Supported Protocols

Overview

CONNECT speaks one protocol per interface, and several interfaces can run side by side in one gateway. This page lists what each one needs and what is worth knowing before the first connection attempt.

All supported interfaces

Fifteen interface types ship in the current build. This is the complete list — the same one the Add Interface dialog offers.

Interface type	Target system	Address	Signals found by
MQTT Broker	Any MQTT broker; Siemens process image	Topic	Browse or tag-table import
OPC UA	Any OPC UA server	NodeId	Browse
Siemens S7	S7-300/400/1200/1500, PLCSIM Advanced	DB1.DBX0.0	Manual
Beckhoff TwinCAT ADS	TwinCAT 2 and 3, CX, soft-PLC	Symbol	Browse
Modbus TCP Client	Drives, sensors, Modbus gateways	HR40001	Manual
Modbus TCP Server	A PLC or SCADA connecting to CONNECT	HR0	Manual
EtherNet/IP	Allen-Bradley ControlLogix, CompactLogix, Micro800, Omron	Tag	Browse
Bosch Rexroth ctrlX	ctrlX CORE through the bridge snap	Node path	Browse
Bosch Rexroth ctrlX (Data Layer)	ctrlX CORE natively, no snap needed	Node path	Browse
Keba Kemro X	Keba controllers	Variable	Browse
Festo AX (PLCnext)	Festo AX, Phoenix Contact PLCnext	Variable	Browse
FANUC (RoboGuide / Robot-IF)	FANUC controller or RoboGuide	do4, di1	Manual
Denso (b-CAP / WinCaps VRC)	Denso RC8/RC9, WinCaps VRC	IO104	Manual
ABB RobotStudio (SIMIT SHM)	RobotStudio on the same PC	Signal name	Manual
Shared Memory (SIMIT)	SIMIT or a Unity consumer on the same PC	Signal name	Manual

Browse means the controller can be asked what it offers, so signals are selected rather than typed. Manual means the protocol has no browse mechanism and addresses are entered — validated against the same parser the interface uses at connect time.

Supported value types are Boolean, integer and floating point throughout, plus text where the protocol carries it. The per-protocol sections below name the exact data types each one accepts.

OPC UA

Parameter	Example
Endpoint	opc.tcp://192.168.1.20:4840

Addresses are node ids as the server publishes them, for example ns=2;s=Motor1.Speed. The address space can be browsed, so signals are usually selected rather than typed.

Siemens S7

Parameter	Example
IP address	192.168.1.50
Rack / Slot	0 / 1

Addresses are absolute, DB-style: DB1.DBX0.0 for a bit, DB1.DBW2 for a word, DB1.DBD4 for a real. Values are read big-endian, once per update cycle.

On the PLC side the CPU must allow PUT/GET communication access — the same setting any third-party S7 client needs — and the addressed data blocks must have optimized block access disabled, because S7 communication cannot address optimized blocks by absolute offset.

PLCSIM Advanced

CONNECT connects to a Siemens PLCSIM Advanced instance directly over TCP/IP. No coupler process and no shared-memory bridge are involved.

In the PLCSIM Advanced instance settings, switch the network adapter from Softbus to PLCSIM Virtual Eth. Adapter, then enable PUT/GET in the simulated CPU’s protection settings. After that the instance is addressed exactly like a real S7-1500 — same IP, rack and slot. Softbus is not supported: only the virtual Ethernet adapter speaks TCP/IP.

MQTT

Parameter	Example
Broker URL	mqtt://192.168.1.30:1883

An MQTT interface handles each topic in one of two modes, and one interface may mix both.

Single mode

The topic payload is one scalar value for one signal — the simplest form and the one manual signal creation produces. Values written by the viewer are published back to the topic.

Process image mode

The topic payload is a raw byte array, typically a Siemens process image. A tag table unpacks it into many named signals:

• Addresses use the Siemens notation %I3.1 (bit), %IW13 (word), %IB, %ID, %M, %Q. The offset is a byte offset into the payload.
• Types are decoded big-endian: Bool, Byte, Word, Int, DWord, DInt, Real.
• Only the bytes that actually changed are turned into signal updates; the first message after every reconnect resends everything.

Tag tables are imported in the browser from a Siemens tag export and pushed to the gateway.

TwinCAT ADS

Parameter	Example
AMS Net Id	5.78.123.1.1.1
ADS port	851
Mode	SumCommand (default), OnChange, Cyclic

Signals are addressed by ADS symbol name (MAIN.bStart) and typed by a Beckhoff primitive: BOOL, BYTE, WORD, DWORD, SINT, USINT, INT, UINT, DINT, UDINT, REAL, LREAL.

TwinCAT does not have to be installed on the gateway PC — CONNECT starts an embedded ADS router when none is present, and steps aside when a real TwinCAT installation already owns the port.

An AMS route is still required on the PLC. This is an ADS protocol requirement: in the target PLC’s route configuration, add a route back to the gateway PC’s IP address and the configured Net Id.

Discovery reads the PLC’s symbol table and derives the direction from the I/O image — symbols on the physical input image become PLCInput (realvirtual supplies them), symbols on the output image become PLCOutput. That is the correct orientation for virtual commissioning.

Modbus TCP client

Parameter	Example
Host / Port	192.168.1.60 / 502
Unit id	1
Word order	ABCD, CDAB, BADC, DCBA

Addresses name one of the four standard tables plus an offset, with an optional bit suffix:

Prefix	Table	Writable
HR	Holding register	yes
IR	Input register	no
C	Coil	yes
DI	Discrete input	no

Both notations are accepted: classic five-digit Modicon (HR40001 = offset 0, C00013 = offset 12) and the modern short form (HR0, C12). HR40010.3 addresses bit 3 of a holding register.

Caution

Word order is the classic Modbus integration bug. Types spanning two registers — INT, UINT, FLOAT — have no protocol-level negotiation, so a wrong word order produces a different, plausible-looking value rather than an error. Set it explicitly per device.

Modbus RTU is reserved in the configuration but not yet implemented.

Modbus TCP server

CONNECT listens as a Modbus slave and an external PLC, HMI or SCADA system connects to it as the master. The address model is the same as the client. Note that the direction meaning mirrors: what a client may only read, a server must be able to write.

EtherNet/IP

Parameter	Example
Gateway	10.10.10.10
Path	1,0 (backplane, slot 0) — leave empty for Micro800
PLC type	ControlLogix, PLC-5, SLC 500, Logix PCCC, Micro800, MicroLogix, Omron

Addresses are tag names exactly as they appear in RSLogix or Studio 5000 — MAIN.bStart for a controller-scope tag, Program:MainProgram.MyTag for a program-scope tag. The supported scalar types are BOOL, SINT, INT, DINT and REAL; arrays and UDTs are out of scope.

Discovery reads the controller’s built-in tag list.

Note

CIP communication modules limit how many sessions they accept, commonly between 8 and 32. Keep the signal count per interface reasonable and avoid pointing several gateways at the same module, or real HMI and SCADA clients can be locked out.

Bosch Rexroth ctrlX

There are two ways to reach a ctrlX CORE, and they are chosen by interface type.

Data Layer (native)

CONNECT authenticates against the ctrlX identity manager and uses the Data Layer API directly. Nothing has to be installed on the device.

Parameter	Example
Address / Port	192.168.1.30 / 443
User / Password	device credentials

Addresses are Data Layer node paths, for example plc/app/Application/sym/MAIN.fSpeed. TLS validation is on by default; accept an untrusted certificate only for a device you deliberately trust with its factory certificate.

Bridge tunnel

The alternative routes through the ctrlx-rv-bridge snap running on the device. This requires a double deployment: the snap on the ctrlX CORE plus the interface here. Without the snap the interface reports exactly that.

Both modes use the same node paths, so an interface can be moved from one to the other.

Keba

Parameter	Example
Host	192.168.1.100
User / Password	controller credentials

Addresses are fully qualified Keba variable names (PLC.app.Speed). Values arrive as pushes over the variable service; writes go out by variable name. Discovery browses the variable tree from configurable root paths and can infer the direction from name patterns.

Festo AX / PLCnext

Parameter	Example
Host / Port	192.168.1.10 / 41100
User / Password	controller credentials

Addresses are GDS variable paths, for example Arp.Plc.Eclr/MainInstance.bStart. Subscription is used when the controller accepts it, with polling as the fallback.

Caution

One Festo interface per gateway. The underlying service manager allows a single connection per process; a second Festo interface fails immediately with that reason. Connect a second PLCnext over its OPC UA server instead.

FANUC

Parameter	Example
Address / Port	127.0.0.1 / 60008
Axis count	6

Addresses are FANUC signal names — a prefix plus a number, such as do4, di1, ui1, ao2. The prefix decides the direction: robot outputs (do, uo, ro, sdo, ao, wo) are read by realvirtual, robot inputs (di, ui, ri, sdi, ai, wi) are written by it.

With an axis count set, the robot’s joint positions are published additionally as <interface>.axis1 … axisN.

A RoboGuide cell with several robots uses one port per robot, incrementing from 60008.

Denso

Parameter	Example
Host	127.0.0.1
Controller type	RC8 or RC9
WinCaps project	C:\Projects\Cell1\Cell1.WPJ

Addresses are VRC variable symbols: IO<n> for a Boolean, I<n> integer, F<n> float, S<n> string. Joint positions are published as <interface>.axis1 … axisN. A virtual controller connection needs the WinCaps project file on the gateway PC.

ABB RobotStudio

CONNECT publishes a SIMIT-layout shared memory that RobotStudio’s SIMIT connection attaches to. Windows shared memory means RobotStudio and the gateway must run on the same PC — the usual RobotStudio virtual commissioning setup.

Addresses are the signal names RobotStudio shows in its SIMIT signal list. Joint values named Joint* arrive in radians and are exposed in degrees.

Shared memory (SIMIT)

The same mechanism for any SIMIT-compatible consumer, including a Unity SharedMemoryInterface, with the full SIMIT type palette: Bool, Byte, Word, Int, DWord, DInt, Real.

Set the global namespace option when the gateway runs as a Windows service while the consumer runs in an interactive session. Signal names must be ASCII.

See also

• Configuring interfaces — signals, direction and write access
• Troubleshooting — connection and signal problems