How to protect Siemens PLC control program? -Solutions - Huaqiang Electronic Network

LC03-3.3 SOP8 TVS Static Protection 3.3V

Brand AVX TPSE226M035R0125 Low impedance tantalum capacitor AVX 22

In the early days of system design, developers should consider the protection of the plc control program from a system perspective:
1. The concept of TIA (Totally Integrated Automation) helps protect our KNOW HOW
TIA enables high integration of configuration and programming, data management and communication, automation and drive products including PLC controllers, hmi HMIs, networks, drives and more. Practice has proved that control systems designed with TIA integrated concepts are difficult to plagiarize. The same software platform, the same hardware components, the same bus communication, can completely design a completely different control system, which is a platform for developers to freely play.
For example, two MM440 inverters and one CPU315-2DP communicate with PROFIBUS-DP. Except for PLC and inverter, there is regular data exchange. If the user uses DRIVES ES engineering software, it can realize between 2 MM440. Direct fast data exchange, in addition to DRIVES ES can also achieve more than 10 total PZD process data exchange between PLC and MM440, to achieve PLC batch download frequency converter parameters.
On the surface, there is no change in hardware. It is difficult for the copycat to judge from the hardware how the system controls the speed of the two drives. Imitations of unfamiliar Siemens products can't easily change hardware configurations or modify software, and even if the imitation is an expert on Siemens products, it's not easy to analyze the details in isolation.
To a certain extent, TIA has greatly improved the threshold for the technical level of the copycats. There are not many technicians who reach the level of Siemens system integration experts. Secondly, there are few people who are willing to do these things. In addition, for some large system OEM developers, routing communication functions, iMAP software packages, etc. are very good TIA system functions or tools, we should try to take advantage of the technological advantages that TIA brings to us, occupy the technical commanding heights, and increase The technical difficulty of imitation or plagiarism.
Second, the use of high-level language to write some important process programs is mainly for the control equipment using S7-300400 or WINAC products, in addition to using the LAD, STL, FBD standard programming language provided by STEP 7 to develop control programs, you can also use SCL, High-level languages ​​such as S7-GRAPH are used to develop some important process programs. WINAC can also develop proprietary blocks using the ODK software package. It is not easy for general imitations to get these development tools, and even if they are, they may not be used, let alone read them. In the process of project implementation, we should consider the protection of PLC control program from the perspective of software development skills:
1. Adoption of programming methods
a) Using a modular program structure, using symbolic names, parameterization to write subprogram blocks
b) S7-300400 uses background data blocks and multiple background data transmission methods as much as possible
c) more indirect addressing programming
d) Control programs for complex systems, especially those with sequential or recipe control, may consider data programming, ie changing the control logic or control sequence of the system through changes in the data.
Users should try to use the above-mentioned several advanced levels of programming, so that the embedded encryption protection program embedded in the program is not easy to be discovered and <the content is blocked>
2. Active protection method
a) utilize the system's clock
b) Use the ID number and serial number of the program card or CPU
c) Use the EEPROM anti-write function, and some memory retention functions that need to be set d) Use the system-provided timer function
e) Set the password in the data block of the user program
f) Set logical traps on the software
g) You can reverse the mistakes you made while programming
3. Passive protection method
a) Do not delete programs that are considered useless under the condition of memory capacity utilization license
b) leave the developer's logo in the data block so that it can be forensic in the event of future infringement
4. Application anti-<here content is blocked> technology considerations
a) Embedding the protection program in the user program should be natural. You can't add a program in abrupt manner. The code should be as simple as possible. The variable symbol name should be consistent with the variable embedded in the program segment.
b) It is often not enough to protect encryption. It should be used in a variety of ways. Once the protection procedures are activated, the consequences on the system should be as different as possible, resulting in the so-called “mine effect”, thus increasing the program. The content is blocked> the difficulty, time and cost, and the plagiarist is helpless in a short time.
c) Protect the original code of the program. If the program needs to be delivered, the appropriate technical processing should be performed on the delivered program without affecting the user's maintenance of the equipment, such as deleting some symbol names and using uploaded programs or data blocks.
d) Do a rigorous test to avoid the unnecessary trouble caused by the malfunction caused by the imperfection of the protection program, and also reduce the cost of after-sales service. 3. The communication function is often used in actual work. Some problems that require data exchange between systems (such as between PLC-PLC, between PLC and driver, between PLC and instrument), whether between Siemens products or between Siemens products and third-party products, it is recommended to use communication. The solution to replace the signal interconnection between analog or digital switching schemes. For the former, the imitation can only see a piece of hardware communication line. As for how much data is exchanged through communication, the implicator must spend energy to study the specific user program to understand; for the latter, the developer is worried. Save effort, the imitation is also clear at a glance.
The communication between the PLC and the driver, in addition to the data communication of the control word status word, set value feedback value and process variable, the parameters of the driver work can also be downloaded by the PLC through software, which can reduce the technical requirements of the end user maintenance system. At the same time, it can prevent the imitation of the working principle and design ideas of the system through the drive working parameter analysis system.
Sometimes the control system will be composed of multiple sub-control systems, thus forming a network with multiple CPUs and human-machine interfaces. The Siemens S7-200 products are commonly PPI networks. The S7-300400 products are commonly MPI networks, usually human-machine interfaces. Data exchange with the CPU, and we can also add some S7 basic communication functions in the user program of the CPU (S7-200 can use the NERTNETW command, S7-300400 can use the X_PUTX_GET command), timing or irregular A small amount of data exchange is performed between the CPUs, and the interlocking of the subsystem control logic is realized by the data. For such a system, it is not easy for the copycat to analyze the program of a certain subsystem.
Fourth, the panel type of human-machine interface is used in the automation system to use the panel type man-machine interface instead of a single button indicator. Although the function of the button indicator cannot be kept secret, so far, the panel type man-machine interface can Products that implement program uploading and decompilation are rare. Developers can add obvious manufacturer identification and contact information to the panel's screen. The imitation is not stupid enough to copy it as it is.
This forces the clone to rewrite the operator panel program or even the PLC program, and the developer can use the special function areas of the panel and PLC data interface (such as the Siemens panel area pointer, or VB script) to control the PLC program. carried out. Such a PLC program can only obtain the change logic of the PLC internal variables by guessing and online monitoring without the HMI source program, which is time-consuming and laborious, and greatly increases the difficulty of copying and copying.