Modbus TCP to CANopen Gateway for Siemens PLC & Sensor Integration
In modern automotive manufacturing, end-of-line test rigs demand high-speed, precise data acquisition from multiple sensors. A common challenge arises when integrating CANopen-based torque sensors with Siemens PLCs that natively support only Modbus TCP. This article explores how a dedicated protocol conversion gateway bridges this gap, enabling reliable, real-time communication in harsh industrial environments.
Project Background: The Need for Protocol Conversion
A German-invested automotive OEM built a new energy vehicle offline inspection test rig. The system had to automatically measure and archive critical parameters—static and dynamic drive shaft torque, motor efficiency, and parking brake force—within a tight 60-second cycle. The measurement layer used a high-precision HBM T40B torque sensor (2 kN·m range, 0.01 N·m resolution) with a CANopen interface, while the control layer relied on a Siemens S7-1200 PLC (1215C AC/DC/Rly) that only provided a Modbus TCP server via its onboard Ethernet port.
Because CANopen and Modbus TCP differ fundamentally in frame structure, addressing, and communication models, a third-party gateway was essential. After rigorous testing for EMC, temperature, vibration, and real-time performance, an industrial-grade protocol converter was selected to act as a transparent bridge: CANopen slave to Modbus TCP server.
Key Technical Challenges
- Protocol Heterogeneity: The T40B outputs CANopen frames per DS-301/DS-402, while the PLC can only interpret Modbus TCP registers.
- Real-Time Constraints: During motor acceleration (0→3000 rpm in ≤3 s), torque values must refresh every 20 ms. Traditional RS-485/CAN converters with 100 ms latency were inadequate.
- Data Integrity: Transient torque overshoot peaks are critical for motor qualification; any frame loss could cause misjudgment.
- Harsh Environment: Test rig vibration up to 4 g, oil mist mixed with metal dust, and enclosure surface temperatures reaching 65°C caused frequent failures in commercial gateways (2–3 times per month).
- Limited Maintenance Windows: Downtime costs exceeded ¥50,000 per hour, demanding remote diagnostics and firmware upgrade capabilities.
Industrial Protocol Gateway Features
The selected gateway (a representative model with dual-core ARM+FPGA architecture) offers the following capabilities tailored for demanding industrial applications:
| Feature | Specification |
|---|---|
| Processing Latency | Bidirectional forwarding delay ≤2 ms (at 250 kbit/s CANopen, 1000 Hz PDO) |
| Environmental Rating | -40 to +85°C operating temperature, IP30 protection, 10 g vibration resistance, CE/FCC/ISO 7637-2 certified |
| PDO Mapping | Up to 64 TPDO/RPDO mappings, 8 bytes per PDO; direct mapping of torque, speed, temperature |
| Bus Termination | Integrated 120 Ω termination resistor, software-switchable remotely |
| Diagnostics & Maintenance | Built-in Web server, SNMP, Syslog; online firmware upgrade; MTBF ≥100,000 hours |
System Topology
The communication architecture is straightforward yet robust:
HBM T40B (CANopen Slave, Node-ID=3) → Shielded twisted pair → Gateway (CANopen Master) → Modbus TCP (192.168.1.10:502) → Switch → S7-1215C (192.168.1.20, Modbus TCP Client)
CANopen side: 250 kbit/s baud rate; cyclic synchronous PDO every 10 ms transmitting 6040h (control word), 6041h (status word), 6077h (actual torque).
Modbus TCP side: Holding registers 40001–40008 correspond to the 8-byte PDO; PLC reads them every 20 ms using function code 0x03.
Implementation Steps
1. Hardware Installation
- Mount the gateway on a DIN rail inside the control cabinet, at least 300 mm away from the 75 kW VFD to minimize EMI.
- Use 0.75 mm² shielded twisted pair for CAN_L and CAN_H; ground the shield only at the sensor end. Enable the built-in termination resistor via DIP switch.
- Provide redundant 24 VDC power: primary from UPS, backup from a regulated switching supply, ensuring data buffering during power loss.
2. Software Configuration
- Connect a PC via USB Type-C, launch the configuration tool (e.g., YC-Config V2.1.6), and create a new project selecting “CANopen Master ↔ Modbus TCP Server”.
- Import the T40B.eds file under the CANopen Master tab; it automatically creates PDOs for 0x6040, 0x6041, 0x6077. Set transmission cycle to 10 ms, map to 0x1A00 sub-index 1–3.
- Under the Modbus TCP tab, bind the 8 bytes of 0x1A00 to registers 40001–40008, data format UINT16, Big-Endian byte order.
- Set gateway IP to 192.168.1.10, subnet mask 255.255.255.0, default gateway 192.168.1.1. Save, download, and reboot; verify SYS LED steady green and CAN LED blinking.
3. PLC Programming
- In TIA Portal V18, use the “MB_CLIENT” instruction with ID=1, IP_ADDR=192.168.1.10, PORT=502, START_ADDR=40001, LENGTH=8, DATA_PTR pointing to a DB array.
- Trigger the REQ bit of MB_CLIENT in a 20 ms cyclic interrupt OB30 to achieve a 50 Hz sampling rate.
- Combine high and low words for torque: RealTorque = 40003 × 65536 + 40004, scaled in 0.01 N·m.
4. Commissioning and Validation
- No-load test: Manually rotate the drive shaft; PLC reading error vs. T40B display < ±0.02 N·m.
- Dynamic loading: Run motor to 1500 rpm, record 1000-point torque curve; average gateway forwarding delay 1.8 ms, max 2.1 ms, zero frame loss.
- 72-hour burn-in: Cyclic forward/reverse with shock loads; gateway temperature stabilized at 58°C, no communication interruption.
Performance Results
| Metric | Before | After | Improvement |
|---|---|---|---|
| Data refresh rate | 80 ms | 20 ms | 4× faster |
| Inspection cycle time | 72 s | 58 s | 24% capacity increase |
| Torque peak capture accuracy | Baseline | 3× improvement | First-pass yield 96.2% → 99.5% |
| Fault localization time | 2 hours | 15 minutes | 87% reduction |
Industry Application Value
This protocol conversion gateway, with its microsecond-level forwarding, industrial-grade protection, and plug-and-play configuration, provides a standardized, replicable, and low-risk solution for high-speed data acquisition scenarios such as automotive testing, dynamometer test benches, and battery formation systems. It demonstrates that in today’s fragmented industrial protocol landscape, using a reliable gateway to achieve “heterogeneous network transparency” is more economical and time-efficient than replacing equipment or developing custom software. This approach offers a practical path for smart factories to reduce costs and increase efficiency.
Key Takeaway: When integrating CANopen sensors with Modbus TCP PLCs, a dedicated industrial protocol gateway ensures deterministic data exchange, withstands harsh environments, and simplifies maintenance—ultimately boosting production throughput and quality.
