Start with transport and safety
- Identify the physical transport and voltage/interface standard before attaching instruments.
- Document authority, equipment hazards and operations that must never be triggered during testing.
- Prefer vendor documentation, software logs and passive observation of known-good operation.
- Capture both directions with timing while changing one safe input or action at a time.
- Separate electrical faults and framing errors from valid but misunderstood protocol messages.
Industrial equipment is not a generic test target. Do not inject commands, bypass interlocks or probe energized interfaces unless a qualified, authorized procedure makes that safe.
Build the protocol model
| Frame | Delimiter or length, address, command, payload and checksum/CRC. |
|---|---|
| Exchange | Request/response pairing, unsolicited events, acknowledgements and timeouts. |
| State | Initialization, modes, sequencing, retries and recovery after interruption. |
| Confidence | Observed examples, competing explanations and controlled validation result. |
Serial captures are common, but the same evidence discipline can apply to USB or vendor APIs when observation is lawful and technically appropriate. Document inferred behavior as fixtures and a state diagram, then validate only the minimum operational functions required.
Use legacy serial integration when the objective is deployment, RS485 protocol analysis for multidrop specifics, traffic capture for serial evidence and the reverse-engineering pillar.