//
//  Licensed to the Apache Software Foundation (ASF) under one or more
//  contributor license agreements.  See the NOTICE file distributed with
//  this work for additional information regarding copyright ownership.
//  The ASF licenses this file to You under the Apache License, Version 2.0
//  (the "License"); you may not use this file except in compliance with
//  the License.  You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
//  Unless required by applicable law or agreed to in writing, software
//  distributed under the License is distributed on an "AS IS" BASIS,
//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//  See the License for the specific language governing permissions and
//  limitations under the License.
//
:imagesdir: ../../images/

== S7 Communication

When communicating with S7 Devices there is a whole family of protocols, that can be used.
In general you can divide them into `Profinet` protocols and `S7 Comm` protocols.
The later are far simpler in structure, but also far less documented.
The `S7 Comm` protocols are generally split up into two flavours: The classic `S7 Comm` and a newer version unofficially called `S7 Comm Plus`.

=== Overview of the Protocols

[ditaa,protocols-s7-osi]
....
                    :                                                       :             : implemented               :
                    :                                                       :             :      |                    :
                    :                       Profinet                        :             :      | S7 Protocol        :
                    :                                                       :             :      V                    :
- - - - - - - - - - +-------------+-------------+-------------+-------------+-------------+-------------+-------------+ - -
                    |c0B0         |c0B0         |c0B0         |c0B0         |c05A         |c0BA         |c0BA         |
 Application        |             |             |             |             |             |             |             |
 Layer              |             |             |             |             |             |             |             |
                    |             |             |             |             |             |             |             |
                    | Profinet IO | Profinet IO | Profinet CBA| Profinet CBA|             |             |             |
- - - - - - - - - - |   RT / IRT  |             |             |      RT     |             |             |             | - -
                    |             |             |             |             |             |             |             |
 Presentation       |             |             |             |             |             |             |             |
 Layer              |             |             |             |             |     S7      |     S7      |     S7      |
                    |             |             |             |             |    Comm     |    Comm     |    Comm     |
                    |             |             |             |             |    Plus     |             |             |
- - - - - - - - - - |             +-------------+-------------+             |             |             |             | - -
                    |             |cAAA         |cAAA         |             |             |             |             |
 Session            |             |             |             |             |             |             |             |
 Layer              |             |     RPC     |    DCOM     |             |             |             |             |
                    |             |             |             |             |             |             |             |
                    |             |             |             |             |             |             |             |
- - - - - - - - - - |             +-------------+-------------+             +-------------+-------------+-------------+ - -
                    |             |cAAA         |cAAA         |             |cF6F                                     |
                    |             |             |             |             |         ISO Transport Protocol          |
                    |             |             |             |             |                 RFC 905                 |
                    |             |             |             |             | (Class 0)                               |
                    |             |             |             |             +---------------------------+             |
                    |             |             |             |             |cFF6                       |             |
 Transport          |             |             |             |             | ISO on TCP                |             |
 Layer              |             |     UDP     |     TCP     |             |  RFC 1006                 |             |
                    |             |             |             |             +---------------------------+             |
                    |             |             |             |             |cAAA                       |             |
                    |             |             |             |             |     TCP                   |             |
                    |             |             |             |             |                           |     ISO     |
- - - - - - - - - - |             +-------------+-------------+             +---------------------------+   Transport | - -
                    |             | cAAA                      |             |cAAA                       |   Protocol  |
 Network            |             |                           |             |                           |   RFC 905   |
 Layer              |             |            IP             |             |     IP                    |   (Class 4) |
                    |             |                           |             |                           |             |
                    |             |                           |             |                           |             |
- - - - - - - - - - +-------------+---------------------------+-------------+---------------------------+-------------+ - -
                    |cAAA                                                                                             |
 Data Link          |                                                                                                 |
 Layer              |                                                                                                 |
                    |                                                                                                 |
                    |                       Industrial                                                                |
- - - - - - - - - - |                        Ethernet                                                                 | - -
                    |                                                                                                 |
 Physical           |                                                                                                 |
 Layer              |                                                                                                 |
                    |                                                                                                 |
                    |                                                                                                 |
- - - - - - - - - - +-------------------------------------------------------------------------------------------------+ - -
....

=== Protocol Descriptions

|===
|Name |ISO |RFC |Link
|Transmission Control Protocol (TCP) |- | RFC 793 |https://tools.ietf.org/html/rfc793
|ISO on TCP |- | RFC 1006| https://tools.ietf.org/html/rfc1006
|ISO Transport Protocol (Class 4) |ISO DP 8073 | RFC 905 |https://tools.ietf.org/html/rfc905
|S7 Comm (0x32) |- |- |http://gmiru.com/article/s7comm/ http://gmiru.com/article/s7comm-part2/ https://www.eng.tau.ac.il/~yash/jdsfl2014.pdf
|S7 Comm Plus (0x72) |- |- |(Information seems to be invalid or incorrect however) https://opensource-security.de/thesis/MA_Maik_Brueggemann.pdf
|RPC |- | RFC 1057 & RFC 5531 |https://tools.ietf.org/html/rfc1057 https://tools.ietf.org/html/rfc5531
|DCOM |- |- | https://msdn.microsoft.com/library/cc201989.aspx
|===

=== Interaction with an S7 PLC

Currently we are concentrating on implementing the TCP-based variants of the `S7 Comm` and `S7 Comm Plus` protocols.
Both are transferred using `ISO TP` which is wrapped by `ISO on TCP`.
Both protocols require establishing a connection on the `ISO TP` level first.
After the `ISO TP` connection is established, the higher level protocols then establish their connections.
These are then handled by the individual protocol sub-pages:

- link:s7comm.html[S7 Comm (0x32)]
- link:s7comm-plus.html[S7 Comm Plus (0x72)]

The hex-value behind each of these correlates to the first byte used in the protocols messages to indicate the type of protocol.

[seqdiag,s7-interaction]
....
{
    === Connect ===

    Client -> "ISO TP" [label = "Connection Request"]
    Client <- "ISO TP" [label = "Connection Response"]

    === Higher Level Connect ===

    === Higher Level Communication ===

    === Disconnect ===

    Client -> "ISO TP" [label = "Disconnect Request"]

}
....

=== ISO TP Message Types

Even if `ISO TP` defines more types of messages, the ones required for `S7 Comm` or `S7 Comm Plus` are only the following.
Each message is called a `TPDU` (Transport Protocol Data Unit):

- Connection Request TPDU
- Connection Response TPDU
- Data TPDU
- Disconnect Request TPDU

Notice: There is no `Disconnect Response` in `ISO TP: Class 0`.

==== Connection Request TPDU

// len (length of bits - use instead of explicit byte count - requires "*" as first element)
// label
// color / background
// linecolor
// rotate (degrees)
// colheight
// height
// numbered
// label_orientation (vertical, horizontal)
// stacked (no value)
// icon
// shape (box, circle, ...)
[packetdiag,s7-connect-request,svg]
....
{
    colwidth = 32

    // ISO on TCP
    * ISO on TCP Magic Number (0x03) [len = 8, color = "#068D9D"]
    * Reserved (0x00) [len = 8, color = "#068D9D"]
    * Packet Length (including ISO on TCP header) [len = 16, color = "#068D9D"]

    // ISO Transport Protocol
    * ISO TP Header Length\n(excluding length byte) [len = 8, color = "#53599A"]
    * TPDU-Code\n(CR = 0xE0) [len = 4, color = "#AEECEF"]
    * Signal CDT\n(0x00) [len = 4, color = "#53599A"]
    // ISO TP Header (Fixed Part)
    * Destination Reference [len = 16, color = "#53599A"]
    * Source Reference [len = 16, color = "#53599A"]
    * Protocol Class\n(Class 0 = 0x00) [len = 8, color = "#53599A"]

    // ISO TP Header (Variable Part / Parameters)
    * Parameter Code\n(TPDU Size = 0xC0) [len = 8, color = "#53599A"]
    * Parameter Length\n(1 = 0x01) [len = 8, color = "#53599A"]
    * Parameter Value\n(TPDU Size 1024 = 0x0A) [len = 8, color = "#53599A"]

    * Parameter Code\n(Calling TSAP = 0xC1) [len = 8, color = "#53599A"]
    * Parameter Length (2 = 0x02) [len = 8, color = "#53599A"]
    * Device Group\n(PG/PC = 0x01) [len = 8, color = "#53599A"]
    * TSAP Id (0x00) [len = 8, color = "#53599A"]

    * Parameter Code\n(Called TSAP = 0xC2) [len = 8, color = "#53599A"]
    * Parameter Length (2 = 0x02) [len = 8, color = "#53599A"]
    * Device Group\n(Others = 0x03) [len = 8, color = "#53599A"]
    * Rack Number[len = 4, color = "#80DED9"]
    * Slot Number[len = 4, color = "#80DED9"]
}
....

Legend:

- [protocolIsoOnTcp]#ISO on TCP Packet Header#
- [protocolIsoTP]#ISO Transport Protocol Packet Header#
- [protocolId]#Part of the packet that identifies the type of request#
- [protocolParameter]#Variable Parts of the ISO Transport Protocol Packet Header#

==== Connection Response TPDU

The `Connection Response` is identical to the `Connection Request` with the only difference that the `TPDU-Code` has a code of `0xD0`.

==== Data TPDU

// len (length of bits - use instead of explicit byte count - requires "*" as first element)
// label
// color / background
// linecolor
// rotate (degrees)
// colheight
// height
// numbered
// label_orientation (vertical, horizontal)
// stacked (no value)
// icon
// shape (box, circle, ...)
[packetdiag,s7-data,svg]
....
{
    colwidth = 32

    // ISO on TCP
    * ISO on TCP Magic Number (0x03) [len = 8, color = "#068D9D"]
    * Reserved (0x00) [len = 8, color = "#068D9D"]
    * Packet Length (including ISO on TCP header) [len = 16, color = "#068D9D"]

    // ISO Transport Protocol
    * ISO TP Header Length\n(excluding length byte) [len = 8, color = "#53599A"]
    * TPDU-Code\n(DATA = 0xF0) [len = 4, color = "#AEECEF"]
    * Signal CDT\n(0x00) [len = 4, color = "#53599A"]
    * TPDU-NR/EOT [len = 8, color = "#53599A"]

}
....

Legend:

- [protocolIsoOnTcp]#ISO on TCP Packet Header#
- [protocolIsoTP]#ISO Transport Protocol Packet Header#
- [protocolId]#Part of the packet that identifies the type of request#

==== Disconnect Request TPDU

// len (length of bits - use instead of explicit byte count - requires "*" as first element)
// label
// color / background
// linecolor
// rotate (degrees)
// colheight
// height
// numbered
// label_orientation (vertical, horizontal)
// stacked (no value)
// icon
// shape (box, circle, ...)
[packetdiag,s7-disconnect-request,svg]
....
{
    colwidth = 32

    // ISO on TCP
    * ISO on TCP Magic Number (0x03) [len = 8, color = "#068D9D"]
    * Reserved (0x00) [len = 8, color = "#068D9D"]
    * Packet Length (including ISO on TCP header) [len = 16, color = "#068D9D"]

    // ISO Transport Protocol
    * ISO TP Header Length\n(excluding length byte) [len = 8, color = "#53599A"]
    * TPDU-Code\n(DR = 0x80) [len = 4, color = "#AEECEF"]
    * Signal CDT\n(0x00) [len = 4, color = "#53599A"]
    * Destination Reference [len = 16, color = "#53599A"]
    * Source Reference [len = 16, color = "#53599A"]
    * Reason [len = 8, color = "#53599A"]

    // ISO TP Header (Variable Part / Parameters) (Optional)
    * Parameter Code\n(Disconnect Additional Information = 0xE0) [len = 8, color = "#53599A"]
    * Parameter Length\n(1 ... 128) [len = 8, color = "#53599A"]
    * Parameter Data\n(Custom user data) [len = 24, color = "#53599A"]

}
....

Legend:

- [protocolIsoOnTcp]#ISO on TCP Packet Header#
- [protocolIsoTP]#ISO Transport Protocol Packet Header#
- [protocolId]#Part of the packet that identifies the type of request#
- [protocolParameter]#Variable Parts of the ISO Transport Protocol Packet Header#
