Industrial Protocol Compatibility Matrix

The matrix

UNIT 01

Where each family actually sits. Almost every integration is a matter of getting from a lower band to the highlighted one, and then out — two clean hops rather than one clever translator.

Search

20 of 20 protocols

Protocol	Where you meet it	What it carries	What it will not do	Security, honestly	Getting it out
Modbus RTUSerial fieldbusRS-485 or RS-232, master/slave polling	Energy meters, VFDs, weighing indicators, older PLCs, almost every panel meter sold since 1990.	Registers and coils. Integers and floats by convention, addressed by number.	No timestamps, no report-by-exception, no discovery, no data types beyond 16-bit registers you agree to interpret. One master per bus, and everything is a poll.	None whatsoever. No authentication, no encryption, no integrity check beyond a CRC.	A serial device server or Modbus RTU-to-TCP gateway. Straightforward and cheap. Take care tapping an existing bus — RS-485 can be listened to in parallel, RS-232 cannot.
Modbus TCPIndustrial EthernetTCP port 502	Modern instruments, gateways, PLCs, and nearly every device claiming to be open.	The same register model as RTU, over Ethernet, with multiple concurrent masters.	Everything RTU will not do, minus the bus limitation. Still no timestamps, still no types, still no discovery.	None in the protocol. Anything that can reach port 502 can write to a coil, and writes are not distinguishable from reads at the network layer without deep inspection.	Already open. Constrain it at the network instead — read-only firewall rules, and never expose 502 beyond the segment that needs it.
PROFIBUS DPSerial fieldbusRS-485, token-passing master/slave	Siemens-based plants installed between roughly 1995 and 2012, and the drives and remote I/O on them.	Cyclic process data with strong determinism, plus acyclic parameter access.	Not routable, not readable without a master or a dedicated interface, and it will not tolerate a badly terminated segment.	None. Physical access is the control.	A PROFIBUS-to-Ethernet gateway, or read the data at the PLC that is already master rather than joining the bus. The second is nearly always cheaper and safer.
PROFINETIndustrial EthernetEthernet, real-time channels alongside standard TCP/IP	Current Siemens installations, drives, remote I/O, and machine builders working in that ecosystem.	Cyclic I/O at millisecond scale, plus acyclic record access and diagnostics.	Not something to poll casually from an IT system. Real-time traffic is sensitive to what shares the network with it.	Weak by default; hardening exists in newer devices but is rarely enabled. Treat the PROFINET segment as trusted-internal and firewall its edge.	Read from the controller over OPC UA or S7comm rather than joining the PROFINET network. Joining it is possible and is almost never the right answer for a data project.
EtherNet/IP (CIP)Industrial EthernetEthernet, TCP 44818 and UDP 2222	Rockwell and Allen-Bradley plants, and equipment built for the North American market.	Tag-based access to named data in a ControlLogix or CompactLogix processor, plus cyclic I/O.	Implicit (I/O) messaging is not something a business system should participate in. Tag names are not guaranteed stable across a program revision.	CIP Security exists and is seldom deployed. Assume none, and note that a controller can be put into program mode over this protocol if it is not key-locked.	Explicit messaging from an edge gateway, or OPC UA where the controller supports it. Pin the tag list and version it, because a program change will silently rename things.
EtherCATIndustrial EthernetEthernet frames processed on the fly, ring or line topology	Motion control, packaging machinery, robotics, test rigs.	Microsecond-scale synchronised I/O. The fastest thing on this list by a wide margin.	Nothing outside the machine. It is a machine-internal bus and there is no sensible way to attach a data collector to it.	Not applicable — it is not a network in the addressable sense.	Take the data from the machine controller, which will offer OPC UA, Modbus TCP or a file export. Never plan to read EtherCAT directly.
CANopenSerial fieldbusCAN bus, 2-wire	Mobile plant, cranes, vehicles, medical and laboratory equipment, small drives.	Compact process data objects and a standard object dictionary, on a robust two-wire bus.	Long distances, high bandwidth, or anything resembling a file transfer.	None. Any node on the bus can transmit anything.	CAN-to-Ethernet gateway, or a telematics unit where the asset is mobile.
BACnet MS/TPBuilding systemsRS-485	HVAC controllers, VAV boxes, chiller plants, older building management systems.	Building objects — setpoints, sensors, schedules — in a well-defined object model.	Speed. MS/TP is slow, and a large trunk polls slowly enough to shape what you can collect.	None on MS/TP.	A BACnet router to BACnet/IP, which nearly every BMS head-end already provides.
BACnet/IPBuilding systemsUDP 47808	Current building management systems, energy meters, chillers, lighting control.	The same object model over Ethernet, with discovery through Who-Is/I-Am.	It will not cross a subnet without a BBMD configured, which is the single most common reason a building integration stalls.	Minimal. BACnet/SC addresses this and is not yet common in the field.	Already open, and the object model is genuinely good. Read it directly, and get the BBMD question answered before quoting.
OPC DA (Classic)Vendor-proprietaryWindows DCOM	SCADA systems installed before roughly 2015, and still running.	Tag values from a server that already knows how to talk to the controllers.	Cross a firewall without pain. DCOM's dynamic port allocation and authentication model make this genuinely difficult, and tunnelling products exist purely because of it.	Windows authentication, in practice frequently configured to be permissive.	An OPC DA-to-UA wrapper, or a tunneller. Both are mature products. Do not attempt to open DCOM across a network boundary.
OPC UAIndustrial EthernetTCP 4840, or HTTPS	Modern PLCs, machine controllers, historians, and anything sold as Industry 4.0 ready.	Typed, timestamped, quality-stamped values in a browsable address space, with subscriptions rather than polling.	Nothing much — this is the target format for most integration work. It is heavier than Modbus and needs certificate management to be done properly.	The strongest on this list: certificate-based authentication, signing and encryption. It is also frequently deployed in None/None mode because that is easier.	Already the destination. If a machine offers UA, use it, and insist on Sign&Encrypt rather than accepting the default.
MQTT / Sparkplug BIoT and messagingTCP 1883, or 8883 with TLS	Edge gateways, remote sites, anything reporting to a cloud platform.	Publish/subscribe messages, outbound from the plant, with Sparkplug adding a standard payload and birth/death semantics.	Deterministic control. It is a reporting transport, and using it as a control path is how a message ends up delivered twice or late.	TLS and per-device credentials, done properly. The common failure is one shared credential across a fleet.	This is usually what you bridge TO, not from. Its virtue is that the connection originates inside the plant and travels outward, which is what makes it firewall-friendly.
HART / WirelessHARTInstrument levelDigital signal superimposed on a 4–20 mA loop; IEEE 802.15.4 for the wireless variant	Process instruments — transmitters, positioners, analysers — in process industries.	The primary variable on the analogue loop, plus device diagnostics, configuration and secondary variables digitally.	Speed. HART over the loop is slow, and most installations never read the digital half at all.	None on wired HART; WirelessHART is genuinely well secured.	A HART multiplexer or a WirelessHART gateway. Worth doing where instrument diagnostics matter — most sites are paying for capability they have never connected.
IO-LinkInstrument levelPoint-to-point over standard sensor cabling to an IO-Link master	Modern discrete sensors, RFID heads, indicator lights, valve manifolds.	Process data plus identification, parameters and diagnostics from individual sensors.	Long runs, or anything beyond 20 metres to the master.	Not applicable at the device; the master is where the network boundary is.	The IO-Link master usually speaks PROFINET, EtherNet/IP or Modbus TCP. Read it there. This is the cheapest route to sensor-level diagnostics in a new installation.
DNP3Utility and gridSerial or TCP 20000	Water, wastewater, electricity distribution, and SCADA over wide areas.	Timestamped events with report-by-exception, built for links that are slow, intermittent or expensive.	Anything requiring high bandwidth or sub-second cycles.	DNP3 Secure Authentication exists and is deployed in regulated utilities, rarely elsewhere.	Read directly, or take it from the SCADA historian, which is usually simpler.
IEC 61850Utility and gridEthernet — MMS, GOOSE and sampled values	Substation automation, protection relays, switchgear.	A rich standardised data model of electrical plant, plus very fast peer-to-peer GOOSE messaging.	Tolerate casual traffic on the same network. GOOSE is time-critical and unroutable by design.	Addressed in IEC 62351 and unevenly implemented.	Read MMS from a gateway or the station computer. Never attach a data collector to the GOOSE network.
IEC 60870-5-104Utility and gridTCP 2404	Grid telecontrol, and utility SCADA in Europe and Asia.	Timestamped telemetry and commands over a wide-area link.	Fine-grained plant data. It is a telecontrol protocol, not a process historian feed.	None in the base standard; IEC 62351 adds it.	Gateway to OPC UA or MQTT, or take the data from the control centre's historian.
S7comm / S7comm-plusVendor-proprietaryTCP 102 (ISO-on-TCP)	Siemens S7-300, S7-400, S7-1200 and S7-1500 controllers.	Direct read and write of data blocks, memory and I/O in a Siemens PLC.	Behave predictably across firmware generations. S7comm-plus on the 1200/1500 is encrypted and access has to be enabled deliberately.	Optimised block access and protection levels on newer controllers are meaningful. On an S7-300, anything that reaches port 102 can read and write memory.	Use OPC UA where the controller offers it — the 1500 does. Where it does not, a driver library or gateway reads S7comm reliably, and a legacy S7-300 should be firewalled tightly.
LoRaWANIoT and messagingSub-GHz radio to a gateway, then IP	Retrofit sensing across a site — tank levels, temperature, energy sub-metering, asset presence.	Small, infrequent messages over long distances, from battery devices lasting years.	Anything frequent or large. Duty cycle and payload limits are real, and a device sending every ten seconds is not a LoRaWAN device.	Sound, with per-device keys — provided key provisioning is handled properly.	The gateway delivers to MQTT or a network server API. This is the standard answer for retrofit sensing where cabling is the expensive part.
Proprietary serial or ASCIIVendor-proprietaryRS-232 or RS-485, vendor-defined framing	Weighbridges, printers, analysers, older instruments, anything with a manual in a drawer.	Whatever the manufacturer decided, usually a fixed-format line of text per reading.	Anything not in that fixed format, and it will not tell you when it changes.	None.	A protocol converter with a custom parser. Cheap in principle, and paced entirely by whether anybody can find the interface specification. Ask for it before quoting.

Bridge finder

UNIT 02

Getting from one family to another

By family rather than by individual protocol. A twenty-by-twenty matrix would be four hundred cells nobody reads, and the honest answer is nearly always set by the pair of families rather than the pair of protocols.

From

To

Low effort

Serial fieldbus → IoT and messaging

An edge gateway that polls the serial side and publishes outbound. This is the standard retrofit shape and it is firewall-friendly, because the connection originates inside the plant.

Three things worth knowing

UNIT 03

Open does not mean secure

Most of the protocols above were designed for a wire nobody else could reach, and they are honest about that if you read them properly. Modbus TCP has no authentication at all: anything that can open port 502 can write to a coil. This is not a flaw to be fixed in the protocol, it is a property to be handled at the network — which is what the segmentation planner is for.

The polling rate is an engineering decision

A controller specified in 2008 for a control loop was not sized for a dashboard refreshing every second. The most common way to slow down a working plant with an integration project is to poll it at the rate the dashboard designer chose. Rate-limit at the edge, cache, and test on a spare before touching a running line.

Two clean hops beat one clever one

Where a bridge is needed, converting to an open protocol at the edge and moving on from there is almost always better than a single bespoke translator. Each hop can be tested on its own, replaced on its own, and understood by somebody who was not there when it was built — which is the property that matters in year three.

Technical references

UNIT 04

What the reasoning on this page is drawn from. Where a standard costs money to read it is marked, and where a free document covers the same ground better it is listed first.

Links open in a new tab so anything you have entered above survives. Every one was checked at build time; if one has rotted since, tell us and it comes out rather than getting patched from memory.

Every one of these tools is a compressed version of a conversation. If yours turned up something you would rather talk through than read about, that is what the scoping call is for — bring your result with you.

Ask about a protocol we have not listed

Also on the shelf