B&R Network Architecture and Device Enumeration

Overview

B&R X20 systems use a multi-layer network architecture: ETHERNET Powerlink (EPL) for real-time control communication, standard Ethernet/TCP-IP for IT-level traffic, X2X for local IO bus expansion, and optional CAN bus. Understanding this architecture is essential when you inherit an undocumented machine — you need to map out what devices exist, how they’re connected, and what data flows between them.

Network Topology Types

ETHERNET Powerlink Topologies

POWERLINK supports any combination of the following topologies without manual configuration:

B&R POWERLINK hubs (e.g., X20HB8880) support all these topologies. The Compact Link Selector enables ring redundancy for critical applications.

X2X Bus Topologies

The X2X bus (backplane bus connecting X20 IO modules) is always a daisy chain:

CPU/BC → [Module 1] → [Module 2] → [Module 3] → [Terminal Module]

Each module has an X2X in and X2X out connector. The terminal module provides termination.

Typical Machine Network Layout

                          Standard Ethernet (TCP/IP)
                          ┌──────────────────────┐
                          │  Engineering PC      │
                          │  HMI / SCADA          │
                          │  SDM (web browser)    │
                          └──────────┬───────────┘
                                     │
                              ┌──────┴──────┐
                              │  Ethernet   │
                              │  Switch     │
                              └──────┬──────┘
                                     │
┌────────────┐   POWERLINK    ┌──────┴──────┐   POWERLINK    ┌────────────┐
│  ACOPOS    │◄──────────────►│  CP1584      │◄──────────────►│  ACOPOS    │
│  Drive 1   │               │  (MN node)   │               │  Drive 2   │
└────────────┘               └──────┬──────┘               └────────────┘
                                     │ X2X Bus
                              ┌──────┴──────┐
                              │  X20 IO     │
                              │  Modules    │
                              └──────┬──────┘
                                     │ X2X Bus
                              ┌──────┴──────┐
                              │  X20 IO     │
                              │  Modules    │
                              └─────────────┘

Device Discovery on an Unknown Network

Method 1: Automation Studio Browse

1. Open Automation Studio
2. Go to Online → Settings
3. Toggle Browse ON
4. Automation Studio broadcasts on the local subnet and discovers all B&R devices
5. Devices appear with: IP address, device name, model number, serial number

Method 2: Standard Network Scan

Since B&R devices respond to standard Ethernet protocols:

## ARP scan - finds all devices on the local subnet
arp -a

## Nmap scan - detailed device discovery
nmap -sn 192.168.1.0/24

## Ping sweep
for i in {1..254}; do ping -c 1 -W 1 192.168.1.$i | grep "bytes from" & done; wait

## DNS reverse lookup (some B&R devices register their name)
nmap -sL 192.168.1.0/24

Method 3: B&R Community Tools

Method 4: Wireshark / POWERLINK Capture

1. Install Wireshark with the POWERLINK plugin
2. Connect your PC to the same network segment
3. Start capture on the Ethernet interface
4. Filter: epl for POWERLINK frames
5. The Managing Node (MN) — your CP1584 — will be visible in SoC (Start of Cycle) frames
6. All Controlled Nodes (CNs) respond with their node addresses

The POWERLINK MN node is typically node 240 (0xF0). CNs are assigned sequentially.

See powerlink-internals.md for detailed POWERLINK protocol analysis.

Method 5: SDM Web Interface

1. Open a browser to the PLC’s IP address (default often 192.168.1.10)
2. The SDM shows all connected POWERLINK nodes, their status, and firmware versions
3. Navigate to System → Network for full device enumeration

Method 6: Finding a PLC with Unknown IP

If you don’t know the PLC’s IP address:

1. Connect directly with an Ethernet cable (no switch)
2. Set your PC to DHCP
3. B&R PLCs often have DHCP enabled by default, or respond to ARP from any IP
4. In Wireshark, look for ARP packets from the PLC’s MAC address (B&R OUI prefix)
5. In Automation Studio, enable Browse — it discovers devices via UDP broadcast
6. Reset to factory IP: hold the MODE button during power-on for 5 seconds (resets IP to 192.168.1.10)

Network Addressing

IP Address Configuration

B&R devices have IP addresses configured via:

1. Automation Studio — set in the CPU’s Ethernet configuration
2. SDM web interface — accessible via browser
3. SNMP — using brsnmp tool
4. Hardware reset — MODE button during power-on (factory default: 192.168.1.10)

POWERLINK Node Addressing

POWERLINK uses node IDs (1-239 for CNs, 240 for MN):

• MN (Managing Node): Always node 240 — this is the CP1584
• CN (Controlled Node): Assigned sequentially 1, 2, 3… by the MN
• Node addresses are automatically assigned during POWERLINK startup (SoC phase)
• No manual IP configuration needed for POWERLINK communication — it uses MAC-based addressing

X2X Station Addressing

X2X stations are addressed by their position in the daisy chain:

• Station 0: The bus controller (BC module on the CPU)
• Station 1: First IO module after the BC
• Station 2: Second IO module, etc.

Addresses are automatic — the bus controller enumerates stations during initialization.

Network Diagnostic Tools

Built-in Diagnostics

External Network Tools

Common Network Issues

POWERLINK Communication Failure

Symptoms: Drives/IO modules show as offline, red LEDs on modules

Diagnosis:

1. Check SDM — which nodes are missing?
2. Verify POWERLINK cable connections (daisy chain: each module has IN and OUT)
3. Check termination — the last device in the chain needs a terminator or the bus controller must have termination enabled
4. Verify the bus controller (BC) module is correctly configured in the project
5. Check cable continuity with a cable tester
6. Look for the POWERLINK activity LEDs on the bus controller and hub modules

Ethernet Connectivity Problems

Symptoms: Can’t reach PLC from PC, HMI disconnected

Diagnosis:

1. Verify IP address is correct and on the same subnet
2. Check physical Ethernet cable and link LEDs on the PLC and switch
3. Ping the PLC — if no response, check cabling and IP configuration
4. Verify subnet mask and gateway settings
5. Check if the PLC’s Ethernet interface is enabled in the hardware configuration

IP Address Conflicts

Symptoms: Intermittent connectivity, PLC appears and disappears from network

Diagnosis:

1. Check for duplicate IPs using arp -a — look for the same IP with different MAC addresses
2. Ensure no other device is using the PLC’s IP
3. Change the PLC’s IP if needed (via SDM, brsnmp, or Automation Studio)

Network Performance Degradation

Symptoms: POWERLINK cycle time violations, intermittent timeouts

Diagnosis:

1. Check POWERLINK cycle time configuration — is it too fast for the number of nodes?
2. Verify cable quality — damaged cables cause retransmissions
3. Check for excessive non-real-time traffic on the same Ethernet segment
4. Separate real-time (POWERLINK) and IT (TCP/IP) traffic onto different VLANs or physical networks if possible
5. Monitor POWERLINK timing in Wireshark — look for cycle time jitter

Documenting an Unknown Network

When you inherit an undocumented machine, systematically document the network:

Step 1: Physical Inspection

1. Follow every cable from the PLC to each device
2. Note cable types (Ethernet, X2X flat cable, motor power, encoder)
3. Label every cable at both ends
4. Photograph the cabinet layout

Step 2: Software Discovery

1. Connect to the PLC’s SDM web interface
2. Use Automation Studio Browse to find all B&R devices
3. Run a network scan (nmap or arp) to find non-B&R devices (switches, HMIs)
4. Capture POWERLINK traffic in Wireshark to see all active nodes

Step 3: Create a Network Map

Document:

• Device model, serial number, firmware version
• IP address / POWERLINK node address / X2X station address
• Cable connections (what port connects to what)
• Network configuration (subnet, gateway, cycle time)

Step 4: Record Network Configuration

Ethernet Switching Requirements for POWERLINK

Why Switches Matter

POWERLINK is a time-sliced protocol that requires deterministic Ethernet frame delivery. Standard managed switches can interfere with POWERLINK timing. Understanding this is critical for network design.

POWERLINK Switching Rules

Network Segregation Strategies

GOOD: Separate physical networks
┌──────────────┐     ┌──────────────┐
│  IT Network  │     │ POWERLINK    │
│  (Switch)    │     │ (Hub chain)  │
│  HMI/SCADA   │     │ Drives/IO    │
└──────┬───────┘     └──────┬───────┘
       │                    │
       └────────┬───────────┘
                │
         ┌──────┴──────┐
         │   CP1584     │
         │ IF2=Ethernet │
         │ IF3=POWERLINK│
         └─────────────┘

ACCEPTABLE: Same switch with VLANs
┌──────────────────────┐
│  Managed Switch      │
│  VLAN 10: IT traffic │
│  VLAN 20: POWERLINK  │
└──────────┬───────────┘
           │
    ┌──────┴──────┐
    │   CP1584     │
    └─────────────┘

Important: When POWERLINK and TCP/IP share IF3 (same physical port), they are time-multiplexed. The POWERLINK real-time phase has absolute priority. Non-real-time traffic fills the remaining time slots. If the cycle time is very tight, TCP/IP performance on IF3 will be severely degraded. Use IF2 (dedicated Ethernet) for IT traffic.

OPC UA Network Integration

Port and Protocol

OPC UA on the Network

• OPC UA runs on IF2 (Ethernet), not IF3 (POWERLINK)
• If IF2 is on the same subnet as POWERLINK address range (192.168.100.x), there may be routing issues
• OPC UA traffic is standard TCP — works through routers, VPNs, and firewalls
• See opcua.md for detailed configuration and client access

Network Security Considerations

B&R systems from defunct OEMs often have minimal security:

Remote Access Options

For monitoring machines remotely:

See iiot-retrofit.md for detailed remote monitoring setup.

Compact Link Selector (Ring Redundancy)

B&R POWERLINK supports automatic ring redundancy via the Compact Link Selector:

• Connect the last node in the daisy chain back to the first (forming a ring)
• If any cable in the ring breaks, communication continues via the alternate path
• Failover is automatic and typically completes within 1-2 POWERLINK cycles
• Requires compatible B&R hubs (X20HB8880 with Compact Link support)
• Configured in Automation Studio’s POWERLINK network configuration

When to Use Ring Redundancy

• High-availability applications (continuous processes)
• Long cable runs where damage risk is elevated
• Multi-machine lines where one cable break would stop the entire plant
• Not typically needed for standalone machines

Subnet Design Guidelines

Default Address Ranges

Best Practices

1. Keep POWERLINK on its own subnet (192.168.100.x)
2. IT traffic on a separate subnet (192.168.1.x)
3. Use a dedicated VLAN if sharing physical switches
4. Document all IP addresses — use the network map template above
5. Reserve IP ranges for future expansion (spare PLCs, new drives)

DHCP and IP Configuration

For an undocumented machine: check if DHCP is enabled by connecting a PC to the same switch and running a DHCP discovery. If the PLC responds, you’ll find its IP. Otherwise, use ANSL discovery (nmap port 11169/11160) or factory reset (hold MODE button during power-up).

DNS Configuration

Why DNS Matters in B&R Automation

DNS is required for several B&R system services, even on isolated plant networks:

DNS Configuration in Automation Runtime

DNS servers are set in the CPU properties under Ethernet Interface → TCP/IP → DNS:

DNS Servers for Industrial Use

On isolated plant networks without internet access, configure DNS to point at the plant’s internal DNS server. If no internal DNS exists and NTP is required, either use IP addresses directly for NTP or set up a local DNS resolver.

“Get DNS from DHCP” Option

When enabled, the PLC obtains DNS server addresses from the DHCP response alongside the IP address. This is convenient but has caveats:

• Only works on interfaces configured for DHCP (typically IF2)
• DNS settings are lost if the DHCP server is unreachable at boot
• The PLC may boot with stale DNS if the DHCP lease expires during a network outage
• For critical systems, use static DNS configuration for reliability

DNS Troubleshooting for B&R Networks

For detailed NTP and DNS interdependencies, see time-sync.md.

Ethernet Interface Configuration

IF2 vs IF3 on X20CP1584

The X20CP1584 has two independent Ethernet interfaces, each serving a different purpose:

Critical distinction: IF3 can carry both POWERLINK real-time frames and non-real-time TCP/IP traffic in a time-division multiplexed manner. The POWERLINK cycle owns the isochronous phase; TCP/IP traffic fills the remaining asynchronous phase slots. If the POWERLINK cycle time is tight (e.g., 200 µs), very little bandwidth remains for TCP/IP on IF3. For heavy IT traffic, use IF2 exclusively.

Interface Configuration in CPU Properties

Each interface is configured independently in Automation Studio under the CPU’s hardware configuration:

Speed and Duplex Settings

Forcing speed/duplex on one end without matching the other causes a duplex mismatch, leading to late collisions, CRC errors, and severe performance degradation. If forcing is necessary, both the PLC port and the switch port must match exactly.

MAC Address Format (B&R OUI)

B&R Automation assigns MAC addresses from their registered OUI (Organizationally Unique Identifier):

When scanning a network, filtering by B&R OUI prefixes identifies B&R devices among all network endpoints:

# Find all B&R devices by MAC prefix in ARP table
arp -a | grep -i "00:07:6c"

Link Aggregation and Multi-Homing

The X20CP1584 does not support IEEE 802.3ad link aggregation (LACP) natively. However, multi-homing — using both IF2 and IF3 simultaneously on different subnets — is fully supported and is the standard operating mode:

• IF2: Connected to the IT/SCADA network (192.168.1.x)
• IF3: Connected to the POWERLINK real-time bus (192.168.100.x)

Each interface routes independently. The PLC maintains separate routing tables per interface. Traffic for the POWERLINK subnet goes out IF3; traffic for the IT subnet goes out IF2. If both subnets overlap, ambiguous routing occurs and connectivity becomes unpredictable.

Interface LED Indicators

On POWERLINK hubs (X20HB8880), additional LEDs indicate POWERLINK bus activity and ring redundancy status. See cp1584-hardware-ref.md for complete LED reference.

Latency and Performance Analysis

POWERLINK Cycle Time Latency Components

A single POWERLINK cycle is divided into phases, each contributing to overall latency:

Total cycle time = sum of all phases. For a system with 5 CNs at 200 µs cycle time, the isochronous portion consumes approximately 50-75 µs, leaving the remainder for asynchronous traffic.

Ethernet Switch Latency

Each switching element in the POWERLINK path adds latency:

X2X Bus Latency Contribution

The X2X backplane bus adds latency for IO data to reach the CPU:

X2X latency is independent of POWERLINK cycle time. The CPU updates the IO image at the X2X rate and maps it into the POWERLINK cycle. If X2X cycle time exceeds POWERLINK cycle time, IO data may be stale by one cycle.

End-to-End Latency Budget Calculation

For a signal traveling from a digital input to a drive command output:

This budget explains why cycle time configuration is critical — reducing POWERLINK cycle time from 1 ms to 200 µs saves 800 µs per cycle in the command path.

Measuring Latency with Wireshark

To measure actual POWERLINK latency from captures:

1. Capture POWERLINK traffic on the MN’s interface
2. Apply filter: epl && epl.soc
3. Calculate time delta between consecutive SoC frames — this is the actual cycle time
4. Apply filter: epl && epl.preq && epl.node == 1
5. Measure time from PReq to matching PRes — this is the round-trip to CN 1
6. Compare actual cycle times against configured cycle time to detect jitter

Wireshark column setup for latency analysis:

Acceptable Latency Thresholds

When the application requires cycle times below 200 µs, the number of nodes in the POWERLINK chain must be carefully managed — each additional CN consumes time in the isochronous phase.

Network Troubleshooting Deep Dive

POWERLINK Packet Loss Diagnosis

Packet loss in POWERLINK manifests as drives going to fault state, IO modules showing communication errors, or cycle time violations. Use Wireshark to diagnose:

## Wireshark capture filter for POWERLINK traffic
## Capture on the interface connected to the POWERLINK segment

## Display filter: show only Poll Requests to detect missing responses
epl && epl.preq

## Display filter: show only Start of Cycle to check cycle consistency
epl && epl.soc

## Display filter: show errors
epl && epl.error

## Display filter: isolate a specific node
epl && epl.node == 3

Steps to diagnose packet loss:

1. Start Wireshark capture on the POWERLINK segment
2. Apply epl && epl.soc — verify SoC frames arrive at the configured interval
3. Apply epl && epl.preq — for each PReq, confirm a matching PRes follows within the timeout window
4. Missing PRes frames indicate the CN is not responding — check cabling and power to that node
5. Late PRes frames (arriving outside the isochronous window) indicate switch latency or cable issues
6. Count total frames over 60 seconds; compare expected vs. actual to calculate loss percentage

Cycle Timing Violation Analysis

When the PLC logs POWERLINK cycle time violations, the actual cycle exceeded the configured maximum. Diagnose by:

1. Capture a 10-second Wireshark trace with filter epl
2. Export to CSV and calculate the time delta between consecutive SoC frames
3. Plot the cycle times — look for outliers and patterns
4. Common causes:
   • Too many CNs for the configured cycle time
   • Async phase overflow — too much TCP/IP traffic on IF3
   • Switch latency spikes from managed switch features
   • Cable integrity issues causing retransmissions
   • Competing traffic from a misconfigured VLAN

Duplex Mismatch Detection

Duplex mismatch causes late collisions, FCS errors, and severe throughput degradation (often 40-60% packet loss):

Fix: configure both ends to the same speed/duplex, or ensure both are set to auto-negotiate. Never mix auto-negotiate on one end with forced settings on the other.

Cable Quality Testing

For POWERLINK networks, use Cat5e minimum (Cat6 preferred). Maximum cable run: 100 meters per segment. Longer runs require repeaters or fiber media converters. B&R fiber optic POWERLINK modules (X20ET001) are available for runs up to 2 km.

Network Storm Detection and Prevention

A network storm occurs when broadcast or multicast traffic floods the segment, blocking POWERLINK frames:

Prevention: enable broadcast storm control on managed switches (~100 pps threshold), disable unused ports, avoid creating loops without spanning tree, and use B&R POWERLINK hubs which do not propagate broadcasts.

Spanning Tree Issues with Managed Switches

Spanning Tree Protocol (STP/RSTP/MSTP) can disrupt POWERLINK:

For POWERLINK segments, disable spanning tree on the relevant ports or use “edge port” / “portfast” designation to skip the listening/learning phases.

Auto-Negotiation Failures

Auto-negotiation can fail between B&R devices and certain switches, resulting in:

B&R Ethernet interfaces generally implement IEEE 802.3ab auto-negotiation correctly. Issues typically arise with older switches or non-standard Ethernet implementations. When auto-negotiation fails, forcing 100 Mbps Full Duplex on both the PLC and the switch port resolves the issue.

Firewall and Security Configuration

Ports Used by B&R Systems

Firewall Rule Recommendations for B&R PLC Isolation

A minimum-viable firewall configuration for a B&R PLC:

For outbound traffic from the PLC, allow: NTP to NTP Server (123/UDP), Syslog to Log Server (514/UDP), and default deny all other outbound.

Network Segmentation for Security

Deploy B&R PLCs in a dedicated automation zone separated from the corporate IT network:

Corporate IT ──► Firewall (rules above) ──► Automation Zone (VLAN)
                                              ├── PLC 1 (192.168.1.10)
                                              ├── PLC 2 (192.168.1.11)
                                              ├── HMI (192.168.1.20)
                                              ├── SCADA Server (192.168.1.30)
                                              └── Engineering PC (192.168.1.100)

Key segmentation principles:

• All traffic between IT and automation traverses a firewall
• The automation zone has no direct internet access
• Engineering PCs are dual-homed or access the automation zone via VPN
• SNMP community strings are unique per device and not “public”
• OPC UA uses certificate-based security (not “None” mode)

PLC-to-PLC Firewall Rules

When PLCs communicate directly (PLC-to-PLC, see plc-to-plc.md):

Restrict PLC-to-PLC communication to only the required ports. If PLCs only use POWERLINK for inter-communication (via shared bus), no TCP/IP firewall rules between them are needed.

SCADA/IT Network Demilitarized Zone (DMZ)

For plants requiring SCADA connectivity to both the automation zone and the corporate network, place SCADA servers in a DMZ between two firewalls: Corporate IT -> Firewall A -> DMZ (SCADA Server, Historian, OPC UA Gateway) -> Firewall B -> Automation Zone.

• The SCADA server sits in the DMZ with two network interfaces
• Firewall A allows SCADA-specific ports from corporate IT to the DMZ
• Firewall B allows only SCADA-to-PLC ports from DMZ to automation zone
• OPC UA gateways in the DMZ can bridge protocols (OPC UA to MQTT, OPC UA to REST)
• The DMZ provides a buffer — if the corporate network is compromised, the attacker cannot directly reach PLCs

Multicast and Broadcast Handling

POWERLINK’s Use of Multicast and Broadcast

POWERLINK uses destination addresses that appear as multicast or broadcast on the wire:

POWERLINK SoC and SoA frames use a reserved multicast MAC address (01:EF:00:00:00:01) to simultaneously reach all CNs. This is not standard IPv4 multicast — it is an Ethernet-level multicast specific to POWERLINK.

IGMP Snooping Interaction

IGMP snooping on managed switches can interfere with POWERLINK:

Recommendation: Disable IGMP snooping on all POWERLINK ports. If the switch requires IGMP snooping for other VLANs, place POWERLINK on a separate VLAN with snooping disabled, or use B&R POWERLINK hubs.

Broadcast Domain Sizing

The POWERLINK segment should be sized appropriately:

Large POWERLINK networks (>50 nodes) require careful planning: use tree or star topology to reduce cable length per chain, increase cycle time proportionally to node count, consider multiple MNs for very large installations, and use ring topology for redundancy on critical paths.

ANSL Discovery Broadcast

ANSL (Automation NET Service Layer) uses broadcast for device discovery:

ANSL discovery broadcasts from Automation Studio (engineering PC) and from SDM. These broadcasts are limited to the local broadcast domain and do not traverse routers. If the engineering PC and PLC are on different subnets, ANSL discovery will not work — use direct IP connection or configure a DHCP relay. For network scanning:

# Scan for B&R devices using ANSL discovery
nmap -sU -p 11160 192.168.1.0/24 --open

# Check ANSL service on a known PLC
nmap -sT -p 11169 192.168.1.10

Key Findings (Updated)

1. POWERLINK topology is auto-configuring — star, daisy chain, tree, ring, any combination works without manual setup. The MN (CP1584) automatically discovers and addresses all CNs.

2. SDM is your first stop for network discovery — the web interface shows every device, its status, firmware version, and connection topology without needing any tools or software.

3. B&R community tools are invaluable — brsnmp, ListAllBurPLCs, and brwatch give you command-line access to discover and manage B&R devices without Automation Studio.

4. Physical cable tracing is essential — no software tool can tell you where cables actually run. Get your hands on the cabinet and follow every cable.

5. POWERLINK and TCP/IP can share the same physical network, but separating them improves performance for critical applications.

6. Node addressing is automatic for both POWERLINK and X2X — you don’t need to configure addresses manually (unless using specific addressing modes).

7. POWERLINK requires deterministic switching — avoid standard managed switches with spanning tree or storm control. B&R POWERLINK hubs (X20HB8880) are purpose-built for zero-delay frame forwarding.

8. Always keep POWERLINK on its own subnet (192.168.100.x) separate from Ethernet/IT traffic (192.168.1.x) to prevent routing conflicts and performance degradation.

9. Default PLC IP is often 192.168.1.10 — if you can’t find the PLC, try this address. Factory reset restores it.

Cross-References

• powerlink-internals.md — POWERLINK protocol deep internals and Wireshark analysis
• x2x-protocol.md — X2X bus protocol and wire-level details
• cp1584-forensics.md — Extracting info from an unknown CP1584
• diagnostics-sdm.md — System Diagnostics Manager usage
• acopos-drives.md — ACOPOS drive communication details
• cp1584-hardware-ref.md — CP1584 hardware specifications, interfaces, LED indicators
• opcua.md — OPC-UA server configuration and client access
• time-sync.md — NTP/DNS configuration for time synchronization
• iiot-retrofit.md — Adding modern monitoring protocols (MQTT, SNMP), network integration
• modbus-gateway.md — Modbus TCP/RTU gateway configuration, Modbus TCP networking
• plc-to-plc.md — Inter-PLC communication discovery and monitoring
• firmware.md — Firmware architecture and update mechanisms
• ftp-web-interface.md — FTP and web server interfaces for remote access
• cybersecurity-hardening.md — Network isolation and firewall strategies
• cf-card-boot.md — CF card contents and boot sequence
• io-card-hardware.md — IO module hardware architecture and LED diagnostics