Each HMI panel keeps one connection to a master PLC that aggregates the other 27 into a defined data map. Direct polling fails when the panel driver's device limit, 7 in one documented case, is below the PLC count. Put the panels and the PLC cell networks on separate switched segments.
Two HMI panels watching 27 PLCs is past the point where each panel should hold its own connection to every controller. The deciding number is the panel driver's device cap: one documented panel driver tops out at 7 PLCs, and 27 is far beyond it. The design that works puts one master PLC between the cell and the panels, holds the shared values in a defined data map, and gives each panel a single connection to that map. Under it run two switched Ethernet segments, one for the master and the PLCs, one for the panels. This page sizes the connections, works the numbers for a 27-PLC cell, and lists what to pull from the manuals before you wire anything.
The panel driver's device cap decides it
Direct polling puts one connection in the panel for every PLC it addresses, so 27 PLCs means 27 connections in each panel. Every HMI driver documents a cap on that count, and published caps differ by an order of magnitude: 7 PLC devices in one documented panel driver, 48 TCP connections in one HMI software family, a 4-request limit on simultaneous reads in the CODESYS PLCHandler client library. Your cap is printed in the driver manual, and it settles the architecture before Ethernet speed enters the discussion.
The controller side is finite too. An older interface module that puts a small controller on Ethernet documents 6 connections, and a panel can consume more than one connection per PLC it addresses, so a single panel watching several small controllers through one can spend all 6. One controller platform budgets up to 3 connection resources for each HMI connection, so two panels hold 6 resources before the master's own exchanges are counted. A mid-range controller CPU documents 256 CIP and 120 TCP connections, comfortable headroom for a master, though the pool is never bottomless.
That is also why the earlier 15-PLC serial bus felt slow: every device on a multidrop bus waits its turn, so each PLC added to the bus stretches every update on it. Ethernet removes the turn-taking on the wire. It leaves the driver's device cap exactly where it was, in the panel's software.
Your options for 2 panels and 27 PLCs
| Option | Connections per panel | Where the work goes | Pick it when |
|---|---|---|---|
| Direct polling | 27, against the driver cap | nowhere, it is the plain design | the whole cell fits inside the cap, say 5 PLCs under a 7-PLC driver |
| One master PLC | 1 | a data map and comms logic in the master | many PLCs and both panels need the same values |
| Two area masters | 1 each | each master carries its area, masters swap shared words | the cell is really two areas and the panels sit far apart |
| Panels on the master's serial port | 1 serial drop each | station IDs and a turn-taking poll schedule | the panels sit near the master and display updates can wait their turn |
For 27 PLCs the master wins on arithmetic alone: 27 connections per panel is beyond every cap quoted above, and 1 connection per panel fits inside any of them. If part of the cell is still serial Modbus, a gateway joins those PLCs to the master's Ethernet side, and gateway's master side decides the poll schedule.
Example: sizing one master PLC for a 27-PLC cell
Take a theatre cell: 27 PLCs driving winches and curtains, two panels, one master. Give each PLC 12 words in the master's map: 8 status, 2 alarms, 2 position words from the winch encoder. The map is 27 × 12 = 324 words. The Modbus/TCP protocol caps a single read at 125 registers, so each panel pulls the whole map in 3 requests, since 3 × 125 = 375 registers of capacity covers 324 words. That fits a 4-request client cap with one request to spare.
Set an illustrative poll rate, twice a second per panel, and tune it later. Each panel then sends 3 requests × 2 polls per second = 6 exchanges per second, and the two panels together put 12 exchanges per second into the master. A 125-register response carries 250 data bytes plus headers, call it 300 bytes per exchange, so the panel traffic is 12 × 300 = 3,600 bytes per second against roughly 12.5 MB per second on a 100 Mbit/s link, about 0.03% of the wire. The master's own exchanges with 27 PLCs are the traffic that actually fills the schedule.
Position freshness sets the poll rate, not bandwidth. Assume the master's comms step refreshes each PLC's words every 200 ms. The oldest position an operator can see is the master interval plus the panel poll: 200 ms + 500 ms = 0.7 s. A curtain moving at 0.5 m/s travels 0.35 m in that time, so the bar on screen lags the real bar by about a third of a metre at worst. Cut the panel poll to 250 ms and staleness drops to 200 ms + 250 ms = 0.45 s, about 0.23 m of travel. That is the tuning loop: shorten the poll until the operator stops chasing the bar.
Two panels polling one master is the mirror image of many PCs polling one PLC: each panel's wait grows with the other panel's traffic. In one documented Modbus/TCP case, a second heavy master doubled the time for the same four polls, from 1 s to 2 s. The two panels above are nowhere near that load, but log exchange times again whenever a third screen joins.
When direct polling still wins
Direct is the simpler design whenever the cell fits inside the driver's cap. Five PLCs under a documented 7-PLC driver need no master, no data map and no staleness layer: a value the panel writes lands in the target PLC on the next exchange. Two panels can also split the cell between them, each polling its own subset, as long as each panel's own list stays inside the cap.
Aggregation has a price worth naming. A command now travels panel to master to target PLC, so the map must carry the handshake: the panel writes a command word, the master copies it to the target, and the target's ack word returns through the map. Display the ack, never the pressed button, so the operator can tell a completed move from a requested one.
One safety line: winch and curtain motion stays inside the safety chain the winch controls define. The HMI is an operator view of that machinery, never a safety device.
A status board is not a third panel
If the crew also wants the cell's status on a board by the door, that is a display job, not a control job. The board mirrors the master's map and holds no connection to any motion control, the same split as choosing an annunciator display over another HMI. We build shop-floor signage units for exactly that board, with offline playback or your own Android app; they are not HMIs.
Two switched segments under the master
Run one segment for the master and the 27 PLCs and a second for the two panels. If the panels only ever talk to the master, the segments need no path between them. Give each segment its own port on a two-port master, and the planning questions are the ones in running PROFINET IO on one or two Ethernet ports; a one-port master puts both segments on the same switch and still works, with shared broadcast space.
Use switches, never hubs. A hub repeats every frame to every port, so one chatty device drowns the cell; a switch forwards a frame only to the port it is addressed to. Take managed switches and switch on the broadcast storm protection their manuals document.
Copper runs carry their own limit: 100 m per run between a switch and a device under the ANSI/TIA-568 structured cabling rules. A switch extends total reach one legal run at a time, each span getting its own 100 m.
If the serial row in the table wins instead, each panel takes its own station ID on the multidrop and the master polls them in turn; the wiring rules are the ones that carry one panel to three PLCs on an RS-422 bus. Keep the PLCs and the panels off one shared serial bus: two masters on one RS-485 bus is its own documented fault, and that article carries the fix.
What to ask for, and the recommendation
- The device cap for your exact driver and software version, from the panel's manual.
- The free connection pool where the panels land; one platform budgets up to 3 connection resources per HMI connection, so ask for the pool size, not a yes or no.
- Any interface module limit between the master and small controllers; 6 connections is a real documented number there.
- The data map: source PLC, address, type, scale and a stale flag per PLC, so an exchange that stops shows as stopped.
- The poll schedule: which words ride in the first 125-register read, and the master's own exchange interval.
- Switches: managed, with broadcast storm protection, rated for the cabinet's temperature.
Recommendation: For 27 PLCs and 2 panels, put one master PLC between the cell and the panels unless your driver's documented cap is 27 or more. Give each panel one connection to the master's map, park position and alarm words in the first 125-register read, start the panel poll at 250 ms and tighten it against the curtain speed. Keep the panels on their own switched segment and leave the PLC network to the master.
Questions
Can the panels stay off the PLC network completely?
Yes, and that is the point of the master design. Each panel needs one address on its own segment and one connection to the master. No panel ever addresses a cell PLC, so adding a 28th PLC grows the master's map and leaves both panel programs untouched. Panel projects shrink to one driver entry each and stop changing as the cell grows.
Can the two panels see each other's state?
Yes, through the master's map. Reserve a few words for each panel's own state, such as the screen it is on and the commands it has issued. Each panel reads the other's words like any map value, so both operators see the same picture with no panel-to-panel link at all.
Does a router between the two segments raise the panel's device cap?
No. The cap counts the PLC devices the panel's driver is configured for, and it lives in the panel's software, not in the network. A router changes where packets travel. Keep the segments separate when the panels only need the master, and route between them only for an engineering station that must reach both.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.