Direct answer: You can stream PLC tags to MQTT or the cloud without touching ladder logic by using a passive, read-only consumer that reads data the controller already exposes — through its existing protocol (Modbus TCP, OPC UA, EtherNet/IP), a mirror port or tap on its traffic, the HMI that already connects to it, a cellular transmitter on remote assets, or the SCADA layer it already feeds. No program downloads, no line stoppage, no re-certification.
Why passive collection beats opening the project
The cost of modifying validated logic
Your control logic is validated, commissioned, and locked by the OEM. The last thing you want is to crack open the project, drop in a telemetry routine, and pay to have the whole line re-certified — all for a dashboard.
What "passive" actually means
In practice, you usually do not have to touch the logic. Most controllers already speak Modbus TCP, OPC UA, or EtherNet/IP on their service port, or already stream data to an HMI or SCADA system. You only need a passive consumer that reads what is already there.
Five methods to send PLC data to MQTT without changing the logic
Method 1 — Read-only polling over the protocol already running
Almost every modern PLC exposes its tags over Modbus TCP, EtherNet/IP, or PROFINET. A protocol converter or edge controller can register as a read-only client and poll the values your program already computes — no ladder edit, no download. The controller sees nothing beyond a few extra request frames, well within its scan headroom. An Emerson RSTi I/O coupler is a typical polling target when you need a node that sits natively on the same bus.
Method 2 — Mirror existing traffic instead of joining the network
Where you cannot add a node, drop a managed switch with a span or mirror port in line, or a passive tap, and let a collector listen to the PLC-to-HMI traffic that was already flowing. You extract values from traffic rather than generating new requests. For validated safety or process networks, it is usually the lowest-risk path — nothing new sits on the live bus.
Several of our PLCs are built to sit at exactly that passive edge. The Opto 22 GRV-EPIC-PR1 runs a real-time Linux controller with an integrated IIoT gateway, while the UTICOR EZRack combines a compact PLC and edge gateway on a DIN rail.
Method 3 — Let the HMI you already run do the pushing
If an IIoT HMI already holds a live connection to the controller, enable its built-in OPC UA and MQTT client. The Emerson RXi HMI IC760COW15CDA and its 12-inch sibling the IC760COW12CDA ship with OPC UA, MQTT, and Movicon WebHMI — the panel itself publishes to the broker, and your ladder logic stays exactly as the OEM left it.
Method 4 — Cellular telemetry for assets with no LAN
Remote pumps, tanks, and RTUs with no wired network use a cellular transmitter that reads Modbus RTU over the serial port and ships compressed payloads over LTE-M or NB-IoT. The SignalFire Ranger and the Zen IoT G3 gateway ship with Wi-Fi, 4G, and MQTT enabled out of the box. For sites with no infrastructure at all, the Omniflex Teleterm M3 is a GPRS-based Modbus bridge RTU, and the Advantech ADAM-3600-C2G is a 4G-ready edge RTU with MQTT built in that bridges Modbus and analog I/O straight to the cloud.
Method 5 — SCADA backbone and protocol conversion
For SCADA-backed sites, the Honeywell ControlEdge PLC exposes integrated universal I/O and OPC UA for upstream historians, extending the same read-only principle to a full plant backbone. The NIVUS NivuLink is a WAGO-based IoT gateway for SCADA, while the Endress+Hauser NXA822 is a web-configurable fieldbus gateway for the in-between protocol cases. Browse our protocol converters and fieldbus gateways for the full range.
Choosing and comparing the methods
The five methods at a glance
| Method | Protocol | Best for | What you need |
|---|---|---|---|
| Read-only polling | Modbus TCP / OPC UA / EtherNet/IP | Controller already on the network | A read-only client or edge coupler |
| Mirror port / TAP | Passive sniffing | Safety/process nets, no new node | Managed switch or tap + collector |
| IIoT HMI push | OPC UA + MQTT client | HMI already connected | HMI with built-in OPC UA/MQTT |
| Cellular telemetry | Modbus RTU → LTE-M/NB-IoT | Remote assets with no LAN | Cellular RTU/gateway |
| SCADA backbone | OPC UA / protocol gateway | Plant-wide aggregation | SCADA PLC or IoT gateway |
How to choose the right method
Pick the path that matches what is already on your network, not the one with the most features:
- The controller is already on Ethernet and you just need its tags — start with read-only polling. It is the lightest touch and adds almost no load.
- You cannot add a node to a validated safety or process network — use a mirror port or passive tap. Nothing new sits on the bus, so re-certification is not on the table.
- An HMI already connects to the controller — turn on its built-in OPC UA/MQTT client and let the panel publish. You get cloud data with zero PLC changes.
- The asset has no wired network at all — a cellular RTU or gateway reading Modbus RTU over serial is the only practical option.
- You are aggregating a whole plant into SCADA or a historian — extend the read-only principle through a SCADA PLC or protocol gateway.
Security and the OT/IT boundary
Keeping the controller off the enterprise network
Passive reading does not mean exposing the controller to the enterprise network. Best practice keeps the collector or edge device at the boundary between the machine network and the plant network: OPC UA with certificate authentication on the OT side, TLS-secured MQTT on the IT side, and no inbound connections from IT to OT. We cover this partitioned architecture in our article on OPC UA and MQTT in industrial HMIs — it is the same "no logic change" principle applied at the protocol boundary.
Frequently asked questions
Will passive polling slow down my PLC?
Minimal, if you size it right: keep poll rates inside the controller's scan headroom and cap concurrent clients. A single read-only OPC UA session adds far less load than a second HMI panel.
Can I expose data the program does not already compute?
No. That is the real ceiling of any passive method. Passive methods only surface tags the controller already produces. If you need a new calculated value, that still requires a logic change; no gateway can invent it.
What protocols can I read passively?
The common ones: Modbus TCP and Modbus RTU, OPC UA, EtherNet/IP, and PROFINET. Most passive collectors speak at least Modbus and OPC UA; if your controller only offers a proprietary protocol, you will need a protocol converter in the path — which is still read-only from the controller's point of view.
Does this bypass my firewall or create a security hole?
It should not. The collector sits inside the machine network and reaches out to the broker over an outbound TLS connection; you are not opening an inbound port to the PLC. The boundary design in our OPC UA and MQTT article follows the ISA/IEC 62443 zone-and-conduit model, keeping OT and IT logically separated.
Find the right passive edge for your controller
Match a device to your controller model
Every method above starts with one rule: do not touch the logic. Browse our PLC selector or our protocol converters to match a passive edge device to your controller model.
