Best practices for working with Modbus/TCP

Ignition
,
1

I didn’t want to necro the threads where I saw this advice given, but I was wanting to get a clearer answer on this. The inductive automation training seems to direct you to use the address mapping feature in the Gateway, but once I started reading threads on the forum I see multiple instances of users recommending against it. Why?

@pturmel In particular I’ve seen a couple threads where you suggest to not use the address mapping feature and to instead create OPC tags directly.

Beyond this, I’d appreciate any advice others have on working with PLCs using Modbus. I’m coming from the IT/software dev world so most of this is new to me. In particular I’m working with some DL205s from Automation Direct and I have had a couple engineers here warn me about polling them for data as they are very slow, or other issues such as only being able to have a single modbus master? Another issue they told me about is that our server communicates over UDP to the PLCs, but I feel like this is wrong as the protocol is literally called Modbus/TCP, and wireshark shows TCP connections. From what I’ve read and observed Modbus/TCP supports multiple clients. Am I missing something here?

Lastly, I’d appreciate any advice in terms of cybersecurity. I see modbus/TCP is a plaintext protocol, which made it very nice for me to debug and get familiar with, but I see there is a modbus/TCP/TLS version now. Our PLCs don’t support it I believe, but beyond this, is there any other advice regarding cybersecurity? I’ve seen a couple different camps online where they suggest you completely rip up and replace all the PLCs with new ones that support advanced features like encryption etc, and others who say this isn’t necessary and to instead just keep it on a private network.

Thank you!

2

The address mapping feature is a "convenience" feature of the IA native driver that assigns some browsable names to specific ranges of bit or register addresses. That convenience adds complexity to your configuration and, as the driver author pointed out recently, add complexity to any troubleshooting you might need to do. (Error logging uses the raw addresses, requiring the troubleshooter to translate from raw address to mapped names to find troublesome tags.) You should just use the "raw" manual addresses in your OPC tags' OPC Item Paths.

If the convenience of browsable addresses is important to you, consider my alternate driver. It offers OPC browse of the raw addresses and their various data type transforms.

To my knowledge, no Ignition driver implements Modbus UDP.

The DL205 CPU only has serial ports, not ethernet, so you must use Modbus RTU with them. All forms of serial modbus can only have a single master. (And are 100x to 1000x slower than Modbus TCP, simply due to slow serial speeds.)

Modbus TLS is on the roadmap both for IA and for my alternate driver. But you should keep control system devices on private networks anyways. Modbus TLS is protection against bad actors that penetrate to that level.

1 Like