Resolving SFTP Connection Failures on SINUMERIK 840D sl TCU

Field engineers frequently report that FileZilla, WinSCP, and other SFTP/FTP clients fail to reach a SINUMERIK 840D sl TCU (Thin Client Unit). Because the TCU is a stateless display terminal that only renders HMI pages from a paired NCU (Numerical Control Unit), file transfer failures almost always point at the wrong target, the wrong network port, or a service interface that has not been enabled. This reference walks through the architecture, the network ports, the required credentials, and the diagnostic steps that consistently bring up a working SFTP session against an 840D sl control.

1. System Architecture: TCU vs NCU vs PCU

The 840D sl family is built around three hardware roles that engineers routinely confuse:

Confirm which device you are standing in front of before you chase an FTP problem. The label on the back of a TCU reads "TCU 30.2" or "TCU 50.5"; the NCU sits in the cabinet and exposes a Type 2 CompactFlash slot behind a captive screw.

2. Network Interfaces on the NCU and TCU

The SINUMERIK 840D sl provides a deterministic, segmented network topology. Every interface is bound to a specific role; you cannot repurpose them without changing PLC configuration and HMI sl configuration files.

Why X127 is the correct SFTP target

The X127 service interface is hard-wired to 192.168.215.1, accepts a single engineering workstation, and is intentionally isolated from the plant network. It is the only port that:

• Runs an SSH/SFTP server bound to port 22.
• Allows connections with the manufact, auduser, or service accounts.
• Bypasses plant-side firewalls and DHCP topology issues.

Pointing your SFTP client at the X130 IP (192.168.214.1) often fails because the plant interface is firewalled by the customer's IT, or the SSH daemon is bound only to the X127 socket. Always start at X127.

3. Required Connection Parameters

Working SFTP/FTP parameters for a stock 840D sl NCU running HMI Pro or HMI Advanced V4.x or later:

4. Service Account Hierarchy

840D sl uses a numeric access level for every login. Each account maps to one of seven levels. File system write privileges scale with the level.

5. Root Causes of "Connection Refused" and "Timed Out"

The source conversation shows three recurring failure modes. Each is treated separately below.

5.1 Wrong target host

Connecting to the TCU's address returns either "connection refused on port 22" (because the TCU has no SSH daemon) or a successful login to a minimal display-only shell that exposes no engineering directories. Always target the NCU's X127 IP, not the TCU's display-link IP.

5.2 SSH service not yet up

The NCU boots in several stages: BIOS, Linux, then the HMI. The SSH server on the NCU 720.3B / 730.3B / 731.3B is started by the HMI runtime; if the HMI is in startup or in recovery mode, the daemon may not bind port 22 for 60-180 seconds. Ping the X127 address first; only attempt SFTP after a successful ping.

5.3 Key exchange / algorithm mismatch

NCU firmware 4.7 SP2 and later disabled SHA-1 and 3DES for SSH. Legacy clients that only negotiate these ciphers (FileZilla < 3.32, PuTTY < 0.67, WinSCP < 5.13) see a handshake failure. Upgrade the client or force AES-256-CTR + Diffie-Hellman group 14 in the client config.

5.4 Customer firewall / port blocking

X127 is point-to-point. If the engineering laptop is on a managed VLAN, switch port isolation can block ARP. Configure the laptop with a static address in 192.168.215.0/24 (e.g. 192.168.215.2) and disable any VPN client during commissioning.

5.5 Wrong username casing

Linux PAM is case-sensitive. Manufact, MANUFACT, and manufact are three different accounts. The correct spelling is lowercase manufact.

6. Step-by-Step Procedure: Establish Working SFTP to NCU 720/730

1. Identify the NCU and TCU. Confirm the NCU is reachable by checking the seven-segment display on the front of the NCU. It must show a number (e.g. "6" = ready, "0" = boot pending). If the display cycles through numbers, wait for steady state.
2. Connect the engineering laptop directly to X127. Use a Cat5e or better patch cable. Do not connect through a switch unless you have a dedicated service switch that preserves the 192.168.215.0/24 subnet.
3. Set a static IP on the laptop. Configure a manual IPv4 address: 192.168.215.2, mask 255.255.255.0, gateway 192.168.215.1. Disable Wi-Fi to prevent routing ambiguity.
4. Verify reachability with ping. From a Windows cmd prompt: ping 192.168.215.1 -n 4. You should see four replies with < 2 ms latency. If you see "destination host unreachable", the cable, NIC, or NCU is suspect.
5. Probe the SSH port with a TCP test. PowerShell: Test-NetConnection 192.168.215.1 -Port 22. A "TcpTestSucceeded: True" confirms the daemon is bound and listening. A "False" means the HMI has not yet started the SSH server or it has been disabled by configuration.
6. Install or upgrade the SFTP client. WinSCP 5.17 or FileZilla 3.46+ are recommended. Avoid using the Windows built-in FTP command-line client; it does not speak SFTP.
7. Create a new site in WinSCP:
   • File protocol: SFTP
   • Host name: 192.168.215.1
   • Port number: 22
   • User name: manufact
   • Password: SUNRISE (or the rotated password)
   • Click Advanced → SSH → Key exchange and ensure only ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, and diffie-hellman-group14-sha256 are enabled.
8. Click Login. Accept the host key fingerprint on first connection; WinSCP stores it for subsequent sessions. You should land in /card with the standard directory tree visible (user, oem, addon, commissioning, etc.).
9. Validate directory visibility. Switch to the manufact account. You must see /card/user, /card/oem, /card/addon, and /card/commissioning. The service account cannot see /oem/sinumerik; customer cannot see /addon.
10. Transfer a test file. Upload a small text file (1 KB) to /card/user. Verify it appears in the HMI's Program Manager within 10 seconds (the HMI scans for new files every 5-15 s).

7. Verification Matrix

8. Alternative File Transfer Methods When SFTP Is Unavailable

If the SSH daemon cannot be enabled, several supported channels exist for moving files to the NCU:

9. Network Topology Diagram

10. Diagnostic Decision Flow

11. Common Misconfigurations and Fixes

12. Enabling or Disabling the SFTP Server

The SSH server is normally enabled. If a customer's IT policy has disabled it, re-enable it through the following path on the HMI:

1. Press the Commissioning softkey on the main menu.
2. Enter the manufact password (access level 5 required).
3. Navigate to Diagnostics → SFTP / SSH service.
4. Set the service to Active; bind to X127 only.
5. Confirm and reboot if prompted.

For NCU firmware 4.95 and later, the equivalent setting lives in /card/oem/sinumerik/hmi/cfg/sshd.cfg. Setting enabled = TRUE and interface = X127 is the recommended factory configuration.

13. Performance and Limits

14. Frequently Asked Questions