Detailed explanation of PLC program encryption and decryption methods

Everyone knows that many brands of PLC programs can be decrypted by software. Once decrypted, the program will be displayed in the eyes of others very transparently, and it is impractical to sell the equipment to others and lock the entire PLC program. Party A will not be able to maintain it; confidentiality and rights protection are even more enduring topics in the Chinese market. In fact, German engineers never encrypt their own programs as a whole, but use other methods, which will not affect the diagnosis in the event of a failure, but also You can protect your core secrets. Today I will introduce you to these methods for your reference.

1. Use Siemens Safety PLC or Portal's KNOWHOW function

As a product of Siemens' main safety function, Siemens safety PLC has no doubt about its performance, and the program blocks of safety PLC cannot be cracked after being encrypted; it can protect the core well. As the latest product of Siemens, Portal PLC, its copyright protection is also one of its main functions. The KNOWHOW function is double encryption of software and hardware. Unencrypted blocks can be monitored normally. Without a password, it cannot even be downloaded to other PLCs; therefore, use the blog. The KNOWHOW function of Tuo can not only hand over the program to Party A for convenient maintenance, but also protect its core program from being stolen.

2. Use high-level language to write some important process programs

In addition to the most basic LAD ladder diagram programming, Siemens has many other methods for FBD function block programming and STL statement programming, such as PCS7 CFC, SFC; in addition to SCL, S7-GRAPH and so on. For these languages, it is difficult for general industrial control personnel to master all of them, so the difficulty of imitation is greatly increased. Therefore, very critical process programs can be written in these languages, and their cores can also be well protected. 1. Use of programming methods a) Use modular program structure, use symbolic names, and parameterize to write subroutine blocks. b) Try to use background data blocks and multi-instance data transfer methods. c) Use indirect addressing programming methods. d) For control programs of complex systems, especially programs with sequence control or recipe control, data programming can be considered, that is, the control logic or control sequence of the system can be changed through data changes. Users should try to use the above several high-level programming methods, so that the system's protection encryption program is embedded in the compiled program, and it is not easy to be found and copied.

2. Active protection method a) Use the system clock b) Use the ID number and serial number of the program card or CPU c) Use the reverse write function of EEPROM, and some memory retention functions that need to be set d) Use the time-consuming function provided by the system E) Set the password in the data block of the user program. f) Set the logic trap on the software. g) Reversely use the mistakes made during programming.

3. Passive protection method a) Do not delete programs that are considered useless under the conditions of the memory capacity utilization permission b) Leave the developer's logo in the data block so that evidence can be obtained in case of infringement in the future 4. Application counter Precautions for stealing technology a) Embedding the protection program in the user program should be natural, and a section of the program should not be added abruptly. The code should be as concise as possible, and the variable symbol name should be consistent with the variable embedded in the program segment. b) Often One type of protection encryption method is not enough, multiple methods should be used together, and once these protection programs are activated, the consequences to the system should be as different as possible, causing the so-called "landmine effect", thereby increasing the difficulty, time and time of the program being stolen. Cost, so that the plagiarism can't do anything in a short time, c) Protect the original code of the program, if the program needs to be delivered, without affecting the user's maintenance of the equipment, appropriate technical processing should be done on the delivered program, such as deleting some symbols Name, use the uploaded program or data block d) Do rigorous testing to avoid unnecessary troubles caused by malfunctions caused by imperfect protection programs, and at the same time reduce the cost of after-sales service.

3. Using the communication function In practical applications, there are often problems that require data exchange between systems (between multiple PLCs, between PLCs and third-party instruments), whether it is between Siemens products or between Siemens products and third parties Between products, it is recommended to use communication schemes instead of signal interconnection schemes between analog or switch quantities. For the former, the imitator can only see one hardware communication line. As for how much data is exchanged through communication, the imitator must spend time studying the specific user program to figure it out; for the latter, the developer is relieved. It saves effort, and imitators are also clear at a glance and have a panoramic view. For the program design of some inverters or servo motors, there are generally multiple methods, which can be directly controlled by the line or can be controlled by communication. If the communication method is used, the program will increase the difficulty of imitation, such as the control of the servo drive by the PLC. There are many types, the simpler one can be pulse direct control or analog control. This method is easy to imitate. If it is replaced by communication control, the program will be much more complicated. In addition, if the imitator is not familiar with the message, it is difficult. Go to imitate. Sometimes the control system is composed of multiple sub-control systems, thus forming a network of multiple CPUs and man-machine interfaces. Siemens S7-200 products are commonly PPI networks, and S7-300400 products are commonly MPI networks, which are usually man-machine interfaces. Data exchange with the CPU, and we can also add some S7 basic communication functions without configuration in the user program of the CPU (S7-200 can use NETRNETW instruction, S7-300400 can use X_PUTX_GET instruction), regularly or irregularly A small amount of data is exchanged between the CPUs, and the interlocking of the subsystem control logic is realized through these data. For such a system, it is not very easy for a copycat to analyze the program of a certain subsystem.

Fourth, the use of panel type man-machine interface

Try to use a panel type man-machine interface in the automation system to replace a single button indicator. If many man-machine interfaces do not have source programs, they only have backup and restore functions. The maintenance function can be fully realized and the HMI program is kept secret. For a PLC system, it is difficult to imitate even if the source program is missing but the mark of the HMI part is missing. Moreover, developers can add obvious manufacturer logos and contact information on the screen of the panel, and imitators cannot copy them as they are. If so, if the imitator wants to copy the program, he must rewrite the program of the operation panel or even the program of the PLC, and the developer can use some special functional areas of the panel and the PLC data interface (such as the area pointer of the Siemens panel, Or VB script) to control the PLC program execution. Such a PLC program can only rely on guessing and online monitoring to obtain the change logic of the PLC internal variables without the HMI source program, which is time-consuming and labor-intensive, which greatly increases the difficulty of copying and plagiarism.

5. Use non-standard man-machine interface

German engineers are willing to use this method. In China, most engineers are willing to use WINCC, INTOUCH or Kingview, etc., but in fact, in addition to these software, there is a more advanced way of writing, that is, to use VB to write their own programs, and for the interface between the software and the PLC , You can choose LIBNODAVE or other libraries, etc. The man-machine interface written in this way has many advantages. First of all, there is no copyright issue, because the VB software is free, and only a few simple additions are required for the upgrade of the WINDOW system. The file can be realized, unlike WINCC, if the window is upgraded, a large number of files need to be modified. Most people can't modify it, let alone copy it; if you don't have good computer programming skills, you won't dare to modify it easily, and you can't modify it if you have computer skills and no PLC or process foundation. I have used S7-300 to make such a system, but my purpose is not to keep it confidential, but to request from Party A. The system that I sat out was completely in accordance with my own style and was very comfortable. It is best to warn everyone not to overconsume the integrity of the Chinese industrial market, and to use PLC technology reasonably to protect core secrets, rather than overuse it for other purposes. The integrity of the Chinese industrial market requires everyone's efforts to have a chance to improve.

Magnetic Transducer

Magnetic Transducer,Smd Magnetic Transducer,Buzzer Magnetic Transducer,Magnetic Transducer Buzzer

NINGBO SANCO ELECTRONICS CO., LTD. , https://www.sancobuzzer.com