" I don't know how to enter into the data stream between industrial controller and its master."

Not quite sure what you're after here.

Do you mean something like this:

 +---------+      +-----------+      +-----------+
 |       Tx|----->|           |----->|Rx         |
 | Master  |      | "sniffer" |      | Controller|
 |       Rx|<-----|           |<-----|Tx         |
 +---------+      +-----------+      +-----------+

In which case, your "sniffer" will need two UARTs: one to connect to the Tx/Rx of the master; the other to the Tx/Rx of the Controller.
This will give you full monitoring in both directions, and full "drop-and-insert" capability (ie, you can delete any data in either direction between the 2 units, and you can also insert data).

Yes, ring buffers would probably come in very handy.

Or maybe you just want to monitor, like this:

 +---------+                         +-----------+
 |       Tx|---------+-------------->|Rx         |
 | Master  |         |               | Controller|
 |       Rx|<--------------+---------|Tx         |
 +---------+         |     |         +-----------+  
                  +--V-----V--+                   
                  | Rx1   Rx2 |                   
                  | "sniffer" |                    
                  |           |                   
                  +-----------+ 

If it's a full-duplex link, you need 2 receivers to monitor it properly; if it's only half-duplex, you could get away with just one, and some logic to combine the two.

I've done both with the Triscend, where it's really useful to be able to have an almost unlimited number of UARTs, and to have receive-only (UAR?) or transmit only (UAT?) ports as required. And logic to do the half-duplex combining. And flashing lights.

In fact, one monitor just used the configurable logic with no code in the 8051 bit at all! I used it with the Eargwigg PC software for display & logging