MQTT, OPC UA and IIoT
Helmholz supplies the components and the knowledge to bring data from PROFINET, S7 and Modbus TCP controllers into MQTT: a compact MQTT broker for the control cabinet, couplers and gateways that exchange PLC data with a local or cloud broker, and monitoring devices for the control cabinet and the PROFINET network that report via MQTT, plus design reviews and troubleshooting in the Benelux.
- MQTT broker for the DIN rail with the full MQTT V3.1.1 and V5 feature set, TLS, user and ACL management, also usable as a conduit between two network zones
- Publish and subscribe from a PROFINET PLC, configured via GSDML in the hardware configurator, without extra software
- OPC UA and MQTT from one gateway for existing S7 and Modbus TCP controllers, without changing the PLC program
- Design reviews and troubleshooting, from the PLC via the network to the broker
Go straight to: How MQTT works · MQTT broker · PLC data to MQTT · Monitoring via MQTT · Services · FAQ. Or see all infrastructure components.
How MQTT works
MQTT (Message Queuing Telemetry Transport) is a lightweight publish/subscribe protocol and an OASIS standard. It was designed to transfer data with little bandwidth, which makes it a common choice for IIoT: machine data to dashboards, MES or the cloud.
Background
Publish and subscribe
Devices do not talk to each other directly. A device that has data publishes a message on a topic. A device that needs data subscribes to that topic. Sender and receiver do not need to know each other’s address; they only agree on the topic.
Broker
Every message goes to a central broker. The broker checks which clients have subscribed to the topic and forwards the message to all of them. The broker can run locally in the machine or factory network, for example Mosquitto or the Helmholz MQTT broker, or in the cloud. MQTT runs over TCP/IP: port 1883 without encryption, port 8883 with TLS.
Topics
A topic is a text string with levels separated by a slash. For a holding register of the PN/ModbusTCP Coupler, the topic is built from the client ID, the register type and the register: MODBUS_MQTT/Holding Register/Register 10. A subscriber can use wildcards: + stands for one level, # for all levels below. MODBUS_MQTT/# receives every value of that coupler.
Note: topics are case-sensitive. Machine1/Temperature and machine1/temperature are two different topics.
Selection
Which Quality of Service do I need?
Per message the sender chooses a QoS level: how sure delivery to the broker must be. A higher level costs more messages on the network.
| Variant | Choose it when |
|---|---|
| QoS 0 · at most once | You send measured values often and a missed value is replaced by the next one |
| QoS 1 · at least once | The message must arrive and the receiver can handle a duplicate |
| QoS 2 · exactly once | A message must not be processed twice, such as a counter value or an order |
Two more features are useful in machines. A retained message is stored by the broker, so a dashboard that connects later gets the last value straight away. A Last Will is a message the broker publishes when a client disconnects without saying goodbye, so the receiver sees that a machine has gone offline.
Sparkplug B
MQTT itself does not define what a topic or a payload looks like: every device chooses its own structure. Sparkplug B, a specification of the Eclipse Foundation, adds those rules on top of MQTT. Topics follow a fixed structure starting with spBv1.0/, payloads are binary encoded, and every device announces itself with a birth message and signs off with a death message, based on the Last Will. A SCADA or IIoT platform can then find devices and their values automatically, without mapping every topic by hand.
MQTT broker
The Helmholz MQTT broker stores and forwards MQTT messages between the participants in a machine, a factory network or to the cloud. It is 32.5 mm wide on the DIN rail, so it fits into even a small control cabinet.
Local broker or cloud broker?
A local broker keeps machine data in the machine or factory network and keeps working when the internet connection is down: for example between a PLC, an HMI and a data logger in the same line. A cloud broker, such as AWS IoT, Microsoft Azure or HiveMQ Cloud, makes sense when data from several sites comes together in one application. The Helmholz couplers and gateways on this page connect to both.
Broker as conduit. In firewall mode the broker sits between two network zones, for example the machine network and the factory network. Only MQTT passes, and only for the users and topics you allow in the ACL. The zones stay separated, as the zone and conduit model of IEC 62443 asks for, while the data still gets through.
MQTT broker
700-462-MQB01. MQTT V3.1.1 and V5, TLS, user and ACL management. Four-port switch, or firewall mode as a conduit between two zones.
Security
Zones and conduits in the rest of the network
WALL IE firewalls and background on industrial security for the traffic that is not MQTT.
PLC data to MQTT
Most machine data sits in the PLC. These couplers and gateways bring it to an MQTT broker without a PC in between, configured via GSDML or a web interface.
Publish only, or both directions?
Publish means the PLC values go to the broker: enough for dashboards, data logging and MES. Subscribe means the PLC also receives values from the broker, such as setpoints, recipes or orders. The PN/MQTT Coupler and the S7-EDGE Protocol Converter do both; the PN/ModbusTCP Coupler and the uaGates publish.
Selection
Which coupler or gateway do I need?
| Variant | Choose it when |
|---|---|
| PN/MQTT Coupler | Your PROFINET PLC must publish to and subscribe from a broker, with up to 100 values configured at the same time |
| PN/ModbusTCP Coupler | You couple PROFINET and Modbus TCP and also want to publish the exchanged values via MQTT |
| S7-EDGE Protocol Converter | You read an existing S7 or Modbus TCP controller without changing the PLC, need MQTT in both directions and want your own logic or logging in Node-RED. Up to 200 variables per PLC |
| uaGate SI | You take large data sets from an S7-300, S7-400, S7-1200 or S7-1500 to MES or SCADA via OPC UA, up to 20,000 items, and publish them via MQTT |
| uaGate MB | You do the same for a Modbus TCP controller |
PN/MQTT Coupler
700-162-3MQ02. Publish and subscribe, MQTT V3.1.1 and V5, TLS with password or certificate. Separate networks for PROFINET and MQTT, galvanically isolated.
PN/ModbusTCP Coupler
700-159-3MB02. Up to 1024 bytes of I/O data between PROFINET and Modbus TCP, with an MQTT publisher on both network sides.
S7-EDGE Protocol Converter
GC300T-0-03. S7 Put/Get and Modbus TCP to the PLC; OPC UA server and MQTT publish and subscribe to the higher level, with Node-RED and logging on board.
uaGate SI for S7
GAA-DX-145111. OPC UA server with 20,000 items and MQTT publisher with 1,000 topics, for S7-300, S7-400, S7-1200 and S7-1500.
uaGate MB for Modbus TCP
GAA-YE-145133. OPC UA server and MQTT publisher for Modbus TCP controllers, with physically separated OT and IT interfaces.
PROFINET
The network behind the PLC
Switches, connectors, cables and diagnostics for the PROFINET side of the coupler.
Monitoring via MQTT
Two devices stay in the machine permanently and report via MQTT, independently of the PLC: the Cabinet Guard for the conditions inside the control cabinet, PROFINET TEST TOOL Online for the state of the PROFINET network. Their data ends up on the same dashboard as the machine data.
Cabinet Guard
700-210-1AA01. Temperature, humidity, air pressure, vibration and door opening. MQTT, Modbus TCP and SNMP, SD card for long-term logging.
PROFINET TEST TOOL Online
4210-0004. Permanent monitoring of up to 250 PROFINET devices: topology, diagnostics, missing devices and update times. Shares the results via MQTT, REST and Node-RED.
Troubleshooting
Common causes when MQTT data does not arrive
When values do not show up at the receiver, the cause is usually in the configuration, not in the protocol. These are the points we check first:
- Topic – one capital letter or an extra slash makes a different topic. A leading slash, as in
/machine1/temperature, adds an empty first level. - Client ID – two clients with the same client ID push each other off the broker. The connection drops and returns every few seconds.
- Port and TLS – 1883 is unencrypted, 8883 uses TLS. A TLS connection fails when the CA certificate is missing or the device clock is wrong, because the certificate then seems not yet or no longer valid.
- Access rights – the broker refuses a publish or subscribe that the ACL does not allow. With MQTT V3.1.1 the sender often gets no error back; MQTT V5 reports a reason code.
- Network path – a firewall or zone transition blocks the port, or the MQTT interface has no default gateway. On the PN/MQTT Coupler the MQTT side is a separate network with its own IP settings.
Services for MQTT and IIoT
Our network engineers work on PROFINET, PROFIBUS and Industrial Ethernet, so they see the whole chain: from the PLC via the coupler and the network to the broker.
Before you build
Network design review
We check where the broker goes, how the OT and IT networks are separated and which data you publish, and explain the consequences of each choice.
When it fails
Troubleshooting on site
We follow the data from the PLC to the broker, fix the cause and leave a report on what went wrong and how to keep the connection reliable.
Quick question
Advice by phone or online
Stuck on a topic structure, a TLS certificate or the PN/MQTT Coupler in your PLC project? Schedule a call with one of our engineers.
See all network services.
Frequently asked questions
Your question not listed? Ask us directly.
MQTT basics
What is MQTT?
MQTT (Message Queuing Telemetry Transport) is a lightweight publish/subscribe protocol and an OASIS standard. Devices publish messages on a topic to a central broker, and the broker forwards them to every client that has subscribed to that topic. MQTT runs over TCP/IP on port 1883, or on port 8883 with TLS.
MQTT or OPC UA?
OPC UA works client/server with a described information model and is common for connecting MES and SCADA to a PLC. MQTT sends messages via a broker to any number of receivers and is common for dashboards and cloud platforms. They complement each other: the S7-EDGE Protocol Converter, uaGate SI and uaGate MB offer an OPC UA server and MQTT in one device.
What do QoS 0, 1 and 2 mean?
QoS 0 delivers a message at most once, without confirmation. QoS 1 delivers at least once, so a duplicate is possible. QoS 2 delivers exactly once, with a four-step handshake. Use QoS 0 for frequent measured values and QoS 1 or 2 for messages that must arrive.
Are MQTT topics case-sensitive?
Yes. Machine1/Temperature and machine1/temperature are two different topics, and a subscriber to one does not receive messages on the other. A leading slash also creates an extra, empty topic level.
MQTT V3.1.1 or V5?
MQTT V5 adds reason codes, so a client learns why a publish or subscribe was refused, plus message expiry and user properties. Many devices and brokers still use V3.1.1. The Helmholz MQTT broker and the PN/MQTT Coupler support both versions.
Do your devices support Sparkplug B?
Sparkplug B is a specification of the Eclipse Foundation on top of MQTT. It fixes the topic structure, starting with spBv1.0/, encodes payloads in a binary format and uses birth and death messages, so a SCADA or IIoT platform finds devices and their state automatically. Sparkplug B runs over a standard MQTT broker. Our couplers and gateways publish plain MQTT with their own topic structure. Contact us and we will check whether your application needs Sparkplug B.
Products and setup
How do I get PROFINET PLC data into MQTT?
With the PN/MQTT Coupler. Import its GSDML file into the hardware configurator, add the coupler as a PROFINET IO device and map up to 100 values. The broker address, topics and security are set on the web page of the coupler. No extra software is needed.
Local broker or cloud?
Both are possible. A local broker, such as the Helmholz MQTT broker, keeps data in the machine or factory network and works without internet. The PN/MQTT Coupler also connects directly to cloud brokers such as AWS IoT, Microsoft Azure and HiveMQ.
How do I secure MQTT?
Use TLS on port 8883, give every client its own user name and password or certificate, and set ACLs on the broker so each client may only publish and subscribe to its own topics. In firewall mode the Helmholz MQTT broker also works as a conduit between two network zones.
Can I order components online?
Yes, most MQTT components are in our online shop. For the uaGate MB, contact us for delivery information. See the webshop FAQ for ordering and delivery.
Help with MQTT in your machine
Bringing PLC data to a broker, setting up a topic structure or chasing values that do not arrive? Tell us which controller and which broker you work with, and we will help you choose the right components or find the cause.