Modbus for OEE: Reading Older Machines and Helper Equipment

Key takeaways

• Modbus is common on helper equipment such as checkweighers and labellers, and on older machines.
• Read four kinds of data: coils, discrete inputs, input registers and holding registers.
• Map each address once, with its type, scaling and word order.
• Use read functions only. OEE never writes a register.
• Classic Modbus has no built-in security, so keep it inside the OT zone, behind one gateway.

Many machines that are hard to connect for OEE still speak Modbus. Checkweighers, labellers, coders and older machines often offer it over Ethernet or a serial line. Read a few registers for state and counts, and those machines join the same OEE as the rest of the line.

Fabrico, OEE and light MES software with AI cameras, connects a machine through its PLC, a Fabrico IoT device or an AI camera. Where a machine offers Modbus, the register map is agreed for each plant with Fabrico's technical team.

Where do you find Modbus on a packaging line?

• Helper equipment: checkweighers, labellers, coders and some metal detectors.
• Older machines, especially those older than about 15 years, which may offer a serial port or nothing.
• Drives and meters, which often report speed, current or energy over Modbus.

Modbus comes in two common forms. Modbus TCP runs over Ethernet. Modbus RTU runs over a serial line such as RS-485, and needs a serial gateway to reach the network. Our guide to Modbus TCP vs RTU explains the difference.

Which Modbus data types does OEE read?

The read functions are 01 for coils, 02 for discrete inputs, 03 for holding registers and 04 for input registers. An OEE gateway should use only those. Functions that write must never be part of the setup.

What makes Modbus values come out wrong?

• Off by one. Manuals often call the first holding register 40001, while it is address 0 on the wire. Check which convention your tool uses.
• Word order. A 32-bit count spans two 16-bit registers, and builders put the high word first or second.
• Scaling. A speed of 1234 may mean 123.4. The manual says how to scale it.
• Signed or unsigned. Read a large unsigned count as signed and it turns negative.

Worked example: a checkweigher on Modbus TCP

Sample line (illustrative numbers, not a customer). A checkweigher offers this register map. Its manual numbers input registers from 30001.

Registers 30001 and 30002 hold the values 1 and 34,464. High word first, the count is 1 x 65,536 + 34,464 = 100,000 packs. Read with the words swapped, the same two registers give 34,464 x 65,536 + 1 = 2,258,632,705. One wrong setting, and Performance is nonsense.

So test the map against reality. Weigh a known number of packs, and check that the count moves by exactly that much. Then check the reject count the same way.

Read the counters every few seconds, not many times a second. OEE needs the change over each interval, and a slow serial device answers more reliably when it is not flooded with requests.

How do you keep Modbus safe on the plant network?

Classic Modbus has no built-in authentication or encryption. Anyone who can reach the device can read it, and on many devices also write to it. So the protection has to come from the network.

1. Keep Modbus devices in the OT zone, never on the office network.
2. Let only the gateway reach them, on the Modbus port, usually TCP 502.
3. Use read functions only in the gateway's setup.
4. Send data upstream from the gateway, outbound only and encrypted.

Our guide to IEC 62443 zones and conduits shows how to draw that zone.

Which mistakes do plants make with Modbus for OEE?

• Guessing the register map instead of using the builder's manual.
• Ignoring word order on 32-bit counters.
• Polling too fast on a slow serial line, so readings time out.
• Leaving write access open because the device allows it.
• Not checking after a firmware update, which can move registers.
• No list of which device sits on which serial address, so a swapped cable mixes up two machines.

For other ways to connect older machines, read our guide to OEE on brownfield and legacy equipment.

Where does Fabrico fit?

Fabrico is a computer vision enabled Manufacturing Performance Platform. OEE and light MES come first, across modern and older equipment.

• Automatic downtime logging from PLC tags, IoT devices or cameras.
• The operator confirms the reason in one tap, because a register says "fault", not why.
• OEE live by line and shift, with every loss priced in money.
• A pilot on one line, so the register maps are proven first.

There is no free plan and there are no tiers: each plant gets a quote. See the product on the computer vision OEE page, and the basics in what a PLC is.

Frequently asked questions

What is Modbus used for in OEE?

It is a simple, widely used protocol that many machines and helper devices offer. For OEE, a gateway reads a few values over Modbus. Typically that is whether the device is running, its total and reject counts, its fault number and the product it runs.

What is the difference between coils and registers?

Coils and discrete inputs hold single bits, such as running or stopped. Input and holding registers hold 16-bit numbers, such as counts or speeds. Coils and holding registers can be written on most devices, so an OEE gateway should only ever read them.

Why does a Modbus value look wrong?

Usually one of four things. The address may be off by one, or the two words of a 32-bit value are swapped. The value may need scaling, or a signed value is read as unsigned. Check the builder's manual for each register and test against a known count.

Is Modbus secure?

Classic Modbus has no built-in authentication or encryption. Make it safe through the network. Keep devices in the OT zone and let only the gateway reach them. Use read functions only, and send data upstream outbound only.

Can Modbus RTU devices be read for OEE?

Yes, through a serial gateway that connects the RS-485 line to the network. Keep the polling rate modest, because serial lines are slow, and read only the registers OEE needs. The rest of the setup is the same as for Modbus TCP.

Connect your helper equipment with us

Bring one checkweigher or labeller manual. We will show which registers OEE needs and what that machine's stops cost.

Request a demo · Contact us