Vendor proprietary
UMAS
Schneider Electric's proprietary engineering protocol for Modicon controllers — the M580, M340, Quantum and Premium families. It is how EcoStruxure Control Expert reads and writes controller programs, and it travels inside ordinary Modbus/TCP on 502 as function code 90, which means an environment that allows 'Modbus' also allows programming unless the function code is inspected.
How it works
The client opens a normal Modbus/TCP session to 502, then sends function code 90 with a UMAS sub-function byte. It first reserves the controller (taking an exclusive engineering lock), then issues the operation — read project, download blocks, change mode, read memory — and releases the reservation. The reservation handshake is the reliable tell that engineering, not polling, is happening.
Communication patternControl Expert host → 502/TCP → reserve → operation (read/write/mode) → unreserve.
Fact sheet
Why should I care?
Understanding UMAS is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Reserve / release controller
- Read controller identity and project info
- Upload and download program blocks
- Read and write memory blocks
- Start / stop the CPU
- Read the diagnostic buffer
Security concerns
- Shares port 502 with routine Modbus polling, so port-based conduit rules cannot distinguish a data read from a program download
- Older firmware accepts engineering commands without any application password
- Where a password exists, the reservation handshake has historically been the target of bypass research — treat the password as a control, not a boundary
- A CPU stop over UMAS is a single command with immediate process consequence
What normal looks like
- Reservations only from the small set of Control Expert engineering hosts
- Downloads clustered inside declared maintenance windows and matched to change records
- SCADA and HMI clients using standard read/write function codes and never function code 90
What deserves attention
- Function code 90 from a host that has only ever issued function codes 3, 4 or 16
- A reservation attempt from the SCADA server, a historian or an IT subnet
- Repeated reserve/unreserve cycles — a sign of scripted probing rather than engineering work
- Download or CPU mode change outside a change window
Hunting ideas
- unauthorized-plc-programming
- controller-logic-changes
- controller-mode-change
- protocol-write-activity
Defensive controls
- Inspect Modbus function codes at the cell boundary and allow function code 90 only from named engineering hosts — this is the single highest-value control on a Modicon estate
- Set the Control Expert application password and enable program-download protection on every controller that supports it
- Alarm on the reserve → download sequence and correlate each occurrence with a change record
- Keep Control Expert project files (.STU/.STA) under version control and run periodic online-versus-offline comparison
- Never expose 502/TCP beyond the process network, and never through the IT/OT boundary