Protocol Compatibility: What Your Vendor Won't Tell You

PLC firmware evolves. A driver written for a specific firmware version may not handle data structures introduced in a later version, or may fail on devices running older firmware that predates a feature the driver assumes is present. Always ask: what is the oldest and newest firmware version your driver has been tested against for this specific device model?

Most drivers handle standard integer and float tags reliably. String tags, UDT arrays, and program-scoped tags are where coverage gets inconsistent. In Allen-Bradley Logix platforms, controller-scoped tags are generally accessible. Program-scoped tags require driver navigation of the program namespace — not all drivers implement this fully.

If your PLC uses program-scoped tags — and most real-world programs do — verify explicitly that the driver can read them and ask for a production reference who uses them in a comparable environment.

This is the biggest protocol roadblock in the Siemens world and it is almost never mentioned in vendor documentation. By default, modern Siemens TIA Portal projects configure data blocks with Optimized Block Access enabled. Generic third-party drivers using standard ISO-on-TCP with absolute addressing (e.g., DB1.DBD0) cannot read these blocks.

To read optimized data blocks, the driver must support native symbolic browsing via the S7Comm+ protocol, or an engineer must manually disable optimization on every data block intended for polling. Disabling optimization is a PLC program modification that requires change management approval and retesting. Verify which approach your vendor's driver uses before purchase — and if it requires program modifications, factor that into your deployment timeline.

IIoT gateways use Explicit Messaging (Class 3/UCMM) to poll PLCs for data collection. Implicit Messaging (Class 1) is reserved for real-time deterministic I/O control between the PLC and remote I/O racks or drives — it is not a data collection mechanism. The constraint to understand is the explicit messaging connection pool.

Legacy and low-end processors — Allen-Bradley MicroLogix, SLC 5/05, older CompactLogix L32E — have strict limits on simultaneous explicit message connections. If an HMI, a programming laptop, and your new IIoT gateway are all polling the PLC simultaneously, the gateway will hit "no available CIP connections" errors. Know the connection pool limit of every target device before configuring polling.

Modbus has no native concept of a float or a string — it only understands 16-bit registers. To read a 32-bit floating-point value, a gateway must read two adjacent registers and reconstruct the float. If the gateway interprets byte and word ordering differently from the device — Big-Endian vs. Little-Endian, or word-swapped — a temperature reading of 23.5°C arrives in your analytics platform as NaN or a nonsensical value. There will be no connection error. The pipeline looks healthy. The data is wrong.

Additionally, some Modbus implementations use 0-based register indexing while others use 1-based, causing all addresses to shift by one. Verify byte order, word order, and register offset with the device documentation before configuring tags.

OT networks are segmented by VLANs, separated by firewalls, and divided into isolated subnets. A gateway that can reach a device on the corporate LAN may not reach the same device on a cell-level OT VLAN behind a managed switch with strict ACLs. Test connectivity from the actual network location the gateway will occupy — not from a laptop on the corporate network.