B&R Automation Studio Project Reconstruction from an Unknown Running CP1584

Overview

This document describes the end-to-end process of creating a new B&R Automation Studio project for a CP1584 controller that is already running in the field but has no known project files. Since B&R PLCs store only compiled binaries on-target, the original source code cannot be recovered — instead, the approach relies on extracting every observable artifact from the running system to reconstruct a functional project. The methodology covers network discovery to locate the PLC, AR log analysis for configuration clues, OPC-UA browsing and PVI enumeration to surface all accessible variables, hardware configuration reading, and exploiting the CF/CFast card for additional data. Throughout, cross-references are provided to companion documents that expand on specific techniques: cp1584-forensics.md for low-level forensic analysis, opcua.md for OPC-UA setup and browsing details, pvi-api.md for the PVI Python API used during enumeration, and diagnostics-sdm.md for System Diagnostics Manager (SDM) usage and remote diagnostics capabilities.

Table of Contents

1. Executive Summary
2. Critical Limitation: Source Code Cannot Be Extracted
3. Network Discovery: Finding the PLC
4. AR Log Analysis
5. System Dump: The Most Important Diagnostic Tool
6. OPC-UA Browsing for Variable Discovery
7. Using PVI to Enumerate All Accessible Variables
8. Reading Hardware Configuration from a Running PLC
9. Using the CF/CFast Card to Aid Reconstruction
10. Creating a New Automation Studio Project
11. Creating a Matching Hardware Configuration
12. Capturing the Current Program State
13. Building a Configuration Export Tool
14. Systematic Step-by-Step Workflow
15. Documenting Findings: IO Maps, Variable Lists, Program Structure
16. What Information Is Permanently Lost
17. Best Practices for Documenting Undocumented Machines
18. Open-Source Tool Reference
19. Sources

1. Executive Summary

Reconstructing an Automation Studio project for a B&R X20CP1584 PLC without the original source code is a challenging but partially achievable task. B&R PLCs store only compiled binary code on the controller – the source code (structured text, ladder logic, C code) is never stored on the PLC unless the programmer explicitly enabled the “Transfer source files to target” option during the original download.

However, a surprising amount of information can be recovered: the complete hardware tree (modules, firmware versions, serial numbers), all runtime variables with their names and types, task configurations, AR version information, IO states, network configuration, and diagnostic logs. This information, combined with systematic observation of the machine’s behavior, allows you to create a new Automation Studio project that matches the hardware and can connect to the running program – even if you cannot view or modify the original logic.

This document covers every known method for extracting information from a running B&R PLC and assembling it into a usable project.

2. Critical Limitation: Source Code Cannot Be Extracted

“There is no way to get the code out of a B&R PLC. If you need to make changes to the PLC you need to have the source code to begin with.” – Reddit r/PLC community

“There is only compiled code on the control that is not readable. Only if the programmer has explicitly stored the source code on the flash can it be downloaded.” – Stephan Herbig, B&R Community

Key facts:

• B&R PLCs store only compiled binaries by default
• The compiled code cannot be decompiled or reverse-engineered back to readable source
• Two optional mechanisms exist that may have stored source on the target:
  1. Target Source Files Comparison (Project > Compare Source Files On Target) – stores a copy of source for comparison purposes
  2. Store project source files directly on target – stores the full source on the CF card’s user partition

To check if source exists on the target:

1. Open Automation Studio
2. Connect to the PLC (Online > Settings, configure the IP, click “Connect”)
3. Try File > Open Project From Target
4. If you get “No valid Automation Studio project file found”, no source was stored

Sources:

• https://community.br-automation.com/t/upload-program-from-a-plc/1520
• https://www.reddit.com/r/PLC/comments/1ja6zbk/problem_getting_program_from_a_plc_x20_br/

3. Network Discovery: Finding the PLC

3.1 Method 1: B&R SNMP Scan via Automation Studio

The primary method for finding a B&R PLC on the network:

1. Open Automation Studio
2. Go to Online > Settings
3. Click Browse – Automation Studio uses SNMP to discover B&R devices
4. All B&R PLCs on the network segment will appear with their IP addresses, serial numbers, and device types

Requirements:

• The PLC must have SNMP enabled (it is by default on AR < 6.0, but disabled by default in AS 6.0+ projects)
• If SNMP is disabled, put the PLC in BOOT mode – SNMP re-enables automatically
• WinPcap/Npcap must be installed on the PC (required for the browsing feature)
• The PC must be on the same subnet

Sources:

• https://community.br-automation.com/t/browse-for-targets-in-as-not-working/2065
• https://community.br-automation.com/t/finding-browsing-plc-in-online-settings-not-possible-under-windows-11/4840

3.2 Method 2: brsnmp (Open-Source CLI Tool)

brsnmp is an open-source command-line tool that uses B&R’s PVI-SNMP protocol to discover and manage PLCs on the network without Automation Studio.

## List all B&R PLCs as JSON with full details
brsnmp --details

## Output example:
[
  {
    "targetTypeDescription": "X20CP1583",
    "serialNumber": "D45B0168612",
    "cfSerialNumber": "000060076643A1000085",
    "arVersion": "B04.45",
    "arVersionNorm": "04.45.2",
    "arState": "4",
    "arBootPhase": "40",
    "deviceName": "IF2",
    "macAddress": "00-60-65-16-fd-da",
    "ipAddress": "192.168.0.14",
    "subnetMask": "255.255.255.0",
    "ipMethod": "0",
    "nodeNumber": "129",
    "inaActivated": "1",
    "inaPortNumber": "11159",
    "hostName": "br-automation",
    "defaultGateway": "",
    "dnsActivated": "0"
  }
]

## List only MAC addresses
brsnmp --list

## Filter to a specific PLC type
brsnmp --filter="X20CP1584" --details

## Change IP settings remotely
brsnmp --filter="X20CP1584" ipAddress=192.168.1.100 subnetMask=255.255.255.0

## Save discovery results
brsnmp --details > plc_inventory.json

Key fields for reconstruction:

Note: AS 6.0+ projects disable SNMP by default. If the PLC is running AS 6.0+ code, you may need to put it in BOOT mode first to enable SNMP.

Sources:

• https://github.com/hilch/brsnmp

3.3 Method 3: Wireshark / ARP Scan

If SNMP is completely unavailable:

1. Connect your PC to the same physical network as the PLC
2. Set your PC’s IP to the same subnet (B&R default is typically 192.168.100.x)
3. Open Wireshark and capture on the Ethernet interface
4. Look for B&R’s SNMP responses or POWERLINK multicast traffic (group address 01:E0:AF:00:00:00)
5. The PLC’s MAC address starts with 00:60:65 (B&R’s OUI)
6. Use ARP scan: arp -a or nmap -sn 192.168.100.0/24

3.4 Method 4: Physical Inspection

The X20CP1584 has:

• DIP switches on the bottom for node number (POWERLINK address)
• Default IP: 192.168.100.X where X is derived from the DIP switch settings (when switches are set to FF, default is 192.168.100.1)
• Ethernet ports: IF1 (left) and IF2 (right, typically IF2 is the main connection)
• LED indicators: RUN (green = running), ERR (red = error), MAINT (yellow = service mode)

Sources:

• https://community.br-automation.com/t/determining-a-plcs-ip-address-using-wireshark/495
• https://community.br-automation.com/t/how-to-find-your-b-r-plc-in-a-network-with-python/7227

4. AR Log Analysis

4.1 What Is the AR Log?

The AR Log (Automation Runtime Log) is the PLC’s internal logbook. It records:

• Startup/shutdown events
• Module insertion/removal
• Configuration errors
• Runtime errors and warnings
• Task class execution information
• Software module loading
• Network events
• POWERLINK/X2X bus events

The primary log file is arlogsys which contains the system logbook entries.

4.2 Accessing the AR Log

Method 1: Via SDM (System Diagnostics Manager)

1. Navigate to http://<PLC_IP>/sdm in a web browser (or https://<PLC_IP>/sdm for AR 6.0+)
2. Click the Logger tab
3. Click Upload from target to download the log file
4. The log file can be opened in Automation Studio’s Logger (Open > Logger > Load Data)

Method 2: Via Automation Studio Logger

1. Connect to the PLC in Automation Studio (Online > Settings)
2. Go to Open > Logger (or Ctrl+L)
3. The Logger connects to the PLC and displays log messages in real-time
4. Use Load Data to load historical logs

Method 3: Via CF Card (for ARembedded systems)

1. Remove the CF card from the PLC
2. Open Runtime Utility Center
3. Select Tools > Back up files from Compact Flash
4. Navigate to DATA1 Partition > RPSHD > SYSROM
5. Select all files beginning with $ (these are the log files)
6. Save them to your PC

Method 4: Via System Dump The System Dump (see Section 5) includes the complete log files bundled into a single archive.

4.3 What Information the Log Reveals for Reconstruction

4.4 Important: AS Version Matching

Your Automation Studio version must match the AR major version of the PLC:

• PLC running AR B4.93 → Use AS 4.12
• PLC running AR 6.5.1 → Use AS 6.x
• Mismatched versions will fail to read logs properly

Sources:

• https://community.br-automation.com/t/how-to-collect-a-system-dump-from-a-b-r-controller/10497
• https://community.br-automation.com/t/service-mode-what-is-it-and-how-to-collect-diagnostics/1613
• https://community.br-automation.com/t/access-to-logging-in-plc/3243

5. System Dump: The Most Important Diagnostic Tool

5.1 What Is a System Dump?

The System Dump is the single most valuable artifact you can extract from a running B&R PLC for reconstruction purposes. It is a .tar.gz archive that collects comprehensive diagnostic data about the PLC into one file.

Available starting with AR V3.08. Created via the SDM web interface.

5.2 Information Contained in a System Dump

The system dump XML file contains:

5.3 Creating a System Dump via Web Browser

1. Open browser: http://<PLC_IP>/sdm
2. Click the System Dump icon
3. Select “Parameters + Data-Files” (recommended for full information)
4. Click OK
5. Click Upload from target
6. Save the resulting .tar.gz file

5.4 Creating a System Dump via Python (Automated)

Using the open-source systemdump.py tool:

pip install systemdumpy

# Create, upload, and save a system dump
py -m systemdumpy 192.168.0.100 -cuv -p MachineA_

# Create an inventory spreadsheet from the dump
py -m systemdumpy BuR_SDM_Sysdump_2024-01-15_11-51-55.tar.gz -iv

5.5 Viewing a System Dump

Method 1: SystemDumpViewer (Open Source, Recommended)

• SystemDumpViewer is a Qt-based application that visualizes system dump data in a format similar to the SDM
• Shows hardware tree, module details, software versions, IO status, log data
• Built with Qt 6.4.2, supports multiple languages
• Download releases from GitHub

Method 2: Automation Studio Logger

1. Open Automation Studio
2. Open > Logger
3. Load Data (top-left icon)
4. Select the .tar.gz file
5. Logs will populate with all available modules on the left

Method 3: Direct XML Extraction The .tar.gz contains a SystemDump.xml file that can be parsed programmatically to extract hardware inventories, software lists, and configuration data.

5.6 System Dump for Hardware Inventory

The system dump is the primary source for discovering the complete hardware configuration:

py -m systemdumpy <dumpfile>.tar.gz -iv

This generates an .xlsx spreadsheet with:

• Every module in the system (CPU, IO modules, bus couplers, communication modules, drives)
• Slot/position within the bus tree
• Serial numbers
• Firmware versions
• Module types

This information directly maps to what you need to recreate in Automation Studio’s Hardware Configuration.

Sources:

• https://github.com/hilch/systemdump.py
• https://github.com/bee-eater/SystemDumpViewer
• https://community.br-automation.com/t/how-to-collect-a-system-dump-from-a-b-r-controller/10497
• https://help.br-automation.com/#/en/6/automationruntime/targets/sdm/sdm/sdm.htm

6. OPC-UA Browsing for Variable Discovery

6.1 Enabling OPC-UA on the PLC

The X20CP1584 supports an integrated OPC-UA server, but it must be enabled and configured. If it was enabled in the original project, you can use it to browse variables without the source code.

Note: OPC-UA must be explicitly configured in the original Automation Studio project. If it was never configured, this method will not work.

To enable OPC-UA (if you can get a blank project connected):

1. In Automation Studio, open the Configuration View
2. Right-click on the CPU and select Properties
3. Navigate to the OPC-UA tab
4. Enable the OPC-UA server
5. Configure the port (default: 4840)
6. Transfer to target

6.2 Browsing Variables via OPC-UA

If OPC-UA is active:

1. Use any OPC-UA client (UA Expert, Prosys Simulation, Ignition, Node-RED)
2. Connect to opc.tcp://<PLC_IP>:4840
3. Browse the address space
4. Variable nodes will show symbolic names and data types

Important: Only variables that were explicitly mapped to the OPC-UA server in the original project’s UA Map will be visible. This is typically a subset of all variables.

6.3 Automation Studio Code Watch (Online Monitoring)

Automation Studio’s Code Watch Extension (AS 2025) provides an online watch capability:

“The extension displays live variable values and, in development versions, supports writing to variables.”

Even without source code, Automation Studio’s Watch Window (Online > Compare > Software) can access all variables on the PLC if the project has been configured for online comparison.

Using Online > Compare > Software without source:

1. Connect to the PLC
2. Open Online > Compare > Software
3. Scroll to Diagnosis Objects to see configured diagnostic items
4. The watch window shows variables that are available for monitoring

6.4 Automation Studio Code Watch Access Limitation

“It seems like AS Code Watch window has access to all the variables on the PLC even if they aren’t enabled in the UA Map.”

This means the Automation Studio IDE can see variables through PVI even without OPC-UA, but you need an AS project connected to the PLC to use this feature.

Sources:

• https://community.br-automation.com/t/opc-ua-server-enable-steps-for-x20cp1584/3036
• https://community.br-automation.com/t/exposing-all-variables-over-opcua/11799
• https://community.br-automation.com/t/release-2025-automation-studio-code-watch-extension-overview/8620

7. Using PVI to Enumerate All Accessible Variables

7.1 What Is PVI?

PVI (Process Visualization Interface) is B&R’s proprietary communication protocol between PLCs and PC applications. It is the foundation for all online monitoring, HMI communication, and diagnostic access. PVI can enumerate all process variables (PVs) on a running PLC, including their symbolic names, data types, and current values.

7.2 Method 1: Runtime Utility Center (RUC)

The Runtime Utility Center is installed with the PVI Development Setup (free download from B&R).

To extract all variables:

1. Install PVI Development Setup from https://www.br-automation.com/en/downloads/software/automation-netpvi/pvi-development-setup/
2. Open Runtime Utility Center
3. Select “Create, modify and execute projects (.pil)”
4. Create a new connection to the PLC (specify IP and protocol)
5. Once connected, expand the variable tree to browse all available variables
6. Use the Variable List feature to export all variables to a file

“If you have installed PVI, you will find the Runtime Utility Center on your computer. This allows you to save all the controller variables in a file.”

“You can get the variable list using PVI and even create a new HMI using those variables in .NET on a PC using the PVIservices dll.”

7.3 Method 2: brwatch (Open-Source Variable Browser)

brwatch is the most practical open-source tool for variable enumeration on a B&R PLC.

Features:

• Lists all B&R PLCs on the network via SNMP/UDP scan
• Browses the complete variable tree of a connected PLC
• Watches variables in real-time (with configurable number representation)
• Changes variable values (with confirmation)
• Starts/stops/restarts tasks
• Logs variable values to CSV files
• Changes IP settings
• Supports both INA and ANSL protocols

Usage for variable enumeration:

1. Download brwatch.exe from https://github.com/hilch/brwatch/releases
2. Requires PVI Development Setup to be installed (for PVI DLLs)
3. Run brwatch.exe
4. Click on the TCP/IP device to start network scanning
5. Select the target PLC
6. Left-click on each node in the tree view to scan/expand variables
7. Drag variables to the watch list on the right
8. Save the configuration via File > Save

Configuration (brwatch.ini):

[General]
; Use ANSL=1 for newer PLCs (AR >= 4.x)
; Default is INA protocol
ANSL=0

Limitations:

• Without a PVI license (1TG0500.02), PVI runs for only 2 hours at a time, then requires restart
• Built in plain C using Win32 API, Windows only

7.4 Method 3: PVIservices DLL (.NET Development)

For programmatic variable enumeration:

// Requires PVIservices library (installed with PVI Development Setup)
using B&R.PVI;

PviConnection pvi = new PviConnection();
pvi.Connect("192.168.1.100", PVIProtocol.INA);

// Enumerate all variables
foreach(var variable in pvi.GetAllVariables())
{
    Console.WriteLine($"{variable.Name}: {variable.Address} [{variable.DataType}]");
}

7.5 Method 4: pvipy (Python PVI Wrapper)

pvipy is a Python wrapper for B&R’s PVI interface:

pip install pvipy

This allows you to write Python scripts that connect to the PLC and enumerate all variables programmatically, export them to CSV, or build custom tools.

7.6 What Variable Information Is Available

Sources:

• https://community.br-automation.com/t/read-values-with-pvi/3497
• https://github.com/hilch/brwatch
• https://industrialmonitordirect.com/blogs/knowledgebase/extracting-variables-from-br-cp476-plc-without-source-code
• https://www.plctalk.net/forums/threads/b-r-cp476-visualisation-on-b-r-studio.96158/

8. Reading Hardware Configuration from a Running PLC

8.1 Via System Dump (Recommended)

As detailed in Section 5, the System Dump provides the complete hardware tree including:

• CPU model and firmware
• All X20 bus couplers and their stations
• IO module types, positions, and configurations
• Communication module types and settings
• Drive system topology
• Serial numbers for all modules

# Extract hardware inventory to Excel
py -m systemdumpy <dumpfile>.tar.gz -iv

8.2 Via SDM Web Interface

Navigate to http://<PLC_IP>/sdm and browse the following sections:

• System Page > General: CPU model, AR version, serial number, uptime
• System Page > Hardware: Complete module list with status and firmware versions
• System Page > Timing: Task class list with cycle times
• IO Viewer: Live state of all IO points

8.3 Via brsnmp

## Get detailed PLC information
brsnmp --details

This shows the CPU type, serial number, AR version, network configuration, and POWERLINK node number.

8.4 Via Automation Studio Online

1. Create a new blank project (File > New Project)
2. Go to Online > Settings
3. Configure the connection to the PLC’s IP
4. Click Connect
5. If hardware recognition succeeds, AS can auto-detect the hardware configuration

Automation Studio’s “Load Hardware Configuration from Target”: When creating a new project, Automation Studio offers the option to load the hardware configuration from the target system. This is one of the most powerful methods:

1. File > New Project
2. When prompted, select the option to detect hardware from the target
3. AS queries the PLC’s hardware tree and populates the Hardware Configuration

Note: This works best when AS and AR versions match. The hardware detection identifies module types and positions but may not capture all parameter settings.

8.5 Via SDM IO Viewer

The SDM’s IO Viewer shows live IO states:

• Navigate to http://<PLC_IP>/sdm
• Select the IO Viewer tab
• See all digital inputs, digital outputs, analog inputs, analog outputs with their current values
• This helps map physical IO points to functional purposes

Sources:

• https://community.br-automation.com/t/unable-to-find-hardware-configuration-online/1049
• https://instrumentacionycontrol.net/wp-content/uploads/2017/11/IyCnet_BR_AutomationStudio_QuickStart_MASYS2ASQS-E_240.pdf
• https://www.dmcinfo.com/blog/24942/creating-new-projects-and-adding-hardware-modules-br-automation-studio-blog-series-part-one/

9. Using the CF/CFast Card to Aid Reconstruction

9.1 CF Card Partition Structure

B&R typically creates 4 partitions on the CF/CFast card:

Important: Consumer card readers often cannot handle multi-partition industrial CF cards. Use the Runtime Utility Center or a card reader specifically designed for industrial CF cards.

9.2 What May Be on the CF Card

1. Compiled binaries (always present): The compiled PLC program in .br format
2. Source code (optional): Only if “Transfer source files to target” was enabled in the original project
3. Configuration files: CFCfg.ini and other configuration files
4. Log files: In the RPSHD/SYSROM directory
5. User files: On the User partition – recipes, data logs, custom files
6. AR system files: The complete Automation Runtime installation

9.3 Creating a CF Card Image (Critical First Step)

Before doing anything else, create a complete backup image of the CF card:

1. Install Runtime Utility Center (from PVI Development Setup)
2. Open Runtime Utility Center
3. Select “Create, modify and execute projects (.pil)”
4. Go to Tools > Back up files from Compact Flash / Image file
5. Select the CF card drive letter
6. Choose “Create Image” and save the complete .img file
7. This image can be restored to a replacement CF card using “Restore Image”

“You could also create a copy or image of the compact flash card. You are then not able to change the program code since there are just compiled binaries on it, but you could restore it on another CPU if your current CPU fails.”

9.4 Exploring CF Card Contents

Using Runtime Utility Center:

1. Tools > Back up files from Compact Flash
2. Select the CF card
3. Wait for disk information to load
4. Expand: DATA1 Partition > RPSHD > SYSROM
5. Select files beginning with $ (log files)
6. Browse other directories for configuration files and user data

9.5 Checking for Source Code on the CF Card

If you’re very lucky, the source project may be stored on the user partition:

“If you are very lucky, the source project will be stored on the F:\ (user partition) of the CF card.”

To check:

1. In Runtime Utility Center, browse the user partition (usually the last partition on the card)
2. Look for .apj (Automation Studio project) files or .ac (Automation Studio Configuration) directories
3. If found, these can potentially be loaded in Automation Studio

9.6 CF Card for Backup and Migration

Even without source code, the CF card image serves as:

• A complete backup of the running system
• A way to restore the exact same program on a replacement CPU
• A source of configuration and log information

Sources:

• https://www.reddit.com/r/PLC/comments/1amxzp6/br_plc_program_loading/
• https://community.br-automation.com/t/how-to-reset-a-plc-without-removable-media/3383
• https://community.br-automation.com/t/runtime-utility-center-create-restore-backups-plc-images/11710
• https://industrialmonitordirect.com/blogs/knowledgebase/br-pcmcia-cf-card-backup-and-restore-procedure

10. Creating a New Automation Studio Project

10.1 Prerequisites

1. Determine the AR version from the System Dump or SDM or brsnmp
2. Install the matching Automation Studio version
3. Install hardware support packages for the CPU and modules
4. Install PVI Development Setup for additional tools

10.2 Create a New Project with Hardware Auto-Detection

Option A: Load Hardware from Target (Best Method)

1. File > New Project
2. Select “Standard Project”
3. Assign a project name
4. During hardware configuration, select “Load Hardware Configuration from Target”
5. Enter the PLC’s IP address
6. Automation Studio queries the PLC and auto-populates the hardware tree
7. The complete hardware configuration (CPU, bus couplers, IO modules, communication modules) is imported

Option B: Manual Hardware Configuration

1. File > New Project
2. Select “Standard Project”
3. Manually add hardware based on System Dump inventory
4. Navigate to Physical View
5. Right-click > Insert Module
6. Add the CPU (X20CP1584)
7. Add bus couplers and IO modules matching the System Dump

10.3 Configure Network Settings

1. In Configuration View, select the CPU
2. Set the IP address to match the PLC’s current IP
3. Configure subnet mask, gateway, hostname
4. Enable SNMP (required for online browsing)
5. Configure Ethernet POWERLINK settings if applicable

10.4 Connecting to the Running PLC

1. Online > Settings
2. Add a new connection
3. Set the IP address (must match exactly)
4. Set the transport protocol (INA or ANSL)
5. Click “Connect”
6. The PLC’s status should change to “Online”

10.5 What You Can Do Once Connected

Sources:

• https://www.dmcinfo.com/blog/24942/creating-new-projects-and-adding-hardware-modules-br-automation-studio-blog-series-part-one/
• https://community.br-automation.com/t/getting-started-with-b-r-hello-community-first-project-backend-plc-part/4676
• https://instrumentacionycontrol.net/wp-content/uploads/2017/11/IyCnet_BR_AutomationStudio_QuickStart_MASYS2ASQS-E_240.pdf

11. Creating a Matching Hardware Configuration

11.1 Using the System Dump Inventory

The system dump provides everything needed to recreate the hardware tree:

1. Run py -m systemdumpy <dump>.tar.gz -iv to generate the hardware inventory spreadsheet
2. Use the inventory as a checklist for adding modules in Automation Studio
3. Pay special attention to:
   • Module order: The position of modules on the bus matters
   • Bus couplers: X20 bus couplers (BC, BB, etc.) and their station numbers
   • Slot positions: Some modules are slot-sensitive
   • Firmware versions: Match firmware versions in the new configuration

11.2 Physical Inspection Checklist

Since the System Dump provides module types but not physical wiring:

1. Photograph all IO modules in the cabinet, noting:
   • Module part numbers (visible on the module label)
   • Slot/position on the bus
   • Terminal wiring labels
2. Document the bus topology:
   • Which bus couplers are at which addresses
   • Which station numbers are configured via DIP switches
   • Cable routing between bus couplers
3. Record DIP switch settings on all bus couplers

11.3 X20 Bus Topology Notes

The X20 system uses a right-side bus (X2X) to connect modules:

• The CPU’s IF3 or IF4 port connects to the first bus coupler
• Bus couplers have station numbers (configured via hardware switches or software)
• Each bus coupler can have up to 12 modules attached
• Station numbers must be unique within a bus segment
• Bus couplers may be connected in a chain (daisy-chain topology)

11.4 POWERLINK Configuration

The X20CP1584 typically has:

• IF3: Ethernet POWERLINK (managed node or CN)
• IF1/IF2: Standard Ethernet for programming and OPC-UA

Document the POWERLINK configuration:

• Node number (from brsnmp nodeNumber field)
• Whether the CPU is a Managing Node (MN) or Controlled Node (CN)
• Connected drives/slaves on the POWERLINK bus

Sources:

• https://community.br-automation.com/t/automation-studio-hardware-list-export/8312
• https://store.sim3d.com/demo3d_2024/configuring_a_br_automation_connection

12. Capturing the Current Program State

12.1 What CAN Be Captured

12.2 What CANNOT Be Captured

12.3 Snapshot Procedure

Before making any changes, capture a complete snapshot:

# 1. System dump
py -m systemdumpy <PLC_IP> -cuv -p MachineName_

# 2. SNMP details
brsnmp --details > <PLC_IP>_snmp_details.json

# 3. Variable list (via brwatch: browse all tree nodes, save config)
# In brwatch: File > Save As > variables.bww

# 4. CF card image
# In Runtime Utility Center: Tools > Back up files from Compact Flash > Create Image

# 5. IO states (manual: screenshot SDM IO Viewer)

Sources:

• https://community.br-automation.com/t/upload-program-from-a-plc/1520
• https://community.br-automation.com/t/backup-program-from-plc-x20cp1381-so-i-can-restore-it-in-another-cpu-same-as-the-first-one/8140

13. Building a Configuration Export Tool

13.1 Python-Based Export Script Concept

A reconstruction toolkit can be built using open-source components:

"""
B&R PLC Configuration Export Tool
Combines system dump parsing, SNMP discovery, and PVI variable enumeration
"""

import json
import subprocess
import xml.etree.ElementTree as ET
from pathlib import Path
from datetime import datetime

class BRConfigExporter:
    def __init__(self, plc_ip: str, output_dir: str = "./export"):
        self.plc_ip = plc_ip
        self.output_dir = Path(output_dir) / f"BR_Export_{datetime.now():%Y%m%d_%H%M%S}"
        self.output_dir.mkdir(parents=True, exist_ok=True)

    def export_system_dump(self):
        """Create and download system dump from PLC"""
        subprocess.run([
            "py", "-m", "systemdumpy",
            self.plc_ip, "-cuv",
            "-p", f"Export_{self.plc_ip.replace('.', '_')}"
        ])
        # Find the downloaded file and move to output dir

    def export_snmp_details(self):
        """Export PLC network and hardware details via SNMP"""
        result = subprocess.run(
            ["brsnmp", "--filter", self.plc_ip, "--details"],
            capture_output=True, text=True
        )
        with open(self.output_dir / "snmp_details.json", "w") as f:
            f.write(result.stdout)

    def parse_system_dump_xml(self, dump_path: str) -> dict:
        """Parse system dump XML to extract structured data"""
        # The .tar.gz contains SystemDump.xml
        # Parse: hardware modules, software modules, tasks, memory, network
        pass

    def export_hardware_inventory(self, dump_path: str):
        """Generate hardware inventory spreadsheet"""
        subprocess.run([
            "py", "-m", "systemdumpy", dump_path, "-iv"
        ])

    def generate_io_map_template(self, hardware_data: dict):
        """Create IO mapping template from hardware data"""
        # Generate a spreadsheet with columns:
        # Module, Slot, Channel, Type, Current Value, Purpose (to be filled), Wire Label
        pass

    def generate_variable_list_template(self):
        """Create variable documentation template"""
        # Generate a spreadsheet with columns:
        # Variable Name, Data Type, Scope, Current Value, Purpose (to be filled)
        pass

    def export_all(self):
        """Run all export operations"""
        self.export_system_dump()
        self.export_snmp_details()
        # ... additional exports
        print(f"All exports saved to: {self.output_dir}")

13.2 System Dump XML Structure (Key Elements)

The SystemDump.xml contains these primary sections:

<SystemDump>
  <GeneralStatus>
    <TargetMode>RUN</TargetMode>
    <ARVersion>B04.45</ARVersion>
    <SerialNumber>...</SerialNumber>
    <HostName>br-automation</HostName>
  </GeneralStatus>

  <Software>
    <Module Name="AsBrStr" Version="4.45.2"/>
    <Module Name="AsIec" Version="4.45.2"/>
    <Module Name="MpCore" Version="4.45.0"/>
    <!-- ... all loaded libraries -->
  </Software>

  <Hardware>
    <Module Type="X20CP1584" Slot="0" Serial="..." Firmware="...">
      <SubModule Type="X20BC0087" Station="1" Slot="1"/>
      <SubModule Type="X20DI9371" Slot="2"/>
      <SubModule Type="X20DO9322" Slot="3"/>
      <!-- ... complete hardware tree -->
    </Module>
  </Hardware>

  <Timing>
    <TaskClass Name="Cyclic#1" CycleTime="10000"/>
    <TaskClass Name="Cyclic#2" CycleTime="100000"/>
  </Timing>

  <Memory>
    <Partition Name="RPSHD" Used="..." Total="..."/>
    <Partition Name="User" Used="..." Total="..."/>
  </Memory>
</SystemDump>

13.3 Leveraging Existing Tools

Sources:

• https://github.com/hilch/systemdump.py
• https://github.com/bee-eater/SystemDumpViewer
• https://github.com/hilch/brwatch
• https://github.com/hilch/brsnmp

14. Systematic Step-by-Step Workflow

Phase 1: Discovery (No Changes to PLC)

Phase 2: Variable Enumeration

Phase 3: Hardware Documentation

Phase 4: Project Assembly

Phase 5: Documentation

15. Documenting Findings: IO Maps, Variable Lists, Program Structure

15.1 IO Map Template

| Station | Slot | Module Type | Channel | Type (DI/DO/AI/AO) | Wire Label | Current State | Purpose (observe) |
|---------|------|-------------|---------|-------------------|------------|---------------|-------------------|
| 1       | 1    | X20BC0087   | -       | Bus Coupler       | BC1        | OK            | Cabinet 1 base    |
| 1       | 2    | X20DI9371   | CH1     | DI                | X1-E1      | TRUE          | Safety door closed |
| 1       | 2    | X20DI9371   | CH2     | DI                | X1-E2      | FALSE         | Start button      |

15.2 Variable List Template

| Variable Name | Data Type | Scope | Current Value | Structure/Parent | Purpose (observe) |
|---------------|-----------|-------|---------------|-----------------|-------------------|
| gMachineState | DINT       | Global| 2             | -               | Machine state enum |
| stAxis1       | AxAxisRef | Global| [struct]       | -               | Axis 1 parameters |
| stAxis1.nPos  | LREAL     | Member| 1234.56       | stAxis1         | Current position  |
| bStartButton  | BOOL       | Global| FALSE         | -               | Start command     |

15.3 Task Configuration Template

| Task Class | Name | Cycle Time (ms) | Priority | Watchdog (ms) | Estimated Purpose |
|------------|------|-----------------|----------|----------------|-------------------|
| 1          | Cyclic#1 | 10           | 1        | 50             | Fast IO / motion    |
| 2          | Cyclic#2 | 100          | 5        | 500            | Standard logic     |
| 3          | Cyclic#3 | 1000         | 10       | 5000           | Slow / HMI update   |

15.4 Program Structure Inference

Without source code, program structure must be inferred:

1. Variable naming conventions: Well-named variables reveal functional groupings (e.g., stConveyor_*, axisHeater_*)
2. Task class count and cycle times: Fast tasks suggest motion/safety, slow tasks suggest HMI/recipes
3. Software modules loaded: MpAxis suggests motion, MpRecipe suggests recipe handling
4. Observed behavior: Watch variable changes during machine operation to understand logic flow
5. IO patterns: Correlate IO changes with machine actions to infer interlocks and sequences

16. What Information Is Permanently Lost

16.1 Completely Lost (Cannot Be Recovered)

16.2 Partially Recoverable

16.3 The “Golden Scenario”: Source Code Was Stored on Target

In rare cases, the original developer enabled “Transfer source files to target” or “Target Source Files Comparison”. In this case:

• File > Open Project From Target in Automation Studio will load the complete source
• The source files are stored on the CF card’s active partition
• You can fully edit and rebuild the program

Check this FIRST before attempting any reconstruction.

Sources:

• https://community.br-automation.com/t/upload-program-from-a-plc/1520
• https://www.reddit.com/r/PLC/comments/1ja6zbk/problem_getting_program_from_a_plc_x20_br/
• https://community.br-automation.com/t/problem-getting-program-from-a-plc-x20/5019

17. Best Practices for Documenting Undocumented Machines

17.1 Immediate Actions

1. NEVER power off the PLC until you have at minimum:
   • A CF card image backup
   • A system dump
   • A complete variable list export
2. Work on a copy: Clone the CF card image and work with the clone, never the original
3. Document everything as you go: Don’t rely on memory; photograph and record immediately
4. Use version control: Store all exports and documentation in a Git repository

17.2 Documentation Standards

1. Naming convention: Use consistent naming for all discovered elements
2. Date stamps: Include dates on all exports and observations
3. Machine state context: Record what the machine was doing when you captured each piece of data
4. Correlation: Cross-reference variable names with IO points and observed behavior
5. Confidence levels: Mark information as “Observed”, “Inferred”, or “Guessed”

17.3 Functional Reverse Engineering Approach

Since you cannot see the code, reverse-engineer the function:

1. Map all IO: For each input, trigger it and observe which outputs/variables change
2. Map sequences: Track the order of operations by watching state variables
3. Identify modes: Determine machine states (auto, manual, fault, setup) from state variables
4. Map safety interlocks: Identify which conditions prevent certain actions
5. Document recipes/parameters: Capture all setpoint/parameter values
6. Record timing: Measure cycle times and sequence durations
7. Map communication: Identify external device communication (Modbus, PROFINET, OPC-UA, etc.)

17.4 Building a Replacement Strategy

If modification is required and source code is truly lost:

1. Keep the original running: Do NOT overwrite the existing binary
2. Build a parallel system: Create a new project that runs alongside the original, taking over functions incrementally
3. Use the CF card image as safety net: If anything goes wrong, you can restore the original image
4. Consider external overrides: For simple changes, an external PLC or soft-PLC can modify IO signals without touching the original program
5. Contact B&R support: They may be able to help identify the original system integrator

17.5 Long-Term Recommendations

1. Label everything: Every wire, every module, every terminal
2. Create as-built drawings: Update cabinet drawings to match actual configuration
3. Record all setpoints: Many machines have critical parameters visible as variables
4. Document startup sequence: Record the order the machine goes through on power-up
5. Archive all discovered data in multiple locations: Local PC, network share, cloud backup

18. Open-Source Tool Reference

Essential Tools

B&R Official Tools

Python Ecosystem

19. Sources

B&R Official Documentation

• B&R Online Help: https://help.br-automation.com/
• B&R SDM Documentation: https://help.br-automation.com/#/en/6/automationruntime/targets/sdm/sdm/sdm.htm
• B&R System Dump Help: https://help.br-automation.com/#/en/6/automationruntime/targets/sdm/sdm/sdm2_sdmpage_systemdump.html
• PVI Development Setup Download: https://www.br-automation.com/en/downloads/software/automation-netpvi/pvi-development-setup/
• B&R Tutorial Portal: https://www.br-automation.com/en/academy/virtual-classroom/br-tutorial-portal/

B&R Community Forum Posts

• How to collect a System Dump: https://community.br-automation.com/t/how-to-collect-a-system-dump-from-a-b-r-controller/10497
• Service Mode Diagnostics: https://community.br-automation.com/t/service-mode-what-is-it-and-how-to-collect-diagnostics/1613
• Upload program from a PLC: https://community.br-automation.com/t/upload-program-from-a-plc/1520
• OPC UA Server enable steps for X20CP1584: https://community.br-automation.com/t/opc-ua-server-enable-steps-for-x20cp1584/3036
• Exposing all variables over OPCUA: https://community.br-automation.com/t/exposing-all-variables-over-opcua/11799
• Read values with PVI: https://community.br-automation.com/t/read-values-with-pvi/3497
• Browse for targets troubleshooting: https://community.br-automation.com/t/browse-for-targets-in-as-not-working/2065
• Finding PLC in Online Settings: https://community.br-automation.com/t/finding-browsing-plc-in-online-settings-not-possible-under-windows-11/4840
• SNMP scan from CLI: https://community.br-automation.com/t/scan-network-snmp-from-terminal-cli/10280
• Runtime Utility Center backups: https://community.br-automation.com/t/runtime-utility-center-create-restore-backups-plc-images/11710
• Open Project from Target: https://community.br-automation.com/t/x20cp0292-program-upload-no-valid-automation-studio-project-file/8613
• Hardware list export: https://community.br-automation.com/t/automation-studio-hardware-list-export/8312
• Logger access: https://community.br-automation.com/t/access-to-logging-in-plc/3243
• PLC IP via Wireshark: https://community.br-automation.com/t/determining-a-plcs-ip-address-using-wireshark/495
• SystemDumpViewer guide: https://community.br-automation.com/t/how-to-open-and-view-a-systemdump/6006

Open-Source Repositories

• brwatch: https://github.com/hilch/brwatch
• brwatch manual: http://hilch.github.io/brwatch/manual.html
• brsnmp: https://github.com/hilch/brsnmp
• systemdump.py: https://github.com/hilch/systemdump.py
• SystemDumpViewer: https://github.com/bee-eater/SystemDumpViewer
• Pvi.py: https://github.com/hilch/Pvi.py
• awesome-B-R: https://github.com/hilch/awesome-B-R
• ListAllBurPLCs: https://github.com/Chihing/ListAllBurPLCs
• B&R Automation Tools VS Code Extension: https://github.com/br-automation-community/vscode-brautomationtools

Third-Party Guides

• DMC: Creating New Projects: https://www.dmcinfo.com/blog/24942/creating-new-projects-and-adding-hardware-modules-br-automation-studio-blog-series-part-one/
• DMC: AR Configuration Changes: https://www.dmcinfo.com/blog/26437/br-automation-changing-automation-runtime-configurations/
• IMD: PVI Variable Extraction: https://industrialmonitordirect.com/blogs/knowledgebase/extracting-variables-from-br-cp476-plc-without-source-code
• IMD: CF Card Backup: https://industrialmonitordirect.com/blogs/knowledgebase/br-pcmcia-cf-card-backup-and-restore-procedure
• Automation Studio Quick Start: https://instrumentacionycontrol.net/wp-content/uploads/2017/11/IyCnet_BR_AutomationStudio_QuickStart_MASYS2ASQS-E_240.pdf

Community Discussions

• Reddit: Getting program from B&R X20: https://www.reddit.com/r/PLC/comments/1ja6zbk/problem_getting_program_from_a_plc_x20_br/
• Reddit: Recover code from controller: https://www.reddit.com/r/PLC/comments/vtxc9b/help_request_with_rb_x20_plc_can_i_upload_the/
• PLCtalk: X20CP1584 upload program: https://www.plctalk.net/forums/threads/b-r-plc-x20cp1584-v4-10-upload-program.144873/
• PLCtalk: CP476 variable extraction: https://www.plctalk.net/forums/threads/b-r-cp476-visualisation-on-b-r-studio.96158/

Key Findings

1. Full source code recovery is impossible — B&R compiles IEC 61131-3 code to object modules (*.BR files). You can upload configuration and variable names but NOT the original ladder/ST/FBD source code. Reconstruction means building a NEW project that matches the RUNNING behavior.
2. The upload from target gives you ~80% of what you need — hardware configuration, IO mapping, variable declarations, task configuration, and library references are all recoverable. What’s lost is the program logic (the actual code).
3. SDM is your first tool on any undocumented machine — it reveals the complete hardware tree, module firmware versions, task configuration, and system logs without any software installation.
4. OPC-UA namespace browsing can expose the complete variable structure — if the OEM enabled OPC-UA, browsing the address space reveals all global variables, their data types, and even array structures.
5. PVI variable extraction from a PC provides the variable list without AS — using the PVI API’s CmpObject interface to enumerate variable names and types gives you the data declarations needed for a new project.
6. The process is: discover hardware → extract configuration → map IO → document behavior → write replacement logic. See documentation-reconstruction.md for the parallel documentation track.

Cross-References