Detecting TIA Portal Online Access on Siemens S7 PLCs Security

Overview: The Problem of Online Monitoring Detection

When a Siemens S7 CPU runs a production machine, engineering stations running TIA Portal (V15..V18, now V19) can establish an online connection to upload hardware configuration, monitor blocks online, force variables, and modify values during RUN. Operators and machine builders frequently ask: Can the PLC detect that someone is currently online monitoring a function block (FC), data block (DB), or organization block (OB), and set an internal bit so that the application can react?

The short answer from the Siemens S7-1200 / S7-1500 / S7-300 / S7-400 firmware is: there is no system bit, system function (SFC/SFB), or system flag in the standard firmware that toggles to "1" the moment a programming device connects online and opens a block in monitoring view. The CPU exposes connection-state information through the diagnostic buffer, the system status lists (SSLs), and the Get_ConnectionInfo family of instructions, but it does not expose a dedicated "block is currently being monitored" bit.

This article maps every available detection primitive Siemens provides, explains how to interpret them, and then describes the network-level approach (S7Comm wire analysis) and dedicated security appliances that close the gap.

What "Online" Actually Means in TIA Portal

An online session in TIA Portal is built on the S7 communication protocol over ISO-on-TCP (port 102) or, on S7-1500, optionally over TLS-encrypted S7Comm-Plus. A typical session proceeds through these stages:

1. TCP/ISO transport establish – PG/OP slot negotiation via AR (Application Relationship) using S7-Communication on connection resource 1 (default PG).
2. User authentication – CPU protection-level password challenge (see SIMATIC S7-1500 System Manual, section on access protection).
3. Online block services – PI service PI_SERVICE_1 (read SZL), READ_SZL, READ_PI, _CP_READ for runtime data, and the online monitoring VAR_READ / VAR_WRITE request packets.
4. Online block view – PI service ONLINE_BLOCKVIEW requests the loaded block headers and live values for the watch table.

Each of these stages leaves a trace in either the CPU diagnostic buffer or the network. The detection problem reduces to: which trace can the application code read directly, and which trace requires an external observer?

CPU-Side Detection Primitives

The S7-1500 CPU firmware (V2.0 and later, currently shipping V3.1) and the S7-1200 (V4.0 and later) expose the following read-only diagnostics that the user's program can poll. None of them is a direct "monitoring is active" flag, but in combination they provide a reliable detection envelope.

SSL ID W#16#0132 – Connection Overview

Partial list read with RD_SINFO or the instruction "Get_ConnectionInfo" (S7-1500/S7-1200 only). Returns per-connection entries with the following layout:

Connection ID 1 (type 03H) is the default PG slot. As soon as the user program polls this entry and observes type = 03H and active = 1, a TIA Portal engineering station is connected — though it may be in "offline project" view with no block open.

Diagnostic Buffer Entry 0x013C / Event IDs

The diagnostic buffer records every login event. The relevant event IDs (decimal):

These entries can be read with the instruction "Read_DiagnosticBuffer" (S7-1500: extended instruction "Diag_RD" or "RD_DIAG"). The application program can react to 16#38:01 by raising a "PG online active" flag with a configurable hold time (typical: 60 s).

Operating Mode and Write Protection

On S7-1500, tag CPU.OperatingState returns RUN, STOP, STARTUP, HOLD. The "know-how protection" blocks in TIA Portal (Block properties → Protection → Know-how protection) encrypt the block, but do not affect detection — encryption hides block content from the reader, not the existence of a connection.

Implementation in SCL (S7-1500)

The following Structured Control Language snippet demonstrates a typical implementation. It polls SSL 0x0132 every 500 ms, raises PG_OnlineActive for 60 s after the last detection, and logs to a ring buffer.

// FB "PG_OnlineMonitor" – detect PG online sessions on S7-1500
// Triggered every 500 ms by cyclic OB (OB1 / OB30..OB38)

FUNCTION_BLOCK "PG_OnlineMonitor"
VAR
    ConnInfo   : ARRAY[1..16] OF LCON_TYPE;  // 16 connection slots
    RetVal     : INT;
    i          : INT;
    PG_Found   : BOOL;
    PG_IP      : STRING[15];
    HoldTimer  : TON;                         // 60 s hold time
    RingBuf    : ARRAY[1..32] OF STRING[80]; // last 32 events
    RingIdx    : INT := 1;
END_VAR

BEGIN
    // SSL ID W#16#0132 = Connection overview, partial list
    RetVal := Get_ConnectionInfo(REQ := TRUE,
                                 ConnectionInfo := ConnInfo);
    PG_Found := FALSE;
    FOR i := 1 TO 16 DO
        IF ConnInfo[i].ConnectionType = 16#03   // PG type
           AND ConnInfo[i].ActiveState = TRUE THEN
            PG_Found := TRUE;
            PG_IP    := ConnInfo[i].RemoteAddress;
        END_IF;
    END_FOR;

    HoldTimer(IN := PG_Found, PT := T#60s);
    "PG_OnlineActive" := HoldTimer.Q;

    // Log rising edge
    IF PG_Found AND NOT "PG_PrevFound" THEN
        RingBuf[RingIdx] := CONCAT(IN1 := 'PG online at ',
                                   IN2 := PG_IP,
                                   IN3 := '  ',
                                   IN4 := DWORD_TO_STRING(TIME_TO_DWORD(CPU_CLK)));
        RingIdx := RingIdx MOD 32 + 1;
    END_IF;
    "PG_PrevFound" := PG_Found;
END_FUNCTION_BLOCK

Limits of CPU-Side Detection

The CPU-side approach is sufficient when:

• All access comes through the integrated PROFINET interface (X1/X2).
• The application only needs to react to live engineering sessions (e.g. inhibit certain outputs while a programmer is connected).
• The CPU firmware revision supports Get_ConnectionInfo.

It is not sufficient when:

• The attacker uses an unsecured S7 communication path that does not register as a "PG connection" (e.g. raw S7Comm read of process data without a full AR establish — older TIA Portal versions, third-party OPC servers).
• The detection must include passive sniffing on the wire (someone using Wireshark with the S7 protocol dissector).
• The user needs a tamper-proof audit trail that survives a CPU STOP/RUN or a download.
• Compliance regimes (IEC 62443-3-3 SL-2, NIST SP 800-82) require an independent Security Information and Event Management (SIEM) feed.

Network-Level Detection: S7Comm Wire Analysis

The S7 communication protocol runs over ISO Transport on TCP port 102 (defined in RFC 1006, ISO 8073). The standard S7Comm header layout (version 1, ROSCTR types) is documented in the Wireshark dissector source, but the relevant request/response pairs that indicate online monitoring are:

The function codes inside UserData requests that correspond to online monitoring include:

• 0x00F0 – CPU_read_user_memory (block content read for online view).
• 0x00F1 – CPU_write_user_memory (downloads and online block modifications).
• 0x0112 – PI_START with PI_SERVICE_1 = "READ_PI" (read system state lists).
• 0x0132 – READ_SZL_0x0132 (request the connection list from the CPU — same SSL the CPU-side code reads).

A passive tap on the automation cell network (typically placed at the PROFINET ring or the engineering subnet) can therefore detect online monitoring without CPU cooperation. Open-source tooling commonly used for this is Wireshark (with the built-in s7comm dissector), the s7comm-plus dissector for S7-1500 TLS sessions, and Python libraries such as python-snap7 and scapy-s7 for scripted capture.

Example: Wireshark Display Filter for Live TIA Sessions

s7comm.param.func == 0x00f0 ||
s7comm.param.func == 0x00f1 ||
s7comm.header.rosctr == 0x07

Industrial Security Appliances (Dedicated Hardware)

For production environments where the network-level approach must be automated, hardened, and continuously running, Siemens and third-party vendors sell industrial security appliances that sit inline on the automation cell network, learn the S7 baseline traffic, and raise alarms on deviation:

Engineering Workstation Hardening

Even with detection in place, the engineering workstation running TIA Portal should be hardened. Practical controls:

1. Local Windows account – Disable the built-in Administrator account, require named accounts with strong passwords (Windows LAPS for automatic rotation).
2. BitLocker + TPM – Full-disk encryption of the engineering laptop. Protects the offline project (and any extracted CPU password) from theft.
3. Windows Defender Application Control (WDAC) – Allow-list only TIA Portal, WinCC, and required Siemens utilities.
4. Restricted network – Place the engineering VLAN in the DMZ between the corporate IT network and the OT cell. Block direct internet egress.
5. Project sign-out – TIA Portal supports multi-user server projects with "check-out / check-in" on FC/FB/DB. Enable this to enforce peer review on every online change.
6. TLS on S7-1500 – Configure the S7-1500 CPU for secure PG/OP communication (Properties → Security → Secure PG/PC and HMI Communication). Requires TIA Portal V16+ and firmware V2.9+ on the CPU. See Siemens FAQ: Secure PG/PC and HMI Communication with S7-1500.

CPU Protection Levels Compared

Configure in TIA Portal under: Device → Properties → Protection & Security → Access level. Always assign at minimum protection level 2 before FAT (Factory Acceptance Test). Reference: SIMATIC S7-1500 System Manual, section 6.4 "Access protection".

Troubleshooting Matrix

Verification Procedure

After implementing the CPU-side monitor or installing an appliance, validate the chain end-to-end:

1. Open TIA Portal on the engineering station, perform "Online → Accessible nodes" against the CPU. Confirm PG_OnlineActive rises within 1 s.
2. Open a watch table and pin a tag. Confirm the diagnostic buffer entry 16#38:01 appears in the buffer (read with Read_DiagnosticBuffer or via TIA Portal: Online → Diagnostics → Diagnostic buffer).
3. Close TIA Portal. Confirm PG_OnlineActive drops 60 s later and a 16#38:02 entry is recorded.
4. From a second engineering station (different IP), try to connect with a wrong password. Confirm 16#38:03 entry is logged and the security appliance raises an SNMP trap.
5. Disable the second station's MAC at the managed switch and confirm that the appliance logs the ARP/MAC change.

Standards and Further References

The following standards and Siemens manuals should be on the engineer's shelf when designing a detection regime for online access:

• IEC 62443-3-3:2013 – Industrial communication networks – Network and system security – Part 3-3: System security requirements and security levels. SR 1.3, SR 1.4, SR 2.1, SR 6.2 are the most relevant requirements.
• IEC 62443-4-2:2019 – Technical security requirements for IACS components (relevant to the S7-1500 component certification).
• NIST SP 800-82 Rev. 2 – Guide to Industrial Control Systems (ICS) Security. NIST publication.
• NIST SP 800-53 Rev. 5 – AC-2 Account Management, AU-2 Auditable Events.
• SIMATIC S7-1500 System Manual – section on Access Protection (CPU properties).
• SIMATIC S7-1200 Programmable Controller System Manual – chapter on Security.
• S7-1500 Diagnostic Functions Manual – SSL ID reference.

FAQ