The matrix

UNIT 01

Where each protocol family sits. Almost every integration moves data from a lower band up to the highlighted band, and then out to business systems. Two simple conversion steps work better than one complex translator.

Search

20 of 20 protocols

Protocol	Where it is used	What it carries	What it cannot do	Security in practice	How to read the data
Modbus RTUSerial fieldbusRS-485 or RS-232, master/slave polling	Energy meters, variable-frequency drives (VFDs), weighing indicators, older PLCs and almost every panel meter sold since 1990.	Registers and coils, addressed by number. Integers and floating-point values are stored by convention.	It has no timestamps, no report-by-exception and no device discovery. Its only data type is the 16-bit register, which both sides must agree how to interpret. Each bus has one master, and every reading is a poll.	None. It has no authentication and no encryption. Its only integrity check is a CRC.	Use a serial device server or a Modbus RTU-to-TCP gateway. This is simple and cheap. Take care when connecting to an existing bus: you can listen to RS-485 in parallel, but not RS-232.
Modbus TCPIndustrial EthernetTCP port 502	Modern instruments, gateways, PLCs and nearly every device sold as open.	The same register model as Modbus RTU, over Ethernet, with several masters at the same time.	It has the same limits as Modbus RTU, except the one-master bus limit. It still has no timestamps, no data types and no discovery.	The protocol has none. Any device that can reach port 502 can write to a coil. At the network layer, writes look the same as reads unless you use deep packet inspection.	The protocol is already open. Control it at the network level with read-only firewall rules. Never expose port 502 outside the segment that needs it.
PROFIBUS DPSerial fieldbusRS-485, token-passing master/slave	Siemens-based plants installed between roughly 1995 and 2012, and their drives and remote I/O.	Cyclic process data with highly predictable timing, plus acyclic access to parameters.	It cannot be routed. You cannot read it without a master or a dedicated interface. A badly terminated segment will cause it to fail.	None. The only protection is control of physical access.	Use a PROFIBUS-to-Ethernet gateway, or read the data from the PLC that is already the master. Reading from the PLC is nearly always cheaper and safer than joining the bus.
PROFINETIndustrial EthernetEthernet, real-time channels alongside standard TCP/IP	Current Siemens installations, drives, remote I/O, and machine builders who use Siemens equipment.	Cyclic I/O at millisecond speed, plus acyclic access to records and diagnostics.	An IT system should not poll it directly. Its real-time traffic is affected by any other traffic on the same network.	Weak by default. Newer devices offer security hardening, but it is rarely switched on. Treat the PROFINET segment as a trusted internal zone and put a firewall at its boundary.	Read from the controller over OPC UA or S7comm. You can join the PROFINET network, but for a data project this is almost never the right choice.
EtherNet/IP (CIP)Industrial EthernetEthernet, TCP 44818 and UDP 2222	Rockwell and Allen-Bradley plants, and equipment built for the North American market.	Tag-based access to named data in a ControlLogix or CompactLogix processor, plus cyclic I/O.	Business systems should not take part in implicit (I/O) messaging. Tag names may change when the controller program is revised.	CIP Security exists but is seldom used, so assume there is none. Over this protocol, anyone can switch a controller into program mode unless its key switch is locked.	Use explicit messaging from an edge gateway, or OPC UA where the controller supports it. Fix the tag list and keep it under version control, because a program change can rename tags without warning.
EtherCATIndustrial EthernetEthernet frames processed on the fly, ring or line topology	Motion control, packaging machinery, robotics, test rigs.	Synchronised I/O at microsecond speed. It is by far the fastest protocol in this matrix.	It works only inside the machine. It is an internal machine bus, and there is no practical way to connect a data collector to it.	Not applicable, because it is not an addressable network.	Take the data from the machine controller, which will offer OPC UA, Modbus TCP or a file export. Never plan to read EtherCAT directly.
CANopenSerial fieldbusCAN bus, 2-wire	Mobile machinery, cranes, vehicles, medical and laboratory equipment, and small drives.	Compact process data objects and a standard object dictionary, on a two-wire bus that resists electrical noise.	It cannot cover long distances, carry high bandwidth or transfer files.	None. Any device on the bus can send any message.	Use a CAN-to-Ethernet gateway, or a telematics unit if the equipment moves.
BACnet MS/TPBuilding systemsRS-485	HVAC controllers, VAV (variable air volume) boxes, chiller plants and older building management systems (BMS).	Building objects (setpoints, sensors, schedules) in a well-defined object model.	It is slow. On a large trunk, polling is slow enough to limit what data you can collect.	None on MS/TP.	Use a BACnet router to convert to BACnet/IP. Nearly every central BMS server already provides one.
BACnet/IPBuilding systemsUDP 47808	Current building management systems, energy meters, chillers and lighting control.	The same object model over Ethernet, with device discovery through Who-Is/I-Am messages.	It cannot cross a subnet unless a BBMD (BACnet broadcast management device) is configured. This is the most common reason building integrations stall.	Minimal. BACnet/SC adds security, but few sites use it yet.	The protocol is already open, and its object model is good. Read it directly, and confirm the BBMD set-up before quoting.
OPC DA (Classic)Vendor-proprietaryWindows DCOM	SCADA systems installed before roughly 2015 that are still running.	Tag values from a server that is already connected to the controllers.	It does not pass through a firewall easily. DCOM assigns ports dynamically and has a complex authentication model. Tunnelling products exist only to solve this problem.	Windows authentication, which in practice is often configured to allow too much access.	Use an OPC DA-to-UA wrapper or a tunnelling product. Both are mature products. Do not try to open DCOM across a network boundary.
OPC UAIndustrial EthernetTCP 4840, or HTTPS	Modern PLCs, machine controllers, historians and any equipment sold as Industry 4.0 ready.	Values with data types, timestamps and quality flags, in an address space you can browse. Clients subscribe to changes instead of polling.	Very little. It is the target format for most integration work. It uses more resources than Modbus, and it needs proper certificate management.	The strongest in this matrix, with certificate-based authentication, signing and encryption. However, many sites run it in None/None mode because that is easier.	OPC UA is usually the target format already. If a machine offers it, use it, and require Sign&Encrypt mode instead of the default.
MQTT / Sparkplug BIoT and messagingTCP 1883, or 8883 with TLS	Edge gateways, remote sites and any system that reports to a cloud platform.	Publish/subscribe messages sent out from the plant. Sparkplug adds a standard message format and birth/death messages that show when a device connects or disconnects.	It cannot provide control with guaranteed timing. It is designed for reporting. If you use it for control, messages can arrive twice or late.	TLS and a separate credential for each device, when set up properly. The common mistake is one shared credential for all devices.	MQTT is usually the protocol you convert to. Its main advantage is that the connection starts inside the plant and goes outward, so it works well with firewalls.
HART / WirelessHARTInstrument levelDigital signal superimposed on a 4–20 mA loop; IEEE 802.15.4 for the wireless variant	Process instruments (transmitters, positioners, analysers) in the process industries.	The main measured value on the analogue loop. Device diagnostics, configuration and secondary values travel digitally on the same loop.	It is slow over the loop. Most installations never read the digital signal at all.	None on wired HART. WirelessHART is well secured.	Use a HART multiplexer or a WirelessHART gateway. This is worth doing where instrument diagnostics matter. Most sites have paid for this capability but never connected it.
IO-LinkInstrument levelPoint-to-point over standard sensor cabling to an IO-Link master	Modern discrete sensors, RFID readers, indicator lights and valve manifolds.	Process data, plus identification, parameters and diagnostics from each sensor.	It cannot run more than 20 metres to the master.	Not applicable at the device. The network boundary is at the master.	The IO-Link master usually supports PROFINET, EtherNet/IP or Modbus TCP, so read the data from the master. In a new installation, this is the cheapest way to get sensor-level diagnostics.
DNP3Utility and gridSerial or TCP 20000	Water, wastewater, electricity distribution and wide-area SCADA.	Timestamped events with report-by-exception, designed for links that are slow, unreliable or expensive.	It cannot handle high bandwidth or cycles faster than one second.	DNP3 Secure Authentication exists. Regulated utilities use it, but other sites rarely do.	Read it directly, or take the data from the SCADA historian, which is usually simpler.
IEC 61850Utility and gridEthernet: MMS, GOOSE and sampled values	Substation automation, protection relays and switchgear.	A detailed standard data model of electrical equipment, plus very fast device-to-device GOOSE messages.	It cannot share its network with other traffic. GOOSE messages are time-critical and are designed so that they cannot be routed.	IEC 62351 covers security, but implementation varies widely.	Read MMS from a gateway or the station computer. Never attach a data collector to the GOOSE network.
IEC 60870-5-104Utility and gridTCP 2404	Grid telecontrol, and utility SCADA in Europe and Asia.	Timestamped telemetry and commands over a wide-area link.	It does not carry detailed plant data. It is a telecontrol protocol and was not designed to feed a process historian.	None in the base standard. IEC 62351 adds security.	Use a gateway to OPC UA or MQTT, or take the data from the control centre's historian.
S7comm / S7comm-plusVendor-proprietaryTCP 102 (ISO-on-TCP)	Siemens S7-300, S7-400, S7-1200 and S7-1500 controllers.	Direct read and write of data blocks, memory and I/O in a Siemens PLC.	Its behaviour changes between firmware generations. On the S7-1200 and S7-1500, S7comm-plus is encrypted, and access must be switched on deliberately.	On newer controllers, optimised block access and protection levels give real protection. On an S7-300, any device that reaches port 102 can read and write memory.	Use OPC UA where the controller offers it, as the S7-1500 does. Where it does not, a driver library or gateway can read S7comm reliably. Protect a legacy S7-300 with strict firewall rules.
LoRaWANIoT and messagingSub-GHz radio to a gateway, then IP	Sensors added to an existing site, for tank levels, temperature, energy sub-metering and asset location.	Small, infrequent messages over long distances, from battery-powered devices that last for years.	It cannot send frequent or large messages. Its limits on transmission time and message size are strict. A device that must send every ten seconds is not suited to LoRaWAN.	Good, with a separate key for each device, provided the keys are issued and managed properly.	The gateway sends data to MQTT or a network server API. This is the standard choice for adding sensors to an existing site where cabling would be expensive.
Proprietary serial or ASCIIVendor-proprietaryRS-232 or RS-485, vendor-defined framing	Weighbridges, printers, analysers and older instruments, often with only a paper manual.	Whatever format the manufacturer chose, usually one fixed-format line of text per reading.	It carries nothing outside that fixed format, and it gives no warning when the format changes.	None.	Use a protocol converter with a custom parser. This is cheap in principle. The schedule depends entirely on whether anyone can find the interface specification, so ask for it before quoting.

Bridge finder

UNIT 02

The protocol family decides how hard a bridge will be

Choose the protocol family you are starting from and the one you need to reach. The answer nearly always depends on the two families, so we give guidance by family. A full twenty-by-twenty table of protocols would have four hundred cells and be hard to use.

From

To

Low effort

Serial fieldbus → IoT and messaging

Use an edge gateway that polls the serial devices and publishes the data outward. This is the standard retrofit design. It works well with firewalls, because the connection starts inside the plant.

Three points for any protocol project

UNIT 03

An open protocol is not necessarily a secure one

Most of the protocols in this matrix were designed for isolated cables that no outsider could reach. Their specifications make this clear. Modbus TCP has no authentication: any device that can reach port 502 can write to a coil. You cannot fix this in the protocol. You must control it at the network level, and our segmentation planner helps you do that.

An engineer should set the polling rate

A controller specified in 2008 for a control loop was not sized for a dashboard that refreshes every second. Integration projects most often slow down a working plant by polling it at the rate the dashboard designer chose. Limit the polling rate at the edge, cache the data, and test on a spare controller before you connect to a running line.

Two simple conversion steps are better than one complex one

Where you need a bridge, convert to an open protocol at the edge and pass the data on from there. This is almost always better than a single custom translator. You can test and replace each step separately. An engineer who did not build it can also understand it, which matters most in the third year of operation.

Technical references

UNIT 04

These are the sources for the reasoning on this page. We mark standards that you must pay to read. Where a free document covers the same subject better, we list it first.

Links open in a new tab, so you do not lose anything you have entered on this page. We checked every link when we built the page. If a link no longer works, please tell us and we will remove it.

Each of these tools is a short version of a conversation with one of our engineers. If your result raised a question you want to discuss, book a scoping call and bring your result with you.

Ask about a protocol we have not listed

More resources

Industrial Protocol Compatibility Matrix