Siemens S7-200 tutorial: A comprehensive guide to understanding the Siemens S7-200; Decoding the encryption of Siemens S7-200 series PLCs

Thread Content

This post was last edited by sea7000 on 2017-7-31 at 12:52. 1. Basic structure of the S7-200 The Siemens S7-200 series belongs to the category of integrated, compact PLCs; it is used for simple control applications where relays are sufficient, as well as in more complex automation systems. 　　An integrated PLC combines the CPU module, I/O modules, and power supply within a box-shaped enclosure; the S7-200 is referred to as the CPU module. Under the front cover in Figure 1 are the RUN/STOP switch, analog potentiometer, and expansion I/O connector. The S7-200 series PLC offers a variety of CPU modules with different numbers of I/O points, as well as digital and analog I/O expansion modules for users to choose from; the CPU modules and expansion modules are connected using flat cables. 　　The overall PLC is also equipped with many dedicated special function modules, such as analog input/output modules, thermocouple and thermal resistor modules, communication modules, etc., which expand the functionality of the PLC. 　　The S7-200 can be programmed using ladder diagrams, statement lists (i.e., instruction lists), and function block language. It has a rich set of instructions, powerful functionality, is easy to master, and convenient to operate. It is equipped with a high-speed counter, high-speed output, PID controller, RS485 communication/programming interface, PPI communication protocol, MPI communication protocol, and free-mode communication functionality. It can be expanded to up to 248 digital I/O points or 35 analog I/O channels. There is up to 26kB of storage space for programs and data. 　　2. CPU modules of S7-200 The S7-200 comes with 5 types of CPU modules. The CPU221 has no expansion functions and is suitable for use as a microcontroller for smaller applications; the CPU222 has expansion functions; the CPU224 is a controller with advanced control capabilities; the CPU226 and CPU226 XM are suitable for complex medium and small-scale control systems. 　　The technical parameters of the CPUs for different models in the S7-200 series are shown in Table 1. The S7-200 offers instructions such as transfer, comparison, shifting, looping, complement calculation, subroutine calling, pulse width modulation, pulse sequence output, jumping, data conversion, arithmetic operations, word logic operations, floating-point operations, square root calculation, trigonometric functions, and PID control. It adopts a program structure consisting of a main program, up to 8 levels of subroutines, and interrupt programs; users can utilize timing interrupts with a duration of 1–255 ms. The user program supports 3-level password protection and has a monitoring timer (watchdog) function. 　　Among the digital inputs, 4 are used for hardware interrupts and 6 are used for high-speed functions. The highest counting frequency of the 32-bit high-speed add/subtract counter is 30 kHz; it can count two pulse sequences from an incremental encoder that are 90 degrees out of phase from each other. An interrupt is generated when the count value reaches a set value or when the counting direction changes, allowing for timely manipulation of the output in the interrupt routine. The two-point high-speed output can generate pulse trains with a maximum frequency of 20 kHz and an adjustable width. 　　The optional memory card can permanently store programs, data, and configuration information, while the optional battery card can store typical event values of data for 200 days. The DC-output type circuit uses a field-effect transistor (MOSFET) as the power amplifier element; only the DV-output type provides high-speed pulse output, with a maximum output frequency of 20 kHz. 　　3. S7-200 expansion modules: The S7-200 CPUs come equipped with a certain number of digital I/O points for different signals. If the actual number of I/O points required exceeds what the CPU can provide, expansion modules for inputs/outputs can be added to enhance functionality and expand control capabilities. Expansion modules come in three types: input/output expansion, thermocouple/thermistor input expansion, and communication expansion, and they are connected to the CPU module via bus connectors (plug-ins). 　　For the expansion unit to function properly, it requires a +5VDC power supply, which is provided by the CPU via the bus connector. The 24VDC input and output terminals of the expansion unit can be powered by the 24VDC supply from the main unit, but attention must be paid to the maximum current capacity provided by the main unit. 　　CPU 221 has no I/O expansion capability; CPU 222 can be connected to up to 2 expansion modules (digital or analog); CPU 224 and CPU 226 can be connected to up to 7 expansion modules. 　　(1) Input/Output Expansion Modules The S7-200 series of PLCs currently offer the following expansion modules: ① Digital input expansion module EM221 (8DI); ② Digital output expansion module EM222 (8DO); ③ Hybrid digital input/output expansion module EM223 (8I/O, 16I/O, 32I/O); ④ Analog input expansion module EM231 (3AI, with an A/D conversion time of 25μs and 12-bit resolution); ⑤ Hybrid analog input/output expansion module EM235 (3AI/1AO, where the A/D conversion time is 25μs, the D/A conversion time is 100μs, and both have a 12-bit resolution). (2) Thermocouple/Thermistor Expansion Modules Thermocouple and thermistor modules (EM231) are used in conjunction with CPUs such as CPU222, CPU224, and CPU226. Various types of thermocouples (producing mV signals) and thermistors (producing resistance signals) can have their signals transmitted to the S7-200 via the EM231 module. The user selects the calibration code of the thermocouple or thermal resistor, the wiring method, the measurement unit, and the direction of open-circuit fault through the DIP switches on the EM231. 　　(3) Communication expansion module In addition to the communication ports integrated in the CPU, the S7-200 can also be connected to larger networks through communication expansion modules. The S7-200 series currently has two communication expansion modules: the PROFIBUS-DP expansion slave module EM277 and the AS-i interface expansion module CP243-2. 　　The main technical specifications of the input/output expansion modules for the S7-200 series PLC are shown in Table 2. 4. Communication functions of S7-200 The RS485 serial communication built into the CPU module of the S7-200 supports PPI, DP/T, free communication port protocols, and PROFIBUS point-to-point protocol. Each network can have up to 126 stations, with a maximum of 32 master stations. The communication interface enables communication with the following devices: computers running programming software, the text display TD200, the OP (operator panel), and the S7-200 CPU; through the free communication port protocol, serial communication can be established with devices from other manufacturers. 　　The EM277 PROFIBUS-DP slave module is used to connect an S7-200 CPU to a PROFIBUS-DP network. The communication rate is 9600-12 Mbit/s. 　　The industrial Ethernet communication module CP243-1 has a communication speed of 10 Mbit/s or 100 Mbit/s, supports half-duplex/full-duplex communication, and uses the TCP/IP protocol via the RJ-45 interface. The STEP 7-Micro/WIN software can be used to enable configuration and remote programming services over industrial Ethernet (uploading and downloading programs, monitoring status), to connect other CPUs via industrial Ethernet, and to process data on a computer using S7-OPC. 　　The EM241 Modem module supports remote maintenance or remote diagnosis, communication between PLCs, communication between PLCs and PCs, as well as sending short messages to mobile phones. The EM241 parameterization wizard is integrated into Micro/WIN V3.2. 　　Through the CP243-2 AS-i communication processor, the S7-200 CPU can act as an AS-i master, capable of connecting up to 62 AS-i slaves and providing access to 496 remote digital input/output points. 　　5. Programming software for S7-200: STEP 7-Micro/WIN 32 is a programming software designed specifically for the S7-200, and it runs on personal computers with the Windows operating system. The CPU communicates with the computer via a PC/PPI cable or a CP 55111 or CP 5611 communication card inserted into the computer. Through a PC/PPI cable, multi-master communication can be achieved under Windows. 　　STEP 7-Micro/WIN 32 has a simple and clear structure for user programs; a main program is used to call subroutines or interrupt routines, and variable initialization can also be carried out through data blocks. Users can program using Statement Table (STL), Ladder Diagram (LAD), and Function Block Diagram (FBD). Programs written in different programming languages can be converted into one another. A symbol table can be used to define the symbols corresponding to the addresses of variables used in the program, which facilitates the design and understanding of the program. 　　STEP 7-Micro/WIN 32 provides users with two sets of instruction sets, namely the SIMATIC instruction set (S7-200 style) and the international standard instruction set (IEC1131-1 style). Remote programming can be achieved through a modem, and programs can be debugged and faults diagnosed using methods such as single scans and forced outputs. 　　The S7-200 was developed based on a small PLC from Texas Instruments in the United States, while the predecessors of the S7-300/400 were Siemens’ S5 series of PLCs, whose programming software is STEP 7. Although the S7-200 and S7-300/300 have many similarities, there are significant differences in their instruction sets, program structure, and programming software. 　　Ordering data for SIMATIC S7-200 SMART 　　① Ordering numbers for the central processing unit CPU 　　CPU SR20 module: Key parameters – AC/DC/RLY, 12 DI/8 DO; Ordering number: 6ES7 288-1SR20-0AA0 　　CPU SR40 module: Key parameters – AC/DC/RLY, 24 DI/16 DO; Ordering number: 6ES7 288-1SR40-0AA0 　　CPU ST40 module: Key parameters – DC/DC/DC, 24 DI/16 DO; Ordering number: 6ES7 288-1ST40-0AA0 　　CPU CR40 module: Key parameters – AC/DC/RLY, 24 DI/16 DO; Ordering number: 6ES7 288-1CR40-0AA0 　　CPU SR60 module: Key parameters – AC/DC/RLY, 36 DI/24 DO; Ordering number: 6ES7 288-1SR60-0AA0 　　CPU ST60 module: Key parameters – DC/DC/DC, 36 DI/24 DO; Ordering number: 6ES7 288-1ST60-0AA0 　　② Ordering numbers for I/O expansion modules EM 　　EM DI08 digital input module: Key parameters – 8×24VDC inputs; Ordering number: 6ES7 288-2DE08-0AA0 　　EM DR08 digital output module: Key parameters – 8 relay outputs; Ordering number: 6ES7 288-2DR08-0AA0 　　EM DR16 digital input/output module: Key parameters – 8×24VDC inputs/8 relay outputs; Ordering number: 6ES7 288-2DR16-0AA0 　　EM DR32 digital input/output module: Key parameters – 16×24VDC inputs/8 relay outputs; Ordering number: 6ES7 288-2DR32-0AA0 　　EM DT08 digital input/output module: Key parameters – 8×24VDC outputs; Ordering number: 6ES7 288-2DT08-0AA0 　　EM DT16 digital input/output module: Key parameters – 8×24VDC inputs/8×24VDC outputs; Ordering number: 6ES7 288-2DT16-0AA0 　　EM DT32 digital input/output module: Key parameters – 16×24VDC inputs/16×24VDC outputs; Ordering number: 6ES7 288-2DT32-0AA0 　　EM AI04 analog input module: Key parameters – 4 input channels; Ordering number: 6ES7 288-3AE04-0AA0 　　EM AQ02 analog input module: Key parameters – 2 output channels; Ordering number: 6ES7 288-3AQ02-0AA0 　　EM AM06 analog input/output module: Key parameters – 4 input channels/2 output channels; Ordering number: 6ES7 288-3AM06-0AA0 　　EM AR02 thermistor input module: Key parameters – 2 input channels; Ordering number: 6ES7 288-3AR02-0AA0 　　③ Ordering numbers for communication expansion cards SB 　　SB CM01 communication expansion card: Key parameters – R485/R232; Ordering number: 6ES7 288-5CM01-0AA0 　　SB DT04 digital expansion card: Key parameters – 2×24VDC inputs/2×24VDC outputs; Ordering number: 6ES7 288-5DT04-0AA0 　　SB AQ01 analog expansion card: Key parameters – 1×12-bit analog output; Ordering number: 6ES7 288-5AQ01-0AA0 　　A brief discussion on reverse engineering and encryption of Siemens S7-200 series PLCs 　　1. First, understand the common methods used for decrypting PLCs. To be invincible in every battle, one must know both oneself and the enemy; only by fully understanding the common decryption methods used for current PLCs can one develop better encryption schemes. What is available for sale now are software tools for reverse engineering; no direct-reading software has yet been developed. These tools work by removing the EEPROM chips and modifying their system blocks in order to bypass the password protection and obtain the program. Such a decryption method does achieve the purpose of reading the program, but it has severe side effects, completely altering the original settings of the system blocks. Since the settings of the original system block were unknown and could not be ascertained, a system block obtained from another PLC was hastily used in its place, completely changing the original settings. Thus, it is possible to develop targeted anti-reverse-engineering encryption based on this flaw. You can download the routine to take a look now. 　　2. Be sure to set a level 4 password protection. PLCs version 2.0 and above all come equipped with level 4 encryption, which is the highest level of encryption available; if you opt for level 3 encryption alone, it is very easy to crack. Because the original password can be obtained simply by removing the chip and reading it; there is no need to modify the chip. With the password, programs can be uploaded using that password. So if you only set up level 3 encryption protection, it’s as good as giving it away; you must use the highest level, level 4, of protection. So, how powerful is level 4 protection? As shown in the diagram below, with level 4 password protection, it’s not possible to upload files, regardless of whether you know the password or not; in other words, even if you know the password, you still can’t upload the files. To achieve uploading, decryption is carried out by using the method of replacing entire system blocks; after this replacement, the system blocks no longer have encryption capabilities, allowing the program to be uploaded. However, this changes your original settings, so next I will teach you how to counter such replacements of system blocks for decryption purposes. 　　3. The communication port settings cannot be set to the default value. If you click on the \"Default Value\" button in the image below, you’ll see that the default communication settings for system blocks are a baud rate of 9600 and a station number of 2. To prevent the enemy from being able to communicate after cracking the system, it’s best to set the baud rate to 187.5kbps. However, if your cable does not support this communication rate, then it’s better not to use it! Do not use the default address of 2 for the PLC; that’s too inefficient. Choose another station number instead. By doing this, even if it is cracked, it will still prevent others from establishing a communication connection; it’s especially effective if you have a touchscreen or a host computer for communication. After cracking, since the communication settings no longer match those originally set, external devices will be unable to communicate, and ultimately you will have to be contacted. Great, that’s wonderful!! 4. Set up a special power-off retention area; do not use the default setting. Take a look at the settings for the power-off data retention area in the figure below – they are all the system’s default values. If you’re too lazy to make any changes and stick to the system defaults, then even having encryption at level 4 will be pointless, as the system will use its default encryption methods to replace your files that are encrypted at level 4. 　　So, how exactly can we change the default settings within this system’s configuration in order to prevent cracking? There are many ways to do this, and they vary widely; it depends on one’s creativity. Below I’ll give an example of one such method for your reference; you can use this as a basis to come up with other solutions. 　　5. Check whether the data in the power-off retention area has been lost. Use programming methods to check whether the values you embedded in advance are still intact, to see if the mines placed there have exploded, and to determine whether your program has been reverse-engineered or decrypted. Enough talk – just look at the diagram. Of course, this is only a simple form of encryption; in real-world applications it can’t be that simple and easy to understand. You should make the system as complex as possible so that the program cannot be deciphered, with data undergoing various transformations, transmissions, transfers, calculations, and a range of other complex logical operations before it’s used to shut down the system. In the power-loss retention area of the system block, you can set vb0-vb40 as the areas that retain data during power loss, while data beyond vb40 must be cleared when power is lost. In your program, you can determine whether there is data present at the initial stage when the PLC is powered on; if there is data, then stop the machine, and if not, check the data in the power-loss retention area. You can pre-place certain values there, and if those values are no longer present, then stop the machine!

Here are some related questions:
1. Advantages of the Siemens S7-200 series of PLCs
The SIMATIC S7-200 offers a unified and cost-effective solution. Series features of the entire system: Powerful performance, Optimal modularization and open communication. 　　Compact and small in size – an ideal choice for any application in limited spaces. Basic and advanced functions available in all CPU models; large memory capacities for programs and data. Excellent real-time response – full control over the entire process at any time, thereby improving quality, efficiency, and safety. Easy-to-use STEP 7-Micro/WIN engineering software – ideal for both beginners and experts. Integrated R-S 485 interface, which can also be used as a system bus. Extremely fast and precise operation and process control. Full control over time-sensitive processes through time interrupts. 2. Methods to understand the programming inside Siemens PLC S7-200 224CN without disassembling it: There’s no need for decryption. By observing how the I/O indicator lights on the PLC change during operation, one can understand the programming involved. With some practice, one will be able to figure it out on their own, which is even better than decryption. There are also programs whose code isn’t accompanied by a symbol table or comments; even if you manage to read it, you might still not understand it. If you try to feed such a program back into the machine, maintenance will become even more difficult.