Internet-Facing PLCs - A New Back Orifice Johannes Klick, Stephan - - PowerPoint PPT Presentation

▶
internet facing plcs a new back orifice
SMART_READER_LITE
LIVE PREVIEW

Internet-Facing PLCs - A New Back Orifice Johannes Klick, Stephan - - PowerPoint PPT Presentation

Oct 30, 2023 285 likes •1.37k views

Internet-Facing PLCs - A New Back Orifice Johannes Klick, Stephan Lau, Daniel Marzin, Jan-Ole Malchow, Volker Roth <firstname>.<lastname>@scadacs.org AG Secure Identity Department of Mathematics and Computer Science Freie

slide-1
SLIDE 1

SCADACS

Internet-Facing PLCs - A New Back Orifice

Johannes Klick, Stephan Lau, Daniel Marzin, Jan-Ole Malchow, Volker Roth

<firstname>.<lastname>@scadacs.org AG Secure Identity Department of Mathematics and Computer Science Freie Universit¨ at Berlin www.scadacs.org

1 / 100

slide-2
SLIDE 2

SCADACS

Opening

2 / 100

slide-3
SLIDE 3

SCADACS

Volker Roth Jan-Ole Malchow Johannes Klick Daniel Marzin Sascha Zinke Stephan Lau Stephan Arndt Marl Joos Matthias Sekul Jacob Bode Marvin Ullrich Yannik Robin Kettenbach Tina Meyer Hinnerk van Bruinehsen

https://www.scadacs.org

3 / 100

slide-4
SLIDE 4

SCADACS

Talk Overview

4 / 100

slide-5
SLIDE 5

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors

5 / 100

slide-6
SLIDE 6

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs

5 / 100

slide-7
SLIDE 7

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs ◮ Generell Attack Overview

5 / 100

slide-8
SLIDE 8

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs ◮ Generell Attack Overview

Siemens PLCs

◮ STL Language and its MC7 Bytecode

5 / 100

slide-9
SLIDE 9

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs ◮ Generell Attack Overview

Siemens PLCs

◮ STL Language and its MC7 Bytecode ◮ S7Comm Protocol (downloading program blocks)

5 / 100

slide-10
SLIDE 10

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs ◮ Generell Attack Overview

Siemens PLCs

◮ STL Language and its MC7 Bytecode ◮ S7Comm Protocol (downloading program blocks)

Attack Details

◮ PLC Code Injection with PLCinject (Demo)

5 / 100

slide-11
SLIDE 11

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs ◮ Generell Attack Overview

Siemens PLCs

◮ STL Language and its MC7 Bytecode ◮ S7Comm Protocol (downloading program blocks)

Attack Details

◮ PLC Code Injection with PLCinject (Demo) ◮ SNMP Scanner & SOCKS Proxy in STL

5 / 100

slide-12
SLIDE 12

SCADACS

Talk Overview

Introduction

◮ Traditional Attack Vectors ◮ Internet-facing PLCs ◮ Generell Attack Overview

Siemens PLCs

◮ STL Language and its MC7 Bytecode ◮ S7Comm Protocol (downloading program blocks)

Attack Details

◮ PLC Code Injection with PLCinject (Demo) ◮ SNMP Scanner & SOCKS Proxy in STL ◮ Attack Evaluation

5 / 100

slide-13
SLIDE 13

SCADACS

Traditional Attack Vectors of PLCs

6 / 100

slide-14
SLIDE 14

SCADACS

Traditional Attack Vectors of PLCs

Stuxnet

◮ Compromising an off-line site through the supply chain

7 / 100

slide-15
SLIDE 15

SCADACS

Traditional Attack Vectors of PLCs

Stuxnet

◮ Compromising an off-line site through the supply chain ◮ Compromised Siemens IDE downloaded malicious code to

the PLC.

7 / 100

slide-16
SLIDE 16

German steelwork

◮ Compromising an on-line site through the business IT

8 / 100

slide-17
SLIDE 17

German steelwork

◮ Compromising an on-line site through the business IT ◮ Manipulated steel works ICS damaged the furnace

8 / 100

slide-18
SLIDE 18

Control System Distribution - Europe

Datasource: SHODAN (2015)

9 / 100

slide-19
SLIDE 19

Control System Distribution - USA

Datasource: SHODAN (2015)

10 / 100

slide-20
SLIDE 20

Internet-facing Control Systems (worldwide)

Table : Comparison of counts per digital control device type (Datasource: SHODAN).

Category 2013 2015 Change PLCND 23.873 44.883 +88% BMS 31.411 33.883 +7% PLC 7.254 28.189 +289% SCADA 2.254 5.813 +158% ERP 1.400 1.774 +27% TM 788 1.726 +119% HMI 1.741 979 −44% 86.181 109.692 +27%

11 / 100

slide-21
SLIDE 21

Internet-facing PLCs

◮ What is behind an Internet facing PLC? ◮ Are there more indirect internet facing PLCs? ◮ Maybe a whole production network?

12 / 100

slide-22
SLIDE 22

Attack Overview

13 / 100

slide-23
SLIDE 23

Attack Overview I

PLC 1 is connected to the Internet.

14 / 100

slide-24
SLIDE 24

Attack Overview II

The attacker injects a network scanner. . .

15 / 100

slide-25
SLIDE 25

Attack Overview III

. . . to discover the devices on the local network. . .

16 / 100

slide-26
SLIDE 26

Attack Overview IV

. . . to discover the devices on the local network. . .

17 / 100

slide-27
SLIDE 27

Attack Overview V

. . . to discover the devices on the local network. . .

18 / 100

slide-28
SLIDE 28

Attack Overview VI

. . . and retrieves the results.

19 / 100

slide-29
SLIDE 29

Attack Overview VII

Next he adds a proxy. . .

20 / 100

slide-30
SLIDE 30

Attack Overview VIII

. . . to pwn the local devices.

21 / 100

slide-31
SLIDE 31

Introduction to Siemens PLCs

22 / 100

slide-32
SLIDE 32

Introduction to Siemens PLCs

  • 1. PLC
  • 2. Cyclic execution model, I/O
  • 3. Program structure and organization
  • 4. STL programs and their MC7 representation

23 / 100

slide-33
SLIDE 33

Introduction to Siemens PLCs

What is a PLC?

◮ Programmable Logic Controller ◮ realtime industrial computer controlling an industrial

process

◮ inputs connected to sensors ◮ outputs connected to actuators ◮ program controls outputs as a function of the inputs (and

its internal state)

24 / 100

slide-34
SLIDE 34

Introduction to Siemens PLCs

Cyclic execution model, I/O

Source: Siemens, “S7-300 CPU 31xC and CPU 31x: Technical specifications”

25 / 100

slide-35
SLIDE 35

Introduction to Siemens PLCs

Program structure and organization

Block type Description Organization Block OB Program entry point Data Block DB Data storage Function FC Function Function Blocks FB Stateful function System Functions SFC, SFB System library System Data Blocks SDB PLC configuration

26 / 100

slide-36
SLIDE 36

Programming Siemens PLC in STL

Boolean term:

◮ Q0.0 = (I0.0 ∧ I0.1) ∨ I0.2

Statement List (STL):

27 / 100

slide-37
SLIDE 37

Program block binary representation

Description Bytes Offset

Block signature

2

Block version

1 2

Block attribute

1 3

Block language

1 4

Block type

1 5

Block number

2 6

Block length

4 8

Block password

4 12

Block last modified date

6 16

Block interface last modified date

6 22

Block interface length

2 28

Block Segment table length

2 30

Block local data length

2 32

Block data length

2 34 Data (MC 7 / DB) x 36 Block signature 1 36+x

28 / 100

slide-38
SLIDE 38

Program block binary representation

OB 1 with A %I0.0 A %I0.1 O %I0.2 = %Q0.0 is compiled to

00: 7070 0101 0108 0001 0000 0074 0000 0000 pp.........t.... 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 ..’5-...c.!..... 20: 0014 000a c000 c100 ca00 d880 6500 0100 ............e... 30: 0014 0000 0002 0502 0502 0502 0502 0502 ................ 40: 0505 0505 0505 050e 0520 0100 0800 0000 ......... ...... 50: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 60: 0000 0000 0000 0000 0100 a691 0000 0000 ................ 70: 0000 0000 ....

29 / 100

slide-39
SLIDE 39

Program block binary representation

Block Type

OB 08, DB 0A, SDB 0B, FC 0C, SFC 0D, FB 0E, SFB 0F 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

30 / 100

slide-40
SLIDE 40

Program block binary representation

Block Number

Block number is 1 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

31 / 100

slide-41
SLIDE 41

Program block binary representation

Total block length

Total block length is 116 bytes 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

32 / 100

slide-42
SLIDE 42

Program block binary representation

Data/Code Length

Code section has 10 bytes 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

33 / 100

slide-43
SLIDE 43

Program block binary representation

MC7 Opcodes

A %I0.0 A %I0.1 O %I0.2 = %Q0.0 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

34 / 100

slide-44
SLIDE 44

Program block binary representation

MC7 Opcodes

A %I0.0 A %I0.1 O %I0.2 = %Q0.0 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

35 / 100

slide-45
SLIDE 45

Program block binary representation

MC7 Opcodes

A %I0.0 A %I0.1 O %I0.2 = %Q0.0 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

36 / 100

slide-46
SLIDE 46

Program block binary representation

MC7 Opcodes

A %I0.0 A %I0.1 O %I0.2 = %Q0.0 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

37 / 100

slide-47
SLIDE 47

Program block binary representation

MC7 Opcodes

A %I0.0 A %I0.1 O %I0.2 = %Q0.0 BE 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

38 / 100

slide-48
SLIDE 48

S7comm

39 / 100

slide-49
SLIDE 49

S7comm

S7comm Protocol Structure

40 / 100

slide-50
SLIDE 50

S7comm

Download Procedure

41 / 100

slide-51
SLIDE 51

SCADACS

S7comm

Protocol details

Wireshark can dissect S7comm with the dissector available at

http://sourceforge.net/projects/ s7commwireshark/

42 / 100

slide-52
SLIDE 52

SCADACS

S7comm

Protocol details

Implementation of partial S7comm available at

http://snap7.sourceforge.net/

43 / 100

slide-53
SLIDE 53

SCADACS

Attack Details

44 / 100

slide-54
SLIDE 54

SCADACS

Attack Details

  • 1. Instrumenting live PLC programs with scanning malware
  • 2. SNMP scanning
  • 3. Collecting the scan results
  • 4. Instrumenting live PLC programs with proxy malware
  • 5. Connecting to PLCs through the proxy malware

45 / 100

slide-55
SLIDE 55

Attack Details I

Overview

PLC 1 is connected to the Internet

46 / 100

slide-56
SLIDE 56

Attack Details II

Overview

Attacker downloads the main program block. . .

47 / 100

slide-57
SLIDE 57

Attack Details

Overview

◮ Example PLC code

48 / 100

slide-58
SLIDE 58

Attack Details

Overview

◮ OB1 with prepended function call to FC 666

49 / 100

slide-59
SLIDE 59

Overview

Before injection

A %I0.0 A %I0.1 O %I0.2 = %Q0.0 BE 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000

50 / 100

slide-60
SLIDE 60

Overview

Injection

CALL FC666

  • 1. insert block call

JU L1 L1: A %I0.0 A %I0.1 O %I0.2 = %Q0.0 BE 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a fb70 029a 700b 0002 c000 c100 30: ca00 d880 6500 0100 0014 0000 0002 0502 40: 0502 0502 0502 0502 0505 0505 0505 ...

51 / 100

slide-61
SLIDE 61

Overview

Injection

CALL FC666

  • 1. insert block call

JU L1 L1: A %I0.0 A %I0.1 O %I0.2 = %Q0.0 BE 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a fb70 029a 700b 0002 c000 c100 30: ca00 d880 6500 0100 0014 0000 0002 0502 40: 0502 0502 0502 0502 0505 0505 0505 ...

52 / 100

slide-62
SLIDE 62

Overview

Injection

CALL FC666

  • 1. insert block call

JU L1

  • 2. increase total block length

L1: A %I0.0 A %I0.1 O %I0.2 = %Q0.0 BE 00: 7070 0101 0108 0001 0000 007C 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a fb70 029a 700b 0002 c000 c100 30: ca00 d880 6500 0100 0014 0000 0002 0502 40: 0502 0502 0502 0502 0505 0505 0505 ...

53 / 100

slide-63
SLIDE 63

Overview

Injection

CALL FC666

  • 1. insert block call

JU L1

  • 2. increase total block length

L1: A %I0.0

  • 3. increase code length

A %I0.1 O %I0.2 = %Q0.0 BE 00: 7070 0101 0108 0001 0000 007C 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 0012 fb70 029a 700b 0002 c000 c100 30: ca00 d880 6500 0100 0014 0000 0002 0502 40: 0502 0502 0502 0502 0505 0505 0505 ...

54 / 100

slide-64
SLIDE 64

PLCinject

55 / 100

slide-65
SLIDE 65

PLCinject

Release

plcinject -c ip [-r rack=0] [-s slot=2] [-b block] [-p block] [-f dir] [-d]

  • d

Display available blocks on PLC

  • p

Block that has to be injected/patched with a call instruction: OBx, FBx or FCx on PLC, e.g. OB1

  • b

Block to call

  • f

Path to your block(s) you want to download to the plc Example: plcinject -c 10.0.0.1 -p OB1 -b FB1000 -f /home/user/PATH Available at https://github.com/SCADACS/PLCinject

56 / 100

slide-66
SLIDE 66

PLCinject

Live Demo

PLCinject with example Payload (running light) and a PLC

57 / 100

slide-67
SLIDE 67

. . . patches it and uploads a SNMP scanner

58 / 100

slide-68
SLIDE 68

59 / 100

slide-69
SLIDE 69

Attacker downloads the scanning results

60 / 100

slide-70
SLIDE 70

A SOCKS proxy enables him to reach the net behind the PLC

61 / 100

slide-71
SLIDE 71

SNMP Scanner

62 / 100

slide-72
SLIDE 72

SNMP Scanner

Rationale

◮ ping is not possible ◮ TCP is not adequate

◮ number of overall connections is limited ◮ connection can only closed when established

◮ UDP: no connection setup, always closable ◮ SNMP enabled in many Siemens PLCs

63 / 100

slide-73
SLIDE 73

SNMP Scanner I

Details

Get the PLC’s IP

64 / 100

slide-74
SLIDE 74

SNMP Scanner II

Details

Calculate the subnet mask

65 / 100

slide-75
SLIDE 75

SNMP Scanner III

Details

Configure UDP connection

66 / 100

slide-76
SLIDE 76

SNMP Scanner IV

Details

Send UDP packets (SNMP get request)

67 / 100

slide-77
SLIDE 77

SOCKS Proxy – Details

68 / 100

slide-78
SLIDE 78

SOCKS Proxy – Details I

◮ SOCKS5 protocol (RFC 1928) ◮ Without authentication or encryption

69 / 100

slide-79
SLIDE 79

SOCKS Proxy – Details II

Jump list for protocol states

70 / 100

slide-80
SLIDE 80

SOCKS Proxy – Details III

Receive clients connect request. . .

71 / 100

slide-81
SLIDE 81

SOCKS Proxy – Details IV

. . . and store IP and port

72 / 100

slide-82
SLIDE 82

SOCKS Proxy – Details V

Connect to destination host. . .

73 / 100

slide-83
SLIDE 83

SOCKS Proxy – Details VI

◮ connection to client and destination host are established ◮ now we can proxy

◮ send client’s messages to destination and vice versa ◮ an error while receiving means one partner disconnected ◮ send remaining data then disconnect and wait for next

client

74 / 100

slide-84
SLIDE 84

SOCKS Proxy – Details VII

◮ The SOCKS implementation on the PLC is able to

transfer up to 730 KB/s if it is running alone.

◮ In combination with a memory intensive benchmark PLC

programm the proxy was able to transfer up to 40KB/s.

75 / 100

slide-85
SLIDE 85

Attack Video

. . . Video Presentation. . .

76 / 100

slide-86
SLIDE 86

Evaluation

77 / 100

slide-87
SLIDE 87

Evaluation

Questions

◮ How much is the execution time increased by injected

SOCKS proxy?

78 / 100

slide-88
SLIDE 88

Evaluation

Questions

Default maximum cycle time = 150 ms

79 / 100

slide-89
SLIDE 89

Measurements I

How to measure

◮ Pull data from OB1 PREV CYCLE variable ◮ Store the result in a DB ◮ Upload DB from PLC ◮ Compare values for the baseline program and the SOCKS

Proxy (idle / under load)

80 / 100

slide-90
SLIDE 90

Measurements II

*** = p value ≤ 0.0001

81 / 100

slide-91
SLIDE 91

Measurements III

Baseline Proxy idle Proxy under load Mean 85.32 85.40 86.67

  • Std. Deviation

0.4927 0.5003 0.5239

  • Std. Error

0.01089 0.01106 0.01158

All values in milliseconds (ms)

Result:

◮ There exists a significant but not practically relevant

timing difference between the baseline program and its malicious SOCKS proxy version regarding the default cycle time of 150 ms.

82 / 100

slide-92
SLIDE 92

Mitigation strategies

83 / 100

slide-93
SLIDE 93

84 / 100

slide-94
SLIDE 94

Mitigation strategies

  • 1. Network-level access control
  • 2. Enabling protection-level 3
  • 3. If all else fails, means to woo deities to lend disaster

protection

85 / 100

slide-95
SLIDE 95

Summary

86 / 100

slide-96
SLIDE 96

Summary

◮ Inject malware into a PLC without service disruption ◮ An internet facing PLC can be used as a gateway into the

local network

◮ This enables an adversary to attack devices behind the

Internet-facing PLC

◮ Taking these indirect connected systems into account, the

attack surface regarding ICS could be much bigger than expected

87 / 100

slide-97
SLIDE 97

Q&A

88 / 100

slide-98
SLIDE 98

Appendix

89 / 100

slide-99
SLIDE 99

Signature

00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

90 / 100

slide-100
SLIDE 100

Version

00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

91 / 100

slide-101
SLIDE 101

Attribute

00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

92 / 100

slide-102
SLIDE 102

Language

STL 01, LAD 02, FBD 03, SCL 04, DB 05, GRAPH 06, SDB 07 00: 7070 0101 0108 0001 0000 0074 0000 0000 10: 02ab 2735 2d03 03a1 6383 21a7 001c 0006 20: 0014 000a c000 c100 ca00 d880 6500 0100 30: 0014 0000 0002 0502 0502 0502 0502 0502 40: 0505 0505 0505 050e 0520 0100 0800 0000 50: 0000 0000 0000 0000 0000 0000 0000 0000 60: 0000 0000 0000 0000 0100 a691 0000 0000 70: 0000 0000

93 / 100

slide-103
SLIDE 103

Communication setup

94 / 100

slide-104
SLIDE 104

Communication setup

95 / 100

slide-105
SLIDE 105

Appendix

Communication setup

96 / 100

slide-106
SLIDE 106

Appendix

List all blocks

97 / 100

slide-107
SLIDE 107

Appendix

List all blocks

98 / 100

slide-108
SLIDE 108

Appendix

List all blocks – Parameter

99 / 100