Industrial Communication: HART, Modbus, Fieldbus & OPC UA

How instruments, controllers and computers talk. Learn the automation pyramid, HART, Modbus RTU/TCP (function codes, registers, CRC), PROFIBUS/PROFINET, Foundation Fieldbus, EtherNet/IP, EtherCAT, IO-Link, wireless (WirelessHART, ISA100), OPC UA and MQTT for IIoT, determinism, topologies and cybersecurity — with Python that builds a real Modbus frame and decodes a float.

Modern plants have thousands of devices exchanging data: transmitters to controllers, controllers to drives, controllers to HMIs and historians, and the plant to the enterprise and cloud. Different layers need different networks: deterministic milliseconds at the machine, rich information at the top.

Knowing the common protocols lets you commission devices, troubleshoot 'no communication' problems and design secure architectures.

An analogy

Industrial networks are like a city's transport: fast dedicated tram lines (EtherCAT, PROFINET IRT) for time-critical traffic, local buses (Modbus, HART) for simple journeys, and highways (Ethernet, OPC UA, MQTT) carrying large volumes of information to headquarters.

The automation pyramid (ISA-95)

Level 0: sensors and actuators. Level 1: controllers (PLC, DCS). Level 2: supervision (SCADA, HMI, historians). Level 3: manufacturing operations (MES, batch, quality). Level 4: business (ERP). Lower levels need determinism and robustness; upper levels need bandwidth, context and security.

Device-level protocols

Common field protocols:

Industrial Ethernet

PROFINET (RT and IRT for motion), EtherNet/IP (CIP, Rockwell), EtherCAT (on-the-fly frame processing, µs cycles for motion), Modbus TCP, and time-sensitive networking (TSN) bring Ethernet to the controller level. Topologies: star, line, ring with redundancy protocols (MRP, DLR, PRP/HSR) for fault tolerance.

OPC UA, MQTT and cybersecurity

OPC UA offers platform-independent, secure (certificates, encryption), information-model-based communication between controllers, SCADA, MES and cloud; companion specifications define standard models (e.g. PA-DIM for process devices). MQTT (often with Sparkplug B) publishes data efficiently to brokers for IIoT. IEC 62443 defines zones and conduits, security levels and secure development: segment networks with firewalls/DMZs, remove default passwords, patch, and monitor — attacks like Stuxnet and TRITON targeted exactly these systems.

Formulas

Worked example: Modbus addressing

Given: Holding register '40108' in documentation

Find: Protocol address.

Answer: Address 107 (0x006B) — the classic off-by-one

Worked example: Polling time

Given: 19 200 baud, request 8 bytes, response 25 bytes, 11 bits/char

Find: Transfer time.

Answer: ≈ 18.9 ms (+ gaps and turnaround ≈ 25 ms per device)

Worked example: HART

Given: Transmitter at 12 mA with HART

Find: Does HART disturb the analog value?

Answer: No — the DC average stays 12 mA

Building a Modbus RTU request and decoding a float

# Build a Modbus RTU "read holding registers" request and its CRC-16
def crc16(data):
    crc = 0xFFFF
    for b in data:
        crc ^= b
        for _ in range(8):
            crc = (crc >> 1) ^ 0xA001 if crc & 1 else crc >> 1
    return crc

req = bytes([0x11, 0x03, 0x00, 0x6B, 0x00, 0x03])   # slave 17, fn 3, addr 107, 3 regs
c = crc16(req)
frame = req + bytes([c & 0xFF, c >> 8])             # CRC sent low byte first
print("request:", frame.hex(" ").upper())

# Decode a 32-bit float spread over two registers (big-endian word order)
import struct
regs = [0x42F6, 0xE979]
value = struct.unpack(">f", struct.pack(">HH", *regs))[0]
print(f"registers {regs[0]:04X} {regs[1]:04X} -> {value:.3f}")
# request: 11 03 00 6B 00 03 76 87
# registers 42F6 E979 -> 123.456

The frame matches the example in the official Modbus specification (read 3 holding registers from address 107 of slave 17, CRC 0x8776). Floats span two 16-bit registers, and vendors disagree on word order — the most common Modbus integration bug ('byte/word swap').

Common mistakes

Applications

Key takeaways

Going further