMP and a web interface | Standard for control networks |
| Layer 3 switch / router | Layer 3 | Routes between IP subnets and VLANs | Joins machine networks to the plant network |
| Firewall | Layers 3 to 7 | Allows or blocks traffic by address, port and sometimes protocol | See Industrial Network Security |
- Full duplex is the rule. Both directions are used at once and there are no collisions. A port forced to a fixed speed next to a port on auto-negotiate falls back to half duplex and produces errors: set both ends the same, or both to auto.
- Auto-MDI/MDIX. Modern ports detect the cable type, so a straight patch cable works everywhere and crossover cables are rarely needed.
- MAC address table. A switch builds it from the source addresses it sees and ages entries out after a few minutes; a frame to an unknown address is flooded to all ports.
- Store and forward. Most switches receive a whole frame before sending it on, adding delay; some “cut-through” and real-time switches begin to forward sooner.
Managed switches and what to turn on
| Feature | What it gives you | Typical use |
|---|---|---|
| VLANs | Divide one switch into separate networks | Keep control, supervision and other traffic apart (see IP Addressing, Subnets and VLANs) |
| IGMP snooping and querier | Send multicast only to ports that asked for it | Needed for EtherNet/IP I/O |
| QoS (802.1p, DSCP) | Give real-time frames priority over the rest | PROFINET RT uses priority 6; EtherNet/IP uses DSCP |
| Port mirroring (SPAN) | Copy the traffic of a port to another for a sniffer | Troubleshooting (see Sniffers, Analyzers and Serial Tools) |
| LLDP | Neighbors announce themselves, so tools can draw the topology | PROFINET topology detection, documentation |
| SNMP | A monitoring system reads counters and status | Alarm on link down, errors, high load |
| Redundancy (MRP, RSTP, PRP/HSR) | Recover from a cable break | Rings; see below |
| Port security | Allow only known MAC addresses; disable unused ports | Stops casual plug-in of laptops |
| Storm control | Limit broadcast and multicast floods | Protects against a looping cable or a faulty device |
| Spanning tree | Blocks loops automatically | Prevents a patch cord loop from taking the network down; keep it on unless you use a different loop protection |
The real-time protocols compared
| EtherNet/IP | PROFINET RT / IRT | EtherCAT | Modbus TCP | |
|---|---|---|---|---|
| Governed by | ODVA | PROFIBUS & PROFINET International | EtherCAT Technology Group | Modbus Organization |
| Uses | TCP and UDP over IP; CIP application layer | Ethernet frames directly (RT); IP for configuration | Ethernet frames directly; processing on the fly | TCP over IP |
| Model | Producer/consumer connections plus messages | Cyclic IO controller and devices, acyclic records | Master and slaves, one frame per cycle | Client and server |
| Typical cycle | 2 to 100 ms (CIP Sync and Motion faster) | RT: 1 to 16 ms; IRT: 31.25 µs to 4 ms | 50 µs to a few ms | 10 to 100 ms |
| Topology | Star, line (DLR ring) | Star, line, ring (MRP) | Line, tree, ring | Any |
| Needs special hardware | No (device-level ASICs optional) | IRT: yes; RT: no | Slaves yes; master no | No |
| Safety option | CIP Safety | PROFIsafe | Safety over EtherCAT (FSoE) | None |
| Typical use | Rockwell, Omron NJ, many drives | Siemens and many others | Motion control, fast I/O, Beckhoff | Meters, drives, simple devices |
| Device file | EDS | GSDML | ESI (XML) | None (register map) |
EtherNet/IP and CIP
EtherNet/IP is the Ethernet version of the Common Industrial Protocol (CIP), the same object model used by DeviceNet and ControlNet. A controller (the scanner) opens a connection to each device (an adapter) using explicit messaging on TCP port 44818, and the devices then exchange implicit I/O data cyclically, as UDP packets on port 2222, at the requested packet interval (RPI) that you set per connection.
| Term | Meaning | Practical note |
|---|---|---|
| Scanner / adapter | The controller that opens connections / the device that accepts them | A PLC can be a scanner to its I/O and an adapter to another PLC |
| Connection | A relationship with a size, an RPI and a timeout | Each connection costs memory in both devices; a device has a maximum (for example 32 or 128) |
| RPI | How often each side sends: 2 to 750 ms typical | Set it to what the process needs; the PLC task and the network must keep up |
| Timeout multiplier | How many missed RPIs before the connection drops (typically 4) | A device that loses its connection goes to its fault state |
| Assembly instances | The numbered data blocks (input, output, configuration) the device exposes | Needed for a generic Ethernet module when you have no EDS file |
| EDS file | Electronic Data Sheet: describes the device’s connections and parameters | Install the EDS (or use the vendor’s add-on profile) matching the device’s firmware revision |
| Unicast and multicast | Cyclic data to one consumer or to a group | Multicast needs IGMP snooping; unicast is simpler for point-to-point I/O |
| Explicit messages | On-demand reads and writes of parameters (MSG) | Slow and unscheduled; do not use them for control data |
| DLR | Device Level Ring: a ring topology with fast recovery | Needs DLR-capable devices and a ring supervisor |
| CIP Security | Authentication and encryption for CIP | Supported on newer devices; plan certificates |
- Match the generation. A wrong EDS or revision gives a connection fault with “electronic keying mismatch”; choose compatible keying only if you understand the risk.
- Do not set the RPI faster than needed. A 2 ms RPI on 100 devices loads the network and the PLC; 10 to 20 ms suits most discrete I/O.
- Detect a lost device. Use the connection status bit in the program and raise an alarm; do not assume stale inputs are still true.
- Switch settings. Use managed switches with IGMP snooping and a querier when using multicast.
PROFINET
PROFINET IO is Siemens’s and the PROFIBUS organization’s industrial Ethernet. An IO controller (the PLC) exchanges cyclic data with IO devices (I/O blocks, drives, field devices) using real-time (RT) frames that skip IP and TCP and go directly in the Ethernet frame with a priority tag, so devices handle them quickly. Configuration, parameters and diagnostics use ordinary IP (UDP and the DCP discovery protocol). IRT (isochronous real-time) schedules the cycle with special switch hardware for sub-millisecond, jitter-free timing in motion applications.
| Concept | What it means | Practical note |
|---|---|---|
| Device name | Every IO device has a unique name (a lowercase string); the controller finds it by name and assigns its IP address | The most common PROFINET fault: the name in the project does not match the device. Assign names with the engineering tool or a free tool such as PRONETA |
| GSDML file | The device description that the engineering tool imports | Use the file for the device’s firmware version |
| Update time | How often the controller and each device exchange data | The send clock (for example 1 ms) times a reduction ratio; set per device |
| Watchdog | How many missed updates before the device declares the controller lost | Default is 3 cycles |
| DCP | Discovery and Configuration Protocol: finds devices by MAC address and sets names and IP | Works on the same layer-2 segment, so a router blocks it |
| Conformance classes A, B, C | A: basic cyclic; B: adds topology detection and diagnostics (LLDP, SNMP); C: adds IRT | Pick devices of a class that meets the application |
| Shared and system redundancy | More than one controller can use the same device; S2 and R1 redundancy | High-availability systems |
| PROFIsafe | Safety protocol over PROFINET (or PROFIBUS) | Treats the network as a black channel; the safety devices check the data themselves |
| Fast start-up (FSU) | Devices start in a fraction of a second | Tool changers and quick-change robots |
EtherCAT
EtherCAT (Ethernet for Control Automation Technology) is built for speed. The master sends one Ethernet frame that passes through every slave in turn; each slave reads its outputs and writes its inputs into the frame as it flows by, with a few nanoseconds of delay, and the last slave turns the frame around so that it comes back to the master carrying all the inputs. One frame serves 100 or more devices, so the efficiency is very high, and distributed clocks synchronize the slaves to within 100 ns for coordinated motion.
Worked example: an EtherCAT cycle with 100 slaves
- 100 slaves, each with 4 bytes of process data: 400 bytes. The frame is Ethernet 14 + EtherCAT header 2 + datagram header 10 + data 400 + working counter 2 + FCS 4 = 432 bytes; with the preamble and gap, 452 bytes of wire time.
- At 100 Mbit/s the frame takes 452 × 8 ÷ 100 = 36.2 µs to send.
- Add the delay through the slaves (about 1 µs each, forward and back through the physical layer): about 100 µs. The cycle is therefore roughly 136 µs, so a 250 µs or 500 µs cycle fits easily with time left for the master’s processing.
- The same 100 devices on a polled protocol, one frame per device and per direction, would need 200 frames and many times the time.
- Topology. Line, tree and star with junctions; a ring (cable redundancy) lets the master reach every slave from both ends.
- Cable. Standard 100BASE-TX, 100 m between devices; 65 535 slaves in a segment in theory.
- Tools. An ESI file per slave; the master configures the process data mapping; hot-connect groups allow tool changers.
- Not routable. EtherCAT runs on its own layer-2 segment; connect to other networks through the master or a gateway.
Other Ethernet protocols
| Protocol | Port or frame | Used by | Notes |
|---|---|---|---|
| Modbus TCP | TCP 502 | Almost every brand | Simple client/server; see Modbus RTU, ASCII and TCP |
| S7 communication (ISO-on-TCP) | TCP 102 | Siemens S7 PLCs, HMIs, drivers | PUT/GET access must be enabled in S7-1200/1500 |
| FINS | UDP or TCP 9600 | Omron PLCs and tools | Node numbers; configurable |
| SLMP / MC protocol | TCP or UDP, port set by the user | Mitsubishi PLCs | Port set in the Ethernet module parameters |
| OPC UA | TCP 4840 | Everyone | See OPC UA, MQTT and Industrial IoT |
| POWERLINK | EtherType 0x88AB | B&R and others | Open, polling with time slots, 200 µs cycles |
| Sercos III | EtherType 0x88CD | Bosch Rexroth, many motion devices | Real-time ring or line with a 31.25 µs minimum cycle |
| CC-Link IE | EtherType 0x890F | Mitsubishi and partners | Gigabit control and field networks |
| MQTT | TCP 1883 / 8883 | IoT gateways | See OPC UA, MQTT and Industrial IoT |
| HTTP, HTTPS, SNMP, SSH | TCP 80, 443; UDP 161; TCP 22 | Device web pages, monitoring, administration | Disable the ones you do not use |
Multicast, IGMP and flooding
EtherNet/IP I/O data is often sent as multicast so that several devices can consume one producer’s data. A switch that does not understand multicast treats it as a broadcast and floods it to every port, including ports with slow devices (panels, cameras, laptops) that can be overloaded by the traffic. A managed switch with IGMP snooping listens to the devices’ requests to join a multicast group, and forwards the data only to the ports that asked. Someone must also send the periodic membership queries: the IGMP querier, usually one of the managed switches.
- Symptoms of flooding: an HMI or camera slows down or reboots when a drive network starts; an office PC on the same switch is slow.
- Fixes: managed switches with IGMP snooping and one querier; VLANs to keep the I/O network separate; or unicast connections where the adapters support them.
- Multicast addresses start 239.x.x.x for EtherNet/IP; each connection uses an address derived from the device.
Redundancy and rings
| Protocol | Recovery time | Notes |
|---|---|---|
| RSTP (IEEE 802.1w) | About 1 to 5 seconds, longer in big networks | General purpose; too slow for many machines (devices time out) |
| MRP (IEC 62439-2) | 200 ms (MRP) or as little as 10 ms in fast modes | PROFINET rings; one manager, many clients |
| DLR (ODVA) | Under 3 ms for a typical ring in some implementations, otherwise tens of ms | EtherNet/IP rings; supervisor and nodes |
| HSR / PRP (IEC 62439-3) | Zero: every frame is sent over both paths | Power utilities and high availability; needs special nodes |
| EtherCAT cable redundancy | None needed: a second port at the master closes the ring | Motion systems |
Test redundancy: pull a cable in a safe moment and see what happens. A ring that nobody has tested often fails at the first real break because of a setting on one switch.
Network load calculations
A network can fail by being too busy, even when each device is healthy. Estimate the load: packets per second × bits per packet, with each frame carrying 20 bytes of preamble and gap in addition to its headers.
Worked example: EtherNet/IP I/O on a 100 Mbit/s link
- 50 drives and I/O blocks, each exchanging 100 bytes in each direction every 10 ms RPI (so 100 packets per second per connection per direction).
- A frame is Ethernet 14 + IP 20 + UDP 8 + CIP encapsulation about 24 + data 100 + FCS 4 = 170 bytes, or 190 bytes of wire time.
- Packets per second = 50 × 2 × 100 = 10 000. Bit rate = 10 000 × 190 × 8 = 15.2 Mbit/s, or 15 percent of a 100 Mbit/s link.
- If the controller connects to them all through one 100 Mbit/s port, that port carries the whole load. A gigabit uplink or several controller ports spread it; at 2 ms RPI the same system would need 76 percent, impossible on one 100 Mbit/s link.
Worked example: PROFINET RT update time
- 100 devices, each exchanging 40 bytes in each direction. A real-time frame is Ethernet 14 + VLAN 4 + frame ID 2 + data 40 + status 4 + FCS 4 = 68 bytes (padded to at least 64), so 88 bytes of wire time.
- At a 1 ms update time: 200 000 frames per second = 141 Mbit/s: more than a 100 Mbit/s link can carry.
- At 4 ms: 50 000 frames per second = 35.2 Mbit/s (35 percent); at 8 ms 17.6 Mbit/s (18 percent).
- The engineering tool checks this load for you. The lesson is that a short update time for every device is not free: set fast times only for the devices that need them, and put the controller on a gigabit port where there are many.
Worked example: delay through a chain of switches
- A 1518-byte frame takes 123 µs to send at 100 Mbit/s. A store-and-forward switch adds about that long to a maximum-size frame, plus a few microseconds of processing.
- A real-time frame is small (about 88 bytes, 7.0 µs) so each switch adds a few microseconds to it; ten switches in line add perhaps 50 µs. A large ordinary frame queued in front of it can add up to 123 µs at each switch, which is why priority and IRT exist.
Design rules
- Plan the topology first. Star with managed switches for flexibility; line only where devices have two ports and the application accepts the risk; rings where a break must not stop the machine.
- Separate traffic. Put control, supervision and everything else in separate VLANs or on separate switches.
- Use the right switches. Managed industrial switches with IGMP, QoS and diagnostics for control networks; DIN-rail, wide temperature, redundant power.
- Respect length and device limits. 100 m per copper segment; limits on devices in a line (PROFINET lines of 10 to 20 devices are typical before the cycle suffers).
- Keep the load low. Aim for under 30 to 50 percent of a link, and make uplinks faster than the downlinks.
- Fix addresses and names early and write them in an address list.
- Document and label every cable and every port.
- Test before you rely on it. Pull cables, power-cycle switches, and check the diagnostics of each switch and device.
- Plan security from the start: network segmentation and unused ports shut down. See Industrial Network Security.
Typical faults
| Symptom | Likely cause | Check |
|---|---|---|
| Device not found or not reachable | Different subnet, duplicate IP, wrong cable or port, device without a name (PROFINET) | Link LEDs, IP and mask on both ends, ping, device name |
| EtherNet/IP connection fault with a keying error | Wrong EDS or revision, wrong module definition | Compare the device’s identity with the project |
| I/O drops out occasionally | RPI too fast for the PLC or network, a loose connector, a switch overloaded, multicast flooding | Switch port counters, connection status, cable test |
| Network slow, devices unreachable | A broadcast storm from a loop; a failing device flooding the network | Unplug segments one by one; check spanning tree and storm control |
| Errors only at 100 Mbit/s | A damaged cable pair (works at 10 Mbit/s but not at 100) | Replace or certify the cable |
| Duplex mismatch | Late collisions and CRC errors on a port, slow throughput | Set both ends to auto-negotiate or to the same fixed setting |
| PROFINET device flashes a fault, or “name not assigned” | Name mismatch, DCP blocked by a switch, IP not assigned | Assign the name again; check VLAN and topology |
| EtherCAT slaves stop at one point | A broken cable or connector, a slave without power, a wrong port | The first slave that does not answer; check the cable before it |
| A ring does not recover | Two managers, a disabled port, a wrong protocol on one switch | The ring status on each switch |
Related
- Industrial Communication: the overview of this guide.
- IP Addressing, Subnets and VLANs: addresses, subnets, VLANs and ports.
- Connecting PLCs, Drives and HMIs: setting up EtherNet/IP and PROFINET on a controller.
- Cabling, Grounding and Noise: Ethernet cables and connectors.
- Industrial Network Security: keeping control networks safe.
- Motion Control: drives and servos on these networks.
FAQ
Which is better: EtherNet/IP, PROFINET or EtherCAT?
Whichever your controller supports natively and your key devices offer. EtherNet/IP and PROFINET are general-purpose control networks; EtherCAT is strongest for fast motion and many devices. Gateways can join them, at some cost.
Can I use an office switch for industrial Ethernet?
For a small network with few devices and no real-time need, an unmanaged industrial switch is often enough. An office switch lacks the temperature range, DIN mounting and power redundancy, and an unmanaged one floods multicast. Use managed industrial switches for control networks.
Can EtherNet/IP and PROFINET run on the same network?
Yes: they are different EtherTypes and ports, and many networks carry both. Give them enough bandwidth, keep multicast under control, and put each controller’s devices in the topology that suits it.
What is the difference between RT and IRT?
RT frames get priority but still compete for the wire; typical cycles of 1 ms and up with some jitter. IRT reserves part of every cycle for scheduled real-time data, giving cycles below 1 ms and jitter under 1 µs, but needs IRT-capable switches and engineering.
How many devices can I put in a line?
Each device adds a little delay, and a break cuts off everything beyond it. PROFINET lines of 10 to 20 devices and EtherCAT lines of 100 or more are common; use rings or stars where the risk of a break matters.
Do I need Gigabit?
For field devices, 100 Mbit/s is usually enough. Gigabit helps for controller ports and uplinks, vision systems and large data transfers.
References
- IEEE 802.3, Ethernet; IEEE 802.1Q, Bridges and Bridged Networks; IEEE 802.1w / 802.1D (spanning tree).
- ODVA, EtherNet/IP Specification and The CIP Networks Library (odva.org); Rockwell Automation, EtherNet/IP Network Configuration (ENET-UM001).
- PROFIBUS & PROFINET International, PROFINET Design Guideline and PROFINET Installation Guideline (profibus.com); IEC 61158-6-10.
- EtherCAT Technology Group, EtherCAT: the Ethernet Fieldbus, ETG.1000 (ethercat.org).
- IEC 62439, Industrial communication networks: High availability automation networks (MRP, PRP, HSR).
Last reviewed: October 2026. Speeds, lengths, node counts and menu names are typical: confirm against the specification and the manufacturer’s documentation for the devices you use.