Extracting Telemetry from Legacy PLCs Without Native Ethernet
A practical hardware-and-software guide for connecting older Allen-Bradley, Siemens, and Modbus RTU equipment to a modern IIoT data pipeline — without replacing the PLC.
- The make, model, and CPU type of every PLC you intend to connect
- The communication protocol each device speaks: DH+, DH-485, DF1, Modbus RTU, AS511, or Profibus
- The PLC's register map or data table addresses — without this, you cannot configure tags
- Appropriate serial-to-Ethernet hardware for each PLC type (see Layer 1)
- A protocol translation platform: Kepware, Ignition, or Litmus
- Network access from the gateway host machine to the serial converter's IP address
Do not use the methods described in this guide to connect safety instrumented systems or safety PLCs. Those devices require a separate, qualified approach with formal change management and safety lifecycle review.
The problem this solves
A significant portion of manufacturing equipment running today was installed before Ethernet was an industrial standard. Allen-Bradley PLC-5s and SLC 500s communicate over Data Highway Plus or DH-485. Older Siemens S5 controllers use a serial current-loop interface. Virtually every piece of process equipment from the 1980s and 1990s speaks some variant of Modbus RTU over RS-232 or RS-485. None of these devices have an Ethernet port.
Replacing a running PLC in a production environment is a capital project requiring validation, requalification, and a planned maintenance window. Extraction is a day's work. The three-layer architecture below is how it is done.
The three-layer extraction architecture
S5, Modbus RTU
RS-485
DH+ / TTY
ProSoft AN-X2,
IBH Link S5++
Ethernet
Ignition,
Litmus
OPC-UA
REST
cloud platform
The serial-to-Ethernet converter handles the physical layer problem. The protocol translation software handles the protocol layer problem. The IIoT platform handles the data layer problem. Each layer has its own failure modes and its own configuration requirements.
DH+ is a proprietary Rockwell token-ring network. It requires a dedicated bridging device: either the Rockwell 1784-U2DHP USB-to-DH+ converter or the ProSoft AN-X2-AB-DHRIO gateway. Do not use a generic serial converter. DH+ is not RS-232 or RS-485 and a standard converter will not function.
Most SLC 500s use DH-485, not DH+. Only the SLC 5/04 has a DH+ port. DH-485 is electrically RS-485 with token-passing logic. It can be bridged to Ethernet using less expensive third-party gateways such as the DL-Plus or NetAIC converter. This is significantly cheaper and simpler than the DH+ path.
The SLC 500's Channel 0 is RS-232 DF1. Connect a Moxa NPort 5150 (which supports RS-232, RS-422, and RS-485 — do not use the NPort 5110, which is RS-232 only and will not cover RS-485 applications).
Configure the Moxa in Real COM Mode and install Moxa's driver on the Kepware host to map it to a virtual COM port (COM4, COM5, etc.), then configure Kepware as a standard serial DF1 channel mapped to that virtual COM port. If you use raw TCP Server mode instead, you must explicitly enable the Serial Encapsulation setting in Kepware's channel configuration or the driver will not communicate correctly.
Check Channel 0's duplex setting in RSLogix 500 before connecting. DF1 can be configured as Full-Duplex or Half-Duplex. A mismatch between the PLC setting and Kepware's channel configuration causes immediate framing errors and cyclic connection drops. Match them exactly before troubleshooting anything else.
The S5 does not speak MPI and is not an S7. It communicates via a serial current-loop (TTY) interface using the AS511 protocol, or over L1/L2 networks depending on the CPU. A standard Kepware Siemens S7 driver will not communicate with an S5.
To connect an S5 to Ethernet without adding expensive CP cards to the rack, use a dedicated active gateway such as the IBH Link S5++ or the Process-Informatik S5-LAN module. These devices translate AS511 to Ethernet and emulate an S7 TCP/IP connection, which allows Kepware's S7 driver to read the S5, or use Kepware's native Siemens S5 driver depending on the gateway model. Verify which communication mode your specific gateway emulates before configuring Kepware.
If the S5 is connected via a CP5431 Profibus card, the bridging path is significantly more complex and outside the scope of this guide.
The most standardized case. For RS-232 single-device connections, use a Moxa NPort 5150. For RS-485 multi-drop buses with multiple devices sharing the same bus, use a Moxa NPort 5230 (2-port) or NPort 5130 (1-port). The rack-mounted NPort 5600 series is an 8- or 16-port industrial server appropriate for large aggregation points, not individual machine connections.
Configure using Real COM Mode (preferred) or TCP Server mode with Serial Encapsulation enabled in Kepware. Use Kepware's Modbus TCP/IP Ethernet driver or Ignition's Modbus TCP driver.
RS-485 multi-drop topologies require 120-ohm termination resistors at both physical ends of the bus. Enable the Moxa's built-in termination resistor if the converter is at the physical end of the run. Do not add termination at a mid-bus converter.
Once the serial-to-Ethernet converter is reachable on the network, configure your protocol translation platform to poll the PLC.
For legacy Allen-Bradley and Modbus devices in both Kepware and Ignition, tags must be created manually or imported via CSV. You cannot browse a tag tree on a PLC-5, SLC 500, or Modbus device — these are data-table-based processors, not tag-based. Allen-Bradley legacy addresses follow the format:
[DeviceName]N7:0 ← integer file
[DeviceName]F8:0 ← float file
[DeviceName]B3:0 ← bit file
[DeviceName]T4:0.ACC ← timer accumulatorModbus addresses follow Kepware's Modbus addressing convention, for example 400001 for the first holding register. There is no tag browser. Build your tag list from the PLC's register map or data table documentation before starting configuration.
Set the scan rate conservatively regardless of platform. Start at 1000ms. Verify that the PLC's communication processor utilization stays below 30% after connecting. If it rises above that, increase the scan interval. Check whether other devices — HMIs, programming terminals, existing data collection systems — are also connected to the same port. Most legacy PLCs support only one active connection per port at a time.
Once tags are reading correctly, apply your UNS topic structure before forwarding upstream. Raw data table addresses — N7:0, F8:12, 400001 — are meaningless to any downstream analytics system. The extraction layer is the right place to normalize tag names into semantically useful labels before they enter the data pipeline. See the Unified Namespace guide for the topic hierarchy structure.
Where this breaks
Related: the Unified Namespace guide covers how to normalize and structure the tag data extracted from legacy PLCs before it enters the IIoT pipeline. The vendor index connectivity section covers Kepware, Ignition, and Litmus in detail.