Networking 24 Siemens PLCs and controlling them remotely

[assenzostefano]

Hello, my name is Stefano and I am 17 years old. I'm learning how to use PLCs (more specifically Siemens LOGO PLCs!) at school, at the moment to upload our LAD file, we have to pass the file to the professor, he has to pass the file to his laptop, get close to the PLC and connect with the Ethernet and finally upload the program.
This method takes a lot of time, especially when the professor is busy with something else, so we thought of networking all 24 PLCs via NAT, then creating a back-end in Python that manages the PLCs, so we students can upload the LAD file directly from our PC even if we are not physically connected.

I discovered this library during my research, it has a lot of functionality but I didn't find the one thing I needed, which is to upload a LAD file via Logo Soft Comfort (with the Dynamic DNS function) but instead of putting the NAT IP and the port of that specific PLC, it uses a single IP (i.e. the back-end IP) that decides which PC to assign a specific PLC to.
Now you may be wondering, "how do you decide which PLC to give to each PC?", the user simply has to access a web page, select the PLC to which they want to connect and enter the back-end IP, hence the back-end saves the selection and when uploading the LAD file via Logo Soft Comfort sees which PLC you want to connect to, and voilà, the file will have been uploaded to the PLC.

The only problem is that I don't know how the PLC communicates, i.e. whether I just use the Python library "socket" and activate the communication between PC - Back-end - PLC or whether the PLC uses a different method for communication.

Thank you very much in advance

[spreeker]

Hi Stefano, Stephan here. I would look at https://snap7.sourceforge.net/ if the functionality you want is somewhere described here.
If the functionality is present to upload programs to the PLC then is possible the libary calls can be added to the python library.

Sound like a nice feature, also a dangerous one btw. Lets hack the remote factory and change some plc settings :D.

[assenzostefano]

Hi Stephan, I just looked at the site and there doesn't seem to be a function that allows you to upload a LAD file via Snap7, my guess is to use Python's 'socket' library to connect to the PLC and upload the file, tell me what you think.

P.S I also contacted Mr. Dave Nardella (the creator of the Snap7 project on Curseforge) and he told me that specifically he doesn't know, but to try anyway.

[lautarodapin]

idk if that is posible, if it was easy you would be obligated to use Tia portal to upload the lad to it xD

[nikteliy]

Hi @assenzostefano
I would try to capture the traffic using tcpdump or Wireshark. If LOGO doesn't encrypt the traffic, you can figure out how the PLC communicates with Logo Soft Comfort. If it's using the FTP or S7 protocol, you could reproduce it in Python.
If you're lucky, a TCP socket will be enough. If not, you'll have to use a raw socket and construct packets yourself.