python-snap7 3.2.0__py3-none-any.whl → 3.3.0__py3-none-any.whl

snap7/s7protocol.py

@@ -114,6 +114,10 @@ _STOP_PARAMS = bytes.fromhex("29000000000009") + b"P_PROGRAM"
 _HOT_START_PARAMS = bytes.fromhex("28000000000000fd000009") + b"P_PROGRAM"
 # Cold start: same as hot start but with block "C " before PI service
 _COLD_START_PARAMS = bytes.fromhex("28000000000000fd0002432009") + b"P_PROGRAM"
+# Compress: function(0x28) + 7 reserved + block count(0) + PI length(5) + "_GARB" (as native Snap7 TReqFunCompress)
+_COMPRESS_PARAMS = bytes.fromhex("28000000000000fd000005") + b"_GARB"
+# Copy RAM to ROM: like compress but with file system "EP" before PI service "_MODU" (native TReqFunCopyRamToRom)
+_COPY_RAM_TO_ROM_PARAMS = bytes.fromhex("28000000000000fd0002455005") + b"_MODU"
 
 
 class S7Protocol:
@@ -402,7 +406,7 @@ class S7Protocol:
         Build PLC control request using the S7 PI service PDU format.
 
         Args:
-            operation: Control operation ('stop', 'hot_start', 'cold_start')
+            operation: Control operation ('stop', 'hot_start', 'cold_start', 'compress', 'copy_ram_to_rom')
 
         Returns:
             Complete S7 PDU for PLC control
@@ -411,6 +415,8 @@ class S7Protocol:
             "stop": _STOP_PARAMS,
             "hot_start": _HOT_START_PARAMS,
             "cold_start": _COLD_START_PARAMS,
+            "compress": _COMPRESS_PARAMS,
+            "copy_ram_to_rom": _COPY_RAM_TO_ROM_PARAMS,
         }
 
         if operation not in params:
@@ -449,87 +455,23 @@ class S7Protocol:
         """
         Build PLC control request for memory compression.
 
-        Uses PI service "_MSZL" (compress memory).
+        Uses PI service "_GARB" (compress memory), as native Snap7 does.
 
         Returns:
             Complete S7 PDU for compress request
         """
-        # PI service command for compress
-        pi_service = b"_MSZL"
-
-        # Parameter section: function code + PI service
-        # Format: func(1) + unknown(7) + pi_len(1) + pi_service
-        param_data = (
-            struct.pack(
-                ">BBBBBBBBB",
-                S7Function.PLC_CONTROL,  # 0x28
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                len(pi_service),  # PI service length
-            )
-            + pi_service
-        )
-
-        header = struct.pack(
-            ">BBHHHH",
-            0x32,  # Protocol ID
-            S7PDUType.REQUEST,  # PDU type
-            0x0000,  # Reserved
-            self._next_sequence(),  # Sequence
-            len(param_data),  # Parameter length
-            0x0000,  # Data length
-        )
-
-        return header + param_data
+        return self.build_plc_control_request("compress")
 
     def build_copy_ram_to_rom_request(self) -> bytes:
         """
         Build PLC control request for copying RAM to ROM.
 
-        Uses PI service "_MSZL" with file system parameters.
+        Uses PI service "_MODU" with the "EP" file system, as native Snap7 does.
 
         Returns:
             Complete S7 PDU for copy RAM to ROM request
         """
-        # PI service command for copy RAM to ROM
-        # Uses EP parameter for target file system
-        pi_service = b"_MSZL"
-        file_id = b"P"  # P = passive file system (ROM)
-
-        # Parameter section with file system identifier
-        param_data = (
-            struct.pack(
-                ">BBBBBBBBB",
-                S7Function.PLC_CONTROL,  # 0x28
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                0x00,  # Reserved
-                len(file_id),  # File ID length
-                len(pi_service),  # PI service length
-            )
-            + file_id
-            + pi_service
-        )
-
-        header = struct.pack(
-            ">BBHHHH",
-            0x32,  # Protocol ID
-            S7PDUType.REQUEST,  # PDU type
-            0x0000,  # Reserved
-            self._next_sequence(),  # Sequence
-            len(param_data),  # Parameter length
-            0x0000,  # Data length
-        )
-
-        return header + param_data
+        return self.build_plc_control_request("copy_ram_to_rom")
 
     # ========================================================================
     # Block Transfer PDU Builders (Upload/Download)
@@ -546,22 +488,15 @@ class S7Protocol:
         Returns:
             Complete S7 PDU for start upload request
         """
-        # Block address string: e.g., "0A00001P" for DB1
-        # Format: block_type (2 hex) + block_num (5 digits) + file_system (1 char)
-        block_addr = f"{block_type:02X}{block_num:05d}A".encode("ascii")
+        if not 0 <= block_type <= 0xFF:
+            raise ValueError("block_type must fit in one byte")
+        if not 0 <= block_num <= 99999:
+            raise ValueError("block_num must be between 0 and 99999")
 
-        # Parameters: function + status + reserved + upload_id + block_addr_len + block_addr
-        param_data = (
-            struct.pack(
-                ">BBBIB",
-                S7Function.START_UPLOAD,  # Function code
-                0x00,  # Status
-                0x00,  # Reserved (error code)
-                0x00000000,  # Upload ID (0 for start)
-                len(block_addr),  # Block address length
-            )
-            + block_addr
-        )
+        # TReqFunStartUploadParams: function, six reserved bytes, one-byte
+        # upload ID, then the nine-byte block address `_0TNNNNNA`.
+        block_addr = b"_0" + bytes((block_type,)) + f"{block_num:05d}".encode("ascii") + b"A"
+        param_data = bytes((S7Function.START_UPLOAD,)) + bytes(7) + bytes((len(block_addr),)) + block_addr
 
         header = struct.pack(
             ">BBHHHH",
@@ -585,13 +520,9 @@ class S7Protocol:
         Returns:
             Complete S7 PDU for upload request
         """
-        param_data = struct.pack(
-            ">BBBI",
-            S7Function.UPLOAD,  # Function code
-            0x00,  # Status
-            0x00,  # Reserved
-            upload_id,  # Upload ID
-        )
+        if not 0 <= upload_id <= 0xFF:
+            raise ValueError("upload_id must fit in one byte")
+        param_data = bytes((S7Function.UPLOAD,)) + bytes(6) + bytes((upload_id,))
 
         header = struct.pack(
             ">BBHHHH",
@@ -615,13 +546,9 @@ class S7Protocol:
         Returns:
             Complete S7 PDU for end upload request
         """
-        param_data = struct.pack(
-            ">BBBI",
-            S7Function.END_UPLOAD,  # Function code
-            0x00,  # Status
-            0x00,  # Reserved
-            upload_id,  # Upload ID
-        )
+        if not 0 <= upload_id <= 0xFF:
+            raise ValueError("upload_id must fit in one byte")
+        param_data = bytes((S7Function.END_UPLOAD,)) + bytes(6) + bytes((upload_id,))
 
         header = struct.pack(
             ">BBHHHH",
@@ -642,24 +569,42 @@ class S7Protocol:
         Returns:
             Dictionary with upload_id and block_length
         """
-        result = {"upload_id": 0, "block_length": 0}
-
         raw_params = response.get("raw_parameters", b"")
-
-        if len(raw_params) >= 8:
-            # Parse: function + status + reserved + upload_id
-            result["upload_id"] = struct.unpack(">I", raw_params[4:8])[0]
-            if len(raw_params) > 8:
-                # Block length string follows
-                len_field = raw_params[8]
-                if len(raw_params) > 9 + len_field:
-                    length_str = raw_params[9 : 9 + len_field]
-                    try:
-                        result["block_length"] = int(length_str)
-                    except ValueError:
-                        pass
-
-        return result
+        if len(raw_params) != 16 or raw_params[0] != S7Function.START_UPLOAD:
+            raise S7ProtocolError("Invalid start-upload response parameters")
+        try:
+            block_length = int(raw_params[11:16].decode("ascii"))
+        except (UnicodeDecodeError, ValueError) as exc:
+            raise S7ProtocolError("Invalid start-upload block length") from exc
+        return {"upload_id": raw_params[7], "block_length": block_length}
+
+    def parse_upload_fragment(
+        self,
+        response: Dict[str, Any],
+        *,
+        first_fragment: bool = False,
+        include_block_header: bool = False,
+    ) -> Tuple[bytes, bool]:
+        """Validate and decode one upload response fragment."""
+        raw_params = response.get("raw_parameters", b"")
+        if len(raw_params) != 2 or raw_params[0] != S7Function.UPLOAD or raw_params[1] not in (0, 1):
+            raise S7ProtocolError("Invalid upload response parameters")
+
+        raw_data = response.get("raw_data", b"")
+        if len(raw_data) < 4:
+            raise S7ProtocolError("Upload response data is truncated")
+        declared_length, marker = struct.unpack(">HH", raw_data[:4])
+        if marker != 0x00FB:
+            raise S7ProtocolError("Invalid upload response data marker")
+        if declared_length != len(raw_data) - 4:
+            raise S7ProtocolError("Upload response data length mismatch")
+        payload = raw_data[4:]
+        if first_fragment and not include_block_header:
+            compact_header_size = 36
+            if len(payload) < compact_header_size:
+                raise S7ProtocolError("First upload response is missing its compact block header")
+            payload = payload[compact_header_size:]
+        return payload, raw_params[1] == 0
 
     def parse_upload_response(self, response: Dict[str, Any]) -> bytes:
         """
@@ -668,13 +613,15 @@ class S7Protocol:
         Returns:
             Block data bytes
         """
-        data_info = response.get("data", {})
-        raw_data: bytes = data_info.get("data", b"")
+        payload, _ = self.parse_upload_fragment(response)
+        return payload
 
-        # Skip the data header if present (length + unknown bytes)
-        if len(raw_data) > 2:
-            return raw_data
-        return b""
+    def check_end_upload_response(self, response: Dict[str, Any]) -> None:
+        """Require a canonical END_UPLOAD acknowledgement."""
+        if response.get("raw_parameters", b"") != bytes((S7Function.END_UPLOAD,)):
+            raise S7ProtocolError("Invalid end-upload response")
+        if response.get("raw_data", b""):
+            raise S7ProtocolError("End-upload response must not contain data")
 
     def build_download_request(self, block_type: int, block_num: int, block_data: bytes) -> bytes:
         """
@@ -688,26 +635,20 @@ class S7Protocol:
         Returns:
             Complete S7 PDU for request download
         """
-        # Block address string
-        block_addr = f"{block_type:02X}{block_num:05d}P".encode("ascii")
+        if not 0 <= block_type <= 0xFF or not 0 <= block_num <= 99999:
+            raise ValueError("Invalid block type or number")
+        if len(block_data) > 999999:
+            raise ValueError("Block is too large for the download request")
+        if len(block_data) >= 36 and block_data[2] == 1 and block_data[4] == 5:
+            mc7_size = struct.unpack(">H", block_data[34:36])[0]
+        else:
+            mc7_size = len(block_data) - 36 if len(block_data) >= 36 else len(block_data)
+        if mc7_size > 999999:
+            raise ValueError("MC7 size is too large for the download request")
 
-        # Block length as string
-        length_str = f"{len(block_data):06d}".encode("ascii")
-
-        # Parameters
-        param_data = (
-            struct.pack(
-                ">BBBBB",
-                S7Function.REQUEST_DOWNLOAD,  # Function code
-                0x00,  # Status
-                0x00,  # Reserved
-                0x00,  # Reserved
-                len(block_addr),  # Block address length
-            )
-            + block_addr
-            + struct.pack(">B", len(length_str))
-            + length_str
-        )
+        block_addr = b"_0" + bytes((block_type,)) + f"{block_num:05d}".encode("ascii") + b"P"
+        sizes = b"1" + f"{len(block_data):06d}{mc7_size:06d}".encode("ascii")
+        param_data = bytes((S7Function.REQUEST_DOWNLOAD, 0, 1)) + bytes(5) + b"\x09" + block_addr + b"\x0d" + sizes
 
         header = struct.pack(
             ">BBHHHH",
@@ -721,6 +662,37 @@ class S7Protocol:
 
         return header + param_data
 
+    @staticmethod
+    def parse_download_service_request(pdu: bytes, function: int, block_num: int) -> int:
+        """Validate a PLC request for a download slice or completion acknowledgement."""
+        if len(pdu) != 28 or pdu[0:2] != bytes((0x32, S7PDUType.REQUEST)):
+            raise S7ProtocolError("Invalid PLC download request header")
+        sequence, param_len, data_len = struct.unpack(">HHH", pdu[4:10])
+        if param_len != 18 or data_len != 0:
+            raise S7ProtocolError("Invalid PLC download request lengths")
+        params = pdu[10:]
+        expected_address = b"_0" + bytes((0x41,)) + f"{block_num:05d}".encode("ascii") + b"P"
+        if params[0] != function or params[8] != 9 or params[9:] != expected_address:
+            raise S7ProtocolError("Unexpected PLC download request")
+        return int(sequence)
+
+    @staticmethod
+    def build_download_fragment_response(sequence: int, is_last: bool, data: bytes) -> bytes:
+        """Reply to a PLC DOWNLOAD_BLOCK request with one bounded fragment."""
+        if not 0 <= sequence <= 0xFFFF or len(data) > 0xFFFF:
+            raise ValueError("Invalid download response sequence or payload length")
+        parameters = bytes((S7Function.DOWNLOAD_BLOCK, 0 if is_last else 1))
+        payload = struct.pack(">HH", len(data), 0x00FB) + data
+        header = struct.pack(">BBHHHHH", 0x32, S7PDUType.ACK_DATA, 0, sequence, 2, len(payload), 0)
+        return header + parameters + payload
+
+    @staticmethod
+    def build_download_ended_response(sequence: int) -> bytes:
+        """Acknowledge the PLC's DOWNLOAD_ENDED request."""
+        if not 0 <= sequence <= 0xFFFF:
+            raise ValueError("Invalid download response sequence")
+        return struct.pack(">BBHHHHH", 0x32, S7PDUType.ACK_DATA, 0, sequence, 1, 0, 0) + bytes((S7Function.DOWNLOAD_ENDED,))
+
     def build_delete_block_request(self, block_type: int, block_num: int) -> bytes:
         """
         Build delete block request.
@@ -845,16 +817,7 @@ class S7Protocol:
         )
 
         # Data section: block type (0x30 prefix + type per Snap7 C format)
-        data_section = struct.pack(
-            ">BBHBBBB",
-            0x0A,  # Return value (request)
-            0x00,  # Transport size
-            0x0004,  # Length (4 bytes)
-            0x30,  # Block type indicator
-            block_type,  # Block type code
-            0x0A,  # Trailing bytes per Snap7 C
-            0x00,
-        )
+        data_section = struct.pack(">BBHBB", 0xFF, 0x09, 2, 0x30, block_type)
 
         # S7 header for USER_DATA
         header = struct.pack(
@@ -892,8 +855,9 @@ class S7Protocol:
         data_info = response.get("data", {})
         raw_data = data_info.get("data", b"")
 
-        if not raw_data:
-            return result
+        # Native Snap7 requires exactly seven four-byte entries (28 bytes)
+        if len(raw_data) != 28:
+            raise S7ProtocolError("Block-count response must contain exactly seven entries (28 bytes)")
 
         # Parse block entries (4 bytes each: 0x30 | type | count_hi | count_lo)
         # Block type codes
@@ -907,16 +871,18 @@ class S7Protocol:
             0x46: "SFBCount",  # System Function Block
         }
 
-        offset = 0
-        while offset + 4 <= len(raw_data):
+        seen: set[int] = set()
+        for offset in range(0, 28, 4):
             indicator = raw_data[offset]
             block_type = raw_data[offset + 1]
             count = struct.unpack(">H", raw_data[offset + 2 : offset + 4])[0]
 
-            if indicator == 0x30 and block_type in type_to_name:
-                result[type_to_name[block_type]] = count
-
-            offset += 4
+            if indicator != 0x30 or block_type not in type_to_name:
+                raise S7ProtocolError("Invalid block-count response entry")
+            if block_type in seen:
+                raise S7ProtocolError("Duplicate block type in block-count response")
+            seen.add(block_type)
+            result[type_to_name[block_type]] = count
 
         return result
 
@@ -937,6 +903,8 @@ class S7Protocol:
 
         if not raw_data:
             return result
+        if len(raw_data) % 4 != 0:
+            raise S7ProtocolError("Block-list response length is not a multiple of four")
 
         # Parse block entries (4 bytes each per TDataFunGetBotItem:
         # BlockNum(2) + Unknown(1) + BlockLang(1))
@@ -972,19 +940,11 @@ class S7Protocol:
             0x00,  # DataRef (0x00 for initial request)
         )
 
-        # Data section: [0x30, type, 'A', ASCII_num(5)] per Snap7 C format
+        # Data section: [0x30, type, ASCII_num(5), 'A'] per Snap7 C TReqDataBlockInfo
         # Block number is 5-digit zero-padded ASCII (e.g., 1 -> "00001")
         block_num_ascii = f"{block_num:05d}".encode("ascii")
-        data_payload = struct.pack(">BB", 0x30, block_type) + b"A" + block_num_ascii
-        data_section = (
-            struct.pack(
-                ">BBH",
-                0x0A,  # Return value (request)
-                0x00,  # Transport size
-                len(data_payload),  # Length
-            )
-            + data_payload
-        )
+        data_payload = struct.pack(">BB", 0x30, block_type) + block_num_ascii + b"A"
+        data_section = struct.pack(">BBH", 0xFF, 0x09, len(data_payload)) + data_payload
 
         # S7 header for USER_DATA
         header = struct.pack(
@@ -1030,8 +990,8 @@ class S7Protocol:
         data_info = response.get("data", {})
         raw_data = data_info.get("data", b"")
 
-        if len(raw_data) < 78:
-            return result
+        if len(raw_data) != 78:
+            raise S7ProtocolError("Block-info response must contain exactly 78 bytes")
 
         # Parse block info structure per TResDataBlockInfo layout
         result["block_type"] = raw_data[1]
@@ -1099,8 +1059,8 @@ class S7Protocol:
         # Data section: SZL ID and Index
         data_section = struct.pack(
             ">BBHHH",
-            0x0A,  # Return value (request)
-            0x00,  # Transport size
+            0xFF,  # Return value (0xFF, as engineering tools and native Snap7 send for requests carrying data)
+            0x09,  # Transport size (octet string)
             0x0004,  # Length (4 bytes for ID + Index)
             szl_id,  # SZL ID
             szl_index,  # SZL Index
@@ -1131,18 +1091,23 @@ class S7Protocol:
         Returns:
             Complete S7 PDU for follow-up request
         """
-        # Parameter section: same as initial but with DataRef = sequence_number
+        # Parameter section as sent by engineering tools for continuation requests: 12 bytes, method 0x12,
+        # DataRef = sequence_number, followed by last-data-unit and error code fields set to zero
         type_group = 0x40 | (group & 0x0F)  # Type 4 (request) | group
         param_data = struct.pack(
-            ">BBBBBBBB",
+            ">BBBBBBBBBBBB",
             0x00,  # Reserved
             0x01,  # Parameter count
             0x12,  # Type/length header
-            0x04,  # Length of following data
-            0x11,  # Method (0x11 = request)
+            0x08,  # Length of following data
+            0x12,  # Method (0x12)
             type_group,  # Type | Group
             subfunction,  # Subfunction
             sequence_number,  # DataRef from previous response
+            0x00,  # Last data unit
+            0x00,  # Reserved
+            0x00,  # Error code high
+            0x00,  # Error code low
         )
 
         # Minimal data section for follow-up
@@ -1250,6 +1215,9 @@ class S7Protocol:
 
         Returns:
             Complete S7 PDU for set clock request
+
+        Raises:
+            ValueError: If the year is outside 1990-2089, which the two-digit S7 year cannot represent.
         """
 
         # Convert datetime to BCD format
@@ -1257,17 +1225,23 @@ class S7Protocol:
         def to_bcd(value: int) -> int:
             return ((value // 10) << 4) | (value % 10)
 
-        year = dt.year % 100  # Only last 2 digits
+        # The two-digit S7 year maps 90-99 to 1990-1999 and 00-89 to 2000-2089
+        if not 1990 <= dt.year <= 2089:
+            raise ValueError(f"S7 clock supports years 1990-2089, got {dt.year}")
+        year = dt.year % 100
+        millisecond = dt.microsecond // 1000
         bcd_time = struct.pack(
-            ">BBBBBBBB",
-            0x00,  # Reserved
-            to_bcd(year),  # Year (BCD)
+            ">BBBBBBBBBB",
+            0x00,
+            0x19,  # Siemens date/time prefix
+            to_bcd(year),
             to_bcd(dt.month),  # Month (BCD)
             to_bcd(dt.day),  # Day (BCD)
             to_bcd(dt.hour),  # Hour (BCD)
             to_bcd(dt.minute),  # Minute (BCD)
             to_bcd(dt.second),  # Second (BCD)
-            (dt.weekday() + 1) & 0x0F,  # Day of week (1=Monday)
+            to_bcd(millisecond // 10),
+            ((millisecond % 10) << 4) | (dt.isoweekday() % 7 + 1),  # S7 weekday: 1=Sunday .. 7=Saturday
         )
 
         # Parameter section for USER_DATA clock request
@@ -1284,15 +1258,7 @@ class S7Protocol:
         )
 
         # Data section with BCD time
-        data_section = (
-            struct.pack(
-                ">BBH",
-                0x0A,  # Return value (request)
-                0x00,  # Transport size
-                len(bcd_time),  # Length
-            )
-            + bcd_time
-        )
+        data_section = struct.pack(">BBH", 0xFF, 0x09, len(bcd_time)) + bcd_time
 
         # S7 header for USER_DATA
         header = struct.pack(
@@ -1322,29 +1288,41 @@ class S7Protocol:
         data_info = response.get("data", {})
         raw_data = data_info.get("data", b"")
 
-        if len(raw_data) < 8:
-            # Return current time if no valid data
-            return dt_class.now().replace(microsecond=0)
+        # The S7 clock data is ten bytes: reserved, century (0x19/0x20), then year, month, day,
+        # hour, minute, second and milliseconds/weekday. The older eight-byte form (no century byte,
+        # no milliseconds) is still accepted.
+        if len(raw_data) == 10:
+            time_bytes = raw_data[2:]
+        elif len(raw_data) == 8:
+            time_bytes = raw_data[1:]
+        else:
+            raise S7ProtocolError("Clock response must contain ten bytes (or eight in the legacy form)")
 
-        # Parse BCD time
         def from_bcd(value: int) -> int:
+            if value >> 4 > 9 or value & 0x0F > 9:
+                raise S7ProtocolError("Clock response contains an invalid BCD timestamp")
             return ((value >> 4) * 10) + (value & 0x0F)
 
-        # Skip first byte (reserved)
-        year = from_bcd(raw_data[1])
-        month = from_bcd(raw_data[2])
-        day = from_bcd(raw_data[3])
-        hour = from_bcd(raw_data[4])
-        minute = from_bcd(raw_data[5])
-        second = from_bcd(raw_data[6])
-
-        # Determine century (assume 2000s for years 0-99)
+        year = from_bcd(time_bytes[0])
+        month = from_bcd(time_bytes[1])
+        day = from_bcd(time_bytes[2])
+        hour = from_bcd(time_bytes[3])
+        minute = from_bcd(time_bytes[4])
+        second = from_bcd(time_bytes[5])
+        microsecond = 0
+        if len(raw_data) == 10:
+            # Byte 8: milliseconds hundreds/tens (BCD); high nibble of byte 9: milliseconds ones
+            microsecond = (from_bcd(time_bytes[6]) * 10 + (time_bytes[7] >> 4)) * 1000
+            if microsecond > 999000:
+                raise S7ProtocolError("Clock response contains an invalid BCD timestamp")
+
+        # The two-digit S7 year maps 90-99 to 1990-1999 and 00-89 to 2000-2089
         full_year = 2000 + year if year < 90 else 1900 + year
 
         try:
-            return dt_class(full_year, month, day, hour, minute, second)
-        except ValueError:
-            return dt_class.now().replace(microsecond=0)
+            return dt_class(full_year, month, day, hour, minute, second, microsecond)
+        except ValueError as exc:
+            raise S7ProtocolError("Clock response contains an invalid BCD timestamp") from exc
 
     # ========================================================================
     # Session Password PDU Builders (Security / Function Group 5)
@@ -1354,8 +1332,8 @@ class S7Protocol:
     def encode_password(password: str) -> bytes:
         """Encode an S7 session password into the 8-byte wire format.
 
-        The encoding pads or truncates the password to 8 characters, XORs each
-        byte with ``0x55``, then rotates each byte left by 3 bits.
+        Snap7 pads with spaces, XORs with ``0x55``, and chains each byte
+        from the encoded byte two positions earlier.
 
         Args:
             password: Plaintext password (max 8 characters).
@@ -1363,12 +1341,13 @@ class S7Protocol:
         Returns:
             8-byte encoded password block.
         """
-        # Pad/truncate to exactly 8 bytes
-        raw = password.encode("ascii")[:8].ljust(8, b"\x00")
+        raw = password.encode("ascii")
+        if not 1 <= len(raw) <= 8:
+            raise ValueError("Session password must contain between one and eight ASCII characters")
+        raw = raw.ljust(8, b" ")
         encoded = bytearray(8)
         for i in range(8):
-            xored = raw[i] ^ 0x55
-            encoded[i] = ((xored << 3) | (xored >> 5)) & 0xFF
+            encoded[i] = raw[i] ^ 0x55 ^ (encoded[i - 2] if i >= 2 else 0)
         return bytes(encoded)
 
     def build_set_session_password_request(self, encoded_password: bytes) -> bytes:
@@ -1396,15 +1375,9 @@ class S7Protocol:
         )
 
         # Data section: encoded password
-        data_section = (
-            struct.pack(
-                ">BBH",
-                0x0A,  # Return value (request)
-                0x00,  # Transport size
-                len(encoded_password),  # Length
-            )
-            + encoded_password
-        )
+        if len(encoded_password) != 8:
+            raise ValueError("Encoded session password must contain eight bytes")
+        data_section = struct.pack(">BBH", 0xFF, 0x09, 8) + encoded_password
 
         header = struct.pack(
             ">BBHHHH",
@@ -1457,7 +1430,14 @@ class S7Protocol:
 
         return header + param_data + data_section
 
-    def check_userdata_response(self, response: Dict[str, Any]) -> None:
+    def check_userdata_response(
+        self,
+        response: Dict[str, Any],
+        expected_group: int | None = None,
+        expected_subfunction: int | None = None,
+        *,
+        accept_null_ack: bool = False,
+    ) -> None:
         """Check a USERDATA response for errors.
 
         Verifies both the parameter-level error code and the data section
@@ -1465,6 +1445,11 @@ class S7Protocol:
 
         Args:
             response: Parsed S7 response from :meth:`parse_response`.
+            expected_group: Expected function group, if it should be verified.
+            expected_subfunction: Expected subfunction, if it should be verified.
+            accept_null_ack: For services that return no data (set clock, session passwords). Real PLCs
+                acknowledge these with return code 0x0A, transport size 0 and length 0 next to a zero
+                parameter error code, which is then a success.
 
         Raises:
             ~snap7.error.S7ProtocolError: If the response indicates an error.
@@ -1475,13 +1460,29 @@ class S7Protocol:
             if param_error != 0:
                 error_msg = get_protocol_error_message(param_error)
                 raise S7ProtocolError(f"USERDATA request failed: {error_msg} (0x{param_error:04x})")
+            if params.get("last_data_unit", 0) not in (0x00, 0x01):
+                raise S7ProtocolError(f"Invalid USERDATA last data unit value 0x{params['last_data_unit']:02x}")
+            if expected_group is not None and params.get("group") != expected_group:
+                raise S7ProtocolError("Unexpected USERDATA response function group")
+            if expected_subfunction is not None and params.get("subfunction") != expected_subfunction:
+                raise S7ProtocolError("Unexpected USERDATA response subfunction")
+        else:
+            raise S7ProtocolError("Missing USERDATA response parameters")
 
         data_info = response.get("data", {})
         if isinstance(data_info, dict):
             return_code = data_info.get("return_code", 0xFF)
-            if return_code != 0xFF:
+            null_ack = (
+                accept_null_ack
+                and return_code == 0x0A
+                and data_info.get("transport_size", 0) == 0
+                and data_info.get("data_length", 0) == 0
+            )
+            if return_code != 0xFF and not null_ack:
                 desc = get_return_code_description(return_code)
                 raise S7ProtocolError(f"USERDATA request failed: {desc} (0x{return_code:02x})")
+        else:
+            raise S7ProtocolError("Missing USERDATA response data")
 
     def build_cpu_state_request(self) -> bytes:
         """
@@ -1560,8 +1561,9 @@ class S7Protocol:
         if pdu_type not in (S7PDUType.ACK, S7PDUType.ACK_DATA, S7PDUType.USERDATA):
             raise S7ProtocolError(f"Expected response PDU, got {pdu_type}")
 
+        # Like native Snap7, treat the whole 16-bit header error word as the failure indicator
         combined_error = (error_class << 8) | error_code
-        if error_class != 0:
+        if combined_error != 0:
             error_msg = get_protocol_error_message(combined_error)
             raise S7ProtocolError(
                 f"S7 protocol error (class={error_class:#04x}, code={error_code:#04x}): {error_msg}",
@@ -1583,6 +1585,7 @@ class S7Protocol:
                 raise S7ProtocolError("Parameter section extends beyond PDU")
 
             param_data = pdu[offset : offset + param_len]
+            response["raw_parameters"] = param_data
             response["parameters"] = self._parse_parameters(param_data)
             offset += param_len
 
@@ -1592,16 +1595,29 @@ class S7Protocol:
                 raise S7ProtocolError("Data section extends beyond PDU")
 
             data_section = pdu[offset : offset + data_len]
-            if (response.get("parameters") or {}).get("function_code") == S7Function.WRITE_AREA:
+            function_code = (response.get("parameters") or {}).get("function_code")
+            if function_code == S7Function.WRITE_AREA:
                 # WRITE data is an array of acknowledgement codes, not a READ item header.
                 response["data"] = {"return_code": data_section[0]}
+            elif function_code == S7Function.UPLOAD:
+                response["data"] = {"data": data_section}
             else:
-                # Other functions (notably block upload) do not carry READ item headers.
+                parameters = response.get("parameters") or {}
+                validate_item_length = function_code != S7Function.READ_AREA or parameters.get("item_count") == 1
                 response["data"] = self._parse_data_section(
                     data_section,
-                    validate_length=(response.get("parameters") or {}).get("function_code") == S7Function.READ_AREA,
+                    validate_length=validate_item_length,
                 )
             response["raw_data"] = data_section
+            offset += data_len
+
+        if offset != len(pdu):
+            raise S7ProtocolError("S7 response contains trailing bytes")
+
+        if pdu_type == S7PDUType.USERDATA:
+            # The null acknowledgement is only a success for no-data services; callers that expect data
+            # run check_userdata_response again without accept_null_ack.
+            self.check_userdata_response(response, accept_null_ack=True)
 
         return response
 
@@ -1612,7 +1628,9 @@ class S7Protocol:
 
         # Detect USERDATA response parameters:
         # byte 0 = 0x00 (reserved), len >= 12, byte 2 = 0x12, byte 4 = 0x12 (method=response)
-        if param_data[0] == 0x00 and len(param_data) >= 12 and param_data[2] == 0x12 and param_data[4] == 0x12:
+        if param_data[0] == 0x00 and len(param_data) >= 5 and param_data[2] == 0x12 and param_data[4] == 0x12:
+            if len(param_data) != 12:
+                raise S7ProtocolError("USERDATA response parameters must contain exactly 12 bytes")
             return self._parse_userdata_response_params(param_data)
 
         function_code = param_data[0]
@@ -1673,7 +1691,7 @@ class S7Protocol:
             [6]    Subfunction
             [7]    Sequence number (used as DataRef in follow-up)
             [8]    Data unit reference
-            [9]    Last data unit (0x00 = last, non-zero = more)
+            [9]    Last data unit (0x00 = last, 0x01 = more)
             [10-11] Error code
         """
         type_group = param_data[5]
@@ -1718,7 +1736,9 @@ class S7Protocol:
                 byte_length = data_length // 8
 
             if validate_length and 4 + byte_length > len(data_section):
-                raise S7ProtocolError("Read data item is truncated")
+                raise S7ProtocolError("Data item is truncated")
+            if validate_length and 4 + byte_length < len(data_section):
+                raise S7ProtocolError("Data item contains trailing bytes")
             actual_data = data_section[4 : 4 + byte_length]
 
             return {"return_code": return_code, "transport_size": transport_size, "data_length": data_length, "data": actual_data}