← All case studies
PROTO-006 Machine building · OEM OEM · Protocol RE · Retrofit

Retrofit solution for EOL drives in field machines.

Manufacturer
direct project
Worldwide
machines in use
Software
unchanged
3 axes
retrofitted

Situation

A machine manufacturer had a series of foil punching machines installed at customer sites around the world. The servo drives in those machines reached end of life. The manufacturer needed a practical retrofit solution instead of pointing customers toward a new machine.

The machine control source code was no longer available. We therefore had to find out how the software talks to the drives: by capturing bus traffic and analyzing the program file with Ghidra.

The goal was a clear retrofit path: operation and machine software stay the same, while the old drives are replaced by modern inverters.

Approach

1
1 Binary RE

Understand the program without source code

  • End-of-life servo drives in an existing machine series
  • Machine control source code no longer available
  • Program file analyzed to find the port, axes, and first parameters
2
2 Sniffer

Capture communication on the machine

  • RS-422 traffic captured without interfering with the machine
  • Stable telegrams and line settings identified
  • Real drive status replies decoded
3
3 Parser

Rebuild and test the protocol

  • Parser built for the drive telegrams
  • Key commands and replies reproduced from real logs
  • Tests run against captured bus data
4
4 Bridge

Install the STM32 intermediate controller

  • STM32-based intermediate controller placed between machine control and drive side
  • The machine control continues speaking as before
  • Replies come from documented logic instead of old black-box hardware
5
5 Models

Model the three axes

  • Software models created for the three drive axes
  • Axis behaviour reproduced from machine data
  • Models connected to parser and bridge
6
6 Acceptance

Commission new inverters

  • All three servo axes moved to new inverters
  • Machine software and operation remain unchanged
  • Documentation for manufacturer support and further customer machines

How the solution works

Operation & software (unchanged for customers)
Interface translation (legacy machine dialogue)
Virtual drive models (three axes — behaviour reproduced)
Modern servo inverters (real hardware — retrofitted)

Results

Retrofit solution for existing customer machines instead of “buy a new machine” as the default answer
Machine software unchanged — no new operating or control concept for customers
All three servo axes running on new inverters
Manufacturer support receives documentation — rebuilt from bus capture and binary RE instead of missing source code
The manufacturer can offer customers a concrete modernization path

Technologies

Protocol reverse engineeringSTM32 bridge firmwareIntermediate controllerVirtual drive modelsRegression testingServo retrofit

EOL drives in your field machines?

In 30 minutes we clarify whether a retrofit path is realistic when source code is missing and the drive protocol must be rebuilt from binary and bus traffic.

Request a free assessment
Reply within 24 hours No commitment Confidential