Industrial communication: HART, Profibus and Modbus

Instrumentation and Control Engineering (B.E./B.Tech) · Industrial automation · free study notes for exams, placements and interviews

In short

Industrial communication protocols carry measurement, control and diagnostic data between field instruments, PLC/DCS controllers and supervisory systems. HART rides digital data on top of the existing 4-20 mA analogue loop; Modbus is a simple, open master-slave register protocol used everywhere from energy meters to VFDs; Profibus is a high-speed fieldbus standardised in IEC 61158/61784 with a process-automation variant (Profibus PA) for hazardous areas. Instrumentation graduates are examined on this in Industrial Automation, Process Instrumentation and Computer Control of Processes papers, and GATE/IN asks protocol features, bit rates and topologies. In Indian industry the knowledge is used daily by automation engineers at L&T, Honeywell, Yokogawa, ABB, Siemens, Emerson, Rockwell, BHEL, NTPC, IOCL, Reliance and Tata Steel for commissioning, loop checking and troubleshooting.

Explained

Why protocols, and the automation pyramid

A protocol is an agreed set of rules for physical signalling, framing, addressing, error checking and data meaning so that devices from different vendors can exchange data.
Levels: field level (sensors, actuators - HART, Profibus PA, Foundation Fieldbus) → control level (PLC/DCS - Profibus DP, Modbus, Profinet, EtherNet/IP) → supervisory level (SCADA/HMI - OPC UA, Modbus TCP) → enterprise level (MES/ERP - Ethernet, OPC UA).
OSI mapping: fieldbuses normally implement only layers 1, 2 and 7 (physical, data link, application); layers 3-6 are omitted because messages are short and the network is local.
Determinism matters more than raw speed in control: a guaranteed worst-case response time (cycle time) is needed, which is why token/polling schemes are preferred to collision-based ones.
Analogue vs digital signalling: a 4-20 mA loop carries one variable with no diagnostics and needs one pair per instrument; a digital bus carries many variables, status and diagnostics on a shared pair, cutting cable and marshalling cost.
Smart/intelligent transmitter: a microprocessor-based instrument that can be configured, re-ranged and self-diagnosed remotely over a digital link.

HART (Highway Addressable Remote Transducer)

Idea: superimpose a digital FSK (frequency shift keying) signal on the 4-20 mA current loop - Bell 202 standard, 1 = 1,200 Hz, 0 = 2,200 Hz, 1,200 bps.
The FSK signal is a sine wave of ±0.5 mA amplitude whose average over a bit period is zero, so the analogue 4-20 mA value is undisturbed - this is the key exam point: HART is simultaneous analogue and digital communication on the same two wires.
Backward compatible: an existing 4-20 mA loop with a 250 Ω sense resistor can be HART-enabled without rewiring; HART is often called a hybrid protocol.
Master-slave, half duplex. Two masters allowed: primary master (PLC/DCS or asset-management system) and secondary master (handheld communicator, e.g. Emerson 475/Trex, Yokogawa YHC).
Modes:
1. Point-to-point (analogue + digital): address 0, current carries the PV, digital carries diagnostics and configuration. About 2-3 replies per second per device.
2. Multidrop (digital only): up to 15 slaves (addresses 1-15) on one pair; current is parked at 4 mA, all data is digital, update rate is slow - used for tank gauging, temperature multiplexing, not for fast loops.
3. Burst mode: the slave transmits continuously without being polled, raising throughput to about 3-4 messages/s.
Variables: PV (primary), SV, TV, QV (secondary/third/fourth) - e.g. a Coriolis meter sends mass flow, density, temperature and totaliser.
Commands: *Universal* (0-30, must be supported by all - read manufacturer/type, read PV, read loop current), *Common Practice* (optional but standardised - re-range, trim, set damping), *Device-Specific* (vendor's own).
Device description: the DD/DD file (written in DDL) tells a host how to display and configure a particular device; FDT/DTM and FDI are the newer host-integration frameworks.
Loop requirements: minimum 230-250 Ω and maximum about 1,100 Ω loop resistance; cable capacitance limits length (roughly 1,500 m single pair, up to ~3,000 m with low-capacitance shielded twisted pair).
HART 7 added WirelessHART (IEC 62591) - 2.4 GHz IEEE 802.15.4, self-organising mesh, TDMA with channel hopping, AES-128 encryption - plus time-stamped and event-notification messages.
Limitations: slow (1,200 bps), only one analogue variable per loop, polled architecture, not suited to fast or safety-critical closed loops.

Modbus

Published by Modicon (1979), now maintained by the Modbus Organization; completely open and royalty-free, which explains its ubiquity.
Variants:
- Modbus RTU: serial, binary frames, CRC-16 error check, compact and fast - the usual choice on RS-485.
- Modbus ASCII: each byte sent as two hex characters, frame delimited by ':' and CR/LF, LRC check - readable, half the throughput.
- Modbus TCP/IP: the same application frame (ADU minus CRC) wrapped in an MBAP header and sent over TCP port 502.
Physical layer: RS-232 (point-to-point) or RS-485 (2-wire differential, multidrop) - up to 32 unit loads per segment without repeaters, 1,200 m at modest baud, typically 9,600 to 115,200 bps; needs 120 Ω termination and correct A/B polarity; daisy-chain (bus) topology only, no star/stub.
Addressing: 1-247 for slaves, 0 = broadcast (write functions only), 248-255 reserved.
Data model - four tables:

Table	Type	Access	Typical use
Discrete Inputs	1 bit	Read only	Limit switches, status
Coils	1 bit	Read/Write	Valve open command, motor start
Input Registers	16 bit	Read only	Measured values from transmitters
Holding Registers	16 bit	Read/Write	Setpoints, tuning parameters, meter data

Common function codes: 01 read coils, 02 read discrete inputs, 03 read holding registers, 04 read input registers, 05 write single coil, 06 write single register, 15 (0x0F) write multiple coils, 16 (0x10) write multiple registers, 23 (0x17) read/write multiple registers.
Limits per transaction: 2,000 bits (read coils/inputs), 125 holding registers read, 123 registers written - because the serial PDU is capped at 253 bytes.
RTU framing: silence of 3.5 character times marks start/end of frame; a gap over 1.5 character times inside a frame makes it invalid.
Exception response: function code with the MSB set (e.g. 0x83) plus an exception code - 01 illegal function, 02 illegal data address, 03 illegal data value, 04 slave device failure, 05 acknowledge, 06 slave busy.
32-bit values (floats, totalisers) occupy two consecutive registers; word order (big-endian vs little-endian / "word swap") is vendor-dependent and is the single commonest commissioning problem.
Advantages: simple, open, cheap, implemented in almost every meter, drive, UPS, RTU and PLC. Limitations: no standard data typing or device description, master-polled (no peer-to-peer or event reporting), no built-in security (Modbus TCP is plaintext and must be firewalled/segmented), no diagnostics layer.

Profibus

PROFIBUS = Process Field Bus, originally DIN 19245, now in IEC 61158/IEC 61784 (Communication Profile Family 3); owned by PI (PROFIBUS & PROFINET International).
Variants:
- Profibus DP (Decentralised Peripherals): factory automation, cyclic I/O exchange with remote I/O, drives and valves; RS-485 or fibre; 9.6 kbps to 12 Mbps.
- Profibus PA (Process Automation): process instruments; 31.25 kbps Manchester-coded on IEC 61158-2 (H1) physical layer, two-wire bus-powered, suitable for intrinsically safe areas via FISCO/FNICO; links to DP through a DP/PA coupler or link.
- Profibus FMS - older, message-oriented, obsolete in new designs.
DP versions: DP-V0 (cyclic data exchange, diagnostics), DP-V1 (acyclic read/write for parameterisation and asset management, alarms), DP-V2 (slave-to-slave *DXB* broadcast, isochronous mode, clock sync - for drive synchronisation).
Bus access - hybrid medium access control:
1. Token passing between active (master) stations - the token circulates in a logical ring, giving each master a bounded possession time.
2. Polling of passive (slave) stations by the master holding the token - master-slave.
3. This gives multi-master with deterministic cycle time; the target rotation time (T_TR) is the design parameter.
Physical layer (DP): RS-485 shielded twisted pair, line topology, 9-pin D-sub, active bus termination at both segment ends, max 32 stations per segment, up to 126 addresses (0-125) with repeaters, maximum 9 repeaters typical; segment length depends on baud rate (1,200 m at 9.6-93.75 kbps, 1,000 m at 187.5 kbps, 200 m at 1.5 Mbps, down to 100 m at 12 Mbps).
Profibus PA physical limits: 31.25 kbps, max 1,900 m per segment, max 32 devices (far fewer in an IS segment because of the current budget), trunk-and-spur topology, terminators at both trunk ends, typical device current draw 10-20 mA.
Configuration: each slave ships with a GSD file (General Station Description, text file listing I/O modules, supported baud rates, diagnostics); the engineering tool builds the bus configuration from GSD files. PA devices add EDD/FDT-DTM for parameterisation.
Diagnostics: standardised station, module and channel-level diagnostic bytes - far richer than Modbus.
Related: Profinet is the Ethernet successor (RT and IRT classes); Profisafe carries safety data over the same bus up to SIL 3; HART-IP, Foundation Fieldbus H1/HSE, DeviceNet, CANopen, EtherCAT and OPC UA are the other names expected in comparison questions.

Comparison, selection and Indian practice

Choose HART to add diagnostics and remote configuration to existing 4-20 mA loops with minimum change - the default for Indian refinery and power-plant instrumentation retrofits.
Choose Modbus for simple, cheap, vendor-mixed data collection: energy meters, VFDs, gensets, water SCADA, solar inverters.
Choose Profibus DP for fast machine/remote-I/O control; Profibus PA / Foundation Fieldbus for a new process plant where cable saving and device diagnostics justify the engineering effort.
Indian standards: fieldbus specifications are adopted largely as IEC texts - IEC 61158 (fieldbus specification), IEC 61784 (profiles), IEC 62591 (WirelessHART), IEC 62443 for industrial cyber security, and IEC 61508/61511 where the bus carries safety functions. BIS has corresponding IS/IEC adoptions in the LITD sector; quote the IEC number if the exact IS/IEC adoption number is not certain.
Hazardous areas: installation follows IS/IEC 60079 series (and the Petroleum Rules / OISD guidance in oil and gas); intrinsically safe bus segments are designed to the FISCO model so the segment energy stays below ignition limits.
Cyber security: CEA's cyber security regulations for the power sector and CERT-In directions push segmentation of Modbus TCP and OT networks; never expose port 502 to a public network.

Key points

HART - 1,200 bps FSK (Bell 202) digital data superimposed on a 4-20 mA loop; analogue and digital coexist.
Zero-average FSK - the ±0.5 mA sine averages to zero over a bit, so the analogue reading is unaffected.
HART modes - point-to-point (address 0), multidrop (up to 15 slaves, current fixed at 4 mA), burst.
Two HART masters - primary (host) and secondary (handheld), half-duplex, 2-3 transactions/s.
HART loop resistance - about 230/250 Ω minimum to about 1,100 Ω maximum for reliable signalling.
DD file - device description that lets any HART host configure any HART device; WirelessHART is IEC 62591.
Modbus - open master-slave protocol; RTU (binary, CRC-16), ASCII (hex, LRC), TCP (port 502, MBAP header).
Modbus data model - discrete inputs, coils, input registers, holding registers; FC 01-06, 15, 16, 23.
Modbus addressing - slaves 1-247, address 0 is broadcast (writes only); max 125 holding registers per read.
RS-485 - 2-wire differential multidrop, 32 unit loads/segment, up to 1,200 m, 120 Ω termination at both ends.
Profibus DP - 9.6 kbps to 12 Mbps on RS-485; cyclic I/O for factory automation; max 126 addresses, 32 per segment.
Profibus PA - 31.25 kbps Manchester on IEC 61158-2, bus-powered, intrinsically safe, 1,900 m per segment.
Hybrid MAC - token passing among masters plus polling of slaves gives multi-master determinism.
GSD file - machine-readable device data sheet needed to configure a Profibus slave.
DP-V0/V1/V2 - cyclic; acyclic + alarms; slave-to-slave and isochronous.
Standards - IEC 61158/61784 for fieldbus, IEC 62591 WirelessHART, IEC 62443 for OT security.
Determinism beats bandwidth - a bounded worst-case cycle time is what control needs.
Commonest field faults - missing/incorrect termination, reversed A/B, wrong baud or parity, word-order mismatch on 32-bit values.

Formulas and examples

Bit time t_b = 1 / baud rate (s); character time t_c = (bits per character) / baud rate
Modbus RTU character = 11 bits (1 start + 8 data + 1 parity + 1 stop); with no parity, 11 bits is still used (2 stop bits)
RTU frame silence: t_silence = 3.5 × t_c ; intra-frame limit = 1.5 × t_c
Modbus RTU frame length = 1 (address) + 1 (function) + n (data) + 2 (CRC) bytes
Poll cycle time T_cycle = Σ [ (request bytes + response bytes) × t_c + t_slave_turnaround ]
HART transaction rate ≈ 2 to 3 per second (point-to-point); bit rate = 1,200 bps
HART loop: V_supply ≥ I_max × R_total + V_transmitter(min) ; R_total includes sense resistor + cable resistance
Profibus DP bus cycle T_cycle ≈ n × (T_request + T_response + T_IDL) ; target rotation time T_TR must exceed it
Current-to-value scaling: Value = LRV + (I − 4) × (URV − LRV) / 16
Register scaling: Engineering value = Raw × (Span / Full-scale count) + Offset

Example 1 - Modbus RTU frame time. A master reads 10 holding registers from slave 7 at 9,600 bps, 8-N-2.

Character time t_c = 11/9,600 = 1.1458 ms.
Request = 8 bytes (addr, FC, start-addr hi/lo, count hi/lo, CRC hi/lo) → 8 × 1.1458 = 9.17 ms.
Response = 1 + 1 + 1 (byte count) + 20 (data) + 2 (CRC) = 25 bytes → 25 × 1.1458 = 28.65 ms.
Inter-frame silence 3.5 t_c = 4.01 ms, applied twice ≈ 8.02 ms.
Total ≈ 9.17 + 28.65 + 8.02 ≈ 45.8 ms plus slave turnaround. With 10 such slaves the scan is about 0.46 s - acceptable for monitoring, too slow for a 100 ms control loop.

Example 2 - Modbus TCP vs RTU throughput. The same 10-register read over Modbus TCP on 100 Mbps Ethernet: ADU = 7-byte MBAP + 5-byte PDU = 12 bytes request, 7 + 22 = 29 bytes response; even with 54 bytes of Ethernet/IP/TCP overhead each way, transmission time is under 0.02 ms. The limit becomes TCP/stack latency (typically 1-10 ms), i.e. roughly 5 to 40 times faster per transaction than RTU at 9,600 bps.

Example 3 - HART loop resistance and supply. A two-wire transmitter needs 12 V minimum at its terminals, the DCS input has a 250 Ω sense resistor, and the cable is 2 × 800 m of 1.5 mm² copper (≈12.1 Ω/km).

Cable resistance = 2 × 0.8 km × 12.1 = 19.4 Ω. Total R = 250 + 19.4 ≈ 269.4 Ω.
Worst-case drop at 20 mA = 0.020 × 269.4 = 5.39 V.
Required supply = 12 + 5.39 ≈ 17.4 V → a 24 V DC loop supply is adequate, with 6.6 V margin.
R is above the 230 Ω minimum and well below ~1,100 Ω, so HART communication is satisfactory.

Example 4 - 4-20 mA plus HART scaling. A pressure transmitter is ranged 0-25 bar (LRV 0, URV 25). The loop current reads 14.4 mA.

Value = 0 + (14.4 − 4) × 25/16 = 10.4 × 1.5625 = 16.25 bar.
The handheld reads the digital PV as 16.19 bar: the 0.06 bar difference is the D/A converter error in the transmitter output stage, corrected by a loop (output) trim, not by a sensor trim - a classic interview distinction.

Example 5 - Profibus DP cycle estimate. 20 slaves, each exchanging 16 bytes in and 16 bytes out, at 1.5 Mbps. Each DP telegram adds about 11 bytes of overhead, and every byte is an 11-bit UART character.

Bytes per slave per cycle ≈ (16 + 11) + (16 + 11) = 54 bytes → 54 × 11 = 594 bits.
Time = 594 / 1,500,000 = 0.396 ms per slave; × 20 = 7.9 ms.
Adding station delay and token overhead (say 40%) gives roughly 11 ms - comfortably inside a 20 ms target rotation time, so a 20 ms PLC scan is feasible. The same traffic at 9.6 kbps would take about 1.24 s.

Feature	HART	Modbus RTU	Profibus DP	Profibus PA
Physical layer	4-20 mA loop, FSK	RS-485 / RS-232	RS-485 / fibre	IEC 61158-2, 2-wire
Speed	1,200 bps	1.2-115.2 kbps	9.6 kbps-12 Mbps	31.25 kbps
Access method	Master-slave (2 masters)	Single master-slave	Token + polling (multi-master)	Token + polling via coupler
Max devices	1 (P2P) / 15 (multidrop)	247 addresses, 32/segment	126 addresses, 32/segment	~32 (fewer if IS)
Max distance	~1,500-3,000 m	1,200 m	1,200 m at 9.6 kbps, 100 m at 12 Mbps	1,900 m
Bus power	Loop powered	Separate	Separate	Bus powered
Intrinsic safety	Yes (loop)	Not inherent	No	Yes (FISCO)
Error check	Parity + checksum	CRC-16 (LRC in ASCII)	FCS, HD 4	FCS
Device file	DD / DTM	None (vendor map)	GSD	GSD + EDD
Typical use	Smart transmitters	Meters, VFDs, RTUs	Remote I/O, drives	Process instruments

Where it is used

Refineries, petrochemicals and fertiliser plants (IOCL, BPCL, RIL, GSFC): HART on every smart transmitter, Foundation Fieldbus or Profibus PA on newer units, asset-management software reading HART diagnostics.
Power generation and transmission (NTPC, BHEL, Tata Power, state DISCOMs): Modbus RTU/TCP from energy meters, battery chargers and SWAS analysers into DCS/SCADA; IEC 61850 for substations takes over at switchyard level.
Manufacturing and machine builders (Tata Motors, Maruti suppliers, pharma OSD lines): Profibus DP and Profinet for remote I/O, servo drives and robots; GSD/GSDML-based configuration in TIA Portal.
Water, wastewater and solar plants: Modbus-based RTUs and inverters polled by SCADA over GPRS/4G; AMR and smart-meter projects under state utilities.
Job roles: instrumentation/commissioning engineer (loop checking with a HART communicator), automation engineer (Profibus/Modbus configuration and diagnostics), control system engineer at EPCs (L&T, Tata Projects, Toyo, Technip), service engineer at Emerson, Yokogawa, Honeywell, Siemens, ABB, Endress+Hauser.
Products to know: Emerson Trex/475 communicator, Siemens S7-1500 with DP and Profinet, Profibus diagnostic analysers, Modbus gateways and protocol converters, OPC UA servers bridging Modbus to IT systems.

Interview questions

Q: How can HART send digital data without disturbing the 4-20 mA reading? A: The FSK signal is a ±0.5 mA sine wave whose average over each bit period is zero, so the loop's DC mean - which carries the analogue value - stays unchanged.
Q: What are the HART frequencies and bit rate? A: Bell 202 FSK: 1,200 Hz for logic 1, 2,200 Hz for logic 0, at 1,200 bits per second.
Q: Why does a HART loop need a 250 Ω resistor? A: The current-mode FSK signal needs a minimum loop impedance (about 230-250 Ω) to develop a detectable voltage; too little and the modem cannot read it, too much (over ~1,100 Ω) and the loop supply cannot drive 20 mA.
Q: How many devices can be put on a HART multidrop loop, and what is the catch? A: Up to 15 slaves (addresses 1-15), but the analogue signal is given up - current is parked at 4 mA and all data is digital and slow, so it suits monitoring, not control.
Q: Difference between a sensor trim and a loop/output trim? A: Sensor trim corrects the input (digital PV against a reference), loop trim corrects the D/A output so the 4-20 mA matches the digital PV; a mismatch between handheld and DCS reading points to loop trim.
Q: Difference between Modbus RTU, ASCII and TCP? A: RTU sends compact binary frames with CRC-16, ASCII sends hex characters with LRC and is slower but human-readable, TCP wraps the same application frame in an MBAP header over TCP port 502.
Q: What are coils and holding registers? A: Coils are 1-bit read/write outputs (commands, on/off), holding registers are 16-bit read/write words used for setpoints and measured values.
Q: Which function code reads a flow transmitter value, and how is a float handled? A: FC 03 (holding) or FC 04 (input registers); a 32-bit float occupies two consecutive registers, and the word order must match the slave's convention or the value comes out nonsense.
Q: Why is Modbus unsuitable for safety or high-speed control? A: It is polled with no event reporting, has no standard device description or data typing, no time stamping and no built-in authentication or integrity protection.
Q: How does Profibus achieve determinism with several masters? A: A hybrid MAC - a token rotates among active masters with a bounded possession time, and the master holding the token polls its slaves, so the worst-case cycle is calculable.
Q: Difference between Profibus DP and PA? A: DP is fast RS-485 cyclic I/O (up to 12 Mbps) for factory automation with separately powered devices; PA is 31.25 kbps on the IEC 61158-2 two-wire bus, bus-powered and intrinsically safe for process instruments, connected to DP through a coupler.
Q: What is a GSD file and why can a bus not be configured without it? A: It is the vendor's machine-readable device description listing I/O modules, supported baud rates, parameters and diagnostics; the engineering tool needs it to build a valid slave configuration and interpret diagnostic bytes.
Q: Why does Profibus DP need active termination, and what happens without it? A: The RS-485 terminator network (390/220/390 Ω) biases and matches the line; without it reflections and undefined idle levels cause intermittent station drop-outs that worsen with baud rate.

Common mistakes

Saying HART replaces the 4-20 mA signal - it coexists with it; only multidrop mode abandons the analogue value.
Forgetting that the handheld is the *secondary* master and that a HART loop allows only two masters.
Omitting the 250 Ω sense resistor (or using a load that is too high) and then blaming the transmitter for "no communication".
Treating Modbus register numbering loosely - confusing 0-based protocol addresses with 1-based documentation addresses (40001 vs offset 0) and reading the wrong register.
Ignoring word/byte order for 32-bit floats and totalisers across vendors, giving absurd engineering values.
Mixing up Profibus DP and PA speeds and physical layers, or assuming PA is intrinsically safe without FISCO design and a current budget.
Leaving out, or doubling, RS-485/Profibus terminations and reversing the A/B pair - a classic cause of random bus errors.
Quoting 12 Mbps with a 1,200 m cable; segment length falls with baud rate (100 m at 12 Mbps).
Assuming a higher bit rate automatically means a faster control loop - cycle time depends on polling, overhead and station delay.