May 14, 2026 · Comparison

Industrial Protocol Comparison: Modbus, OPC UA, MQTT, S7, DNP3, EtherNet/IP and PROFINET

By Dzulfikar Ats Tsauri, founder of Voltrus / JoyoDigitama. He builds the protocol tools covered in these posts. Updated October 28, 2026.

Industrial automation runs on a handful of protocols that each solve a different problem. Pick the wrong one and you either over-engineer a simple register read or under-specify a pipeline that has to survive a slow radio link. This post compares Modbus, OPC UA, MQTT, Siemens S7, DNP3, EtherNet/IP and PROFINET, then works through the three choices that come up most on real projects: S7 vs Modbus TCP on a Siemens PLC, DNP3 vs Modbus for utilities, and EtherNet/IP vs PROFINET.

The Protocols at a Glance

Modbus (1979)

Designed by Modicon (now Schneider Electric) for PLC-to-PLC communication over serial links. Modbus TCP extended it to Ethernet in the late 1990s. It is the simplest industrial protocol still in use: a client/server model where the master reads and writes registers and coils at numeric addresses. No data model, no security, no discovery, no timestamps. Just raw register access.

OPC UA (2006)

Built by the OPC Foundation as a platform-independent successor to COM-based OPC DA. It provides a rich information model, built-in security (encryption, authentication, authorization), and discovery. It is the enterprise-grade protocol, designed for SCADA-to-MES-to-ERP integration and not just device polling.

MQTT (1999)

Created by IBM for oil pipeline monitoring over satellite links, MQTT is a publish/subscribe protocol for low-bandwidth, high-latency networks. It defines no data model for industrial equipment: you bring your own payload format. Its strength is decoupling, because publishers and subscribers never need to know about each other. For how it compares to HTTP and direct database writes, see MQTT vs HTTP vs direct database writes.

S7 / Siemens S7 Communication (1995)

Siemens' proprietary protocol for S7-300, S7-400, S7-1200 and S7-1500 PLCs. S7comm gives direct access to PLC memory areas: data blocks (DB), inputs (I), outputs (Q), markers (M), timers (T) and counters (C), over TCP port 102. See the S7 Communication Protocol Guide for memory areas and addressing. Use it when the plant is Siemens and you need to read or write PLC data without going through TIA Portal.

DNP3

Developed for electric utilities in the 1990s and now standardized as IEEE 1815. DNP3 is event-driven: outstations timestamp state changes and queue them as Class 1, 2 or 3 events, and the master retrieves them in order. It was built for slow, noisy, multi-drop radio and serial links spanning hundreds of sites, and it dominates electric, water and wastewater SCADA in North America.

EtherNet/IP and PROFINET

The two industrial Ethernet families tied to the biggest PLC vendors. EtherNet/IP carries the CIP application layer (shared with DeviceNet and ControlNet) over TCP/UDP, with named tags on Allen-Bradley Logix controllers. PROFINET carries PROFINET IO, configured in an engineering tool such as TIA Portal from GSDML device descriptions, with RT and IRT classes for deterministic cyclic I/O. Which one you use is driven mostly by which PLC ecosystem you already committed to.

Head-to-Head: Modbus, OPC UA, MQTT, S7

Head-to-Head: Modbus, DNP3, EtherNet/IP, PROFINET

When to Use Each Protocol

Modbus

• Simple devices on a local, trusted network. Energy meters, VFDs, temperature controllers, I/O modules: if it exposes registers and you read them every second, Modbus is the fastest path. Never expose Modbus TCP directly to the internet. See Modbus TCP security risks.
• Legacy equipment. Most devices built before 2010 speak Modbus, and for an old meter or PLC it is often the only option.
• Predictable traffic. Small requests and responses with no sessions or handshakes. New to it? What is Modbus covers the basics.

OPC UA

• Structured data. Equipment exposed as objects with properties, methods and events: "Pump-01.Temperature" is easier to maintain than "register 40001".
• Security requirements. X.509 certificates, user authentication, encrypted channels and audit logging.
• SCADA to MES or ERP. Companion specifications (ISA-95, PLCopen, MTConnect) map industrial data to standard models, and any OPC UA client can talk to any server.

MQTT

• Cloud and multi-site data. A PLC or gateway publishes to a topic and a cloud dashboard subscribes, with no direct connection between them.
• Limited bandwidth. A 2-byte fixed header and tiny payloads use a fraction of what OPC UA needs on cellular or satellite links.
• Store-and-forward. QoS levels and persistent sessions keep delivery working over intermittent links. See OPC UA vs MQTT for the layering between them.

S7

• Siemens plants. It is the native protocol for S7-300/400/1200/1500 and gives direct access to data blocks, inputs, outputs and markers.
• Diagnostics and monitoring. Read DB1.DBX0.0 (a BOOL) or write DB1.DBD4 (a 32-bit REAL) with no register mapping, and without opening TIA Portal. The PLC needs PUT/GET enabled first: see connecting to S7-1200/1500 from macOS.

DNP3

• Wide-area utility SCADA. Substations, pump stations and lift stations over radio, cellular or long serial links. Only changes are retrieved, so bandwidth stays low and link interruptions do not lose data.
• Sequence of events. When a breaker tripped matters as much as that it tripped, and DNP3 timestamps every event.
• Alarm prioritization. Class 1 events are retrieved before Class 3, so the master always sees urgent changes first. See DNP3 class 0/1/2/3 explained.

EtherNet/IP and PROFINET

• EtherNet/IP in Rockwell sites: ControlLogix, CompactLogix, PowerFlex drives and PanelView HMIs, with tag-based reads that suit SCADA and ad-hoc monitoring. See CIP explicit vs implicit messaging.
• PROFINET in Siemens sites: S7-1200/1500, ET 200 remote I/O and SINAMICS drives, with IRT for synchronized multi-axis motion and tight I/O.

Siemens PLC: S7 vs Modbus TCP

A Siemens S7-1200/1500 can give you data two ways, and they are two doors into the same controller opened for different visitors. S7 is native: you address typed data at its real offset (a REAL in DB10.DBD4, a BOOL at DB10.DBX0.0), and the only work is knowing the DB layout and enabling PUT/GET. Modbus TCP is universal but needs PLC-side work: you add a Modbus TCP server block (MB_SERVER) to the program and map DB data to holding registers, then publish a register map to whoever reads it.

• Choose S7 when the consumer is Siemens-aware, you want typed reads with no program changes, and you read bulk data. A single request can pull a whole DB, while Modbus is capped at 125 registers per read.
• Choose Modbus TCP when the consumer only speaks Modbus (many IoT gateways and third-party SCADA) or you want to expose only the registers you chose and keep the rest of the DB space private.
• Choose OPC UA when the consumer is cross-vendor and security matters. See S7 vs OPC UA.

They coexist on the same PLC. Many sites run S7 for the Siemens-native SCADA and Modbus TCP for a building-management or IoT layer that cannot speak anything else. For the same payload, speed is dominated by network latency and PLC scan time, not by protocol. S7 does need PUT/GET enabled, which has no authentication, so keep port 102 on an isolated OT network.

Utilities: DNP3 vs Modbus

Modbus is pure poll-response. The master asks for register values and the slave answers with the current ones. There are no timestamps, events or priorities, so to know whether something changed you poll again and compare, and it assumes a fast, reliable local link. DNP3 answers a different question: what changed, when, in what order, and did anything get lost. Outstations queue timestamped events by class, and the master polls the event backlog instead of re-reading every point.

Picking Modbus for a wide-area utility drowns a slow radio network in redundant polls. Picking DNP3 for a single plant with local Ethernet adds protocol features you will not use. In practice they sit at different layers of the same system: RTUs at remote sites talk DNP3 to the SCADA master, and each RTU talks Modbus (or another field protocol) to the meter and VFD in its own cabinet. The RTU is the protocol boundary, so "DNP3 vs Modbus" is usually a false choice. For the wider utility context see DNP3 vs IEC 60870-5-104 and SCADA for water and wastewater.

Rockwell vs Siemens: EtherNet/IP vs PROFINET

Both run on standard Ethernet hardware. EtherNet/IP uses named tags on Logix controllers, which makes ad-hoc reads easy for a SCADA or monitoring tool because the controller publishes type and structure. PROFINET uses GSDML device descriptions that model modules, subslots, diagnostics and alarms more structurally than a flat tag list, and it is engineered inside TIA Portal.

• Real-time: EtherNet/IP CIP Motion reaches deterministic motion over standard Ethernet with IEEE 1588 time sync, which is more than enough for most factory I/O. PROFINET IRT is hardware-synchronized with sub-millisecond determinism, the structural edge for synchronized multi-axis motion.
• Interoperability: they are not interoperable at the application layer. They can share cabling and switches, but a Rockwell controller cannot scan a PROFINET IO device and vice versa. Bridging needs a protocol gateway, a controller that speaks both, or OPC UA pulling data from each side. For the Modbus angle, see Modbus TCP vs PROFINET.
• Decision rule: follow your PLC vendor. Allen-Bradley means EtherNet/IP and Siemens means PROFINET. Only weigh real-time and addressing differences on a green-field build or a mixed-vendor requirement.

Security Compared

OPC UA has the strongest built-in security: X.509 certificates, role-based access, encrypted channels and audit logging. MQTT with TLS gives transport encryption and username/password authentication. EtherNet/IP has CIP Security, PROFINET has its own security classes, and DNP3 has an optional Secure Authentication extension, but many deployed devices do not have them turned on. Modbus has no security at all, and S7comm has none either, so both belong on isolated or VPN-protected networks. Neither Modbus nor S7 access should ever be port-forwarded to the internet; see the OT security checklist for SCADA.

Can They Coexist?

Yes, and most industrial sites use several at once. A typical layered architecture:

1. Field level: Modbus RTU over RS-485 connects sensors and meters to a gateway. S7 or EtherNet/IP/PROFINET connects the PLCs.
2. Remote sites: RTUs speak DNP3 back to the master over radio or cellular, and Modbus to local devices.
3. Cell/area level: a SCADA system speaks Modbus TCP, S7, EtherNet/IP and OPC UA to collect data from different vendors.
4. Site level: OPC UA aggregates SCADA data into a unified namespace for MES and historians.
5. Cloud level: MQTT transports selected points to cloud dashboards, analytics or remote monitoring.

The layered approach uses each protocol where it is strongest, and the key is a SCADA platform or gateway that speaks all of them. For how the layers fit together see SCADA architecture.