Objective and complete flow
The objective is to establish secure communication between a Siemens PLC and a WinCC Unified SCADA Runtime.
To do this, first prepare several settings in the TIA Portal project: both PLC security and protection for the project itself. In this example the PLC is simulated with PLCSIM Advanced, the PLC IP is 192.168.1.188 and the PC Runtime IP is 192.168.1.169.
- Protect the PLC and avoid anonymous or unprotected access.
- Protect the project and enable the Security Features.
- Prepare the PLC network, test tags and FC.
- Configure WinCC Unified Runtime and the HMI-PLC connection.
- Load the PLC and SCADA, then verify encrypted communication.
As an external reference, it is useful to keep the Siemens documentation for encrypted loading in RT Unified close at hand.
Step 1: PLC security
Create the project and open the PLC security settings. This first step protects the CPU.
Follow the security wizard and prepare the base configuration before creating users and permissions.
For this example, use local user management and configure an administrator for the project/PLC.
Do not allow anonymous access: leave that option unchecked.
Leave everything protected so no unprotected access is allowed.
The wizard shows the final summary of the security applied to the PLC.
Step 2: project protection
The next step is to protect the project. Here a project user is created; keep these credentials safe, because losing them may prevent future access to the project.
When creating the project user, TIA Portal asks you to enter or change the password for the user defined for the PLC.
Permissions that were not available before now appear because a project user exists.
Once the project is protected, the Security Features are enabled. From this point, certificates and advanced security options can be managed.
The top area shows the logged-in user and the available user actions.
Step 3: PLC preparation
Configure the PLC network with the usual lab IP: 192.168.1.188.
Reuse an FC and DB from another project, and enable clock memory and system memory. Then create Bool, Int and Real test variables, plus an FC to move those variables.
Compile the PLC and leave it ready to download into PLCSIM Advanced.
Step 4: WinCC Unified configuration
Add the WinCC Unified Runtime, which includes its own PC Station inside the project.
Add a network interface to the PC Runtime so it can communicate with the PLC.
Assign the destination PC IP, in this case 192.168.1.169, and connect it to the network previously created for the PLC.
Check in Devices & Networks that the PLC, network and PC Runtime are correctly linked.
Create a basic start screen by dragging PLC variables onto the screen. This lets TIA Portal automatically create the connection and the required HMI tags. The easiest way is to use a split view.
Confirm that the connection to the PLC has been created automatically.
Also confirm that the variables have been created in HMI tags.
Compile the HMI project and two transfer-related errors appear.
TIA Portal requests a transfer password. This password is used for HMI loading and protects communication between the engineering station and Runtime.
The password must meet the RT Unified complexity rules: between 8 and 120 characters, with at least one uppercase letter, one lowercase letter, one number and one special character. It must also match in the HMI device runtime configuration and in Runtime Manager.
For the first time, if secure loading has not yet been configured in WinCC, it may be necessary to allow the initial transfer through an unencrypted load.
If we compile again now, there are no errors.
Step 5: device loading
Step 5.1: load the PLC
Start with the PLC download.
Enable supported simulation to load the project into PLCSIM Advanced.
Enter the PLC password when TIA Portal requests it.
Start the simulated PLC.
Step 5.2: load the SCADA
Load the SCADA into the virtual machine where Runtime runs, with IP 192.168.1.169.
Enter the password configured for encrypted loading.
Important point: the first time, download without encryption so the password is loaded on the PC station. Then enter it in SIMATIC Runtime Manager.
Start the Runtime.
Validation and encrypted communication
Open the application and enter the credentials for the phs user created earlier with HMI permissions.
You can enter the user in autostart or log in directly.
The HMI is now communicating with the PLC.
Is the communication encrypted? Yes: it uses an internal certificate generated by TIA Portal.
