Great thread! I've done something similar with legacy injection molding machines — the RS232 sniffing approach is absolutely the right starting point for unknown protocols.
A few things that helped me in similar projects:
1. Passive RS232 spy — it works, but mind the baud rate
The spy cable approach @Steve-Mcl described is solid. One practical tip: Techmation A80 series typically communicates at 9600 or 19200 baud, 8N1 — so signal integrity shouldn't be an issue at those speeds even with a simple resistor/diode split. I'd start with 9600 and work up.
Once you're sniffing, capture raw bytes in Node-RED using the serial in node set to "binary buffer" output mode. Don't try to parse yet — just log everything to a file for 10-15 minutes of normal machine operation. You'll need full transaction context (both HMI→PLC and PLC→HMI directions) to reverse the protocol.
2. Protocol decoding strategy for proprietary ASCII/binary
From experience with Chinese-brand injection molding PLCs, the protocol is often a simple request-response pattern:
- HMI sends a short "read request" frame (often starts with
0x02 STX or a specific ASCII command byte)
- PLC responds with a fixed-length frame containing the data
In Node-RED, use a function node to log both timestamp and hex representation:
const hex = Buffer.from(msg.payload).toString('hex');
node.warn(`[${Date.now()}] RX: ${hex}`);
return msg;
After capturing, look for repeating patterns. Production count and cycle time are usually 16-bit or 32-bit integers at fixed offsets. Status/alarm bits are often packed into a bitmask byte.
3. Scaling to 3 machines — the RS232 multiplexer problem
This is where it gets interesting. Once you've decoded the protocol, you still have the problem of 3 separate RS232 ports going to a single Node-RED instance. A few options:
- 3x USB-RS232 adapters into the Pi/PC running Node-RED — simplest, works well if machines are close
- Multi-port serial server (Ethernet-to-serial, 4-port) — good if machines are spread across the floor. Gives you TCP socket access to each machine independently
- Wireless RS232 bridge — if running cables is difficult, there are RS232-to-LoRa or RS232-to-WiFi modules that expose a transparent serial-over-TCP connection
For the last option, I've used a device called WS-PLCMU700 in a similar factory setting — it's a wireless PLC communication unit that supports RS232/RS485 transparent bridge over LoRa or WiFi. Worked well for us when adding new wiring wasn't an option. Just mentioning it as one of the approaches we tried; there are other similar products too.
4. After decoding — MQTT to ThingsBoard
Once you have the data in Node-RED, the MQTT → ThingsBoard part is pretty standard. ThingsBoard accepts JSON telemetry on v1/devices/me/telemetry. Make sure to configure unique device tokens for each machine so you can distinguish them on the dashboard.
Good luck with the reverse engineering! The sniffing phase is the fun part. If you share some of the captured hex bytes here, happy to help interpret them — I've seen a few Techmation variants before.
