Wouldn't it be easy to just rewrite the software if you leave the PLC?
That said, as long as it works...
That said, as long as it works...
See, the situation was that IT management, who officially had the responsibility for the PC saw it as a risk because we in IT were unable to do anything if the system died. But the production line management, who had to pay for the upgrade, saw no reason to do it because it was "working fine!".
Sure it was working fine, and had been for almost 20 years. But WHEN it would inevitably give up the ghost they would be completely hosed.
I would also assume that the PLC just gets some commands from the master.
Granted, these might be too many assumptions.
Yep.
Modern USB/TCP connected PLCs just encapsulate RS-232 data into USB or TCP packets, nothing else (for backward compatibility). Also there are encapsulation and decapsulation devices which enables archaic PLCs and other industrial devices to be retrofitted to more modern systems.
Moreover, the OP noted that emulation speed was at critical importance so, the code is CPU speed sensitive. Missing specs, missing company, missing source plus time sensitivity makes this endeavor very risky if not hard.
Sniffing a protocol to reverse engineer stuff, is like trying to learn a new language by listening to conversations of a ground-level monitor and a crane operator.