🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Manufacturing & Marine › Robotics / Mechatronics › Programmable Logic Controllers for Mechatronics › Lesson 11
MFG-MECH15-02 · Lesson 11 · 12 clock hours · theory

Industrial Networks — EtherNet/IP, PROFINET, and Modbus

Objective. Students will configure a PLC to exchange at least four data tags with a second device (drive, I/O block, or second PLC) over EtherNet/IP or PROFINET, and will describe how Modbus RTU and TCP addressing differ from producer/consumer models.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by a licensed engineer or certified journey-level tradesperson or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Industrial Networks — EtherNet/IP, PROFINET, and Modbus

Modern automated systems rarely consist of a single device. A PLC typically communicates with variable-frequency drives (VFDs), remote I/O modules, operator panels, vision systems, and other controllers — all on a shared network. Understanding how three dominant industrial protocols work lets you wire, configure, and troubleshoot that communication layer confidently.

Network Models: Three Approaches

EtherNet/IP (Ethernet Industrial Protocol) runs on standard IEEE 802.3 Ethernet hardware using CAT5e or CAT6 twisted-pair cable and ordinary managed switches. It was developed by ODVA and uses the Common Industrial Protocol (CIP) at the application layer. EtherNet/IP uses a producer/consumer model: a node (the producer) places data on the network once, and any number of consumers can read that data simultaneously. Real-time cyclic data travels in implicit (I/O) messages; configuration and parameter reads use explicit messages on demand. Every node gets a unique IPv4 address (e.g., 192.168.1.10). Typical cycle times are 1–10 ms. EtherNet/IP is common in Allen-Bradley (Rockwell) systems, though many other vendors support it.

PROFINET is the Siemens-led Ethernet-based protocol standardized under IEC 61158. Its model is controller/device: one IO-Controller (the PLC) actively manages IO-Devices (drives, I/O blocks, encoders). Devices are identified by their device name (a text string such as "drive-station-1") in addition to an IP address. The controller assigns IP addresses and device names during startup, so device replacement is simplified. PROFINET RT (Real-Time) achieves cycle times of about 1–10 ms on standard hardware; PROFINET IRT (Isochronous Real-Time) can go below 1 ms for motion control. PROFINET is the dominant protocol in Siemens TIA Portal environments.

Modbus is one of the oldest industrial protocols, introduced by Modicon in 1979. It uses a master/slave model: one master initiates every transaction; slaves only respond when asked. Modbus RTU runs over RS-232 or RS-485 serial wiring. Each slave has a unique unit address (1–247). Data is organized in four tables: coils (discrete outputs, function code 01/05), discrete inputs (function code 02), input registers (function code 04), and holding registers (function code 03/06/16) — 16-bit read/write registers most commonly used for process values and parameters. Modbus TCP wraps the same protocol inside a TCP/IP packet on Ethernet, port 502, using an IP address plus a unit identifier byte. Because every message is polled individually, Modbus is slower than EtherNet/IP or PROFINET for large datasets, but its simplicity and universal support make it ideal for instruments, drives, and legacy equipment.

Comparison Summary

| Feature | EtherNet/IP | PROFINET | Modbus RTU/TCP |

|---|---|---|---|

| Media | Ethernet (CAT5e/6) | Ethernet (CAT5e/6) | RS-485 / Ethernet |

| Addressing | IPv4 address | IP address + device name | Unit address (1–247) / IP+unit |

| Scan method | Producer/consumer (cyclic implicit) | Controller/device (cyclic IO) | Master/slave (polled) |

| Typical use | Rockwell systems, drives, I/O | Siemens TIA Portal systems | Instruments, legacy drives, meters |

Configuring EtherNet/IP: Key Steps

1. Assign IP addresses. Give the PLC and the remote device addresses in the same subnet (e.g., 192.168.1.1 and 192.168.1.20, mask 255.255.255.0). Use the device's web page, rotary switches, or the programming software.

2. Add the device to the I/O tree. In the PLC project, right-click the Ethernet module and add the device using its Electronic Data Sheet (EDS) file. The EDS file describes the device's data sizes and parameters.

3. Set the requested packet interval (RPI). This controls how often data is exchanged in milliseconds. Match the RPI to the process requirement without overloading the network.

4. Go online and verify. Download the project and open the I/O tree. A green icon (no fault) confirms the connection. Monitor the input and output tags in the tag monitor to confirm live data exchange.

Reading Modbus Holding Registers

In many PLC platforms a MSG (Message) instruction performs an explicit Modbus read. Configure it with: the slave's IP address or COM port, function code 03 (read holding registers), the starting register address, and the number of registers to read. Map the returned 16-bit values into internal PLC tags. If a register contains a scaled value (for example, a drive output frequency multiplied by 10), divide by 10 in a math instruction before displaying on the HMI.

Safety on the Network Layer

Network configuration work usually occurs with panels energized. Follow NFPA 70E arc-flash and shock boundaries whenever you open a control cabinet: verify the required PPE category for the voltage level, and use the shock protection boundary before touching any terminal. If you must de-energize the panel to run cable or change modules, apply OSHA 29 CFR 1910.147 lockout/tagout: isolate the energy source, lock and tag it, and verify absence of voltage with a CAT-rated meter before reaching inside. Never assume a network cable is "just data" — cables inside an energized cabinet are still near hazardous voltage. Ensure all cable routing preserves existing NFPA 79 cable separation requirements (signal cables separated from power wiring).

Key terms8

Producer/consumer modelA network communication model (used by EtherNet/IP) in which a node publishes data once and any number of other nodes can receive it simultaneously, reducing redundant traffic.
Controller/device modelA PROFINET network model in which one IO-Controller (the PLC) manages cyclic data exchange with IO-Devices such as drives and remote I/O modules.
Master/slave modelA network model (used by Modbus) in which only the master initiates communication; slaves respond only when addressed, one transaction at a time.
Holding registerA 16-bit read/write data location in the Modbus data model (addresses 40001–49999 in common notation) used for process values, setpoints, and drive parameters.
Requested Packet Interval (RPI)The configured time interval, in milliseconds, at which an EtherNet/IP connection cyclically exchanges I/O data between the controller and a remote device.
EDS file (Electronic Data Sheet)A vendor-supplied text file that describes an EtherNet/IP device's identity, data sizes, and configurable parameters so the programming software can add it to the I/O tree correctly.
Modbus TCPA version of the Modbus protocol that encapsulates Modbus messages inside TCP/IP packets on an Ethernet network, communicating on port 502 using IP addressing plus a unit identifier.
Implicit messagingEtherNet/IP cyclic I/O data exchange that runs automatically at the RPI without application-level programming; contrasted with explicit messaging, which is on-demand and program-triggered.

Worked examples4

1. A Modbus holding register at address 40001 holds a drive output frequency value that the drive scales by a factor of 10 (so a reading of 600 represents 60.0 Hz). What integer value do you expect to read when the drive runs at 45.0 Hz, and what math instruction converts it to the correct display value?
  1. Multiply the desired frequency by the scale factor: 45.0 Hz × 10 = 450.
  2. The raw register value read from address 40001 will be 450 (an integer).
  3. In the PLC, map the raw register to an internal tag (e.g., Raw_Freq).
  4. Add a DIV (divide) math instruction: Display_Freq = Raw_Freq ÷ 10 = 450 ÷ 10 = 45.0.
  5. Send Display_Freq to the HMI numeric display to show 45.0 Hz.
Answer: The raw register value is 450; dividing by 10 gives 45.0 Hz on the HMI display.
2. You are adding a remote I/O module to a Rockwell PLC over EtherNet/IP. The PLC is at 192.168.1.1 and the existing network uses a 255.255.255.0 subnet mask. You need to assign the I/O module an address that is on the same subnet and not already used. Is 192.168.2.50 a valid choice? What is a valid choice?
  1. With a 255.255.255.0 mask, the network portion is the first three octets: 192.168.1.x.
  2. A valid host address must share those three octets: 192.168.1.1 through 192.168.1.254 (excluding the network and broadcast addresses).
  3. 192.168.2.50 has a different third octet (2 vs. 1), so it is on a different subnet — devices cannot communicate directly without a router.
  4. A valid unused address on the same subnet would be, for example, 192.168.1.20 (confirming it is not already assigned).
Answer: 192.168.2.50 is not valid because it is on a different subnet. A valid address such as 192.168.1.20 (same first three octets, unique host number) is correct.
3. You configure a Modbus RTU network with one master PLC and three slave devices. The slaves must each have unique addresses. You assigned them addresses 1, 2, and 1 by mistake. What happens when the master sends a request to address 1, and how do you fix it?
  1. Both slaves set to address 1 will attempt to respond to the same query simultaneously.
  2. Their signals collide on the RS-485 bus, corrupting the response; the master will log a communication error or timeout.
  3. Fix: power down one of the duplicate slaves, use its address configuration switch, web interface, or software to assign it a unique address (e.g., address 3).
  4. Verify each slave has a distinct address in the range 1–247, then update the master's MSG instruction target addresses accordingly.
Answer: Duplicate addresses cause bus collisions and communication faults. Assign each slave a unique address (e.g., 1, 2, 3) and update the master configuration.
4. A PROFINET IO-Device (remote I/O module) is replaced with an identical spare. The technician connects it but the PLC reports a station failure. The replacement module came from a different machine and still has the device name 'press-io-1'. Your machine's PLC expects the name 'weld-io-1'. What must be done?
  1. PROFINET identifies IO-Devices by their device name, not just IP address; the controller will only accept a device whose name matches the project configuration.
  2. Use the PLC programming software (e.g., TIA Portal) to go online and open the PROFINET device tool.
  3. Assign the correct device name 'weld-io-1' to the replacement module using the 'Assign device name' function while connected to it.
  4. The controller will then recognize the device, assign it the correct IP address automatically, and the station fault will clear.
Answer: Use the programming software to assign the correct PROFINET device name ('weld-io-1') to the replacement module; the controller will then establish communication and clear the fault.
In class: Lecture and diagram: instructor presents producer/consumer (EtherNet/IP), controller/device (PROFINET), and master/slave (Modbus) network models using layered diagrams; students complete a fill-in comparison table for the three protocols (media, addressing, scan method, typical application). · EtherNet/IP configuration lab: students assign IP addresses to the PLC and a second node (variable frequency drive or remote I/O module), add the device to the PLC I/O tree, verify the connection in the software, and confirm live data exchange using the online tag monitor. · Modbus read exercise (simulation or software): using a Modbus simulator or a simple RTU device, students configure a MSG read instruction (or equivalent) to read four holding registers; map register values to internal PLC tags and display them on the HMI numeric display built in Lesson 10.
Materials: Managed Ethernet switch, EtherNet/IP-capable VFD or remote I/O module (or simulation), PLC programming software, Modbus RTU simulator or device, Ethernet patch cables, comparison table worksheet, projector
Check: Comparison table 80% correct; EtherNet/IP connection shows no faults in the I/O tree and at least four tags update live (instructor verified); Modbus register values correctly appear in PLC tags.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Programmable Logic Controllers
1. Which network model does EtherNet/IP use to distribute real-time I/O data efficiently to multiple nodes at once?
Programmable Logic Controllers
2. A Modbus RTU slave is configured with unit address 5. The master sends a function code 03 request to address 5 starting at register 40001, requesting 4 registers. Which devices will respond?
Siemens Mechatronic Systems
3. A PROFINET IO-Device is identified on the network primarily by its:
Safety
4. When opening a control cabinet to plug in an Ethernet patch cable to a powered EtherNet/IP node, which NFPA 70E requirement must you satisfy before reaching inside?
Programmable Logic Controllers
5. In EtherNet/IP, the Requested Packet Interval (RPI) controls:
Programmable Logic Controllers
6. A Modbus holding register contains the raw value 1150, and the sensor documentation states the value is scaled by 100 to represent a pressure in bar. What is the actual pressure?
Programmable Logic Controllers
7. Which of the following correctly distinguishes Modbus TCP from Modbus RTU?
Programmable Logic Controllers
8. A technician must replace a remote EtherNet/IP I/O module that has failed. After connecting the replacement, the PLC I/O tree shows a fault icon on that module. Which of the following is the MOST likely first step to resolve the fault?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →