The first question when taking data from a plant is “which protocol?”. The answer depends on which vendor’s device speaks with which software version, and a wrong choice can lead to weeks of trial and error. This article summarizes the industrial protocols most often met in the field, their typical ports and the questions to ask when choosing a driver.
First check whether the device offers a native OPC UA server. If not, a vendor-specific driver is needed; before choosing it, check the protocol, port, device prerequisites and security impact.
The data acquisition path
A driver speaks the protocol of a specific device family and translates the data to a standard interface. Platforms such as Kepware Server provide drivers for hundreds of devices (driver list); data is exposed as OPC UA, OPC DA or MQTT.
Common protocols
| Protocol | Typical devices | Default port | Data access and notes |
|---|---|---|---|
| Modbus TCP / RTU | Meters, energy analysers, drives, small PLCs | 502 (TCP); RTU is a serial line | Register-based; no types or timestamps, an address map is needed |
| Siemens S7 | S7-300/400, S7-1200/1500 | 102 (ISO-on-TCP) | By data block address; S7-1200/1500 need remote access permission and block access settings |
| EtherNet/IP (CIP) | Rockwell / Allen-Bradley Logix series | 44818 | Access by symbolic tag names; separate implicit messaging for I/O |
| PROFINET | Siemens and other I/O devices | Ethernet layer 2 (real-time) | Mainly for cyclic I/O between controller and devices; S7 or OPC UA is usually used for data collection |
| BACnet/IP | Building automation | 47808 (UDP) | Object and property model |
| IEC 60870-5-104 | Power transmission and distribution | 2404 | For SCADA and telecontrol |
| DNP3 | Water, power, pipelines | 20000 | Supports events and timestamped data |
| OPC UA | New PLCs, gateways, DCS | 4840 | Information model, security, discovery |
| MQTT | Edge gateways, IoT devices | 1883 (plain), 8883 (TLS) | Publisher–subscriber; payload format defined separately (Sparkplug B) |
Eight questions to ask when choosing a driver
- Does the device offer a native OPC UA server? Many current PLCs (for example the S7-1500 family) include a built-in OPC UA server; if available it is usually the cleanest path. Check licence and software-version requirements.
- What is the device’s exact model and software version? Different versions of the same family may need different driver options.
- What prerequisites are needed on the device side? For example some PLCs require remote access to be permitted or block access to be configured.
- Which ports must be open and what is the firewall rule? The defaults in the table are a starting point; rules should be written according to network segmentation (IT/OT integration).
- How is addressing done? Symbolic (tag name) or absolute (data block/register)? Is there an address map document?
- What happens to device load? Number of tags × scan rate must not exceed the device’s request capacity.
- Who produces timestamp and quality? The device or the driver? (data quality and timestamps).
- Is writing needed? If writing will be enabled, permission and acknowledgement mechanisms should be designed.
A security note
Most legacy protocols offer no authentication or encryption; Modbus and some PLC access methods can grant read, and often write, permission to anyone who connects. That is why this traffic should stay inside a segmented OT network and be exposed outward only through a secure interface such as OPC UA or MQTT (TLS). Preferring native OPC UA in new devices improves both integration and security.
The right path: validate small first
Before defining hundreds of tags, read a few tags on a single device and verify quality and timestamp, then scale the load (the Kepware channel–device–tag model). For all data collection options see choosing the right data collection path.
Frequently asked questions
Can I take data directly from PROFINET?
PROFINET is mainly for cyclic I/O between a controller and field devices. To collect data from a PC or server, the PLC’s S7 access or its native OPC UA server is usually used.
Why is an address map needed for Modbus?
Modbus carries only register numbers and raw values; what each register means, its type and its scale are in the device’s documentation.
What if there is no driver?
Options such as the vendor’s OPC UA server, a protocol gateway or developing a custom driver are evaluated; you can get in touch for a technical discussion.
