Modbus TCP to ProfiNet Gateway for Tunnel SCADA Integration

Project Background and Challenge

In 2025, a major city in East China completed a 12km urban expressway tunnel designed for speeds of 80 km/h, with dual tubes and six lanes, handling a daily capacity of 80,000 vehicles. The electromechanical system adopted a three-level management, two-level control architecture. The central SCADA, running on Advantech IPC-610H industrial computers (i7-13700E, Windows 11 IoT), was specified to use Modbus TCP as the only communication protocol. However, the 30 remote I/O boxes distributed along the tunnel were connected via a ProfiNet ring network to a Siemens S7-1516-3 PN/DP PLC. This created a protocol mismatch that threatened project timelines and budget.

Replacing the PLCs or developing custom drivers would have cost over $80,000 and delayed commissioning. The engineering team instead selected an industrial protocol conversion gateway that acts as a slave on both networks, mapping data between Modbus TCP and ProfiNet in milliseconds. This approach preserved the existing SCADA software and PLC program, while ensuring real-time ventilation and lighting control.

Key Equipment in the System

Gateway Technical Highlights

The JM-TCP-PN gateway is built on a dual-core ARM architecture: an 800 MHz Cortex-A7 core handles the ProfiNet stack with real-time capability, while a Cortex-M4 core manages Modbus TCP communication. The two network ports are physically isolated, and data is exchanged through a 32 KB shared RAM, achieving a latency of less than 5 milliseconds. This design ensures deterministic performance even under heavy traffic loads.

• Plug-and-Play Integration: The gateway includes a GSDML file for easy import into TIA Portal V18. It also offers over 6,000 pre-defined Modbus register templates, eliminating manual address calculation.
• Redundancy Support: On the ProfiNet side, it supports S2 redundancy and can join an MRPD ring. On the Modbus TCP side, dual IP addresses allow seamless failover between primary and backup gateways.
• Rugged Design: With an operating temperature range of -40 to +85°C and a fanless aluminum enclosure, it withstands the harsh tunnel environment, including continuous exposure to exhaust fans.
• Comprehensive Diagnostics: A built-in web interface, SNMP MIB, ProfiNet diagnostic buffer, and tri-color LED indicators simplify monitoring and troubleshooting.

Network Topology and Configuration

The tunnel network uses a ring topology for high availability. The Siemens PLC acts as the ProfiNet controller, while the gateway is configured as a ProfiNet slave device. On the Modbus TCP side, the SCADA system (Advantech WebAccess/SCADA 9.1) communicates with the gateway as a Modbus TCP master. The gateway maps I/O data between the two protocols transparently.

In TIA Portal V18, the configuration steps are straightforward:

1. Import the GSDML file (GSDML-V2.43-JM-TCP-PN-20250718.xml) into the project and drag the device into the network view.
2. Set the device name (e.g., “JM_TCP_PN_Tunnel1”), configure I/O mapping (64 Word In / 64 Word Out), update cycle (4 ms), and enable “Prioritized Startup”.
3. Assign the PLC and gateway to the same sync domain, select “Ring” topology for IRT, and enable MRPD.
4. Compile and download. The PLC online scan shows gateway Status=0x00, no packet loss, RT Class B.

Modbus TCP Mapping Table

The gateway uses standard Modbus function codes 03 (Read Holding Registers) and 16 (Write Multiple Registers) on port 502. It supports up to 16 concurrent connections, allowing both redundant SCADA PCs and a maintenance laptop to access data simultaneously. The following table shows the mapping between Modbus registers and ProfiNet I/O addresses:

SCADA Integration and Control Logic

The Advantech WebAccess/SCADA 9.1 software uses its built-in Modbus TCP driver to communicate with the gateway. Tags are created according to the mapping table, with a scan cycle of 100 ms. The SCADA system implements intelligent control strategies through scripting:

• When any CO sensor exceeds 120 ppm or visibility drops below 0.007 1/m, four groups of 37 kW jet fans are automatically started at 45 Hz.
• LED lighting is continuously dimmed based on external luminance and traffic density, achieving energy savings of at least 28%.
• In fire mode, a hardwired signal from the PLC sets register 40200 to 1 within 10 ms, triggering the SCADA to pop up video surveillance.

Commissioning and Performance Verification

Extensive testing was conducted to ensure reliability:

• Protocol Consistency: Wireshark captures showed ProfiNet frame intervals stable at 4 ms with no sequence errors. Modbus TCP average response time was 3.2 ms, compliant with GB/T 19582-2018.
• Redundancy Switchover: When the primary gateway’s fiber was disconnected, the PLC completed ring switchover in 18 ms, and SCADA communication continued without interruption due to dual-master auto-roaming.
• 72-Hour Burn-In: In the tunnel at 45°C and 95% humidity, the gateway enclosure reached a maximum of 62°C, CPU usage was 38%, memory usage 22%, and no reboots occurred.
• EMC Testing: Passed IEC 61000-4-5 surge immunity at ±2 kV and IEC 61000-4-3 radiated immunity from 80 MHz to 1 GHz at 10 V/m without bit errors.

Operational Results and Benefits

After three months of operation with an average daily traffic of 76,000 vehicles, the system delivered impressive results:

• Average CO concentration remained at 52 ppm, and adaptive lighting reduced energy consumption by 31%, saving approximately $67,000 annually in electricity costs.
• Zero communication failures were recorded. Fan startup delay was under 800 ms, and lane indicator switching delay under 300 ms, both exceeding design specifications.
• The gateway’s web interface allowed remote firmware upgrades. In October 2025, an online update to V1.4.6 added SNMP Trap functionality, integrating with the city’s utility tunnel NMS for unified alarming.

Frequently Asked Questions