Transcription

1 FTP Communication with an S Station CP , FTP, FTPS, FTP over TLS Siemens Industry Online Support

2 Legal information Legal information Use of application examples Application examples illustrate the solution of automation tasks through an interaction of several components in the form of text, graphics and/or software modules. The application examples are a free service by Siemens AG and/or a subsidiary of Siemens AG ("Siemens"). They are non-binding and make no claim to completeness or functionality regarding configuration and equipment. The application examples merely offer help with typical tasks; they do not constitute customer-specific solutions. You yourself are responsible for the proper and safe operation of the products in accordance with applicable regulations and must also check the function of the respective application example and customize it for your system. Siemens grants you the non-exclusive, non-sublicensable and non-transferable right to have the application examples used by technically trained personnel. Any change to the application examples is your responsibility. Sharing the application examples with third parties or copying the application examples or excerpts thereof is permitted only in combination with your own products. The application examples are not required to undergo the customary tests and quality inspections of a chargeable product; they may have functional and performance defects as well as errors. It is your responsibility to use them in such a manner that any malfunctions that may occur do not result in property damage or injury to persons. Disclaimer of liability Siemens shall not assume any liability, for any legal reason whatsoever, including, without limitation, liability for the usability, availability, completeness and freedom from defects of the application examples as well as for related information, configuration and performance data and any damage caused thereby. This shall not apply in cases of mandatory liability, for example under the German Product Liability Act, or in cases of intent, gross negligence, or culpable loss of life, bodily injury or damage to health, non-compliance with a guarantee, fraudulent non-disclosure of a defect, or culpable breach of material contractual obligations. Claims for damages arising from a breach of material contractual obligations shall however be limited to the foreseeable damage typical of the type of agreement, unless liability arises from intent or gross negligence or is based on loss of life, bodily injury or damage to health. The foregoing provisions do not imply any change in the burden of proof to your detriment. You shall indemnify Siemens against existing or future claims of third parties in this connection except where Siemens is mandatorily liable. By using the application examples you acknowledge that Siemens cannot be held liable for any damage beyond the liability provisions described. Other information Siemens reserves the right to make changes to the application examples at any time without notice. In case of discrepancies between the suggestions in the application examples and other Siemens publications such as catalogs, the content of the other documentation shall have precedence. The Siemens terms of use ( shall also apply. Security information Siemens provides products and solutions with Industrial Security functions that support the secure operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks against cyber threats, it is necessary to implement and continuously maintain a holistic, state-of-the-art industrial security concept. Siemens products and solutions constitute one element of such a concept. Customers are responsible for preventing unauthorized access to their plants, systems, machines and networks. Such systems, machines and components should only be connected to an enterprise network or the Internet if and to the extent such a connection is necessary and only when appropriate security measures (e.g. firewalls and/or network segmentation) are in place. For additional information on industrial security measures that may be implemented, please visit Siemens products and solutions undergo continuous development to make them more secure. Siemens strongly recommends that product updates are applied as soon as they are available and that the latest product versions are used. Use of product versions that are no longer supported, and failure to apply the latest updates may increase customer s exposure to cyber threats. To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed at: Entry ID: , V3.0, 01/2019 2

3 Table of Contents Table of Contents Legal information Task Solution Overview Description of the core functionality CP as the FTP server CP as the FTP client Hardware and software components Validity Components used Block overview "LFtp_Communication" function block "LFtp_DataHandlingHmi" function block "LFtp_Param" data block "LFtp_ClientFile" and "LFtp_ServerFileX" data blocks Principle of Operation How "CP as FTP server" works How "CP as FTP client" works Installation and Startup Installing the software Installing the hardware Integrating the "LFtp" library Starting up the HMI Basic FTP configuration General setup of the FTP server functionality General procedure for setting up the FTP client functionality Advanced configuration for FTPS (FTP over TLS) Setting up the FTPS server functionality Setting up the FTPS client functionality Starting up FileZilla Client and FileZilla Server FileZilla FTP Server FileZilla FTP Client Operation Menu prompts when using the HMI Controlling "CP as FTP server" Controlling "CP as FTP client" Controlling data transfer with HMI Control without HMI Valuable Information Appendix Service and support Links and literature Change documentation Entry ID: , V3.0, 01/2019 3

4 1 Task 2.1 Overview 1 Task Introduction In many projects and plants, it is necessary to exchange process data between controllers and servers / PCs so that the data generated there can also be used outside the control level. This is made possible by standardized protocols. Due to its versatility, FTP has established itself as a standard for data exchange. It is independent of the type of connection and the operating system. It additionally offers protection mechanisms such as assigning access rights and explicitly sharing paths. The data exchange can be protected by communication encryption (FTPS). Overview of the automation task The figure below provides an overview of the automation task. Figure 1-1: Overview of the automation task FTP client FTP communication FTP server PG / PC S7 station Process / send / request data Provide data S7 station PG / PC Description of the automation task An S controller is to exchange data with a PC via FTP. The CP is ideally suited for this task as it can perform the function of both an FTP client and an FTP server. The aim is to implement the following scenarios: The CP acting as an FTP client (active/passive) requests data from an FTP server and stores it in a suitable data structure or sends a suitable data structure to an FTP server, where it is stored as a file. The CP acting as an FTP server provides its file system to an FTP client. You can implement both scenarios using FTP (unencrypted) or FTPS (encrypted). As an FTP server, the CP only provides access; as an FTP client, it needs to actively act via various FTP commands. Entry ID: , V3.0, 01/2019 4

5 2 Solution 2.1 Overview 2 Solution 2.1 Overview Diagrammatic representation The diagrammatic representation below shows the most important components of the solution: Figure 2-1: Schematic diagram FTP client FTP server Send data to S7 station Request process data from S7 station HMI panel Local control S with CP as an FTP client/server Send process data to server Request files from server PROFINET / IE Advantages The CP can be used both as an FTP server and as an FTP client. This document describes the configuration as a server. Using the CP as a client requires that the "FTP_CMD" instruction be used. To facilitate the programming involved, we provide the "LFtp" library. The "LFtp_Communication" function block and the "LFtp_Param" data block enable you to integrate FTP communication into your project quickly and easily. The CP supports FTP and FTPS. This allows you to transfer the data in an unencrypted or encrypted form. The solution presented here offers the following advantages: Simple and easy to understand FTP communication with an S controller with the aid of the "LFtp" block library Secure transfer via FTPS (FTP over TLS) Entry ID: , V3.0, 01/2019 5

6 2 Solution 2.2 Description of the core functionality 2.2 Description of the core functionality This document describes the configuration and programming of the following functionalities: The CP is the FTP server. An FTP client can access the file system and read/write files. The CP is the FTP client and can access an FTP server with the following FTP commands: NOOP, CONNECT, STORE, RETRIEVE, DELETE, QUIT, APPEND and RETR_PART. The "LFtp" library is used for this purpose. Setting up encrypted transfer via FTPS (FTP over TLS) CP as the FTP server Server functionality flowchart The following diagrammatic representation shows unencrypted data transfer with the CP as the FTP server. Figure 2-2: "CP as server" flowchart 5 Wait for client to connect 1 Client connects to CP 2 Connected? No Yes Manually trigger data transfer on client 3 Data sent/ received? No Error (failed transfer) Stop program execution Data transfer successful (successful transfer) Stop program execution Yes Client disconnects connection 4 Disconnected properly? No Yes Note The CP allows 16 simultaneous connections to the FTP server. Entry ID: , V3.0, 01/2019 6

7 2 Solution 2.2 Description of the core functionality Table 2-1: "CP as server" steps (unencrypted) Action Note 1. The FTP client connects to the CP (action on the PG/PC). 2. Check connection status: OK: Trigger selected command NOK: Stop program execution; the error is displayed in the FTP client software's status display. 3. Check data exchange: OK: Trigger 'disconnect' NOK: Stop program execution; the error is displayed in the FTP client software's status display. 4. Check 'disconnect': OK: Stop program execution. NOK: Stop program execution; the error is displayed in the FTP client software's status display. The connection data is entered in the FTP client's user interface (IP address, user name, password). If NOK: The FTP client identifies a failed transfer and indicates this in its status display. If NOK: The FTP client identifies a failed transfer and indicates this in its status display. If NOK: The FTP client identifies a failed transfer and indicates this in its status display. 5. Wait for retrigger by user. The CP waits for an FTP client to reconnect. HMI visualization The application can be controlled using the HMI included in the "LFtp" library. The following figure shows the associated operating screen. Figure 2-3: "CP as FTP server" operating screen Entry ID: , V3.0, 01/2019 7

8 2 Solution 2.2 Description of the core functionality The numbers have the following meaning: Table 2-2: Functions of the "CP as FTP server" operating screen No. Action Comment 1. Locks the assigned memory areas in the FTP server (here: DB5, DB6, DB7). The DB's data cannot be overwritten. If data transfer is started nevertheless, an error message is output on the FTP client. 2. Confirms the received data. In reality, this option would, in most cases, be automatically executed by the user program once the data has been received and processed. 3. Displays the received data CP as the FTP client Client functionality flowchart The following diagrammatic representation shows unencrypted data transfer with the CP as the FTP client. Figure 2-4: "CP as client" flowchart 5 Wait for new trigger 1 Start Connect to FTP server 2 Connected? No Yes 3 Automatically trigger data exchange Data sent/ received? No ERROR: Stop program execution Output specific status (error-specific) DONE: Stop program execution Output specific status (OK; 0000) Yes Disconnect from FTP server No Disconnected properly? 4 Yes Entry ID: , V3.0, 01/2019 8

9 2 Solution 2.2 Description of the core functionality Table 2-3: "CP as client" steps (unencrypted) Action 1. Setting the "Execute" input starts the block. Note The connection data is entered, for example, in the "LFtp_Param" data block (IP address, user name, password, file name...). 2. Check selected command: OK: Command can be executed. NOK: Command cannot be executed. Program execution is stopped. 3. Check data exchange: OK: Stop program execution and output status (0x0000): Not processing any job. / Job completed without errors. NOK: Stop program execution and output error-specific status. If NOK, an "error" occurs. "status" specifies the error status. If NOK, an "error" occurs. "status" specifies the error status. 5. Wait for retrigger. Also possible in the event of an "error". HMI visualization For easier use, the client functionality can be controlled from the "LFtp" library using the HMI. The following figure shows the "CP as FTP client" operating screen of the supplied HMI. Figure 2-5: "CP as FTP client" operating screen Entry ID: , V3.0, 01/2019 9

10 2 Solution 2.2 Description of the core functionality The numbers have the following meaning: Table 2-4: Functions of the "CP as FTP client" operating screen No. Action Comment 1. Enter the user data and IP address of the server. 2. Select the FTP command from a dropdown list. 3. Enter the file name with the associated extension. These access details are configured in HW Config. Possible commands: NOOP, CONNECT, STORE, APPEND, DELETE, QUIT, RETRIEVE, RETRIEVE_PART. Generally, any file format is possible. 4. Displays the send and receive data. In the "LFtp_DataHandlingHmi" block, the data is prepared for display. 5. Confirm newly received data. Necessary once new data has been received. This confirmation is required to receive new data. 6. Displays the status and start button for starting communication. Connection established: Indicates whether a connection to the server currently exists. Busy: "True" while job active. Done: "True" if job completed successfully. Error: "True" if an error occurred. Status: Shows the current status code. (See Table 2-11 ) Entry ID: , V3.0, 01/

11 2 Solution 2.3 Hardware and software components 2.3 Hardware and software components Validity This library is valid for STEP 7 V15 or higher S FW 2.0 or higher and CP FW 2.0 or higher Any FTP server (PC application) Any FTP client (PC application) Optional: WinCC Comfort V15 or higher Components used The library was created with the following components: Hardware components Table 2-5: Hardware components Component No. Article no. Note SIMATIC S PLC PN PM 70W 120/130V AC 1 6ES AK01-0AB0 Alternatively, any other SIMATIC S with PN interface compatible with the CP can be used. 1 6EP1332-4BA00 Alternatively, any other power supply unit can be used. CP GK AX00-0EX0 Required TP900 Comfort 1 6AV JC01-0AX0 Optional Software components Table 2-6: Software components Component No. Article no. Note STEP 7 PROFESSIONAL V15 1 6ES7822-1AA05-0YA5 WinCC Comfort V15 1 6AV2101-0AA05-0AH5 FileZilla FTP Server software FileZilla FTP Client software Sample files and projects Or higher. Or higher, optional 1 Freeware (GPL) Or other FTP server software 1 Freeware (GPL) Or other FTP client software The following list contains all files that are used in this example. Table 2-7: Sample files Component _FTP_CP_LIB_V30.zip _FTP_CP_DOC_V30_en.pdf Note This.zip file contains the STEP 7 V15 library. This document. Entry ID: , V3.0, 01/

12 2 Solution 2.4 Block overview 2.4 Block overview The following tables list the "LFtp" library blocks. Types The following table shows the blocks that you will find in the "Types" library folder: Table 2-8: "Types" folder Name LFtp_Communication LFtp_DataHandlingHmi LFtp_typeHmiDataExchange Brief description Contains the "FTP_CMD" instruction and controls the FTP communication process. Optional. Required if you want to use the "LFtp_Hmi". Processes the data for HMI and controller. May have to be customized to your project. Contains the data structure of the "LFtp_DataHandlingHmi" block. Master copies The following table shows the components and blocks that you will find in the "Master copies" library folder: Table 2-9: "Master copies" folder Name Type Brief description LFtp_HmiDataExchange FB Optional. Required if you want to use the "LFtp_Hmi". Used for data exchange between HMI and controller. LFtp_Param DB Contains all the parameters necessary for interconnecting the "LFtp_Communication" block. LFtp_Hmi HMI Optional. Contains a fully configured HMI that can be used for control. FileDBs LFtp_ClientFile LFtp_ServerFile1 LFtp_ServerFile2 LFtp_ServerFile3 DB Optional. This folder contains the configured data blocks for the data transfer. The "LFtp_DataHandlingHmi" block and the HMI were configured with these blocks. Entry ID: , V3.0, 01/

13 2 Solution 2.4 Block overview "LFtp_Communication" function block The "LFtp_Communication" FTP function block combines the necessary steps for FTP communication in one block. This block contains a sequencer that controls the FTP communication process. To this end, the "LFtp_Communication" block uses the "FTP_CMD" instruction that provides all the FTP commands the CP can run. The job trigger reacts only to positive edges. The "LFtp_Communication" function block also contains an error handling feature. The following FTP commands can be run: NOOP (do not execute operation) CONNECT (establish encrypted or unencrypted connection) STORE (save data as file) RETRIEVE (retrieve data) DELETE (delete file) QUIT (disconnect) APPEND (attach data to file) RETRIEVE_PART (retrieve partial data) To be able to use the block, you must create at least two data blocks. One data block contains the connection parameters. One or more data blocks are required for the user data/transfer. The "FILE_DB_HEADER" UDT is used to build these data blocks. For more information about the UDT, use the TIA Portal help function. Note This library uses a shared data block ("LFtp_ClientFile" DB) for the receive data (RETRIEVE, RETRIEVE_PART) and the send data (SEND, APPEND). All available commands are controlled via "FTP_CMD". Entry ID: , V3.0, 01/

14 2 Solution 2.4 Block overview The block has the following parameter interfaces: Figure 2-6: FtpCommunication FtpCommunication Bool execute busy Bool USInt command done Bool FTP_CONNECT_IPV4 FTP_FILENAME FTP_FILENAME_PART error status connection Established connectparam filenameftp filenameftppart Bool Word Bool FTP_CONNECT_IPV4 FTP_FILENAME FTP_FILENAME_PART Table 2-10: FtpCommunication parameters Name P type Data type Description execute IN Bool Job triggered on positive edge. command IN USInt Specifies the FTP command: 0 = NOOP 1 = CONNECT 2 = STORE 3 = RETRIEVE 4 = DELETE 5 = QUIT 6 = APPEND 7 = RETRIEVE_PART. busy OUT Bool True while job active. done OUT Bool True if job successful. error OUT Bool True if job failed. status OUT Word Job status in hex code. connectionestablished OUT Bool Indicates whether a connection to the FTP server exists. True: Connection exists. Now files can be transferred. connectparam IN_OUT FTP_CONNECT_IPV4 Specifies connection parameters (CONNECT, QUIT).* filenameftp IN_OUT FTP_FILENAME Specifies connection parameters (STORE, APPEND, RETRIEVE, DELETE).* filenameftppart IN_OUT FTP_FILENAME_PART Specifies connection parameters (RETR_PART).* *) For more information about the UDTs, use the TIA Portal help function. Entry ID: , V3.0, 01/

15 2 Solution 2.4 Block overview The following table shows the HEX code of the "STATUS" output: Table 2-11: Status codes DONE BUSY ERROR STATUS Description X 0000 Job completed without errors. X 7001 Job triggered for the first time. X 7002 Job is being processed. X 9000 Watchdog timer has expired. Timeout while processing job. X 9001 Illegal command detected. The "command" parameter may contain only the following values: 0 = NOOP 1 = CONNECT 2 = STORE 3 = RETRIEVE 4 = DELETE 5 = QUIT 6 = APPEND 7 = RETRIEVE_PART. Depending on the "connectionestablished" parameter, the "CONNECT" and "QUIT" commands may also be illegal. X 8401 Unknown error: Timeout on connection FTP server terminates connection X 8402 Connection faulty. X 8418 Error in user data: File name empty. Data length: "0" X 8423 Connecting to FTP server failed. X 8424 Internal error X 8437 Certificate could not be verified. X 8460 A problem occurred during SSL/TLS handling. X 8480 There is a problem with the FTP client's certificate. X 8501 Verifying the FTP server's SSL certificate failed. X 8F56 NEW bit still set in file DB header X 8F55 LOCKED bit still set in file DB header Note For other status messages that are possible, refer to the TIA Portal Help. Entry ID: , V3.0, 01/

16 2 Solution 2.4 Block overview "LFtp_DataHandlingHmi" function block The function block prepares the data between the HMI and the controller. If you do not use the data blocks from the "FileDBs" folder, you must customize the block to your project "LFtp_Param" data block The "LFtp_Param" data block contains the parameters necessary for communication with the CP as the FTP client. Table 2-12: FtpParam Name Data type Description ConnectParam FTP_CONNECT_IPV4 System data type InterfaceId HW_ANY HW identifier of the CP in HW Config. ID CONN_OUC An ID that must be identical throughout the entire FTP communication. CertIndex Byte Specifies whether FTPS is used. 0 = FTP (unencrypted) >0: FTPS (index of the certificate to be used) UserName String[32] Enter a valid user name. Password String[32] Enter a valid password. FTPserverIPaddr IP_V4 Enter the IP address of the FTP server. Filename FTP_FILENAME System data type InterfaceId HW_ANY See ConnectParam. ID CONN_OUC See ConnectParam. CertIndex Byte See ConnectParam. DataBlockNumber UInt Specifies the storage DB of the data. LenFilename UInt Specifies the maximum length of the selectable file name. Filename Array[0..3] of String The file name is entered here. You can also create folder structures. FilenamePart FTP_FILENAME_ PART System data type InterfaceId HW_ANY See ConnectParam. ID CONN_OUC See ConnectParam. CertIndex Byte See ConnectParam. DataBlockNumber UInt See Filename. Offset DWord Specifies the byte following which the file will be read. Length DWord Specifies how many bytes are read following the "offset". LenFilename UInt See Filename. Entry ID: , V3.0, 01/

17 2 Solution 2.4 Block overview Name Data type Description Filename Array[0..3] of String See Filename. Execute Bool Used for interconnection with "LFtp_Communication" Command USInt Used for interconnection with "LFtp_Communication" Busy Bool Used for interconnection with "LFtp_Communication" Done Bool Used for interconnection with "LFtp_Communication" Error Bool Used for interconnection with "LFtp_Communication" Status Word Used for interconnection with "LFtp_Communication" connectionestablished Bool Used for interconnection with "LFtp_Communication" Note "InterfaceId" and "ID" (connection ID) must be identical for "Filename", "ConnectParam" and "FilenamePart". Instead of one shared send and receive data block, you can also use two separate data blocks and reference them at the appropriate locations. Entry ID: , V3.0, 01/

18 2 Solution 2.4 Block overview "LFtp_ClientFile" and "LFtp_ServerFileX" data blocks To use the data blocks for a transfer with FTP, the data blocks must have the following structure: Header with the "FILE_DB_HEADER" data type Data array with the "Array of Char" or "Array of Byte" data type The following table shows the parameters of the "FILE_DB_HEADER" data type. Table 2-13: FILE_DB_HEADER data structure Name Data type Comment Bit04 Bit15 Bool Reserved bits. EXIST Bool Specifies whether the contents of the data block contain valid data. LOCKED Bool Specifies whether the data block is locked. The DB contents are locked if the bit is set. NEW Bool Specifies that the data block has received new data. As long as the NEW bit is set, data cannot be written over the DB's current data. This data must be confirmed either manually or by the user program. WRITEACCESS Bool "TRUE": The FTP server has write access. "FALSE": The "FTP_CMD" instruction has write access. ACT_LENGTH DInt Specifies the current length of the data stored in the data block in bytes. MAX_LENGTH DInt Specifies the maximum length of the data allowed to be stored in the data block in bytes. FTP_REPLY_CODE Int Outputs the three-digit FTP "reply code". DATE_TIME DATE_ AND_TIME Each write updates the current date. Only valid if EXIST = 1. Entry ID: , V3.0, 01/

19 3 Principle of Operation 3.1 How "CP as FTP server" works 3 Principle of Operation This chapter shows how the server and client functionality works. 3.1 How "CP as FTP server" works The following figure shows the program flow when using the CP as the FTP server and the data transfer is unencrypted: Figure 3-1: 'CP as server' program flow Create file with previously defined name Enter connection data Enter on FTP client Fill file with data to be sent Only necessary when send to PLC is intended Yes Disconnect? No Check / allow connection to FTP server -> User management Data transfer Trigger on FTP client Process data / desired operation on server (LOCK;UNLOCK; CONFIRM) The controller operates as the FTP server. Data connections between the FTP client and the FTP server are established in order to transfer data. Data can be transferred either from the FTP server to the FTP client or from the FTP client to the FTP server. For the latter, memory areas can be created in the controller, where the data from the FTP client is stored. Alternatively, the data is stored in the memory and cannot be used in program execution. The data is sent from a PC (FTP client) to the CP (FTP server). The received data is stored in a DB. In the DB, the data can be locked (LOCKED=1) and unlocked (LOCKED=0); as a result, the FTP client cannot overwrite the data. The FTP server must also confirm that it received the data from the FTP client (NEW=0). Entry ID: , V3.0, 01/

20 3 Principle of Operation 3.2 How "CP as FTP client" works 3.2 How "CP as FTP client" works The following figure shows the program flow when using the CP as the FTP client and the data transfer is unencrypted: Figure 3-2: 'CP as client' program flow Enter connection data Enter file name Select operation Start Connect to FTP server FB: LFtp_Communication Start data transfer FB: LFtp_Communication Disconnect from FTP server FB: LFtp_Communication Output status The CP is used as the FTP client. Here, too, FTP connections are established. All commands provided by the "FTP_CMD" instruction can be run (for more information, refer to the TIA Portal Help "F1"). The FTP client accesses a root folder to execute the commands. In this way, generated process data can be transferred to an FTP server and stored in the FTP server's root directory under the specified file name. The data is then located on the FTP server in the form of files. Based on the file name, the user can select any file type. Any file type can be written/read. In addition, data can be requested from the root directory and stored in the selected DB on the controller. Note If a file with the entered file name already exists in the root directory, this file will be overwritten when the "STORE" command is used. Entry ID: , V3.0, 01/

21 4 Installation and Startup 4.1 Installing the software 4 Installation and Startup This chapter describes the steps necessary to install and start up the application example. 4.1 Installing the software Note It is recommended to run the latest versions of any installed software. FTP server software Table 4-1: Installing FileZilla Server No. Action Comment 1. Download an FTP server software product. Any FTP server software. This application uses FileZilla. 2. Install the FTP server software on your PC/PG. To do this, follow the program's instructions. FTP client software Table 4-2: Installing FileZilla Client No. Action Comment 1. Download an FTP client software product. Any FTP client software. This application uses FileZilla. 2. Install the FTP client software on your PC/PG. To do this, follow the program's instructions. TIA Portal with STEP 7 and WinCC Table 4-3: Installing TIA Portal and WinCC No. Action Comment 1. Install STEP 7 V15 on your PC/PG. To do this, follow the program's instructions. 2. Install WinCC V15 on your PC/PG. Optional (only when using an HMI): To do this, follow the program's instructions. Entry ID: , V3.0, 01/

22 4 Installation and Startup 4.2 Installing the hardware 4.2 Installing the hardware The following figure shows the minimum hardware configuration required for this application example. Figure 4-1: Minimum hardware configuration PM 70W S CP PG / PC with FTP server 24V 24V PROFINET IE Create a TIA Portal project with the following components: Any SIMATIC S PLC CP Optional: HMI If you are using an HMI, you must establish an HMI connection between the PLC and the HMI. Figure 4-2: Hardware configuration Connect the devices to each other and assign an IP address based on the following table: Entry ID: , V3.0, 01/

23 4 Installation and Startup 4.3 Integrating the "LFtp" library Table 4-4 Device IP address Subnet SIMATIC S PLC CP HMI PG/PC Integrating the "LFtp" library This chapter explains how to integrate the "LFtp" library into your project and use the blocks included in it. Table 4-5: Integrating the block library No. Action 1. Unzip the " _FTP_LIB_TIA_V30.zip" file to a directory of your choice. 2. Open your TIA V15 project. 3. Go to the "Libraries" task card and open the "Global libraries" palette. Click the "Open global library" icon and select the "LFtp.al15" library. Entry ID: , V3.0, 01/

24 4 Installation and Startup 4.3 Integrating the "LFtp" library No. Action 4. Use drag and drop to move the "LFtp_Communication" block from the "Types" folder to the "Program blocks" folder. If you want to use the "LFtp_Param" data block, drag it from the "Master copies" folder to the "Program blocks" folder. The blocks from the "FileDBs" folder and the "LFtp_DataHandlingHmi" and "LFtp_HmiDataHandling" blocks are optional and required only if you want to use the "LFtp_Hmi". Entry ID: , V3.0, 01/

25 4 Installation and Startup 4.3 Integrating the "LFtp" library No. Action 5. If you do not want to use the data blocks from the library, create global data blocks for the data exchange in your project. The data blocks must have the following data structure: Header with the "FILE_DB_HEADER" data type Data array with the "Array[X..Y] of Char" or "Array[X..Y] of Byte" data type Note: The size of the data array (here: "Data") must be specified in the "MAX_LENGTH" parameter. Entry ID: , V3.0, 01/

26 4 Installation and Startup 4.3 Integrating the "LFtp" library No. Action 6. Open the "Main" OB1 and in this OB, call the "LFtp_Communication" function block. Interconnect the block with the tags from the "LFtp_Param" DB. Entry ID: , V3.0, 01/

27 4 Installation and Startup 4.3 Integrating the "LFtp" library No. Action 7. Open the "LFtp_Param" data block. Enter valid data for the following parameters: ConnectParam InterfaceId ID ActiveEstablishement = true CertIndex UserName Password FTPserverIPaddr Filename InterfaceId ID ActiveEstablishement = true CertIndex DataBlockNumber Filename FilenamePart InterfaceId ID ActiveEstablishement = true CertIndex DataBlockNumber Filename Note: The following parameters must be identical: "InterfaceId", "ID" and "CertIndex". The "ActiveEstablishement" parameter must be "true". The parameters are checked by the "LFtp_Communication" block and modified if necessary. In this context, it is assumed that the "ConnectParam" structure contains the correct values. If FTPS is not used, the "CertIndex" parameter must have the value 0. If you intend to use FTPS, you must enter the name of the certificate used. 8. Compile the project and download it to your controller. Entry ID: , V3.0, 01/

28 4 Installation and Startup 4.3 Integrating the "LFtp" library Starting up the HMI If you want to use the HMI supplied with the "LFtp" library, perform the following steps: Table 4-6: Starting up the HMI No. Action 1. Open the "LFtp" block library and use drag and drop to move the HMI from the "Master copies" folder to your project. Drag the "LFtp_HmiDataExchange", "LFtp_DataHandlingHmi" blocks and the "FileDBs" folder and its included blocks to the "Program blocks" folder. 2. Open the "Main" OB1 and in a new network, call the "LFtp_DataHandlingHmi" function block. Note: This function block accesses global data blocks. If necessary, change the block names or the "LFtp_DataHandlingHmi" block. 3. Go to the "Network view" and connect the HMI to your PLC. Then assign a valid IP address. Entry ID: , V3.0, 01/

29 4 Installation and Startup 4.3 Integrating the "LFtp" library No. Action 4. Establish an "HMI connection" between the HMI and your PLC. 5. Open the HMI's "ApplicationTags" tag table. Customize the tags to your project. 6. Compile and download the project. Compile the HMI and start the download process. Note: You can also use the simulation. Entry ID: , V3.0, 01/

30 4 Installation and Startup 4.4 Basic FTP configuration 4.4 Basic FTP configuration The general procedure is valid for unencrypted (FTP) and encrypted (FTPS) communication General setup of the FTP server functionality To use the CP as an FTP server, you must perform the following steps. Table 4-7: Setting up the CP as an FTP server No. Action 1. Protect your TIA project by activating the global security settings: In the project tree, go to "Security settings > Settings". 2. Then select the "Users and roles" folder. To allow access via an FTP client, it must log in to the CP. To do this, create a new user with the "NET Standard" role. Example: User name: ftp_user Password: ftp_user Note: The password must comply with the password policy. Entry ID: , V3.0, 01/

31 4 Installation and Startup 4.4 Basic FTP configuration No. Action 3. Go to the hardware configuration. To enable the FTP client to store files in the PLC memory (e.g., in data blocks), you must allow access with Put/Get. In the PLC S7-1500, "Protection" area navigation, go to "Connection mechanisms" and check the "Permit access with PUT/GET communication from remote partner" check box. Entry ID: , V3.0, 01/

32 4 Installation and Startup 4.4 Basic FTP configuration No. Action 4. In the CP properties, "Security" area navigation, check the "Activate security features" check box. Entry ID: , V3.0, 01/

33 4 Installation and Startup 4.4 Basic FTP configuration No. Action 5. In the CP properties, go to "Security > FTP server configuration" and make the following settings: Check the "Activate FTP server" check box. Check the "Use FTP server for S7 PLC data" check box. Now the files are not stored in the CP's file system, but in the DBs of the PLC. In the "Data block assignment" area, select the PLC, assign a DB to it and assign a file name to the DB. 6. Download the hardware configuration to the PLC. On the FTP client (PG/PC), create the files with the file name you previously assigned to the respective DBs on the FTP server. Note The user data entered here is used to log in to this controller (also by the FTP client) General procedure for setting up the FTP client functionality The FTP client functionality is implemented with the aid of the "FTP_CMD" instruction. The "FtpCommunication" function block provides you with the interconnection and handling of the FTP commands. You can use the "FtpParam" data block for interconnection. Both blocks are included in the "LFtp" library. Entry ID: , V3.0, 01/

34 4 Installation and Startup 4.5 Advanced configuration for FTPS (FTP over TLS) 4.5 Advanced configuration for FTPS (FTP over TLS) Setting up the FTPS server functionality To establish data transfer via FTPS, a certificate must be exchanged between server and client. If the CP is used as an FTPS server, a certificate is sent to the FTPS client. For FTPS communication to take place, this certificate must be classified as trusted. Table 4-8: Setting up the CP as the FTP server No. Action/screenshot/note 1. In the CP properties, go to "Security > FTP server configuration". Check the "Allow access only using FTPS" check box. 2. Download the hardware configuration to the PLC. Entry ID: , V3.0, 01/

35 4 Installation and Startup 4.5 Advanced configuration for FTPS (FTP over TLS) Setting up the FTPS client functionality To establish data transfer via FTPS, a certificate must be exchanged between server and client. If the CP is used as an FTPS client, the certificate must be exchanged manually. The following table shows one option of exchanging the certificate: A certificate for the FTPS server is generated in TIA Portal and exported together with the certificate authority (CA). These certificates are then prepared for the server and imported. Note FileZilla does not support the use of certificates in PKCS# 12 format ("*.p12" or "*.pfx"). As a result, the certificate must be converted with the aid of OpenSSL. For a free download, see \3\. Alternatively, you can use the "XCA" software. Table 4-9: Certificate exchange No. Action 1. Go to the S hardware configuration and select the CP. Open the CP's certificate manager and create a new device certificate. Entry ID: , V3.0, 01/

36 4 Installation and Startup 4.5 Advanced configuration for FTPS (FTP over TLS) No. Action 2. Generate a new device certificate. 3. In "Signed by certificate authority", select the CA that has already been specified for the existing certificate. Then enter the FTPS server's name and IP address and click "OK" Entry ID: , V3.0, 01/

37 4 Installation and Startup 4.5 Advanced configuration for FTPS (FTP over TLS) No. Action 4. Go to the global certificate manager. 5. Select the "Device certificates" tab and click "Export". 6. Save the certificate as a "PKCS12 chain archive certificate and private key (*.p12)". Assign a password. Entry ID: , V3.0, 01/

38 4 Installation and Startup 4.5 Advanced configuration for FTPS (FTP over TLS) No. Action 7. Certificates exported from TIA Portal are not in plain text. As a result, the certificate file contents cannot be read by FileZilla Server. The certificate must therefore be edited with the aid of OpenSSL. If you are using a different FTP server, steps 8 and 9 may not be necessary. Import the certificate to your FTP server. Start the "openssl.exe" file as an administrator. By default, this file is installed in the following path: "C:\Program Files\OpenSSL-Win64\bin". 8. Enter the following command: pkcs12 in "file_name.p12" out "file_name.crt" nodes Note: If the file is not in the same folder as the "openssl.exe" file, you must enter the full file path. Enter the password you assigned in step 6. Entry ID: , V3.0, 01/

39 4 Installation and Startup 4.5 Advanced configuration for FTPS (FTP over TLS) No. Action 9. Now start "FileZilla Server Interface". Open the settings and go to the "FTP over TLS settings" menu item. Check the "Enable FTP or TLS support (FTPS)" check box. In "Private key file" and "Certificate file", select the customized certificate with the ".crt" file extension. Check "Allow explicit FTP over TLS". Click "OK" to confirm the settings you made. Entry ID: , V3.0, 01/

40 4 Installation and Startup 4.6 Starting up FileZilla Client and FileZilla Server 4.6 Starting up FileZilla Client and FileZilla Server NOTICE When assigning the IP addresses of your devices, make sure that all of them are in the same subnet and each IP address is assigned only once throughout the subnet FileZilla FTP Server Note The following table shows how to start up FileZilla FTP Server. If you are using different FTP server software, follow the startup information provided in the appropriate manual. It is important to create a user with password and full access to the files in the user's root directory. Table 4-10: Setting up FileZilla Server No. Action Screenshot 1. Start FileZilla Server Interface on your FTP server and click "OK". You are now logged in to the server interface. It allows you to track all of the actions on the FTP server and make all settings. 2. In the menu bar, click "Edit" and then select "Settings" to go to the server settings. Here you can make all your settings. For this application example, you can use the default settings. Select "OK" to confirm. Entry ID: , V3.0, 01/

41 4 Installation and Startup 4.6 Starting up FileZilla Client and FileZilla Server No. Action Screenshot 3. In the menu bar, click "Edit" and then select "Users" to go to user management. Select "General" and click "Add". In the field, enter an FTP user name, for example, "ftp_user". Select "OK" to confirm. 4. Check the "Password" check box and in the field next to it, enter the password, for example, "ftp_user". Select "OK" to confirm. Select "OK" to confirm the following message. 5. Select "Shared folders" and in the "Shared folders" section, click "Add". In Explorer that is now open, navigate to the folder you want to use as the FTP root directory for the created user. Select the folder (e.g., a previously created folder: "FTP_Root") and click "OK" to confirm. Check the following check boxes: "Read", "Write", "Delete" and "Append". In the "Shared folders" section, click "Set as home dir" to make the folder the Home directory. Select "OK" to confirm. Entry ID: , V3.0, 01/

42 4 Installation and Startup 4.6 Starting up FileZilla Client and FileZilla Server No. Action Screenshot 6. Make sure that the FTP server is online: The icon must be active. Now you have created an FTP user with password, root directory and all of the privileges. The FTP server is now ready for the application example and for processing user requests FileZilla FTP Client After installation, the FileZilla FTP Client default settings can be left unchanged and used for the library block. Note The files you have already defined on the controller must be created on the FTP client you are using. To log in to the CP's FTP server, you need a user with the "NET Standard" privileges. Entry ID: , V3.0, 01/

43 5 Operation 5.1 Menu prompts when using the HMI 5 Operation The block can be controlled using the program. For better visualization, you can use the supplied HMI. 5.1 Menu prompts when using the HMI The entire application example can be controlled using the appropriate operating screens. The navigation bar allows you to toggle between the operating screens. Figure 5-1: HMI operating screens overview Entry ID: , V3.0, 01/

44 5 Operation 5.2 Controlling "CP as FTP server" 5.2 Controlling "CP as FTP server" Only the received data (locked, unlocked, confirmed) can be managed on the HMI user interface. The HMI also displays the contents of the files. The FTP client sends data to or requests data from the FTP server. The data transfer is controlled by the FTP client (in this case: FileZilla FTP Client). Controlling data transfer with FileZilla FTP Client Note Before you can start the data transfer from the FTP client to the FTP server, the files must be created on the client (PG/PC). These files must have the same names as the ones assigned to the DBs for data transfer. For the files, you can choose any storage location on the FTP client. Table 5-1: Data transfer with CP as server No. Action Screenshot / note 1. Start FileZilla Client. 2. In the input fields, enter the FTP server's IP address, the user name and the associated password you previously created on the CP. Click "Quickconnect". The files created in the hardware configuration of the S PLC reserved for the data transfer are now available on the controller side. Note: If you are using FTPS, you must confirm the server certificate. Entry ID: , V3.0, 01/

45 5 Operation 5.2 Controlling "CP as FTP server" No. Action Screenshot / note 3. To trigger a data transfer, drag the previously created FTP client file to the FTP server file or vice versa. The upper text window now displays the required commands. Successful and failed data transfers since the start of the session are stored in the log. Entry ID: , V3.0, 01/

46 5 Operation 5.2 Controlling "CP as FTP server" No. Action Screenshot / note 4. Confirm that you want to transfer the data. 5. To resend data, first confirm the new data using the HMI or reset the "NEW" parameter in the "FILE_DB_HEADER" of the data block required for the transfer. When controlling with the HMI: Entry ID: , V3.0, 01/

47 5 Operation 5.3 Controlling "CP as FTP client" 5.3 Controlling "CP as FTP client" Controlling data transfer with HMI Note You can control the "CP as FTP client" scenario using the HMI. Via the FTP server, the executions can merely be monitored. Make sure that the FTP server has started: The figure below shows a screenshot after running the "RETRIEVE_PART" command. The received data ("Receiving Data") shows that only a part was requested and received. Figure 5-2: "CP as client" operating screen Entry ID: , V3.0, 01/

48 5 Operation 5.3 Controlling "CP as FTP client" Table 5-2: Controlling "CP as client" with HMI No. Action Comment 1. Enter the user name and the associated password for the FTP user created in the FTP server. 2. Enter the IP address of the FTP server in the fields. 3. Select the FTP command you want to use. NOOP, CONNECT, STORE, RETRIEVE, DELETE, QUIT, APPEND, RETRIEVE_PART a. If you choose the "CONNECT" command, you must specify whether you want to use FTPS. If this is the case, enter the ID of the certificate used. You will find this ID in the CP's certificate manager. b. If you choose the "RETRIEVE_PART" command, you must specify the offset and length. 4. Enter the file name of the file to be used for the desired data transfer. STORE/APPEND: If the selected file does not yet exist, it will be generated on the FTP server. RETRIEVE/RETRIEVE_PART: If the file does not exist, an error message will be output. 5. Confirm the received files. Only required for RETRIEVE_PART and RETRIEVE. 6. Use the "Execute" button to start the data transfer. Selecting the button "inverts" the stored tag. 7. Status display Connection Established = Connection to the FTP server exists. Done = Last command was executed successfully. Busy = Last command is still being executed. Error = An error occurred during the last command. Status = Transfer status with text display. Entry ID: , V3.0, 01/

49 5 Operation 5.3 Controlling "CP as FTP client" Control without HMI If you control the scenario without the HMI, all the parameters in the "LFtp_Param" data block must have been entered correctly. Table 5-3: Controlling "CP as client" without HMI No. Action Comment 1. Select your desired command at the "command" input. 2. Set the "execute" input to "true" to start FTP communication. 3. While FTP communication is active, the "busy" output is "true". 4. If FTP communication has successfully completed, the "done" output is set to "true". 5. A new FTP communication process can be started. Scan for positive edge. Data can only be transferred when the "ConnectionEstablished" output = "true". The "CONNECT" is required before the transfer. If not, "done" = "false" and "error" = "true". The occurred error is specified at the "status" output (see Chapter 2.4.1). Note A new FTP communication process can be started even after an error has occurred. This is due to the fact that after some errors, a new communication process helps resolve the error. In any case, check the status code. Entry ID: , V3.0, 01/

50 6 Valuable Information 5.3 Controlling "CP as FTP client" 6 Valuable Information FTP general FTP was developed to exchange data between a client and a server. Furthermore, it is designed for managing directories through remote access. In the world of automation, FTP is a useful protocol to easily exchange data. For the data transfer using FTP, two connections are established: One control connection One data connection Once the control connection has been established, the data connection can be established. FTP communication has two modes: Active FTP Passive FTP Note In both modes, the client opens the control connection. The difference between active and passive FTP is defined by the FTP server and the server behavior in terms of the data connection. Active FTP: The server actively opens the data connection. Passive FTP: The server is passive and the client establishes both connections (control and data connection). It also provides the option to exchange data in an encrypted form using: FTPS SFTP Note Not every FTP server supports both options. Before you use an FTP server, check which modes the server supports. If you are using FTPS, you can use the CP Active FTP In this mode, the FTP client opens a random port (>1023) and sends this port and its own IP address to the FTP server using a special command (PORT or EPRT). By default, the command is sent to port 21 of the FTP server. Port 21 must be open or forwarded in the server's firewall; otherwise, no communication will be established. When data transfer is requested, the FTP server initiates a data connection to the sent IP address and FTP server port 20. Active mode is used when the FTP server is located behind a firewall as the data connection is initiated externally from the FTP server and therefore not blocked by the firewall. Hence, the FTP server acts actively. The figure below uses the example of the RETRIEVE command to illustrate active FTP communication. Entry ID: , V3.0, 01/