The usual obstacle with legacy machines is not technical — it is that nobody remembers the comms settings. The serial toolkit works through the possible combinations systematically, judging each one by whether real frames arrive intact and CRC checks out, until it locks on.
Illustrative output. Real scans reorder candidates based on observed traffic and timeout settings.
By hand, every candidate means changing settings and waiting out a timeout. A few hundred permutations quickly becomes an afternoon. The toolkit walks them in milliseconds.
1200 / 2400 / 4800 / 9600 / 19200 / 38400 / 57600 / 115200
7/8 data bits × none/even/odd × 1/2 stop bits
Modbus RTU / ASCII plus signatures of common vendor protocols
Sweeps 1 – 247 and lists every station that responds
Four layers of signal narrow the field and rule out candidates that merely "look like" a response.
At the wrong baud rate the UART raises framing and parity errors. High-error candidates are discarded immediately.
At the correct baud rate, the gaps between frames settle into a stable, protocol-specific pattern.
CRC-16 (RTU) or LRC (ASCII) is recomputed. Only several consecutive passes count as a hit.
Function codes must be in the legal set, declared and actual lengths must agree, address ranges must be sensible.
When an HMI is already polling, the toolkit defaults to passive listening: it transmits nothing at all and derives the settings purely from existing traffic.
That matters wherever injecting frames into a running machine is not permitted — which is most production lines.
If no master is present on the line — an idle machine, or a standalone PLC — the toolkit can probe with the lowest-risk read-only requests (Modbus FC03/FC04).
Active mode always requires explicit human enablement and can be limited to specific station IDs and address ranges.
That last item matters most: the summary is the input to the one-hour remote HMI workflow.
That is exactly the right place to start.