Integrating Programmable Logic Controllers with Cloud Messaging Systems via Secure MQTT

The Challenge of Connecting Industrial Automation to the Cloud

Historically, industrial automation operated in isolated islands. Programmable Logic Controllers, which are robust computers designed to control machines and assembly lines, communicated only with each other or with local operator panels known as HMIs. In practice, this meant that extracting data from a factory to generate management reports required dedicated cables and expensive proprietary software.

With the arrival of Industry 4.0, this reality changed drastically. Companies now need to send telemetry in real time to cloud servers, enabling predictive analytics with artificial intelligence and remote maintenance. However, connecting factory floor devices directly to the open internet exposes the plant to severe cyber risks, making the use of lightweight and secure protocols indispensable.

Understanding the MQTT Protocol and How It Works

MQTT, which stands for Message Queuing Telemetry Transport, is a lightweight communication protocol developed specifically to connect resource-constrained devices on unstable networks. In practice, it works like a postal system based on an intermediary called a broker, where equipment publishes information to specific topics and other systems subscribe to those topics to receive data instantly.

Unlike the traditional HTTP protocol used on the web, which requires constant client requests to check for new data, MQTT maintains an open connection and consumes very little bandwidth. In industry, this is vital because it allows hundreds of PLCs to send temperature, pressure, and part-count readings every second without clogging the local network or delaying critical processing.

Ensuring Security with TLS and Certificate-Based Authentication

Connecting an industrial device to the cloud without encryption is the equivalent of sending banking passwords on an open postcard. To shield the communication, TLS (Transport Layer Security) is used, which is the same technology that protects bank websites on the internet, scrambling data end-to-end so no one can read it along the way.

In addition to data encryption, authentication based on digital certificates ensures that only authorized PLCs can talk to the cloud broker. In practice, the controller presents a digital cryptographic badge before sending any production data, preventing rogue devices from impersonating legitimate machines on the network.

Implementing Connection on the PLC with a Dedicated Library

To put this architecture into practice, many modern PLCs already feature native MQTT libraries within their programming environments. The initial step consists of configuring basic network parameters and the cloud server address within the controller's logic.

1. Configure the IP address, subnet mask, and default gateway of the PLC to ensure connectivity with the local network that has internet access.
2. Import the MQTT client library provided by the PLC manufacturer and declare the data structures for secure connections with TLS certificate support.
3. Write the code in structured text or function blocks to initialize the connection with the broker, passing user credentials and the standard encrypted port 8883.

PROGRAM Cloud_MQTT_Connect
VAR
    mqttClient : MQTT_Client_Secure;
    bConnect : BOOL;
    sBrokerIP : STRING := 'broker.aws.com';
    uiPort : UINT := 8883;
END_VAR

IF bConnect THEN
    mqttClient(
        ServerAddress := sBrokerIP,
        Port := uiPort,
        UseTLS := TRUE,
        KeepAlive := 60,
        Connected => bIsConnected
    );
END_IF;

Cyclic Data Publication and Handling Network Drops

Once the secure connection is established, the PLC program must organize process variables into lightweight payloads, usually in JSON format, to facilitate reading by cloud systems. In practice, this means packaging conveyor states, active alarms, and energy consumption into a single structured text block.

Since industrial networks can experience fluctuations or temporary signal drops, the PLC logic must anticipate offline behavior. When the connection is lost, the controller temporarily stores critical events in its internal memory and attempts to reconnect autonomously, ensuring no valuable data is lost during an internet failure. To complement this implementation in production environments, see our related technical analyses on Integrating Building Automation Systems with Programmable Logic Controllers via Secure Industrial Protocols and Building Management Systems Integration with Programmable Logic Controllers via OPC UA and X.509 Encryption.

Final Considerations on Reliability and Architecture

The integration of Programmable Logic Controllers with cloud systems via secure MQTT represents an unavoidable evolution for modern automation engineering. By uniting the deterministic reliability of factory floor hardware with the analytical scalability of the cloud, companies gain total visibility of their operations without compromising cyber security.

The success of this type of project depends on careful planning of the network topology, the correct choice of communication libraries, and rigor in digital certificate management. With these solid foundations, the factory transforms into a truly connected environment, prepared for the challenges of digital transformation.