Accessing data on a Simatic S7-1200/1500 using Python
Accessing data securely by configuring the integrated OPC UA Server
read in your web browser
www.spektrum-engineering.de Spektrum Engineering 1
TOC
1. Enabling and setting up OPC UA in TIA Project
a) Setting up security mechanisms based on X.509 certificates to enable authentication and encryption in TIA Portal
b) Setting up general PLC security mechanisms
2. Installing python-opcua and opcua-client using pip (on Windows)
a) Install clients and test installation
b) Create client certificate in TIA Portal for Python client
3. Accessing data on the SIMATIC S7-1200/S7-1500
www.spektrum-engineering.de Spektrum Engineering 2
PLC Configuration in TIA Portal
www.spektrum-engineering.de Spektrum Engineering 3
Network Topology
TCP/IP Ethernet
OPC UA Client (Python): OPC UA Server:
IP Adresse: xxx.xxx.xxx.xxx IP Adresse: xxx.xxx.xxx.xxx
www.spektrum-engineering.de Spektrum Engineering 4
Enable OPC UA Server in TIA Project
Purchase OPC UA License from
Siemens Industry Mall and
activate it in your TIA project
www.spektrum-engineering.de Spektrum Engineering 5
Enable OPC UA Server in TIA Project
Activate OPC UA Server for
selected PLC in Device
Configuration.
Make sure to follow security
setup instructions on the
following slides to avoid
unrestricted OPC UA access!
www.spektrum-engineering.de Spektrum Engineering 6
Enable OPC UA Server in TIA Project
…user management via project
security settings is available only
in case the entire project is
protected!
→ protect your TIA project
www.spektrum-engineering.de Spektrum Engineering 7
Setting up OPC UA security mechanisms
Protect entire project to enable advanced
security mechanisms such as:
- project-wide user administration
- project-wide certificate manager
Defining project-wide security settings has the advantage,
that you can administer security settings globally for
multiple PLCs in your project.
In addition, when accessing your PLCs remotely using OPC
UA, it is more comfortable/securer to maintain your
certificates and users project-wide for all PLCs instead of
individually for every single PLC.
www.spektrum-engineering.de Spektrum Engineering 8
Setting up OPC UA security mechanisms
Mutual Authentication
TCP/IP Ethernet
OPC UA Client (Python): OPC UA Server:
IP Adresse: xxx.xxx.xxx.xxx IP Adresse: xxx.xxx.xxx.xxx
www.spektrum-engineering.de Spektrum Engineering 9
Client presents its certificate to Server needs to „know“ the client‘s certificate and has to
server have it marked as „trusted“ to accept the connection request.
TCP/IP Ethernet
Client needs to „know“ the server‘s certificate and has to have it Server presents its certificate to
marked as „trusted“ to accept the connection request. the server.
Setting up OPC UA security mechanisms
Enable project wide certificate manager for
selected PLC
→ All PLC-specific certificates will be lost!
(may cause trouble with OPC UA clients if your PLCs are currently used
in existing environments)
www.spektrum-engineering.de Spektrum Engineering 12
Setting up OPC UA security mechanisms
Server Certificate
In the PLC specific certificate manager create a new
certificate for the OPC Server!
(This creates a key pair)
For the Certificate Authority (CA) select one of the
suggested above (alternatively import your CA in the global
certificate manager, which is not part of this slide deck)
www.spektrum-engineering.de Spektrum Engineering 13
Setting up OPC UA security mechanisms
Server Certificate
Device specific certificate manager,
showing recently created certificate
→ Same certificate will be shown in
project wide certificate manager
www.spektrum-engineering.de Spektrum Engineering 14
Setting up OPC UA security mechanisms
Server Certificate
Global certificate manager showing
recently generated certificate
www.spektrum-engineering.de Spektrum Engineering 15
Setting up OPC UA security mechanisms
Server Certificate
Add created certificate to OPC UA server
settings
www.spektrum-engineering.de Spektrum Engineering 16
Setting up OPC UA security mechanisms
Server Certificate
Configure supported authentication and
encryption schemes the PLC should
support!
Disable “No security” to enforce
cryptographic client authentication and
encrypted communication!
www.spektrum-engineering.de Spektrum Engineering 17
Setting up OPC UA security mechanisms
Disable “Enable guest authentication” to
avoid anonymous access by anyone
without username and password!
Enable “Enable username and password
authentication”, define a username and
password which will be granted access to
the OPC UA Server
www.spektrum-engineering.de Spektrum Engineering 18
Setting up general PLC security mechanisms
Using OPC UA server means connecting
the PLC to a network at the same time.
Therefore, disable unprotected access to
the PLC in any case by disabling
anonymous access without username and
password. Especially for Online Access,
Programming Access and for HMI Access,
as well!
www.spektrum-engineering.de Spektrum Engineering 19
Setting up general PLC security mechanisms
Set a password for your PLC display when
“Enable write access” is activated (S7-
1500)!
www.spektrum-engineering.de Spektrum Engineering 20
Installing OPC UA Python client
www.spektrum-engineering.de Spektrum Engineering 21
Installing OPC UA Python library into a virtualenv
Create a python virtualenv and install opcua, opcua-client and PyQt5 into using pip:
• pip install opcua opcua-client PyQt5
opcua – client library – https://github.com/FreeOpcUa/python-opcua
opcua-client – demo application – https://github.com/FreeOpcUa/opcua-client-gui
PyQt5 – GUI framework required by opcua-client – https://pypi.org/project/PyQt5/
www.spektrum-engineering.de Spektrum Engineering 22
Installing OPC UA Python library into a virtualenv
Install optional libraries to support cryptographic schemes which we have set up in TIA project:
pip install crypto cryptography
www.spektrum-engineering.de Spektrum Engineering 23
Installing OPC UA Python library into a virtualenv
Install optional libraries to get full benefit using the opcua-client application
pip install pyqtgraph numpy
www.spektrum-engineering.de Spektrum Engineering 24
Installing OPC UA Python library into a virtualenv
Test your installation by starting the demo application from within your virtualenv: opcua-client
www.spektrum-engineering.de Spektrum Engineering 25
Create client certificate for Python in TIA Portal
Create second certificate for
client (this creates a key pair)
Use same CA for server and
client certificate!
In the field Subject Alternative Name, set
the string as seen on the left. This is
required by the OPC UA Python client
library which we will use later in the
project!
www.spektrum-engineering.de Spektrum Engineering 26
Create client certificate for Python in TIA Portal
In the global certificate manager, the newly
created client certificate is shown. Export the
certificate (in der format – seen on this slide)
and the belonging private key (in pem format –
seen on next slide). Export by secondary-click
on the certificate. This key-pair will be used to
authenticate the client to the server.
www.spektrum-engineering.de Spektrum Engineering 27
Create client certificate for Python in TIA Portal
Now export the private key and include the
certificate chain. We will be using this certificate
in our client application – which might run
unattended – therefore we will not protect the
private key with a password!
www.spektrum-engineering.de Spektrum Engineering 28
Limit access to clients on PLC
The PLC permits access to clients which provide
the recently created client certificate.
Add this certificate to the PLC “Trusted clients”
and disable “Automatically accept client
certificates during runtime” to prevent clients
from connecting which do not present a proper
certificate to the PLC.
Download the project to the PLC and set it to
Run Mode.
www.spektrum-engineering.de Spektrum Engineering 29
Connect to PLC using Python Client Library
Start the OPC UA Python client as described before.
In the address field type the URL in the following
format:
opc.tcp://<username>:<password>@<ip-address>:<port>
For example:
opc.tcp://OPCUser01:
[email protected]:4840
Click on “Connect options” and then on “Query
server capability” to get recommended connection
properties.
Set your client certificate and client private key!
www.spektrum-engineering.de Spektrum Engineering 30
Connect to PLC using Python Client Library
Close the “Connection Dialog” and click on
“Connect”.
You’ll be presented with the OPC UA XML tree
served by your SIMATIC PLC!
You can read/write only these variables/tags you
have granted access to in TIA portal!
www.spektrum-engineering.de Spektrum Engineering 31
Browse data blocks on PLC
You can access only the variables/tags you have allowed access to in TIA portal!
www.spektrum-engineering.de Spektrum Engineering 32
Spektrum Ingenieurgesellschaft mbH read in your web browser
Web: https://siincos-remote-connect.de
Mail: [email protected]
linkedin.com/company/siincos/
instagram.com/spektrum.engineering/
www.spektrum-engineering.de Spektrum Engineering 33
