Networking Fundamentals
Layers and protocol stacks, network levels, topologies, messaging models, speed, latency and determinism.
Why industrial machines are networked
A machine used to be a cabinet of relays with one wire for every signal. Now a PLC talks to drives, remote I/O blocks, meters, barcode readers, HMIs, vision systems, robots and databases, and most of those links are a cable that carries messages rather than a wire that carries one signal. Networking saves wiring, adds diagnostics and lets different brands work together, but it also adds a new class of fault: the machine is mechanically and electrically fine, and still stops because two devices disagree about a baud rate, an address, a register or a byte order.
This guide takes you from the basic ideas on this page, through serial links, Modbus, fieldbuses, industrial Ethernet, IP addressing and the newer OPC UA and MQTT, to cabling, security and troubleshooting. Wherever a number matters (a frame size, a cycle time, a voltage, a cable length) it is computed in the page so you can follow it and reuse the method.
| What a network gives you | What it costs |
|---|---|
| Less wiring. One cable and a few terminals instead of dozens of wire pairs. | The cable and the connectors are now critical parts: a bad crimp stops many signals at once. |
| Rich data. Parameters, diagnostics, device identity and tag names, not just on/off. | Each device needs set-up: addresses, speeds, files, names. |
| Distributed intelligence. Drives and I/O blocks near the process, PLCs in the cabinet. | Timing depends on the network, not only on the program scan. |
| Integration. The same data reaches SCADA, MES and cloud services. | A larger attack surface and more to keep documented and secure. |
Network levels
Plants are organized in levels. Each level has its own speed and its own job, and usually its own protocols. Fast, deterministic links connect the controller to the field devices; standard Ethernet joins controllers and supervisory systems; IT-style protocols carry data upwards. The boundaries are not strict (Ethernet protocols now reach down to the sensor) but the idea helps you choose and troubleshoot.
| Level | Typical devices | What matters most | Typical protocols |
|---|---|---|---|
| Sensor | Proximity switches, valves, simple transmitters | Cost per point, wiring, remote diagnostics | IO-Link, AS-Interface, HART, 4–20 mA |
| Device | Drives, servos, remote I/O, encoders | Speed, determinism, synchronization | PROFINET, EtherNet/IP, EtherCAT, PROFIBUS, CANopen, Modbus |
| Control | PLCs, HMIs, safety controllers | Reliability, response in tens of milliseconds | EtherNet/IP, PROFINET, S7, FINS, OPC UA |
| Plant | SCADA, historian, MES, engineering stations | Data volume, security, integration | OPC UA, Modbus TCP, SQL, MQTT |
| Enterprise and cloud | ERP, analytics, dashboards | Security, scale, standard IT tools | MQTT, HTTPS, OPC UA, AMQP |
Layers and protocol stacks
Communication is divided into layers, each doing one job and relying on the one below. The seven-layer OSI model is the common vocabulary; the TCP/IP stack used on Ethernet networks has four. Serial Modbus uses only the bottom and top. You do not need to memorize the layers, but you do need the habit they teach: if a lower layer is broken, nothing above it can work, so check from the bottom up.
| Layer | Job | Industrial examples |
|---|---|---|
| 1 Physical | Move raw bits as voltages, light or radio over a medium | RS-232, RS-485, 100BASE-TX, fiber, 4–20 mA, M12 connectors |
| 2 Data link | Frame the bits, address devices on one segment, detect errors | Ethernet frames and MAC addresses, Modbus RTU framing with CRC, CAN frames, PROFIBUS telegrams |
| 3 Network | Route packets between networks | IP addresses, routers, VLAN routing |
| 4 Transport | Deliver data between programs, with or without guarantees | TCP (reliable, connection), UDP (fast, no guarantee) |
| 5 Session, 6 Presentation, 7 Application | Meaning of the data: commands, data types, security | Modbus function codes, CIP, S7 communication, OPC UA, MQTT |
How a message is wrapped
On an Ethernet network each layer wraps the data from the layer above with its own header. A Modbus TCP read of ten registers is only 5 bytes of Modbus (function code, start address, quantity) but travels in a frame of 70 bytes.
Worked example: how big is a Modbus TCP read?
- Request: Ethernet header 14 + IP 20 + TCP 20 + MBAP 7 + Modbus PDU 5 (function 1, start address 2, quantity 2) + frame check 4 = 70 bytes.
- Response to a read of 10 holding registers: the PDU is function 1 + byte count 1 + 20 data bytes = 22 bytes, so the frame is 14 + 20 + 20 + 7 + 22 + 4 = 87 bytes. The 20 bytes you wanted are in a frame of 87.
- On a serial Modbus RTU line the same exchange is only 33 bytes (8 request + 25 response), because there are no Ethernet, IP and TCP headers. Ethernet is far faster per bit, so it still wins: 33 bytes at 9 600 baud take about 34.4 ms on the wire, and 157 bytes at 100 Mbit/s take about 15.8 microseconds.
The header overhead is why protocols that send many small values (MQTT, EtherNet/IP cyclic I/O) group them into one message rather than one message per value.
Topologies
Topology is the shape of the cabling. It decides how many cables fail together and how easy the network is to extend and diagnose.
| Topology | Used by | Strengths | Weaknesses |
|---|---|---|---|
| Bus | RS-485, PROFIBUS, CAN, DeviceNet | Little cable; devices are added along the run | Needs terminators and short stubs; a break or a short can take down the whole bus; hard to find faults |
| Star | Switched Ethernet, IO-Link | Easy to see and test; a fault isolates one branch; scales well | More cable; the switch is a single point of failure |
| Line (daisy chain) | PROFINET and EtherCAT devices with two ports, AS-Interface | Short cable runs along a machine, no external switches | A break cuts off everything beyond it; every device in line adds a little delay |
| Ring | MRP, RSTP, HSR rings; EtherCAT with cable redundancy | Survives one cable break | Needs managed devices and testing; two breaks still split it |
| Tree | Large plants | A core and machine switches fit the plant layout | Uplinks can become bottlenecks; plan the bandwidth |
Messaging models
Who starts a conversation, and who may speak, is the next idea. Three models cover most industrial protocols.
| Model | How it works | Good for | Watch for |
|---|---|---|---|
| Master / slave | One master asks each slave in turn and waits for the reply; slaves never speak first | Serial buses; simple and predictable | Slow for many devices; a dead slave costs a timeout; no alarms from a slave until polled |
| Client / server | Any client opens a connection, asks, and receives a reply | HMI and SCADA reading controllers; OPC UA; Modbus TCP | Polling loads the server; too many clients exhaust its connections |
| Producer / consumer | A device sends its data on a timer or on change; interested devices receive it | Cyclic I/O (EtherNet/IP, PROFINET), MQTT | Needs multicast control; a consumer that missed packets must detect it |
| Term | Meaning |
|---|---|
| Cyclic data | Process data exchanged automatically at a fixed rate, such as I/O values |
| Acyclic data | On-demand data: parameters, diagnostics, configuration |
| Polling | Asking repeatedly for a value, whether or not it has changed |
| Report by exception | Sending a value only when it changes by more than a deadband |
| Unicast, multicast, broadcast | To one device, to a group that asked, or to every device on the segment |
Speed, bandwidth, latency and determinism
These four words are often mixed up. Bandwidth is how many bits per second the link can carry. Latency is how long one message takes to arrive. Jitter is how much that time varies. Determinism is the guarantee that a message arrives within a known time, every time. For a control loop or a servo axis, a predictable 1 ms beats an average of 0.2 ms with occasional 20 ms delays.
Worked example: where does the time go on a 100 Mbit/s link?
- Putting the frame on the wire. The smallest Ethernet frame is 64 bytes, and the preamble and the gap between frames take another 20 bytes of time, so 84 bytes = 672 bits. At 100 Mbit/s that is 6.72 µs; at 1 Gbit/s it is 0.67 µs. A full 1518-byte frame takes 123.0 µs at 100 Mbit/s.
- Travel. A signal moves at about 200 meters per microsecond in cable, so 100 m of cable adds about 0.50 µs.
- Switches. A store-and-forward switch receives the whole frame before sending it on, so each switch adds at least one frame time plus some processing: roughly 5 to 20 µs at 100 Mbit/s. Ten switches in a line add 50 to 200 µs, which is why long daisy chains matter for fast motion.
- The queue. If a 1518-byte frame from another device is already being sent, yours waits up to 123.0 µs. Priority (QoS) and real-time protocols exist to avoid this.
- The software. The device must read the frame, run its stack and update its outputs: often the biggest part, from tens of microseconds in hardware-assisted devices to milliseconds in a PLC task.
- Compare serial: one character at 9 600 baud takes 1.04 ms, a thousand times longer than a whole minimum Ethernet frame.
- Cycle time versus scan time. A network cycle and a PLC scan are independent unless the system synchronizes them. Data may be one scan plus one cycle old when the program uses it.
- Plan with margin. Keep link load under about 30 to 50 percent on a control network. Bursts and retries need headroom.
- Measure, do not assume. The diagnostics of a switch, a drive or a PLC show the real update times and error counts.
Numbers, bytes and byte order
Industrial data is shown in several number systems, and you will switch between them all the time. A bit is 0 or 1; a byte is 8 bits (two hexadecimal digits); a word is usually 16 bits (a Modbus register) and a double word 32 bits.
| Decimal | Binary | Hex | Note |
|---|---|---|---|
| 0 | 0000 0000 | 00 | |
| 10 | 0000 1010 | 0A | The value in register 0 of the Modbus examples |
| 255 | 1111 1111 | FF | Largest unsigned byte; also the Modbus coil ON value (FF 00) |
| 258 | 0000 0001 0000 0010 | 01 02 | High byte 01, low byte 02 |
| 32 767 | 0111 1111 1111 1111 | 7FFF | Largest signed 16-bit integer |
| 65 535 | 1111 1111 1111 1111 | FFFF | Largest unsigned 16-bit integer; as signed it is −1 |
| −1 | 1111 1111 1111 1111 | FFFF | Two’s complement 16-bit |
Byte order (endianness) says which byte comes first. Network protocols such as Modbus send the high byte first (big-endian). Some devices and tools differ for 32-bit values: the two registers can arrive with the high word first or the low word first. The Modbus page shows a worked example, and the same issue appears in EtherNet/IP data and in files exchanged with PCs. When a number reads as nonsense but the link is healthy, suspect byte or word order first.
The site’s bitwise and register calculator converts between these systems, and the Modbus Frame and CRC Calculator builds and decodes real frames.
Choosing a network
| Situation | Reasonable choice | Why |
|---|---|---|
| Read values from a power meter, VFD or temperature controller | Modbus RTU (RS-485) or Modbus TCP | Almost every device supports it; free documentation; simple to test |
| Siemens PLC with remote I/O and drives | PROFINET | Native to the platform; strong tools |
| Rockwell Automation / Allen-Bradley PLC | EtherNet/IP | Native to the platform |
| Synchronized multi-axis motion | EtherCAT or PROFINET IRT | Deterministic, very short cycles |
| Smart sensors that need remote setup and diagnostics | IO-Link | Parameter storage and device replacement without a laptop |
| Many simple switches and valves on a machine | AS-Interface or remote I/O blocks | Cuts wiring: one cable per branch |
| Mixed brands and supervisory data | OPC UA | Vendor-neutral, secure, self-describing |
| Data to a cloud dashboard | MQTT through a gateway | Efficient over slow or unreliable links |
| Existing plant on PROFIBUS | Keep PROFIBUS; add gateways to Ethernet | Replacing a working bus rarely pays |
Choose first for what your controller and key devices support natively, then for the speed and determinism you need. A gateway can translate between protocols when you must mix them, but each adds cost, delay and a place for faults.
Glossary
| Term | Meaning |
|---|---|
| Baud rate | Symbols per second on the line; on a simple serial line the same as bits per second |
| CRC | Cyclic redundancy check: a number computed from the data to detect transmission errors |
| Frame, packet, telegram | One complete message on the wire |
| Gateway | A device that translates between two networks or protocols; also the router address in IP settings |
| MAC address | The fixed 48-bit hardware address of a network port, written like 00:1B:1B:12:34:56 |
| Node, station, device | Any addressable participant on a network |
| Payload | The useful data inside a frame, excluding headers |
| Terminator | A resistor at the end of a bus that stops signal reflections |
| Throughput | The useful data actually delivered per second, always less than the bandwidth |
| TTL, RPI, timeout | How long a device waits, or how often it sends, before it decides the other end is gone |
Related
- Industrial Communication: the overview of this guide.
- Serial Communication: RS-232, RS-422 and RS-485: the physical layer of most small machine networks.
- Modbus RTU, ASCII and TCP: the most widely supported protocol, in detail.
- Industrial Ethernet: EtherNet/IP, PROFINET and EtherCAT and IP Addressing, Subnets and VLANs: the modern plant network.
- PLC & Logic Control: how the controller uses the data it receives.
FAQ
What is the difference between a protocol and a network?
A protocol is the set of rules for the messages (their format, order and meaning). A network is the cabling and devices that carry them. One Ethernet network can carry several protocols at once.
Why can I ping a device but not read its data?
Ping proves the lower layers (cable, IP address, subnet). The data uses a higher layer (a port, a protocol, an address inside the device): check the port, the protocol settings and any firewall.
Is Ethernet fast enough for control?
Standard TCP/IP traffic is not deterministic, but the real-time industrial Ethernet protocols (EtherNet/IP I/O, PROFINET RT and IRT, EtherCAT) give cycles from a few milliseconds down to well below a millisecond on the same style of cable.
Do I need to learn all of the protocols?
No. Learn the ones your controllers and key devices use, and the general rules (physical layer first, matching settings, unique addresses). The same habits carry across.
What is the single most common cause of communication faults?
A mismatch of settings between the two ends, followed by wiring (polarity, termination, connectors). Both are found by working from the bottom up.
References
- IEC 7498-1 / ISO/IEC 7498-1, Open Systems Interconnection: Basic Reference Model.
- IEEE 802.3, Ethernet; IEC 61158 and IEC 61784, Industrial communication networks: fieldbus specifications and profiles.
- Mackay, S. et al., Industrial Data Communications, ISA; Wilamowski, B. and Irwin, J. D., Industrial Communication Systems, CRC Press.
- Modbus Organization, MODBUS Application Protocol Specification V1.1b3 (Modbus TCP frame structure).
Last reviewed: October 2026. Speeds, lengths, node counts and menu names are typical: confirm against the specification and the manufacturer’s documentation for the devices you use.