| <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" |
| "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
| |
| |
| |
| <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> |
| <head> |
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> |
| <title>PLC4X – </title> |
| <script src="../../js/jquery.slim.min.js" type="text/javascript"></script> |
| <!--script src="../../js/popper.min.js" type="javascript"></script--> |
| <script src="../../js/bootstrap.bundle.min.js" type="text/javascript"></script> |
| <!-- The tooling for adding images and links to Apache events --> |
| <script src="https://www.apachecon.com/event-images/snippet.js" type="text/javascript"></script> |
| <!-- FontAwesome --> |
| <link rel="stylesheet" href="../../css/all.min.css" type="text/css"/> |
| <!-- Bootstrap --> |
| <link rel="stylesheet" href="../../css/bootstrap.min.css" type="text/css"/> |
| <!-- Some Maven Site defaults --> |
| <link rel="stylesheet" href="../../css/maven-base.css" type="text/css"/> |
| <link rel="stylesheet" href="../../css/maven-theme.css" type="text/css"/> |
| <!-- The PLC4X version of a bootstrap theme --> |
| <link rel="stylesheet" href="../../css/themes/plc4x.css" type="text/css" id="pagestyle"/> |
| <!-- A custom style for printing content --> |
| <link rel="stylesheet" href="../../css/print.css" type="text/css" media="print"/> |
| |
| <meta http-equiv="Content-Language" content="en"/> |
| |
| </head> |
| <body class="composite"> |
| <nav class="navbar navbar-light navbar-expand-md bg-faded justify-content-center border-bottom"> |
| <!--a href="/" class="navbar-brand d-flex w-50 mr-auto">Navbar 3</a--> |
| <a href="https://plc4x.apache.org/" id="bannerLeft"><img src="../../images/apache_plc4x_logo_small.png" alt="Apache PLC4X"/></a> |
| <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#collapsingNavbar3"> |
| <span class="navbar-toggler-icon"></span> |
| </button> |
| <div class="navbar-collapse collapse w-100" id="collapsingNavbar3"> |
| <ul class="navbar-nav w-100 justify-content-center"> |
| <li class="nav-item"> |
| <a class="nav-link" href="../../index.html">Home</a> |
| </li> |
| <li class="nav-item"> |
| <a class="nav-link" href="../../users/index.html">Users</a> |
| </li> |
| <li class="nav-item"> |
| <a class="nav-link" href="../../developers/index.html">Developers</a> |
| </li> |
| <li class="nav-item"> |
| <a class="nav-link" href="../../apache/index.html">Apache</a> |
| </li> |
| </ul> |
| <ul class="nav navbar-nav ml-auto justify-content-end"> |
| <li class="nav-item row valign-middle"> |
| <a class="acevent" data-format="wide" data-mode="light" data-event="random" style="width:240px;height:60px;"></a> |
| </li> |
| </ul> |
| </div> |
| </nav> |
| <div class="container-fluid"> |
| <div class="row h-100"> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| <main role="main" class="ml-sm-auto px-4 w-100 h-100"> |
| <div class="sect1"> |
| <h2 id="s7_communication">S7 Communication</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>When communicating with S7 Devices there is a whole family of protocols, that can be used. |
| In general you can divide them into <code>Profinet</code> protocols and <code>S7 Comm</code> protocols. |
| The later are far simpler in structure, but also far less documented. |
| The <code>S7 Comm</code> protocols are generally split up into two flavours: The classic <code>S7 Comm</code> and a newer version unofficially called <code>S7 Comm Plus</code>.</p> |
| </div> |
| <div class="sect2"> |
| <h3 id="overview_of_the_protocols">Overview of the Protocols</h3> |
| <div class="imageblock"> |
| <div class="content"> |
| <img src="../../images/protocols-s7-osi.png" alt="protocols s7 osi" width="1270" height="812"/> |
| </div> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="protocol_descriptions">Protocol Descriptions</h3> |
| <table class="tableblock frame-all grid-all stretch"> |
| <colgroup> |
| <col style="width: 25%;"/> |
| <col style="width: 25%;"/> |
| <col style="width: 25%;"/> |
| <col style="width: 25%;"/> |
| </colgroup> |
| <tbody> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Name</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">ISO</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">RFC</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Link</p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Transmission Control Protocol (TCP)</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">RFC 793</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://tools.ietf.org/html/rfc793" class="bare">https://tools.ietf.org/html/rfc793</a></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">ISO on TCP</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">- </p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">RFC 1006</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://tools.ietf.org/html/rfc1006" class="bare">https://tools.ietf.org/html/rfc1006</a></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">ISO Transport Protocol (Class 4)</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">ISO DP 8073</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">RFC 905</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://tools.ietf.org/html/rfc905" class="bare">https://tools.ietf.org/html/rfc905</a></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">S7 Comm (0x32)</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">- </p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="http://gmiru.com/article/s7comm/" class="bare">http://gmiru.com/article/s7comm/</a> <a href="http://gmiru.com/article/s7comm-part2/" class="bare">http://gmiru.com/article/s7comm-part2/</a> <a href="https://www.eng.tau.ac.il/~yash/jdsfl2014.pdf" class="bare">https://www.eng.tau.ac.il/~yash/jdsfl2014.pdf</a></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">S7 Comm Plus (0x72)</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">(Information seems to be invalid or incorrect however) <a href="https://opensource-security.de/thesis/MA_Maik_Brueggemann.pdf" class="bare">https://opensource-security.de/thesis/MA_Maik_Brueggemann.pdf</a></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">RPC</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">RFC 1057 & RFC 5531</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://tools.ietf.org/html/rfc1057" class="bare">https://tools.ietf.org/html/rfc1057</a> <a href="https://tools.ietf.org/html/rfc5531" class="bare">https://tools.ietf.org/html/rfc5531</a></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">DCOM</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">-</p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://msdn.microsoft.com/library/cc201989.aspx" class="bare">https://msdn.microsoft.com/library/cc201989.aspx</a></p></td> |
| </tr> |
| </tbody> |
| </table> |
| </div> |
| <div class="sect2"> |
| <h3 id="interaction_with_an_s7_plc">Interaction with an S7 PLC</h3> |
| <div class="paragraph"> |
| <p>Currently we are concentrating on implementing the TCP-based variants of the <code>S7 Comm</code> and <code>S7 Comm Plus</code> protocols. |
| Both are transferred using <code>ISO TP</code> which is wrapped by <code>ISO on TCP</code>. |
| Both protocols require establishing a connection on the <code>ISO TP</code> level first. |
| After the <code>ISO TP</code> connection is established, the higher level protocols then establish their connections. |
| These are then handled by the individual protocol sub-pages:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><a href="s7comm.html">S7 Comm (0x32)</a></p> |
| </li> |
| <li> |
| <p><a href="s7comm-plus.html">S7 Comm Plus (0x72)</a></p> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <p>The hex-value behind each of these correlates to the first byte used in the protocols messages to indicate the type of protocol.</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>Failed to generate image: Could not find the 'seqdiag', 'seqdiag3' executable in PATH; add it to the PATH or specify its location using the 'seqdiag' document attribute |
| { |
| === Connect === |
| |
| Client -> "ISO TP" [label = "Connection Request"] |
| Client <- "ISO TP" [label = "Connection Response"] |
| |
| === Higher Level Connect === |
| |
| === Higher Level Communication === |
| |
| === Disconnect === |
| |
| Client -> "ISO TP" [label = "Disconnect Request"] |
| |
| }</pre> |
| </div> |
| </div> |
| </div> |
| <div class="sect2"> |
| <h3 id="iso_tp_message_types">ISO TP Message Types</h3> |
| <div class="paragraph"> |
| <p>Even if <code>ISO TP</code> defines more types of messages, the ones required for <code>S7 Comm</code> or <code>S7 Comm Plus</code> are only the following. |
| Each message is called a <code>TPDU</code> (Transport Protocol Data Unit):</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p>Connection Request TPDU</p> |
| </li> |
| <li> |
| <p>Connection Response TPDU</p> |
| </li> |
| <li> |
| <p>Data TPDU</p> |
| </li> |
| <li> |
| <p>Disconnect Request TPDU</p> |
| </li> |
| </ul> |
| </div> |
| <div class="paragraph"> |
| <p>Notice: There is no <code>Disconnect Response</code> in <code>ISO TP: Class 0</code>.</p> |
| </div> |
| <div class="sect3"> |
| <h4 id="connection_request_tpdu">Connection Request TPDU</h4> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>Failed to generate image: Could not find the 'packetdiag', 'packetdiag3' executable in PATH; add it to the PATH or specify its location using the 'packetdiag' document attribute |
| { |
| colwidth = 32 |
| |
| // ISO on TCP |
| * ISO on TCP Magic Number (0x03) [len = 8, color = "#068D9D"] |
| * Reserved (0x00) [len = 8, color = "#068D9D"] |
| * Packet Length (including ISO on TCP header) [len = 16, color = "#068D9D"] |
| |
| // ISO Transport Protocol |
| * ISO TP Header Length\n(excluding length byte) [len = 8, color = "#53599A"] |
| * TPDU-Code\n(CR = 0xE0) [len = 4, color = "#AEECEF"] |
| * Signal CDT\n(0x00) [len = 4, color = "#53599A"] |
| // ISO TP Header (Fixed Part) |
| * Destination Reference [len = 16, color = "#53599A"] |
| * Source Reference [len = 16, color = "#53599A"] |
| * Protocol Class\n(Class 0 = 0x00) [len = 8, color = "#53599A"] |
| |
| // ISO TP Header (Variable Part / Parameters) |
| * Parameter Code\n(TPDU Size = 0xC0) [len = 8, color = "#53599A"] |
| * Parameter Length\n(1 = 0x01) [len = 8, color = "#53599A"] |
| * Parameter Value\n(TPDU Size 1024 = 0x0A) [len = 8, color = "#53599A"] |
| |
| * Parameter Code\n(Calling TSAP = 0xC1) [len = 8, color = "#53599A"] |
| * Parameter Length (2 = 0x02) [len = 8, color = "#53599A"] |
| * Device Group\n(PG/PC = 0x01) [len = 8, color = "#53599A"] |
| * TSAP Id (0x00) [len = 8, color = "#53599A"] |
| |
| * Parameter Code\n(Called TSAP = 0xC2) [len = 8, color = "#53599A"] |
| * Parameter Length (2 = 0x02) [len = 8, color = "#53599A"] |
| * Device Group\n(Others = 0x03) [len = 8, color = "#53599A"] |
| * Rack Number[len = 4, color = "#80DED9"] |
| * Slot Number[len = 4, color = "#80DED9"] |
| }</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Legend:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><span class="protocolIsoOnTcp">ISO on TCP Packet Header</span></p> |
| </li> |
| <li> |
| <p><span class="protocolIsoTP">ISO Transport Protocol Packet Header</span></p> |
| </li> |
| <li> |
| <p><span class="protocolId">Part of the packet that identifies the type of request</span></p> |
| </li> |
| <li> |
| <p><span class="protocolParameter">Variable Parts of the ISO Transport Protocol Packet Header</span></p> |
| </li> |
| </ul> |
| </div> |
| </div> |
| <div class="sect3"> |
| <h4 id="connection_response_tpdu">Connection Response TPDU</h4> |
| <div class="paragraph"> |
| <p>The <code>Connection Response</code> is identical to the <code>Connection Request</code> with the only difference that the <code>TPDU-Code</code> has a code of <code>0xD0</code>.</p> |
| </div> |
| </div> |
| <div class="sect3"> |
| <h4 id="data_tpdu">Data TPDU</h4> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>Failed to generate image: no implicit conversion of nil into String |
| { |
| colwidth = 32 |
| |
| // ISO on TCP |
| * ISO on TCP Magic Number (0x03) [len = 8, color = "#068D9D"] |
| * Reserved (0x00) [len = 8, color = "#068D9D"] |
| * Packet Length (including ISO on TCP header) [len = 16, color = "#068D9D"] |
| |
| // ISO Transport Protocol |
| * ISO TP Header Length\n(excluding length byte) [len = 8, color = "#53599A"] |
| * TPDU-Code\n(DATA = 0xF0) [len = 4, color = "#AEECEF"] |
| * Signal CDT\n(0x00) [len = 4, color = "#53599A"] |
| * TPDU-NR/EOT [len = 8, color = "#53599A"] |
| |
| }</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Legend:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><span class="protocolIsoOnTcp">ISO on TCP Packet Header</span></p> |
| </li> |
| <li> |
| <p><span class="protocolIsoTP">ISO Transport Protocol Packet Header</span></p> |
| </li> |
| <li> |
| <p><span class="protocolId">Part of the packet that identifies the type of request</span></p> |
| </li> |
| </ul> |
| </div> |
| </div> |
| <div class="sect3"> |
| <h4 id="disconnect_request_tpdu">Disconnect Request TPDU</h4> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre>Failed to generate image: no implicit conversion of nil into String |
| { |
| colwidth = 32 |
| |
| // ISO on TCP |
| * ISO on TCP Magic Number (0x03) [len = 8, color = "#068D9D"] |
| * Reserved (0x00) [len = 8, color = "#068D9D"] |
| * Packet Length (including ISO on TCP header) [len = 16, color = "#068D9D"] |
| |
| // ISO Transport Protocol |
| * ISO TP Header Length\n(excluding length byte) [len = 8, color = "#53599A"] |
| * TPDU-Code\n(DR = 0x80) [len = 4, color = "#AEECEF"] |
| * Signal CDT\n(0x00) [len = 4, color = "#53599A"] |
| * Destination Reference [len = 16, color = "#53599A"] |
| * Source Reference [len = 16, color = "#53599A"] |
| * Reason [len = 8, color = "#53599A"] |
| |
| // ISO TP Header (Variable Part / Parameters) (Optional) |
| * Parameter Code\n(Disconnect Additional Information = 0xE0) [len = 8, color = "#53599A"] |
| * Parameter Length\n(1 ... 128) [len = 8, color = "#53599A"] |
| * Parameter Data\n(Custom user data) [len = 24, color = "#53599A"] |
| |
| }</pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Legend:</p> |
| </div> |
| <div class="ulist"> |
| <ul> |
| <li> |
| <p><span class="protocolIsoOnTcp">ISO on TCP Packet Header</span></p> |
| </li> |
| <li> |
| <p><span class="protocolIsoTP">ISO Transport Protocol Packet Header</span></p> |
| </li> |
| <li> |
| <p><span class="protocolId">Part of the packet that identifies the type of request</span></p> |
| </li> |
| <li> |
| <p><span class="protocolParameter">Variable Parts of the ISO Transport Protocol Packet Header</span></p> |
| </li> |
| </ul> |
| </div> |
| </div> |
| </div> |
| </div> |
| </div> |
| </main> |
| <footer class="pt-4 my-md-5 pt-md-5 w-100 border-top"> |
| <div class="row justify-content-md-center" style="font-size: 13px"> |
| <div class="col col-6 text-center"> |
| Copyright © 2017–2022 <a href="https://www.apache.org/">The Apache Software Foundation</a>. |
| All rights reserved.<br/> |
| Apache PLC4X, PLC4X, Apache, the Apache feather logo, and the Apache PLC4X project logo are either registered trademarks or trademarks of The Apache Software Foundation in the United States and other countries. All other marks mentioned may be trademarks or registered trademarks of their respective owners. |
| <br/><div style="text-align:center;">Home screen image taken from <a |
| href="https://flic.kr/p/chEftd">Flickr</a>, "Tesla Robot Dance" by Steve Jurvetson, licensed |
| under <a href="https://creativecommons.org/licenses/by/2.0/">CC BY 2.0 Generic</a>, image cropped |
| and blur effect added.</div> |
| </div> |
| </div> |
| </footer> |
| </div> |
| </div> |
| |
| <!-- Bootstrap core JavaScript |
| ================================================== --> |
| <!-- Placed at the end of the document so the pages load faster --> |
| <script src="../../js/jquery.slim.min.js"></script> |
| <script src="../../js/popper.min.js"></script> |
| <script src="../../js/bootstrap.min.js"></script> |
| <script type="text/javascript"> |
| $('.carousel .carousel-item').each(function(){ |
| var next = $(this).next(); |
| if (!next.length) { |
| next = $(this).siblings(':first'); |
| } |
| next.children(':first-child').clone().appendTo($(this)); |
| |
| for (let i = 0; i < 3; i++) { |
| next=next.next(); |
| if (!next.length) { |
| next = $(this).siblings(':first'); |
| } |
| next.children(':first-child').clone().appendTo($(this)); |
| } |
| }); |
| </script> |
| </body> |
| </html> |
