You need a 4-20mA signal isolator when a ground loop exists, that is, when the signal circuit is connected to earth or a common at more than one point and those points sit at different potentials.

Typical signs are a steady offset, a reading that moves when a motor or heater switches, or a value that changes when you disconnect a second receiver.

An analog signal isolator breaks the copper path between the field side and the PLC or IoT gateway analog input while passing the signal across. If the loop has only one ground reference and reads steady, you usually do not need one.

Who this is for: instrument and electrical engineers, panel builders and integrators adding a PLC, data logger or IoT gateway to signals that already feed another system.

What is a ground loop in a 4-20 mA loop?

Earth is not one perfect zero volt point across a plant. Acromag’s note on how to select a 4-20 mA isolator puts it plainly:

Earth ground at different locations is often at a different potential, so grounding a loop in more than one place puts a conductor between two potentials and drives a current.

A DC difference shows up as an offset in the reading; an AC difference shows up as noise. When the difference changes as equipment switches, the fault comes and goes, which is why ground loops are hard to troubleshoot.

A 4-20 mA loop is fairly tolerant of wire resistance and pickup, because current is the same everywhere in a series loop.

TI’s overview of 4-20 mA current loop transmitters covers this. But that tolerance ends when a second path lets current leak out of the loop or in from another common. A 0-10 V signal is more sensitive still, because any voltage between the two commons adds straight onto the reading.

Common situations that need isolation

TI’s note also makes the point that isolation is required when a sensor can be electrically connected to a potential relative to the loop supply ground, which is common with thermocouples because they touch the material they measure.

Types of signal isolators

Acromag’s white paper on signal conditioning and isolation lists the main reasons for isolation (breaking ground loops and protecting equipment from surges) and the arrangements:

• Input isolation: input floats from output and power. Used when bringing field signals into a grounded system.
• Output isolation: output floats from input and power.
• Three-way (full) isolation: input, output and power are separated. Use this when three differently grounded systems meet.
• Power isolation: signal input and output share a common, isolated from the power common.

By power source, you will see:

• Output loop powered (sinking output): takes power from the receiver’s loop supply. Low cost, low input burden.
• Input loop powered (sourcing output): takes power from the input loop. Adds a large voltage drop on the input loop, so check the transmitter supply budget.
• Externally powered (four-wire): separate 24 V DC power. Most flexible, handles 0-10 V and conversions.

Acromag’s How to Choose a 4-20mA Isolator walks through the voltage budget for each type.

When to isolate before a PLC or IoT gateway

A common case is retrofit: a signal already goes to a PLC or DCS, and now someone wants the same value on a remote monitoring gateway. Before you wire a second input in parallel or series, ask:

1. Who powers the loop today, and where is its negative referenced?
2. Is the gateway analogue input referenced to its own supply negative?
3. Is the gateway supply shared with anything else in the panel?
4. Is the sensor body earthed to the process?

If two or more references appear, put an isolator (or an isolating splitter) in, so each receiver sits on its own loop. If you are designing fresh, a single reference point and one supply per panel often avoids the problem without extra hardware.

Checklist

Where Embedos Edge fits

Embedos Edge (for example Edison or Maxwell) accepts 4-20 mA and 0-10 V DC analogue inputs, so it is often the second receiver in case of a retrofit. 

The usual clean arrangement is: existing transmitter, isolator or isolating splitter, one output to the PLC and one to Edge.

Edge then sends the value over MQTT or HTTPS, holds data with data logging and buffering if the network drops, shows device health and connection status remotely, and can raise threshold alerts by SMS, email or call alerts. also Webhooks.  

Modbus RTU and Modbus TCP carry the same function codes and the same register model, defined in the Modbus Application Protocol specification. RTU sends compact binary frames over a serial line, usually RS-485, with one master, a slave address and a CRC-16. TCP wraps the same request in a 7-byte MBAP header and sends it over Ethernet to port 502, with no Modbus CRC. Pick by the physical network you have or are building.

Modbus RTU vs Modbus TCP at a glance

All figures above come from the Modbus Organization’s free specifications: the Modbus application protocol specification, the Modbus over serial line specification, the Modbus messaging on TCP/IP implementation guide and the Modbus/TCP Security protocol specification. Wikipedia’s Modbus article is useful further reading.

Frame by frame: RTU address and CRC-16 vs the 7-byte MBAP header

The same request in both formats: read two holding registers (function 03) starting at address 0 from device 1. The specification numbers registers from 1 but addresses them from 0 on the wire. In the common Modicon-style convention many manuals use, holding register 40001 is address 0.

Modbus RTU request

01 03 00 00 00 02 C4 0B
01     slave address
03     function: read holding registers
00 00  start address 0
00 02  quantity 2
C4 0B  CRC-16, low byte first

Modbus TCP request

00 01 00 00 00 06 01 03 00 00 00 02
00 01  transaction identifier
00 00  protocol identifier (0 = Modbus)
00 06  length: 6 bytes follow
01     unit identifier
03 00 00 00 02  the same PDU, no CRC

The PDU in the middle is identical; only the wrapper changes. Check a Modbus CRC-16 yourself: choose CRC-16/MODBUS and low byte first.

Reading the response: why do floats read wrong?

A 32-bit float needs two 16-bit registers. Modbus sends each register high byte first, but the Modbus application protocol specification does not say which register comes first, so master and device can disagree without any error. A pressure transmitter on a 0 to 50 bar range returns 01 03 04 41 26 66 66 A4 4E over RTU, or 00 01 00 00 00 07 01 03 04 41 26 66 66 over TCP. The two registers are 4126 and 6666 (hex):

Only ABCD falls inside 0 to 50 bar. These values match the free tool to decode Modbus float word order (ABCD, CDAB).

RTU is a protocol, RS-485 is the wire

Modbus RTU is a framing; RS-485 is the electrical layer it most often runs on. From the Modbus over serial line specification:

• Addresses: 1 to 247 for slaves, 0 for broadcast, one master at a time.
• Silent interval: frames are separated by at least 3.5 character times.
• Devices: 32 devices are always allowed on a segment without a repeater; more only if the device documentation says so. Transceivers rated at a fraction of a unit load raise this. TI’s RS-485 design guide notes that 1/8 unit load parts allow up to 256 nodes on an unbiased bus, but failsafe bias resistors can add up to 20 unit loads, which cuts that to about 96. The Modbus specification likewise reduces the allowed count by 4 when the line is polarised.
• Trunk length: up to 1000 m at a maximum of 9600 baud with AWG26 or wider cable, halved when 4-wire cable is used as a 2-wire system. Category 5 cable may be used up to 600 m.
• Drops: derivation cables never more than 20 m. Faster transceivers need shorter stubs, according to the same TI design guide (SLLA272).
• Termination: at both ends of the trunk only, a 150 ohm resistor, or 120 ohm in series with 1 nF where the line is polarised. Never on a drop, and none on RS-232.
• Bias (polarisation): one pair of resistors for the whole bus, pull-up to 5 V on D1 and pull-down to common on D0, between 450 and 650 ohm, usually at the master. The specification reduces the allowed device count by 4 when bias is fitted, and 650 ohm allows more devices than 450 ohm.

Check your values with the free RS-485 termination and bias calculator.

Speed and polling in practice: which is faster?

On RTU, the arithmetic

At the specification default of 19200 baud, 8 data bits, even parity and 1 stop bit, each byte takes 11 bits, about 0.573 ms. Reading 10 registers from one device:

1. Request, 8 bytes: about 4.58 ms.
2. Silent gap of 3.5 characters: about 2.01 ms.
3. Response, 25 bytes (address, function, byte count, 20 data bytes, CRC): about 14.32 ms.
4. Another 3.5 character gap: about 2.01 ms.
5. Total wire time: about 22.9 ms, plus the device’s own response time from its manual.

With 10 such devices on one segment, a full scan takes at least 229 ms plus ten device response times. Above 19200 baud the serial line specification recommends fixed timer values: 1.75 ms for the inter-frame gap (t3.5) and 750 µs for the inter-character time-out (t1.5). Read registers in blocks, up to 125 per request with function 03. If a slave answers only some of the time, rule out clock baud rate error at either end.

On TCP

Wire time is rarely the limit. The device’s response time, how many simultaneous requests it serves, and any gateway in the path, which brings back the serial timing above, decide the real speed. “Faster” depends on the network and the devices, not on the protocol name.

Ports and security: 502, 802 and authentication

• Modbus TCP uses registered port 502, as the TCP/IP implementation guide states.
• Plain Modbus defines no authentication: any client that reaches the port can read and write. NIST SP 800-82 Rev. 3 notes that many OT protocols have no authentication at any level.
• The Modbus/TCP Security protocol wraps Modbus in TLS, with X.509v3 certificates for authentication and role-based authorisation, on port 802. Check that both ends support it before relying on it.
• Keep plain Modbus TCP on a segmented OT network, never on the internet.

Multiple clients on Modbus TCP vs one master on an RTU bus

An RTU bus has exactly one master, and slaves never talk to each other. Modbus TCP uses a client and server model: the TCP implementation guide lets a server accept several connections and serve several requests at once, up to a limit set by the device’s design, and several transactions can share one connection using the transaction identifier. So two SCADA systems can read one TCP device directly, if the device allows enough connections, but two masters cannot share one RS-485 segment.

Modbus RTU over TCP is not Modbus TCP

Some serial device servers forward raw RTU frames, CRC and all, inside a TCP stream, often called “RTU over TCP”. That is not the Modbus TCP format: there is no MBAP header, and framing still depends on the CRC. A Modbus TCP client talking to such a server, or the reverse, gets garbage or timeouts. Set both ends to the same mode.

Converting RTU to TCP: gateways and the Unit Identifier

A Modbus TCP to RTU gateway is a TCP server on the Ethernet side and the single RTU master on the serial side. The TCP implementation guide says the Unit Identifier carries the serial slave address through the gateway; for a device directly on Ethernet it recommends 0xFF. Plan for:

• requests from several TCP clients being queued and sent one at a time on the serial side;
• a gateway serial timeout longer than the slowest device’s response, and a client timeout longer still;
• a table of IP address, Unit Identifier and serial address for every device.

Which one should you choose for your panel?

For moving whole machines onto a plant system, OPC UA is often the better upper layer; see our guide to retrofitting legacy machines with OPC UA or Modbus.

Where does Embedos fit?

The Embedos 4G Ethernet Modbus gateway page lists Modbus RTU and Modbus TCP with RS-485, Ethernet, Wi-Fi and 4G interfaces.

Decode your registers with the free Modbus register interpreter, and size your bus with the RS-485 termination and bias calculator.

To build an OEE baseline, pick one constraint machine or line, fix the definitions of planned time, ideal cycle time and a good part, then log downtime, output and rejects every shift, by hand if you have to.

Calculate OEE as availability × performance × quality and keep the loss breakdown, because that is what tells you whether MES software will fix anything. Many Indian plants can start with the machines, PLC counters and shift registers they already have.

What is an OEE baseline, and why do you need one before an MES purchase?

OEE is a measure; an MES is software. NIST IR 7911 describes MES activities as dispatching and executing production orders, collecting production data and analysing production performance. OEE is one of the numbers that analysis produces. In the ISA-95 model, MES sits at Level 3, manufacturing operations management. An OEE baseline is that number, with its three factors and its losses, measured the same way over a fixed period before anything changes. For a general definition, Wikipedia’s article on overall equipment effectiveness is useful further reading.

Without a baseline, an MES project has no yardstick. With one, you can ask a vendor which of your losses their system recovers and check the answer later against your own locked figure.

We don’t trust our current OEE numbers. Where do we start?

Start with definitions, not software. Most distrusted OEE numbers are calculated correctly from inputs that mean different things on different shifts:

• Planned time is not fixed. One shift deducts tea breaks and the weekly PM, another does not.
• The ideal cycle time is today’s average. That hides every slow cycle and makes performance look close to 100%.
• Short stops are never written down. A two-minute jam that happens thirty times a shift is invisible in a log that only records breakdowns.
• Rework is counted as good. The ISO 22400-2 quality rate counts only parts that were right the first time.
• Machines are averaged. A simple average of five machines’ OEE says nothing about the line’s output.

How do you calculate OEE for a machine?

NIST AMS 300-11 defines OEE as the product of availability, performance and quality. ISO 22400-2, the international standard for manufacturing KPIs, uses the same structure; the full ISO text is a paid document. A free paper by Kang and colleagues, hosted by NIST, explains the ISO 22400 time and quantity elements behind these formulas. We use the ISO 22400-2 quality rate, which counts only good parts and excludes rework. The NIST paper itself uses a “quality buy rate” that counts reworked parts as good, so check which definition a vendor uses.

A shortcut gives the same answer: good count × ideal cycle time ÷ planned busy time. If your two methods disagree, an input is wrong.

Worked example: one shift by hand

These numbers are illustrative, not a benchmark.

1. Shift length 480 minutes, with a 30 minute planned break. Planned busy time = 450 minutes.
2. Logged unplanned downtime 60 minutes. Actual run time = 450 − 60 = 390 minutes.
3. Ideal cycle time 30 seconds (0.5 minute) per part. Total count 650 parts. Good count 620 parts.
4. Availability = 390 ÷ 450 = 86.7%.
5. Performance = (0.5 × 650) ÷ 390 = 325 ÷ 390 = 83.3%.
6. Quality = 620 ÷ 650 = 95.4%.
7. OEE = 0.867 × 0.833 × 0.954 = 68.9%. Check: (620 × 0.5) ÷ 450 = 310 ÷ 450 = 68.9%.

Here the biggest loss is speed, not breakdowns. A downtime-reason screen alone would not recover those 65 minutes, which is exactly the kind of finding that should shape an MES requirement.

Which definitions do you lock first: planned downtime, ideal cycle time and good parts?

• Planned downtime. In the ISO 22400 elements explained in the NIST paper, planned operation time = planned busy time + planned downtime, and planned downtime includes scheduled breaks, meetings and maintenance. So planned downtime comes out before availability is calculated. Decide what counts as planned and write it down.
• Ideal cycle time. Use the validated or nameplate cycle time per product, not the usual average. If performance comes out above 100%, the ideal cycle time has been set too long (too slow), or a count is wrong.
• Good part. Right first time only. Count rework separately.
• Downtime reasons. A short list, ideally under ten, plus “other”.

Get production, maintenance and quality to sign this one-page sheet before collecting data.

Which data fields do you collect, and where do they live on an Indian shop floor?

If a PLC counter is reachable, you can decode PLC counter registers with a free tool. Where a sensor signal stands in for a run state, for example a motor current transmitter, you may need to scale 4-20 mA signals correctly.

Can we baseline with manual logs, or do we need sensors first?

Start with logs; add signals where logs are weakest. Older machines may need a retrofit to give a run signal.

Which machines do we baseline first?

• The constraint, the machine that sets the line’s output.
• The machine your MES business case leans on most.
• A machine where the shift team is willing to log honestly.
• A machine where a run/stop signal is easy to reach.

How long should you measure, and what do you exclude?

No standard fixes a baseline length, so a fixed number of days, 30 or any other, is a choice rather than a rule. A baseline means something once it covers your plant’s normal variation:

• every shift and crew, including night shift;
• at least one full cycle of your product mix and changeover types;
• your usual maintenance pattern;
• a weekly figure that has stopped moving much from week to week.

Exclude only what your definitions sheet excludes, such as declared planned downtime, and note one-off events (a power cut, a trial run) separately rather than deleting them. Historical data can serve as a baseline only if it was recorded with the same definitions; otherwise treat it as indicative and start a fresh log.

What is a good OEE number, and why not compare with “world class” figures?

ISO 22400 defines how to calculate OEE, not what it should be. Published “world class” figures come from different sources, industries and definitions, and none is set by a standard. Your baseline is only comparable with itself, measured the same way later.

How do you turn the baseline into an MES requirement and vendor scorecard?

Lock the baseline and give every vendor the same one-page summary: OEE, the three factors and minutes lost per bucket. Then score proposals like this:

How does a baseline compare in effort with a full MES?

A baseline needs a definitions sheet, a log, a spreadsheet and, at most, a few signals. An MES needs product and routing master data, an ERP integration, operator workflows, training and change management. The baseline fits inside one department, and it tells you whether the bigger project is aimed at your real losses. Planning a new plant instead? Put the same definitions into your greenfield plant digital readiness checklist.

Where does Embedos fit?

For the baseline period, the hard part is often getting run and count signals off older machines. The Embedos Edge page describes the device as capturing machine and sensor data and sending it to cloud storage or a factory control room. Our pages on plant KPI dashboards for leadership and shift-level visibility for plant managers describe how we approach this.

You can retrofit legacy machines without touching their control logic. Classify each machine first: PLC with Ethernet, PLC with serial only, relay or electromechanical, or no controller at all. Then read the PLC over Modbus or OPC UA using read functions only, or add sensors outside the control circuit where there is no usable PLC. Publish everything upwards through open protocols, and use OPC UA where you need structure and security that plain Modbus does not give.

Why retrofit before you replace?

A machine that still makes good parts usually has years of mechanical life left even when its controls are old. Retrofitting adds data without changing how the machine runs, so it costs a fraction of a replacement in money and downtime and can start on one machine. Replacement makes sense when spares, support or safety, not data, are the problem; the questions for that decision are further down.

Step 1: classify every machine

Walk the floor with this table: note panel space, nameplates, existing ports and spare terminals for each machine. A closed controller with no documentation goes into class C or D, even if it has a port.

Step 2: choose the data path per class

How do you connect a PLC to the internet or cloud?

Not directly. CISA’s first OT mitigation is to remove OT connections to the public internet. Connect the PLC to an edge device on the OT network; the edge device reads it and sends data onward over a controlled, outbound route.

Worked example: scaling a 4 to 20 mA signal

A pressure transmitter on a 0 to 10 bar range, a 150 ohm sense resistor, and a 12-bit ADC with a 3.3 V reference. The loop reads 12.6 mA. These numbers match the free tool to scale 4-20 mA signals from relay-era machines.

1. Sense voltage = 12.6 mA × 150 ohm = 1.890 V.
2. ADC counts = (1.890 ÷ 3.3) × 4095 = 2345.
3. Process value = 0 + ((12.6 − 4) ÷ 16) × 10 = 5.375 bar.
4. At 4 mA the ADC reads 745 counts, at 20 mA 3723 counts, so resolution is about 0.0034 bar per count.
5. At or below 3.6 mA, or at or above 21 mA, NAMUR NE 43 treats the signal as a failure, for example a transmitter fault or a broken wire, so alarm on it instead of showing 0 bar. Readings from 3.8 to 4.0 mA and 20.0 to 20.5 mA are still valid, just under or over range. NE 43 itself is a paid NAMUR document; Beckhoff’s documentation summarises its limits.

A 250 ohm resistor puts 20 mA at 5 V, which clips a 3.3 V ADC. For ovens, dryers and moulds, check temperature readings with the RTD PT100 and PT1000 calculator, including the error a 2-wire RTD adds through its leads.

What does OPC UA add over Modbus?

OPC UA is an open, royalty-free set of standards from the OPC Foundation, as the Machinery specification notes, and the full specifications are free to read online. So the usual answer to “OPC UA vs Modbus” in a retrofit is both: Modbus at the bottom, OPC UA at the top. The OPC Foundation also publishes an open-source edge application, UA Edge Translator, that translates other protocols into OPC UA.

Download the Free “Legacy Machine Retrofit Playbook (Checklist)”!

Modbus to OPC UA gateways: mapping registers to variables

An edge device or gateway polls Modbus and exposes each value as an OPC UA variable. For every point, define:

Wikipedia’s OPC Unified Architecture article is useful further reading on OPC UA itself. Word order is the usual trap: decode Modbus float word order against a known reading before you commission the map. For the transport underneath, see Modbus RTU vs Modbus TCP.

Start with read functions only

Modbus has no read-only mode, and OPC UA has none by default: any client that reaches the port can send write function codes (05, 06, 15 and 16 in the Modbus application protocol specification) unless something blocks them. So “read-only” is a configuration the integrator must enforce: disable or block write function codes in the edge device or gateway, and do not enable writes until change control is in place. NIST SP 800-82 Rev. 3 and CISA’s OT mitigations also call for segmenting IT and OT networks, changing default passwords and securing remote access.

Do we need OEM permission, and does it affect the warranty?

• Sensors outside the control circuit do not change how the machine runs. Still inform the OEM while under warranty.
• A connection to an existing communication port that is configured to use only read functions does not change the PLC program. Disable or block write function codes in the edge device or gateway, but the OEM may still need to tell you the settings and memory map.
• Any change to the PLC program, safety circuits or control wiring needs written OEM approval while under warranty. Do not do it for monitoring. Check your contract in every case.

What happens to production during the install?

1. Survey while the machine runs.
2. Prepare and test the edge device and configuration off the machine.
3. Install sensors and cabling during an existing planned stop.
4. Connect to the PLC with write function codes blocked at the edge device, and confirm the HMI and control behave as before.
5. Run in parallel with manual logs until the numbers agree.

A pilot plan: one line, a fixed window, clear measures

1. Pick one line, including its constraint machine.
2. Agree the window in advance and do not move it.
3. Measure run state, part counts, downtime with reasons, and one or two process values that explain quality.
4. Compare against manual logs, then use the data for an OEE baseline.
5. Decide the next line only once the first line’s numbers are trusted.

Retrofit vs replace: questions for the plant head

• Are spares for the controller still available, and from whom?
• Does the OEM still support the controller and its software?
• Is the problem missing data, or unreliable control and safety?
• How much downtime would a replacement need, and when could the plant afford it?
• Will a retrofit now still be useful if the controller is replaced later?

Will a retrofit lock us into one vendor?

It does not have to. Put these in the order: data published over open protocols such as OPC UA, Modbus TCP or MQTT; raw data exportable in an open format such as CSV without a licence fee; full tag documentation; standard signals (4 to 20 mA, RTD, 24 V digital); and configuration backups handed to the plant.

Where does Embedos fit?

The Embedos Edge IoT gateway page lists Modbus RTU, Modbus TCP, CAN bus and OPC UA among supported protocols, and MQTT, HTTP and HTTPS for sending data onward. Our page on connecting PLCs and controllers describes how we work with automation engineers. For a new plant, put connectivity in the tenders instead, with the greenfield plant digital readiness checklist.

For engineers: check your loop scaling with the free 4 to 20 mA loop scaling calculator and your temperature readings with the RTD PT100 and PT1000 calculator.