Building a Diagnostic Workstation for B&R PLC Systems

A properly equipped diagnostic workstation is the foundation for maintaining, troubleshooting, and reverse-engineering B&R CP1584 machines that have zero OEM documentation. This document specifies a complete hardware and software setup — including protocol analyzers, logic analyzers, oscilloscopes, CAN sniffers, POWERLINK sniffers, and software tools — along with a systematic diagnostic workflow checklist. The goal is to enable a single automation engineer to diagnose any problem on a legacy B&R system. Cross-references: physical-layer-sniffing.md for oscilloscope/logic analyzer techniques, cp1584-forensics.md for information extraction without project files, and first-60-minutes.md for the emergency recovery playbook.

1. Overview

1.1 The Diagnostic Workstation Concept

A diagnostic workstation is a self-contained hardware and software platform purpose-built for interrogating, monitoring, and troubleshooting B&R Automation CP1584 PLC systems that were deployed by OEMs no longer in business. Unlike ad-hoc troubleshooting where you scramble for cables, adapters, and software each time a machine goes down, a prepared workstation lets you walk up to any unknown CP1584 panel, connect in under five minutes, and begin systematic data extraction.

The core idea is separation of concerns: your diagnostic workstation is isolated from production networks, carries every adapter and tool you might need, and stores a library of captured configurations, firmware images, and protocol traces that accumulate value over time. Each new machine you diagnose adds to the knowledge base. Without a workstation, each engagement starts from zero.

1.2 Why Dedicated Tools Beat Ad-Hoc Troubleshooting

1.3 Cost Justification for a One-Man Automation Team

A fully equipped diagnostic workstation costs between $3,500 and $8,000 depending on how many optional items you include. Compare this to a single service call for an unknown machine: 8 hours at $150/hour is $1,200, and without the right tools you may need two or three visits. The workstation pays for itself after 3-4 unknown-machine engagements. Beyond payback, the accumulated protocol traces and configuration backups become an irreplaceable asset that no amount of on-site time can recreate.

Budget tiers:

2. Workstation Hardware – Essential Equipment

2.1 Laptop/PC Requirements

Automation Studio (AS) is the primary constraint. AS runs exclusively on Windows (no Linux, no macOS native). B&R officially supports Windows 10 and Windows 11; Windows 7 reached end-of-support in AS 4.5+. Virtual machines work but add latency and complicate driver installation for network adapters and CAN hardware.

Minimum Specifications

Recommended Specifications

Recommended Laptop Models

These models were current as of mid-2026. For newer purchases, prioritize: Intel I210 or I225-V NIC, minimum 16 GB RAM, Windows 11 64-bit, and at least two USB 3.0 ports.

Automation Studio Version Strategy

B&R ties Automation Studio versions to Automation Runtime (AR) versions. A CP1584 may run AR 4.x. You need AS compatibility:

Strategy: Install the newest AS version you can license. It has backward compatibility to open older projects. If you encounter a project that requires an older AS version, install that version in a VM. Maintain at least two AS versions on the workstation.

Virtual Machine Considerations

If you need to run an older AS version or want a Linux side for Wireshark/Sigrok/SocketCAN:

• VMware Workstation Player (free for non-commercial) or VirtualBox (free)
• Allocate 4 CPU cores, 8 GB RAM, 80 GB disk to the VM
• Pass through USB devices (CAN adapter, logic analyzer) to the VM
• Network bridging for PLC access from VM
• Snapshot the VM after AS installation so you can revert cleanly

Hard Drive Imaging Strategy for CF Card Work

CF cards in B&R systems use a custom partition layout. You will need to:

• Read CF cards with industrial-grade readers (not cheap camera readers)
• Create full binary images with dd, Win32 Disk Imager, or Clonezilla
• Store images with metadata: machine ID, date, firmware version, AR version
• Maintain a library of known-good images for common configurations
• Write images back to replacement CF cards for recovery

Recommended CF card reader: Transcend TS-RDF8K (USB 3.0, supports CF, SD, microSD) or a dedicated PCMCIA/CF adapter for direct slot access.

2.2 Network Tools

Dedicated Ethernet NIC for PLC Connection

The Intel I210 and I225-V are the gold standard for industrial Ethernet work. They have reliable driver support, work with Wireshark in promiscuous mode, and handle the precise timing required for POWERLINK analysis.

For POWERLINK sniffing, you need a NIC that supports promiscuous mode reliably. Intel chipsets are the safest bet. Realtek chipsets sometimes drop packets under high POWERLINK traffic loads.

Network Switch Requirements

Recommended switch: Netgear GS105E (5-port, managed, $45) or Cisco SG250-08 (8-port, fully managed, $150). The managed switch with port mirroring is strongly recommended for POWERLINK diagnostics.

Ethernet Cables and Adapters

2.3 Oscilloscope

Why an Oscilloscope for PLC Diagnostics

An oscilloscope is indispensable for diagnosing analog signal problems (0-10V, 4-20mA sensors), verifying encoder signals (A/B quadrature), checking POWERLINK physical layer integrity, analyzing CAN bus signal quality, and debugging X2X bus timing issues. Without one, you are guessing at electrical problems.

Recommended Oscilloscope Models

The Rigol DS1054Z is the consensus recommendation for automation diagnostics. Four channels let you monitor two differential signals simultaneously (e.g., CAN-H and CAN-L plus a trigger signal). The 100 MHz bandwidth covers all signals you will encounter on a B&R system.

High-End Option

For teams that need deeper analysis (power electronics, high-frequency EMC, motor drive waveforms):

Probe Requirements

A differential probe is the single most important accessory beyond the included passive probes. It lets you safely measure CAN-H and CAN-L relative to each other without ground-reference problems that plague single-ended measurements on differential buses.

Oscilloscope Use Cases for B&R Diagnostics

1. POWERLINK physical layer: Verify 100BASE-TX signal quality at the PLC RJ45 port. Look for jitter, amplitude droop, and retransmissions.
2. CAN bus signal integrity: Check CAN-H and CAN-L differential voltage (should be 1.5-2.5V differential in dominant state). Identify reflections from improper termination.
3. Analog sensor verification: Confirm 4-20mA loop current, 0-10V sensor output, and identify noise sources.
4. Encoder signal analysis: Verify A/B quadrature timing, index pulse, and count accuracy.
5. X2X bus timing: Measure clock, data, and enable signal relationships on the X2X flat cable bus.
6. Power supply ripple: Check 24V supply stability, measure ripple under load.

2.4 Logic Analyzer

Why a Logic Analyzer

Logic analyzers capture digital signals with high channel count and precise timing. For B&R diagnostics, the primary use case is X2X protocol analysis (8-16 digital lines) and SPI/I2C bus debugging on IO modules. They complement oscilloscopes: the scope gives you analog detail on a few channels, the logic analyzer gives you digital timing on many channels.

Recommended Logic Analyzer Models

Channel Count Requirements

For X2X analysis, 16 channels is strongly recommended. The X2X bus uses a flat cable with up to 16 data lines plus clock and frame signals. With only 8 channels you cannot capture the full bus transaction.

Protocol Decoding Support

For X2X protocol, neither Saleae nor Sigrok has a built-in decoder. You will need to define a custom protocol or export raw captures and decode with Python. See x2x-protocol.md for X2X frame format details.

Use Cases

1. X2X bus sniffer: Connect to the flat cable header on a B&R IO module, capture bus traffic, decode frame structure.
2. SPI flash reading: Read configuration data from SPI flash chips on IO modules or interface boards.
3. Digital IO timing: Verify sensor response times, output switching delays, and watchdog timeout behavior.
4. Custom protocol reverse engineering: Capture undocumented serial protocols between PLC and proprietary peripherals.

2.5 CAN Bus Tools

Why CAN Tools

B&R systems use CANopen extensively through modules like the IF2772 (CANopen interface module). Many OEM machines also have CAN buses for auxiliary devices (drives, sensors, HMIs). Without a CAN adapter, you are blind to this communication layer.

Recommended CAN Adapters

The PEAK PCAN-USB is the recommended starting point. It is affordable, well-supported on Windows, and PCAN-View provides immediate CAN bus monitoring without additional software cost.

Professional CAN Software

For diagnostic work, PCAN-View is usually sufficient. If you need to simulate CAN nodes or build automated test sequences, CANalyzer becomes justified.

Linux Alternative: SocketCAN

For Linux-based workstations or Raspberry Pi field tools:

sudo apt install can-utils
sudo ip link set can0 up type can bitrate 500000
candump can0
cansend can0 123#1122334455667788
canplayer -I can0_log

PEAK PCAN adapters have Linux kernel support (peak-linux-driver). Kvaser also provides Linux drivers.

CAN Physical Layer Components

2.6 POWERLINK Sniffing Setup

Why POWERLINK Sniffing

Ethernet POWERLINK (EPL) is B&R’s real-time Ethernet protocol used for communication between CP1584 PLCs, IO modules, drives, and HMIs. The protocol runs on standard Ethernet hardware but uses a managed cycle. Without sniffing capability, you cannot diagnose communication errors, timing problems, or identify the nodes on the network.

Wireshark + POWERLINK Plugin

Wireshark is the primary tool for POWERLINK capture. The POWERLINK dissector plugin is maintained by the openPOWERLINK community.

Setup procedure:

1. Install Wireshark 3.x or 4.x (latest stable)
2. Download the openPOWERLINK Wireshark dissector from the openPOWERLINK project on SourceForge or GitHub
3. Place the dissector DLL (on Windows: powerlink.dll) in the Wireshark plugins directory:
   • C:\Program Files\Wireshark\plugins\4.x\ (adjust for your version)
4. Restart Wireshark
5. Verify: open Edit > Preferences > Protocols, search for “POWERLINK”

The dissector decodes:

• Start of Cycle (SoC) frames
• Poll Request / Poll Response pairs
• Node-to-node communication
• ASnd (asynchronous send) frames
• Error frames and timeout indicators

Capture Hardware Requirements

POWERLINK operates at 100 Mbps with precise timing. Reliable capture requires:

• A dedicated Ethernet NIC not used for any other traffic
• Promiscuous mode support
• No offloading features (disable checksum offload, TCP segmentation offload)
• A managed switch with port mirroring OR a network tap

Recommended approach: managed switch with port mirroring. Mirror the PLC port to the capture NIC. This is non-invasive and captures all traffic including broadcasts.

NIC Configuration for Capture

On the capture NIC, disable all offloading features to prevent packet manipulation:

Windows (via Device Manager > Advanced):

• Disable “Checksum Offload”
• Disable “Large Send Offload”
• Disable “TCP Checksum Offload”
• Disable “UDP Checksum Offload”
• Disable “Interrupt Moderation”

Linux (via ethtool):

sudo ethtool -K eth0 rx off tx off gso off gro off tso off
sudo ethtool -C eth0 rx-usecs 0 rx-frames 0

See powerlink-internals.md for POWERLINK frame structure details.

2.7 Serial Communication Tools

Why Serial Tools

B&R PLCs have serial ports (RS232 on the CP1584 front panel, RS485 on some IO modules) used for Modbus communication, printer output, legacy device connections, and sometimes the system console. Many OEM machines use serial protocols that are undocumented.

RS232/RS485 USB Adapters

Always buy FTDI chipset adapters. Prolific and CH340 have driver instability problems that will waste your time during diagnostics.

RS485 Non-Invasive Tapping

To monitor an existing RS485 bus without disrupting it:

The Y-cable approach works but is invasive (requires unplugging). The breakout board soldered in parallel is the practical approach for one-man teams. See serial-diagnostics.md for detailed procedures.

RS232 Monitoring Y-Cable

For RS232 TX/RX monitoring without disrupting communication, build a Y-cable:

Device TX  ---[1k resistor]---+--- Monitor RX
                             |
Device RX  ---------------+--- Monitor TX
                         |
Ground ------------------+

The 1k resistor on the TX tap prevents the monitor from loading the TX line. This lets you passively sniff RS232 communication.

2.8 Multimeter and Hand Tools

Recommended Multimeter

The Fluke 87V is the industrial standard. Its data logging mode (records up to 10,000 readings) is useful for recording voltage trends over time during machine operation. The temperature probe accessory measures ambient and surface temperatures for thermal diagnostics.

Additional Electrical Test Equipment

Ground current measurement with a clamp meter is critical for diagnosing EMC problems. See grounding-emc.md for procedures.

Hand Tools

2.9 Physical Layer Tools

CAN Physical Layer

Ethernet Testing

EMC Investigation Tools

The DIY near-field probe is made from a small ferrite bead (Material 43 or similar) with a short length of coax cable:

Cut coax to 10cm. Strip one end, wrap 3-4 turns around ferrite bead.
Connect other end to BNC. Use with spectrum analyzer or scope
set to 1 MOhm input, 20 MHz bandwidth.

See physical-layer-sniffing.md for detailed EMC measurement procedures.

3. Software Tool Suite

3.1 Automation Studio

Version Selection

Install the version that covers the widest range of AR versions you expect to encounter. For CP1584 systems, AS 4.7+ covers most deployments from 2016 onward.

Strategy: Install AS 4.10 as primary (covers AR 4.10+). Keep AS 4.5 in a VM for legacy systems.

Service Contract and Licensing

• B&R Automation Studio requires a service contract for updates and full features
• Without a service contract, you can use the last version released before your contract expired
• Evaluation licenses are available (30 days, extendable by request) for initial assessment
• For a diagnostic workstation, consider a shared license pool if your organization has multiple B&R users

Installation on Diagnostic Workstation

1. Install Windows 10/11 clean install (avoid bloatware)
2. Install Automation Studio (run installer as Administrator)
3. Install target AR versions via the AS Update Manager
4. Install mapp Technology packages if needed
5. Configure AS network settings for the dedicated PLC NIC
6. Create a default project template for new machine diagnostics
7. Set AS default directory to a dedicated work folder (not My Documents)

3.2 Wireshark

POWERLINK Dissector Installation

Detailed in Section 2.6. Key configuration steps:

1. Install Wireshark from wireshark.org (not Microsoft Store version)
2. Install Npcap when prompted (packet capture driver)
3. Download openPOWERLINK dissector from openPOWERLINK GitHub releases
4. Copy powerlink.dll to C:\Program Files\Wireshark\plugins\<version>\
5. Verify dissector loads: Wireshark > About > Plugins, search for POWERLINK

Capture Filter Profiles for B&R Protocols

Create custom capture profiles for common scenarios:

POWERLINK capture filter:

ether proto 0x88ab

This filters for the POWERLINK ethertype (0x88AB).

CAN bus capture (via PCAN or SocketCAN):

(no display filter needed; CAN frames are already isolated by interface)

Modbus TCP capture filter:

tcp port 502

OPC-UA capture filter:

tcp port 4840

FTP capture filter (for CF card access):

tcp port 21 or tcp port 20

SDM (Service and Diagnosis Manager) capture filter:

tcp port 11159

Display Filters

POWERLINK node filter:

powerlink.node_id == 0x01

POWERLINK error frames:

powerlink.type == error

Modbus exceptions:

modbus.exception_code > 0

3.3 OPC-UA Clients

UaExpert (Free)

UaExpert by Unified Automation is the most capable free OPC-UA client:

• Browse server address space
• Read/write variables
• Subscribe to monitored items
• Call methods
• Historical data access
• Export node definitions

Connection to B&R OPC-UA server:

1. In Automation Studio, enable OPC-UA server in the PLC configuration
2. Set the endpoint URL (typically opc.tcp://<PLC-IP>:4840)
3. Configure security policy (None for diagnostics, or Basic256Sha256 for production)
4. In UaExpert, add server endpoint, connect, browse namespace

Python asyncua

import asyncio
from asyncua import Client

async def main():
    url = "opc.tcp://192.168.1.10:4840"
    async with Client(url=url) as client:
        root = client.nodes.root
        children = await root.get_children()
        for child in children:
            print(f"  {child.browse_name}: {await child.get_display_name()}")
        var = client.get_node("ns=2;s=SystemVariables.MachineStatus")
        value = await var.read_value()
        print(f"Machine status: {value}")

asyncio.run(main())

See opcua.md for detailed OPC-UA configuration and advanced patterns.

Node-RED OPC-UA Nodes

Node-RED provides a visual programming environment with OPC-UA nodes:

1. Install Node-RED: npm install -g node-red
2. Install OPC-UA package: cd ~/.node-red && npm install node-red-contrib-opcua
3. Configure OPC-UA server endpoint in the node
4. Build flow: Read variable -> Transform -> Display/Log/Alert

3.4 PVI Tools

PVI Development Setup

PVI (Process Visualization Interface) is B&R’s proprietary communication protocol. The PVI Development Setup provides:

• PVI Manager (connection configuration)
• PVI Transfer (data transfer with PLC)
• PVI API (C/C++ library for custom applications)

Download from B&R website (requires service contract or registration). Install on the diagnostic workstation alongside Automation Studio.

brsnmp

brsnmp (github.com/hilch/brsnmp) is an open-source C++ Windows command-line tool for executing PVI-SNMP commands against B&R PLCs. It requires B&R PVI Development Setup (PVI 4.x or 6.5.2+) to be installed. Download the binary from the GitHub releases page.

brsnmp --list                        # List all B&R PLCs on the network
brsnmp --filter=X20CP1584 --details  # Get detailed info for specific model
brsnmp --filter=$LAST --ipAddress=192.168.1.50  # Set IP (use $LAST to reuse previous filter)

This is invaluable for quick system information extraction when you do not have Automation Studio available.

Python PVI Wrapper (Pvi.py)

Community Python wrapper around the PVI COM interface:

from pvi import PviConnection, PviVariable
conn = PviConnection('192.168.1.10')
var = PviVariable(conn, 'MainProgram.Status')
value = var.read()
print(f"Status: {value}")

See pvi-api.md for complete PVI configuration and Python wrapper documentation.

3.5 Serial Communication Software

Recommended: Tera Term for interactive serial communication (macro scripting lets you automate common queries). RealTerm for binary/hex analysis. Saleae Logic for capturing and decoding serial protocols electrically.

Tera Term serial configuration for B&R default settings:

Baud rate: 9600 or 19200 (check PLC configuration)
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None
Terminal: VT or ANSI

See serial-diagnostics.md for comprehensive serial diagnostic procedures.

3.6 Python Environment

Installation

Use Python 3.8+ (3.10 or 3.11 recommended for best library compatibility). Install via python.org or conda.

Key Packages

Virtual Environment Setup

python -m venv C:\br-diagnostics\venv
C:\br-diagnostics\venv\Scripts\activate
pip install -r requirements.txt

Create a requirements.txt file listing all packages. Pin versions for reproducibility.

Jupyter Notebooks

Jupyter notebooks are ideal for interactive protocol analysis. Example workflow:

1. Capture protocol data (Wireshark export to CSV/JSON)
2. Load into Jupyter notebook
3. Parse and visualize using pandas/matplotlib
4. Extract patterns, identify anomalies
5. Document findings inline with code

See python-diagnostics.md for complete Python diagnostic tool library.

3.7 Network Utilities

nmap Quick Reference for B&R Discovery

Discover B&R PLCs on a network:

nmap -sn 192.168.1.0/24
nmap -p 21,80,11159,4840,502 192.168.1.0/24
nmap -O 192.168.1.0/24

Port signatures for B&R systems:

4. Complete Equipment List with Costs

4.1 Essential Equipment

Essential subtotal: $2,850 (excluding AS license)

4.2 Recommended Equipment

Recommended subtotal: $2,970 (choosing Saleae Logic 8 over Pro 16)

4.3 Optional Equipment

Optional subtotal: $14,120 (selecting items as needed)

5. Workstation Setup Procedures

5.1 Network Configuration

Dedicated PLC Network Interface Setup

1. Identify the Intel I210 (or primary) NIC in Windows Device Manager
2. Rename the adapter: “PLC Network”
3. Configure a static IP in the B&R default range:
   • IP: 192.168.1.100 (workstation)
   • Subnet: 255.255.255.0
   • Gateway: Leave blank
   • DNS: Leave blank
4. Disable all power management on this adapter (Device Manager > Power Management)
5. Set adapter metric to 1 (highest priority) to ensure PLC traffic uses this interface

If the PLC uses a different subnet (determined during discovery), change accordingly. Keep notes on which subnets each machine uses.

Wireshark Capture NIC Configuration

If using a second NIC for Wireshark capture:

1. Rename the second adapter: “Capture NIC”
2. Configure static IP on a different subnet (or leave unconfigured)
3. Disable all offloading features (see Section 2.6)
4. In Wireshark, select only this adapter for capture
5. Set Wireshark capture buffer to maximum (128 MB or more)

POWERLINK-Compatible Network Setup

POWERLINK requires 100 Mbps full-duplex links. Configure the switch port and NIC:

1. Set switch port connected to PLC to 100 Mbps full-duplex (disable auto-negotiation if problems occur)
2. Set capture NIC to 100 Mbps full-duplex
3. Verify link lights on both switch port and NIC
4. Test with a ping to the PLC IP before attempting capture

DNS Configuration

For most diagnostic work, you do not need DNS. Use host files if needed:

# C:\Windows\System32\drivers\etc\hosts
192.168.1.10    cp1584-machine-a
192.168.1.11    cp1584-machine-b

5.2 Physical Connections

First Contact Procedure for Unknown B&R System

Before connecting anything to an unknown machine:

Step 1: Safety Assessment

• Verify LOTO (Lock-Out/Tag-Out) procedures with the plant
• Confirm machine is in a safe state (E-stop engaged, drives disabled)
• Identify all power sources: 24V DC, 230V AC, 400V AC (3-phase), pneumatic
• Verify ground connections are intact
• Check for stored energy (capacitors, pressurized systems, suspended loads)

Step 2: Visual Inspection

• Locate the CP1584 PLC (look for the B&R logo and model number on the front panel)
• Note the IP address label (often handwritten on a sticker)
• Identify all connected cables (Ethernet, CAN bus, X2X, serial, power)
• Photograph all cable connections and panel layouts
• Note LED status on CP1584 (PWR, RUN, ERR, BF, MS)
• Check for obvious damage (burnt components, water ingress, loose connectors)

Step 3: Physical Connection

1. Connect workstation Ethernet cable to the PLC Ethernet port (labeled ETH0 or ETHERNET)
2. Connect serial cable if available (RS232 on front panel, COM1)
3. Connect CAN adapter if CAN bus access is needed (locate the CAN bus junction point)
4. Do NOT connect power measurement tools to live circuits until safety is confirmed
5. Verify all connections are secure and not stressing any connectors

Step 4: Initial Power Monitoring

1. Measure 24V supply at the PLC power terminals with the multimeter
2. Verify voltage is within range (20.4-28.8V for 24V nominal)
3. Check for ripple or noise on the 24V supply using the oscilloscope
4. Measure ground reference voltage (should be < 1V between PE and PLC GND)

5.3 Software Configuration

Automation Studio Project Creation

1. Open Automation Studio
2. Create a new project: File > New > Project
3. Set Target: B&R Automation Runtime > CP1584
4. Set AR version to match the PLC (or highest available for forward compatibility)
5. Configure the physical hardware: Add the CP1584 CPU, IO modules, and interface modules found during inspection
6. Create an Ethernet connection to the PLC IP address
7. Set transfer mode: “Transfer to Target” or “Change in Target” as needed

OPC-UA Connection Setup

1. In UaExpert, double-click to add a new server
2. Enter endpoint URL: opc.tcp://<PLC-IP>:4840
3. Select security policy: None (for initial diagnostics)
4. Connect and browse the address space
5. Bookmark important variables (machine state, alarms, process data)
6. Export the address space for offline analysis

Wireshark Capture Profiles

Create named capture profiles:

PVI Connection Configuration

In PVI Manager:

1. Create a new connection
2. Set transport: TCP/IP
3. Set device: CP1584
4. Set IP address to PLC IP
5. Set CPU slot (usually 1)
6. Test connection

CAN Adapter Setup with PCAN-View

1. Connect PCAN-USB to the CAN bus (DB9 connector)
2. Open PCAN-View
3. Set baud rate to match the CAN bus (common: 250 kbps, 500 kbps, 1 Mbps)
4. Set CAN identifier format (11-bit standard or 29-bit extended)
5. Start reception
6. If no traffic is observed, try different baud rates
7. Once traffic is visible, start logging

See if2772-canopen.md for CANopen-specific configuration details.

6. Diagnostic Workflow Checklist

6.1 Pre-Arrival Preparation

• Charge laptop battery (minimum 80%)
• Pack all adapters, cables, and tools
• Verify Wireshark POWERLINK dissector is installed and working
• Verify Automation Studio opens without errors
• Verify PCAN-View detects the CAN adapter
• Verify serial adapter appears in Device Manager
• Check that external SSD has space for new captures
• Bring spare Ethernet cables and adapters
• Bring printed copy of IP range scan results if available
• Review any prior documentation for this machine

6.2 On-Site Diagnostic Procedure

Phase 1: Safety and Assessment (15-30 minutes)

• LOTO confirmed with plant safety
• Power sources identified and verified
• Machine visual inspection completed
• All cable connections documented (photo + written)
• CP1584 front panel LED status noted
• PLC IP address identified (label, DHCP lease table, or ARP scan)

Phase 2: Network Discovery (15-30 minutes)

• Connect workstation to PLC network
• Run ARP scan: arp -a or arp-scan -l
• Run nmap scan: nmap -sn 192.168.1.0/24 (adjust subnet)
• Run port scan on discovered PLC IP: nmap -p 21,80,11159,4840,502 <PLC-IP>
• Document all discovered devices and their roles
• Verify FTP access to CF card (anonymous or configured credentials)

Phase 3: PLC Connection and Backup (30-60 minutes)

• Connect via Automation Studio (transfer mode)
• Upload PLC program and hardware configuration
• Download CF card image via FTP (binary mode)
• Save CF card image to external storage with metadata
• Connect via SDM: http://<PLC-IP>:11159 (check if accessible)
• Connect via OPC-UA: opc.tcp://<PLC-IP>:4840 (check if accessible)
• Read system variables via brsnmp or PVI
• Note AR version, firmware version, project name, build date

Phase 4: Active Diagnostics (1-4 hours)

• Start Wireshark capture on dedicated NIC
• Start CAN bus capture if CAN bus is present
• Connect serial monitor if serial devices are present
• Read all system variables via OPC-UA or PVI
• Map IO configuration (digital inputs, outputs, analog channels)
• Identify communication partners (drives, HMIs, remote IO)
• Check task cycle times and watchdog settings
• Review alarm history and error logs
• Capture representative POWERLINK traffic (at least 10 seconds)
• Note any communication errors or timeouts in traffic

Phase 5: Hardware Health Check (30-60 minutes)

• Measure 24V supply voltage and ripple at PLC terminals
• Check POWERLINK Ethernet signal quality (if problems suspected)
• Measure CAN bus differential voltage (if CAN bus present)
• Check ground connections: PE to PLC GND voltage (< 1V)
• Measure ground currents with clamp meter
• Check ambient temperature and ventilation
• Inspect IO modules for damage or loose connections
• Verify all terminators are present (CAN bus, X2X bus)

Phase 6: Documentation (30-60 minutes)

• Compile findings into diagnostic report template
• Include CF card image location and metadata
• Include Wireshark capture file location
• Include CAN capture log location
• Document all discovered IP addresses and device roles
• Document all IO mappings extracted
• Document any problems found and recommended actions
• Create or update machine documentation file
• Back up all captures and documentation to external storage
• Store documentation in version control (git)

7. Portable vs Bench-Top Configuration

7.1 Portable Setup (Pelican Case)

A portable workstation in a rolling Pelican case is ideal for field service. You carry everything to the machine and set up on a nearby cart or table.

Recommended case: Pelican 1510 (rolling, $280) with custom foam. The 1510 fits airline carry-on requirements (though weight may be an issue at ~35 lbs loaded).

Portable Case Packing List

Pelican 1510 contents:
  Top layer (foam):
    - Laptop (center)
    - Multimeter (right)
    - Power supply + cables (left)
    - CF card reader, adapters (pockets)
  Bottom layer (foam):
    - Oscilloscope (center)
    - Probes (in scope bag, right)
    - Managed switch (front left)
    - Ethernet cables (front right)
    - CAN adapter + cables (rear left)
    - Logic analyzer + clips (rear right)
  External:
    - Hand tool pouch (carried separately or strapped)
    - External SSD (side pocket)
    - Label maker (side pocket)

7.2 Bench-Top Setup

For your workshop or permanent diagnostic bench, you can leave equipment connected and ready. This is more efficient for analyzing captures and programming CF cards after field visits.

7.3 Hybrid Approach

The most practical setup for a one-man team is hybrid: a portable Pelican case for field work plus a bench-top station for analysis. The laptop travels between both. Shared equipment (oscilloscope, logic analyzer) may live on the bench with a second, cheaper unit in the portable case.

Cost comparison:

8. Cross-References

This document is part of a comprehensive B&R diagnostic reference library. Related documents:

• cp1584-forensics.md – Step-by-step forensic analysis of unknown CP1584 systems; what to extract first, how to read configuration files, and how to reconstruct IO mappings from a blank machine.
• io-sniffing.md – Techniques for monitoring and identifying digital and analog IO signals without existing documentation. Covers signal tracing, force table usage, and IO mapping extraction.
• physical-layer-sniffing.md – Physical layer measurement techniques for Ethernet POWERLINK, CAN, X2X, and serial buses. Covers signal quality analysis and EMC diagnostics.
• powerlink-internals.md – Detailed POWERLINK protocol analysis including frame structure, node addressing, cycle timing, and error handling. Essential reference for Wireshark capture interpretation.
• x2x-protocol.md – B&R X2X backplane bus protocol analysis. Frame format, timing, and how to capture and decode X2X traffic with a logic analyzer.
• if2772-canopen.md – CANopen diagnostics for the B&R IF2772 interface module. CANopen object dictionary, SDO/CDC communication, and error handling.
• pvi-api.md – B&R PVI (Process Visualization Interface) API reference. Connection configuration, data transfer, and Python wrapper usage for automated diagnostics.
• opcua.md – OPC-UA configuration on B&R PLCs. Server setup, security configuration, address space structure, and client connection patterns.
• python-diagnostics.md – Python diagnostic tool library. Complete code examples for OPC-UA, PVI, Modbus, CAN, serial, and file-based diagnostics.
• serial-diagnostics.md – Serial protocol diagnostics for RS232/RS485 connections. Baud rate detection, protocol analysis, and non-invasive bus tapping techniques.
• grounding-emc.md – Grounding best practices and EMC diagnostic procedures for industrial installations. Ground current measurement, shield termination, and common-mode noise reduction.
• analog-calibration.md – Analog IO calibration procedures for 4-20mA, 0-10V, and thermocouple inputs. Calibration techniques, verification procedures, and documentation templates.

9. Key Findings

1. Build incrementally. Start with the essential tier ($2,850 excluding AS license) covering laptop, Ethernet tools, oscilloscope, multimeter, serial adapters, and Wireshark. Add CAN and logic analyzer capabilities as you encounter machines that need them. Do not buy everything at once.

2. Dedicated NIC for Wireshark capture is mandatory. Using the same NIC for PLC communication and Wireshark capture causes packet loss, missed frames, and unreliable POWERLINK analysis. A $45 Intel I210-based USB adapter solves this completely.

3. Managed switch with port mirroring is the most reliable POWERLINK capture method. Network taps work but are awkward. Port mirroring on a $45 Netgear GS105E gives you non-invasive, full-duplex capture with zero impact on PLC communication.

4. FTDI-only serial adapters. Prolific and CH340 chipsets have driver instability on modern Windows. The $15 FTDI FT232RL cable saves hours of troubleshooting time. Buy 3: one for RS232, one for RS485, one for TTL.

5. Rigol DS1054Z with differential probe is the oscilloscope sweet spot. Four channels cover CAN differential measurement plus trigger. The differential probe ($250) is the accessory that matters most – single-ended CAN measurements are unreliable and misleading.

6. CF card backup is the first action on any unknown machine. Before you do anything else, FTP into the PLC and download the CF card contents. Use binary FTP mode. Store with machine ID, date, and AR version metadata. This backup is your insurance policy.

7. Saleae Logic 8 ($500) covers most diagnostic needs. The Logic Pro 16 ($1,500) is only needed if you routinely analyze X2X bus traffic (16 data lines). For CAN, SPI, I2C, and serial analysis, 8 channels is sufficient.

8. PCAN-USB ($170) plus PCAN-View (free) is the CAN diagnostic baseline. CANalyzer is professional-grade but at $3,000+ it is difficult to justify for a one-man team. PCAN-View provides real-time monitoring, trace logging, and signal decode at zero additional cost.

9. Python with asyncua + pymodbus + pyserial replaces most proprietary software. For a diagnostic workstation focused on data extraction, Python scripts can read OPC-UA variables, poll Modbus registers, capture serial data, and log everything to structured files. This is faster and more repeatable than manual clicking through proprietary GUIs.

10. Use a template for every diagnostic engagement. Create a directory structure and checklist for each machine: /machines/<machine-id>/<date>/ containing CF card images, Wireshark captures, CAN logs, OPC-UA variable dumps, serial captures, and a diagnostic report. This structure accumulates into a searchable knowledge base over time.

11. The hybrid portable + bench-top configuration is the right architecture. A portable Pelican case for field work and a permanent bench for analysis. The laptop shuttles between both. Shared equipment (oscilloscope, logic analyzer) can be duplicated cheaply (Sigrok-based logic analyzer for the field, Saleae for the bench).

12. brsnmp is the quickest way to identify an unknown PLC. Before opening Automation Studio or attempting a full program upload, run brsnmp to read the AR version, project name, and system variables. This 30-second check tells you what you are dealing with and which AS version you need.

Key Findings

1. A prepared workstation cuts diagnostic time from hours to minutes. Having every adapter, cable, and tool pre-configured and tested means you can connect to any unknown CP1584 in under five minutes and begin systematic data extraction.

2. brsnmp is the fastest first step for any unknown PLC. Running brsnmp against a CP1584 reveals the AR version, project name, system variables, and hardware inventory in seconds — no Automation Studio required.

3. Protocol sniffing is essential for intermittent problems. Problems that can’t be reproduced reliably require passive monitoring. A properly configured protocol sniffer (Wireshark + POWERLINK plugin, PCAN for CAN, logic analyzer for X2X) captures the evidence that logging alone misses.

4. Separate the diagnostic workstation from production networks. Your diagnostic laptop should never be on the plant network. Use a dedicated VLAN or direct connection to avoid introducing security risks or network interference.

5. Build a knowledge base that accumulates value. Every machine you diagnose adds captured configurations, firmware images, protocol traces, and documented procedures to your workstation. Over time, this library becomes your most valuable resource.

10. Sources

• B&R Automation. Automation Studio 4.x Documentation. B&R Industrial Automation, 2018-2024. https://www.br-automation.com
• B&R Automation. CP1584 Hardware Manual. B&R Industrial Automation. Document ID: DOC-00000.
• Rigol Technologies. DS1054Z User’s Guide. https://www.rigol.com
• PEAK-System Technik. PCAN-USB Product Page and Documentation. https://www.peak-system.com
• Saleae. Logic Analyzer Documentation and Protocol Decoders. https://www.saleae.com
• Wireshark Foundation. Wireshark User’s Guide. https://www.wireshark.org
• openPOWERLINK Project. POWERLINK Wireshark Dissector. SourceForge / GitHub. https://sourceforge.net/projects/openpowerlink/
• Unified Automation. UaExpert OPC-UA Client Documentation. https://www.unified-automation.com
• hilch. brsnmp – B&R SNMP Tool. GitHub. https://github.com/hilch/brsnmp
• CAN in Automation (CiA). CANopen Protocol Specification (CiA 301). https://www.can-cia.org
• Fluke Corporation. Fluke 87V Industrial True-RMS Multimeter User Manual. https://www.fluke.com
• Intel Corporation. I210 Ethernet Controller Datasheet. https://www.intel.com
• Python Software Foundation. asyncua Library Documentation. https://github.com/FreeOpcUa/opcua-asyncio
• python-can Project. CAN Bus Interface Documentation. https://python-can.readthedocs.io
• Sigrok Project. PulseView Logic Analyzer Software. https://sigrok.org
• IEC 61158-4-6. POWERLINK Real-Time Ethernet Protocol. International Electrotechnical Commission.
• IEC 61158-4-4. CANopen Communication Profile. International Electrotechnical Commission.
• IEC 62591. WIRELESSHART Communication Protocol (reference for industrial wireless diagnostics). IEC.
• NMAP Project. Nmap Network Scanning Documentation. https://nmap.org
• Netgear. GS105E Managed Switch Documentation. https://www.netgear.com
• Pelican Products. 1510 Case Specifications. https://www.pelican.com