path: root/epan/dissectors/packet-s7comm.c

/* packet-s7comm.c
 *
 * Author:      Thomas Wiens, 2014 (th.wiens@gmx.de)
 * Description: Wireshark dissector for S7-Communication
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

#include "config.h"

#include <epan/packet.h>
#include <epan/reassemble.h>
#include <stdlib.h>
#include <wsutil/strtoi.h>
#include <epan/expert.h>

#include "packet-s7comm.h"
#include "packet-s7comm_szl_ids.h"

#define PROTO_TAG_S7COMM                    "S7COMM"

/* Min. telegram length for heuristic check */
#define S7COMM_MIN_TELEGRAM_LENGTH          10

/* Protocol identifier */
#define S7COMM_PROT_ID                      0x32

/* Wireshark ID of the S7COMM protocol */
static int proto_s7comm;

/* Forward declarations */
void proto_reg_handoff_s7comm(void);
void proto_register_s7comm (void);
static uint32_t s7comm_decode_ud_tis_data(tvbuff_t *tvb, proto_tree *tree, uint8_t type, uint8_t subfunc, uint16_t td_size, uint32_t offset);

/**************************************************************************
 * PDU types
 */
#define S7COMM_ROSCTR_JOB                   0x01
#define S7COMM_ROSCTR_ACK                   0x02
#define S7COMM_ROSCTR_ACK_DATA              0x03
#define S7COMM_ROSCTR_USERDATA              0x07

static const value_string rosctr_names[] = {
    { S7COMM_ROSCTR_JOB,                    "Job" },        /* Request: job with acknowledgement */
    { S7COMM_ROSCTR_ACK,                    "Ack" },        /* acknowledgement without additional field */
    { S7COMM_ROSCTR_ACK_DATA,               "Ack_Data" },   /* Response: acknowledgement with additional field */
    { S7COMM_ROSCTR_USERDATA,               "Userdata" },
    { 0,                                    NULL }
};
/**************************************************************************
 * Error classes in header
 */
#define S7COMM_ERRCLS_NONE                  0x00
#define S7COMM_ERRCLS_APPREL                0x81
#define S7COMM_ERRCLS_OBJDEF                0x82
#define S7COMM_ERRCLS_RESOURCE              0x83
#define S7COMM_ERRCLS_SERVICE               0x84
#define S7COMM_ERRCLS_SUPPLIES              0x85
#define S7COMM_ERRCLS_ACCESS                0x87

static const value_string errcls_names[] = {
    { S7COMM_ERRCLS_NONE,                   "No error" },
    { S7COMM_ERRCLS_APPREL,                 "Application relationship" },
    { S7COMM_ERRCLS_OBJDEF,                 "Object definition" },
    { S7COMM_ERRCLS_RESOURCE,               "No resources available" },
    { S7COMM_ERRCLS_SERVICE,                "Error on service processing" },
    { S7COMM_ERRCLS_SUPPLIES,               "Error on supplies" },
    { S7COMM_ERRCLS_ACCESS,                 "Access error" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Error code in parameter part
 */

static const value_string param_errcode_names[] = {
    { 0x0000,                               "No error" },
    { 0x0110,                               "Invalid block number" },
    { 0x0111,                               "Invalid request length" },
    { 0x0112,                               "Invalid parameter" },
    { 0x0113,                               "Invalid block type" },
    { 0x0114,                               "Block not found" },
    { 0x0115,                               "Block already exists" },
    { 0x0116,                               "Block is write-protected" },
    { 0x0117,                               "The block/operating system update is too large" },
    { 0x0118,                               "Invalid block number" },
    { 0x0119,                               "Incorrect password entered" },
    { 0x011A,                               "PG resource error" },
    { 0x011B,                               "PLC resource error" },
    { 0x011C,                               "Protocol error" },
    { 0x011D,                               "Too many blocks (module-related restriction)" },
    { 0x011E,                               "There is no longer a connection to the database, or S7DOS handle is invalid" },
    { 0x011F,                               "Result buffer too small" },
    { 0x0120,                               "End of block list" },
    { 0x0140,                               "Insufficient memory available" },
    { 0x0141,                               "Job cannot be processed because of a lack of resources" },
    { 0x8001,                               "The requested service cannot be performed while the block is in the current status" },
    { 0x8003,                               "S7 protocol error: Error occurred while transferring the block" },
    { 0x8100,                               "Application, general error: Service unknown to remote module" },
    { 0x8104,                               "This service is not implemented on the module or a frame error was reported" },
    { 0x8204,                               "The type specification for the object is inconsistent" },
    { 0x8205,                               "A copied block already exists and is not linked" },
    { 0x8301,                               "Insufficient memory space or work memory on the module, or specified storage medium not accessible" },
    { 0x8302,                               "Too few resources available or the processor resources are not available" },
    { 0x8304,                               "No further parallel upload possible. There is a resource bottleneck" },
    { 0x8305,                               "Function not available" },
    { 0x8306,                               "Insufficient work memory (for copying, linking, loading AWP)" },
    { 0x8307,                               "Not enough retentive work memory (for copying, linking, loading AWP)" },
    { 0x8401,                               "S7 protocol error: Invalid service sequence (for example, loading or uploading a block)" },
    { 0x8402,                               "Service cannot execute owing to status of the addressed object" },
    { 0x8404,                               "S7 protocol: The function cannot be performed" },
    { 0x8405,                               "Remote block is in DISABLE state (CFB). The function cannot be performed" },
    { 0x8500,                               "S7 protocol error: Wrong frames" },
    { 0x8503,                               "Alarm from the module: Service canceled prematurely" },
    { 0x8701,                               "Error addressing the object on the communications partner (for example, area length error)" },
    { 0x8702,                               "The requested service is not supported by the module" },
    { 0x8703,                               "Access to object refused" },
    { 0x8704,                               "Access error: Object damaged" },
    { 0xD001,                               "Protocol error: Illegal job number" },
    { 0xD002,                               "Parameter error: Illegal job variant" },
    { 0xD003,                               "Parameter error: Debugging function not supported by module" },
    { 0xD004,                               "Parameter error: Illegal job status" },
    { 0xD005,                               "Parameter error: Illegal job termination" },
    { 0xD006,                               "Parameter error: Illegal link disconnection ID" },
    { 0xD007,                               "Parameter error: Illegal number of buffer elements" },
    { 0xD008,                               "Parameter error: Illegal scan rate" },
    { 0xD009,                               "Parameter error: Illegal number of executions" },
    { 0xD00A,                               "Parameter error: Illegal trigger event" },
    { 0xD00B,                               "Parameter error: Illegal trigger condition" },
    { 0xD011,                               "Parameter error in path of the call environment: Block does not exist" },
    { 0xD012,                               "Parameter error: Wrong address in block" },
    { 0xD014,                               "Parameter error: Block being deleted/overwritten" },
    { 0xD015,                               "Parameter error: Illegal tag address" },
    { 0xD016,                               "Parameter error: Test jobs not possible, because of errors in user program" },
    { 0xD017,                               "Parameter error: Illegal trigger number" },
    { 0xD025,                               "Parameter error: Invalid path" },
    { 0xD026,                               "Parameter error: Illegal access type" },
    { 0xD027,                               "Parameter error: This number of data blocks is not permitted" },
    { 0xD031,                               "Internal protocol error" },
    { 0xD032,                               "Parameter error: Wrong result buffer length" },
    { 0xD033,                               "Protocol error: Wrong job length" },
    { 0xD03F,                               "Coding error: Error in parameter section (for example, reserve bytes not equal to 0)" },
    { 0xD041,                               "Data error: Illegal status list ID" },
    { 0xD042,                               "Data error: Illegal tag address" },
    { 0xD043,                               "Data error: Referenced job not found, check job data" },
    { 0xD044,                               "Data error: Illegal tag value, check job data" },
    { 0xD045,                               "Data error: Exiting the ODIS control is not allowed in HOLD" },
    { 0xD046,                               "Data error: Illegal measuring stage during run-time measurement" },
    { 0xD047,                               "Data error: Illegal hierarchy in 'Read job list'" },
    { 0xD048,                               "Data error: Illegal deletion ID in 'Delete job'" },
    { 0xD049,                               "Invalid substitute ID in 'Replace job'" },
    { 0xD04A,                               "Error executing 'program status'" },
    { 0xD05F,                               "Coding error: Error in data section (for example, reserve bytes not equal to 0, ...)" },
    { 0xD061,                               "Resource error: No memory space for job" },
    { 0xD062,                               "Resource error: Job list full" },
    { 0xD063,                               "Resource error: Trigger event occupied" },
    { 0xD064,                               "Resource error: Not enough memory space for one result buffer element" },
    { 0xD065,                               "Resource error: Not enough memory space for several  result buffer elements" },
    { 0xD066,                               "Resource error: The timer available for run-time measurement is occupied by another job" },
    { 0xD067,                               "Resource error: Too many 'modify tag' jobs active (in particular multi-processor operation)" },
    { 0xD081,                               "Function not permitted in current mode" },
    { 0xD082,                               "Mode error: Cannot exit HOLD mode" },
    { 0xD0A1,                               "Function not permitted in current protection level" },
    { 0xD0A2,                               "Function not possible at present, because a function is running that modifies memory" },
    { 0xD0A3,                               "Too many 'modify tag' jobs active on the I/O (in particular multi-processor operation)" },
    { 0xD0A4,                               "'Forcing' has already been established" },
    { 0xD0A5,                               "Referenced job not found" },
    { 0xD0A6,                               "Job cannot be disabled/enabled" },
    { 0xD0A7,                               "Job cannot be deleted, for example because it is currently being read" },
    { 0xD0A8,                               "Job cannot be replaced, for example because it is currently being read or deleted" },
    { 0xD0A9,                               "Job cannot be read, for example because it is currently being deleted" },
    { 0xD0AA,                               "Time limit exceeded in processing operation" },
    { 0xD0AB,                               "Invalid job parameters in process operation" },
    { 0xD0AC,                               "Invalid job data in process operation" },
    { 0xD0AD,                               "Operating mode already set" },
    { 0xD0AE,                               "The job was set up over a different connection and can only be handled over this connection" },
    { 0xD0C1,                               "At least one error has been detected while accessing the tag(s)" },
    { 0xD0C2,                               "Change to STOP/HOLD mode" },
    { 0xD0C3,                               "At least one error was detected while accessing the tag(s). Mode change to STOP/HOLD" },
    { 0xD0C4,                               "Timeout during run-time measurement" },
    { 0xD0C5,                               "Display of block stack inconsistent, because blocks were deleted/reloaded" },
    { 0xD0C6,                               "Job was automatically deleted as the jobs it referenced have been deleted" },
    { 0xD0C7,                               "The job was automatically deleted because STOP mode was exited" },
    { 0xD0C8,                               "'Block status' aborted because of inconsistencies between test job and running program" },
    { 0xD0C9,                               "Exit the status area by resetting OB90" },
    { 0xD0CA,                               "Exiting the status range by resetting OB90 and access error reading tags before exiting" },
    { 0xD0CB,                               "The output disable for the peripheral outputs has been activated again" },
    { 0xD0CC,                               "The amount of data for the debugging functions is restricted by the time limit" },
    { 0xD201,                               "Syntax error in block name" },
    { 0xD202,                               "Syntax error in function parameters" },
    { 0xD205,                               "Linked block already exists in RAM: Conditional copying is not possible" },
    { 0xD206,                               "Linked block already exists in EPROM: Conditional copying is not possible" },
    { 0xD208,                               "Maximum number of copied (not linked) blocks on module exceeded" },
    { 0xD209,                               "(At least) one of the given blocks not found on the module" },
    { 0xD20A,                               "The maximum number of blocks that can be linked with one job was exceeded" },
    { 0xD20B,                               "The maximum number of blocks that can be deleted with one job was exceeded" },
    { 0xD20C,                               "OB cannot be copied because the associated priority class does not exist" },
    { 0xD20D,                               "SDB cannot be interpreted (for example, unknown number)" },
    { 0xD20E,                               "No (further) block available" },
    { 0xD20F,                               "Module-specific maximum block size exceeded" },
    { 0xD210,                               "Invalid block number" },
    { 0xD212,                               "Incorrect header attribute (run-time relevant)" },
    { 0xD213,                               "Too many SDBs. Note the restrictions on the module being used" },
    { 0xD216,                               "Invalid user program - reset module" },
    { 0xD217,                               "Protection level specified in module properties not permitted" },
    { 0xD218,                               "Incorrect attribute (active/passive)" },
    { 0xD219,                               "Incorrect block lengths (for example, incorrect length of first section or of the whole block)" },
    { 0xD21A,                               "Incorrect local data length or write-protection code faulty" },
    { 0xD21B,                               "Module cannot compress or compression was interrupted early" },
    { 0xD21D,                               "The volume of dynamic project data transferred is illegal" },
    { 0xD21E,                               "Unable to assign parameters to a module (such as FM, CP). The system data could not be linked" },
    { 0xD220,                               "Invalid programming language. Note the restrictions on the module being used" },
    { 0xD221,                               "The system data for connections or routing are not valid" },
    { 0xD222,                               "The system data of the global data definition contain invalid parameters" },
    { 0xD223,                               "Error in instance data block for communication function block or maximum number of instance DBs exceeded" },
    { 0xD224,                               "The SCAN system data block contains invalid parameters" },
    { 0xD225,                               "The DP system data block contains invalid parameters" },
    { 0xD226,                               "A structural error occurred in a block" },
    { 0xD230,                               "A structural error occurred in a block" },
    { 0xD231,                               "At least one loaded OB cannot be copied because the associated priority class does not exist" },
    { 0xD232,                               "At least one block number of a loaded block is illegal" },
    { 0xD234,                               "Block exists twice in the specified memory medium or in the job" },
    { 0xD235,                               "The block contains an incorrect checksum" },
    { 0xD236,                               "The block does not contain a checksum" },
    { 0xD237,                               "You are about to load the block twice, i.e. a block with the same time stamp already exists on the CPU" },
    { 0xD238,                               "At least one of the blocks specified is not a DB" },
    { 0xD239,                               "At least one of the DBs specified is not available as a linked variant in the load memory" },
    { 0xD23A,                               "At least one of the specified DBs is considerably different from the copied and linked variant" },
    { 0xD240,                               "Coordination rules violated" },
    { 0xD241,                               "The function is not permitted in the current protection level" },
    { 0xD242,                               "Protection violation while processing F blocks" },
    { 0xD250,                               "Update and module ID or version do not match" },
    { 0xD251,                               "Incorrect sequence of operating system components" },
    { 0xD252,                               "Checksum error" },
    { 0xD253,                               "No executable loader available; update only possible using a memory card" },
    { 0xD254,                               "Storage error in operating system" },
    { 0xD280,                               "Error compiling block in S7-300 CPU" },
    { 0xD2A1,                               "Another block function or a trigger on a block is active" },
    { 0xD2A2,                               "A trigger is active on a block. Complete the debugging function first" },
    { 0xD2A3,                               "The block is not active (linked), the block is occupied or the block is currently marked for deletion" },
    { 0xD2A4,                               "The block is already being processed by another block function" },
    { 0xD2A6,                               "It is not possible to save and change the user program simultaneously" },
    { 0xD2A7,                               "The block has the attribute 'unlinked' or is not processed" },
    { 0xD2A8,                               "An active debugging function is preventing parameters from being assigned to the CPU" },
    { 0xD2A9,                               "New parameters are being assigned to the CPU" },
    { 0xD2AA,                               "New parameters are currently being assigned to the modules" },
    { 0xD2AB,                               "The dynamic configuration limits are currently being changed" },
    { 0xD2AC,                               "A running active or deactivate assignment (SFC 12) is temporarily preventing R-KiR process" },
    { 0xD2B0,                               "An error occurred while configuring in RUN (CiR)" },
    { 0xD2C0,                               "The maximum number of technological objects has been exceeded" },
    { 0xD2C1,                               "The same technology data block already exists on the module" },
    { 0xD2C2,                               "Downloading the user program or downloading the hardware configuration is not possible" },
    { 0xD401,                               "Information function unavailable" },
    { 0xD402,                               "Information function unavailable" },
    { 0xD403,                               "Service has already been logged on/off (Diagnostics/PMC)" },
    { 0xD404,                               "Maximum number of nodes reached. No more logons possible for diagnostics/PMC" },
    { 0xD405,                               "Service not supported or syntax error in function parameters" },
    { 0xD406,                               "Required information currently unavailable" },
    { 0xD407,                               "Diagnostics error occurred" },
    { 0xD408,                               "Update aborted" },
    { 0xD409,                               "Error on DP bus" },
    { 0xD601,                               "Syntax error in function parameter" },
    { 0xD602,                               "Incorrect password entered" },
    { 0xD603,                               "The connection has already been legitimized" },
    { 0xD604,                               "The connection has already been enabled" },
    { 0xD605,                               "Legitimization not possible because password does not exist" },
    { 0xD801,                               "At least one tag address is invalid" },
    { 0xD802,                               "Specified job does not exist" },
    { 0xD803,                               "Illegal job status" },
    { 0xD804,                               "Illegal cycle time (illegal time base or multiple)" },
    { 0xD805,                               "No more cyclic read jobs can be set up" },
    { 0xD806,                               "The referenced job is in a state in which the requested function cannot be performed" },
    { 0xD807,                               "Function aborted due to overload, meaning executing the read cycle takes longer than the set scan cycle time" },
    { 0xDC01,                               "Date and/or time invalid" },
    { 0xE201,                               "CPU is already the master" },
    { 0xE202,                               "Connect and update not possible due to different user program in flash module" },
    { 0xE203,                               "Connect and update not possible due to different firmware" },
    { 0xE204,                               "Connect and update not possible due to different memory configuration" },
    { 0xE205,                               "Connect/update aborted due to synchronization error" },
    { 0xE206,                               "Connect/update denied due to coordination violation" },
    { 0xEF01,                               "S7 protocol error: Error at ID2; only 00H permitted in job" },
    { 0xEF02,                               "S7 protocol error: Error at ID2; set of resources does not exist" },
    { 0,                                    NULL }
};
static value_string_ext param_errcode_names_ext = VALUE_STRING_EXT_INIT(param_errcode_names);

/**************************************************************************
 * Function codes in parameter part
 */
#define S7COMM_SERV_CPU                     0x00
#define S7COMM_SERV_MODETRANS               0x01
#define S7COMM_SERV_SETUPCOMM               0xF0
#define S7COMM_SERV_READVAR                 0x04
#define S7COMM_SERV_WRITEVAR                0x05

#define S7COMM_FUNCREQUESTDOWNLOAD          0x1A
#define S7COMM_FUNCDOWNLOADBLOCK            0x1B
#define S7COMM_FUNCDOWNLOADENDED            0x1C
#define S7COMM_FUNCSTARTUPLOAD              0x1D
#define S7COMM_FUNCUPLOAD                   0x1E
#define S7COMM_FUNCENDUPLOAD                0x1F
#define S7COMM_FUNCPISERVICE                0x28
#define S7COMM_FUNC_PLC_STOP                0x29

static const value_string param_functionnames[] = {
    { S7COMM_SERV_CPU,                      "CPU services" },
    { S7COMM_SERV_MODETRANS,                "Mode transition" },
    { S7COMM_SERV_SETUPCOMM,                "Setup communication" },
    { S7COMM_SERV_READVAR,                  "Read Var" },
    { S7COMM_SERV_WRITEVAR,                 "Write Var" },
    /* Block management services */
    { S7COMM_FUNCREQUESTDOWNLOAD,           "Request download" },
    { S7COMM_FUNCDOWNLOADBLOCK,             "Download block" },
    { S7COMM_FUNCDOWNLOADENDED,             "Download ended" },
    { S7COMM_FUNCSTARTUPLOAD,               "Start upload" },
    { S7COMM_FUNCUPLOAD,                    "Upload" },
    { S7COMM_FUNCENDUPLOAD,                 "End upload" },
    { S7COMM_FUNCPISERVICE,                 "PI-Service" },
    { S7COMM_FUNC_PLC_STOP,                 "PLC Stop" },
    { 0,                                    NULL }
};
/**************************************************************************
 * Area names
 */
#define S7COMM_AREA_DATARECORD              0x01        /* Data record, used with RDREC or firmware updates on CP */
#define S7COMM_AREA_SYSINFO                 0x03        /* System info of 200 family */
#define S7COMM_AREA_SYSFLAGS                0x05        /* System flags of 200 family */
#define S7COMM_AREA_ANAIN                   0x06        /* analog inputs of 200 family */
#define S7COMM_AREA_ANAOUT                  0x07        /* analog outputs of 200 family */
#define S7COMM_AREA_P                       0x80        /* direct peripheral access */
#define S7COMM_AREA_INPUTS                  0x81
#define S7COMM_AREA_OUTPUTS                 0x82
#define S7COMM_AREA_FLAGS                   0x83
#define S7COMM_AREA_DB                      0x84        /* data blocks */
#define S7COMM_AREA_DI                      0x85        /* instance data blocks */
#define S7COMM_AREA_LOCAL                   0x86        /* local data (should not be accessible over network) */
#define S7COMM_AREA_V                       0x87        /* previous (Vorgaenger) local data (should not be accessible over network)  */
#define S7COMM_AREA_COUNTER                 28          /* S7 counters */
#define S7COMM_AREA_TIMER                   29          /* S7 timers */
#define S7COMM_AREA_COUNTER200              30          /* IEC counters (200 family) */
#define S7COMM_AREA_TIMER200                31          /* IEC timers (200 family) */

static const value_string item_areanames[] = {
    { S7COMM_AREA_DATARECORD,               "Data record" },
    { S7COMM_AREA_SYSINFO,                  "System info of 200 family" },
    { S7COMM_AREA_SYSFLAGS,                 "System flags of 200 family" },
    { S7COMM_AREA_ANAIN,                    "Analog inputs of 200 family" },
    { S7COMM_AREA_ANAOUT,                   "Analog outputs of 200 family" },
    { S7COMM_AREA_P,                        "Direct peripheral access (P)" },
    { S7COMM_AREA_INPUTS,                   "Inputs (I)" },
    { S7COMM_AREA_OUTPUTS,                  "Outputs (Q)" },
    { S7COMM_AREA_FLAGS,                    "Flags (M)" },
    { S7COMM_AREA_DB,                       "Data blocks (DB)" },
    { S7COMM_AREA_DI,                       "Instance data blocks (DI)" },
    { S7COMM_AREA_LOCAL,                    "Local data (L)" },
    { S7COMM_AREA_V,                        "Unknown yet (V)" },
    { S7COMM_AREA_COUNTER,                  "S7 counters (C)" },
    { S7COMM_AREA_TIMER,                    "S7 timers (T)" },
    { S7COMM_AREA_COUNTER200,               "IEC counters (200 family)" },
    { S7COMM_AREA_TIMER200,                 "IEC timers (200 family)" },
    { 0,                                    NULL }
};

static const value_string item_areanames_short[] = {
    { S7COMM_AREA_DATARECORD,               "RECORD" },
    { S7COMM_AREA_SYSINFO,                  "SI200" },
    { S7COMM_AREA_SYSFLAGS,                 "SF200" },
    { S7COMM_AREA_ANAIN,                    "AI200" },
    { S7COMM_AREA_ANAOUT,                   "AO" },
    { S7COMM_AREA_P,                        "P" },
    { S7COMM_AREA_INPUTS,                   "I" },
    { S7COMM_AREA_OUTPUTS,                  "Q" },
    { S7COMM_AREA_FLAGS,                    "M" },
    { S7COMM_AREA_DB,                       "DB" },
    { S7COMM_AREA_DI,                       "DI" },
    { S7COMM_AREA_LOCAL,                    "L" },
    { S7COMM_AREA_V,                        "V" },
    { S7COMM_AREA_COUNTER,                  "C" },
    { S7COMM_AREA_TIMER,                    "T" },
    { S7COMM_AREA_COUNTER200,               "C200" },
    { S7COMM_AREA_TIMER200,                 "T200" },
    { 0,                                    NULL }
};
/**************************************************************************
 * Transport sizes in item data
 */
    /* types of 1 byte length */
#define S7COMM_TRANSPORT_SIZE_BIT           1
#define S7COMM_TRANSPORT_SIZE_BYTE          2
#define S7COMM_TRANSPORT_SIZE_CHAR          3
    /* types of 2 bytes length */
#define S7COMM_TRANSPORT_SIZE_WORD          4
#define S7COMM_TRANSPORT_SIZE_INT           5
    /* types of 4 bytes length */
#define S7COMM_TRANSPORT_SIZE_DWORD         6
#define S7COMM_TRANSPORT_SIZE_DINT          7
#define S7COMM_TRANSPORT_SIZE_REAL          8
    /* Special types */
#define S7COMM_TRANSPORT_SIZE_DATE          9
#define S7COMM_TRANSPORT_SIZE_TOD           10
#define S7COMM_TRANSPORT_SIZE_TIME          11
#define S7COMM_TRANSPORT_SIZE_S5TIME        12
#define S7COMM_TRANSPORT_SIZE_DT            15
    /* Timer or counter */
#define S7COMM_TRANSPORT_SIZE_COUNTER       28
#define S7COMM_TRANSPORT_SIZE_TIMER         29
#define S7COMM_TRANSPORT_SIZE_IEC_COUNTER   30
#define S7COMM_TRANSPORT_SIZE_IEC_TIMER     31
#define S7COMM_TRANSPORT_SIZE_HS_COUNTER    32
static const value_string item_transportsizenames[] = {
    { S7COMM_TRANSPORT_SIZE_BIT,            "BIT" },
    { S7COMM_TRANSPORT_SIZE_BYTE,           "BYTE" },
    { S7COMM_TRANSPORT_SIZE_CHAR,           "CHAR" },
    { S7COMM_TRANSPORT_SIZE_WORD,           "WORD" },
    { S7COMM_TRANSPORT_SIZE_INT,            "INT" },
    { S7COMM_TRANSPORT_SIZE_DWORD,          "DWORD" },
    { S7COMM_TRANSPORT_SIZE_DINT,           "DINT" },
    { S7COMM_TRANSPORT_SIZE_REAL,           "REAL" },
    { S7COMM_TRANSPORT_SIZE_TOD,            "TOD" },
    { S7COMM_TRANSPORT_SIZE_TIME,           "TIME" },
    { S7COMM_TRANSPORT_SIZE_S5TIME,         "S5TIME" },
    { S7COMM_TRANSPORT_SIZE_DT,             "DATE_AND_TIME" },
    { S7COMM_TRANSPORT_SIZE_COUNTER,        "COUNTER" },
    { S7COMM_TRANSPORT_SIZE_TIMER,          "TIMER" },
    { S7COMM_TRANSPORT_SIZE_IEC_COUNTER,    "IEC TIMER" },
    { S7COMM_TRANSPORT_SIZE_IEC_TIMER,      "IEC COUNTER" },
    { S7COMM_TRANSPORT_SIZE_HS_COUNTER,     "HS COUNTER" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Syntax Ids of variable specification
 */
#define S7COMM_SYNTAXID_S7ANY               0x10        /* Address data S7-Any pointer-like DB1.DBX10.2 */
#define S7COMM_SYNTAXID_SHORT               0x11
#define S7COMM_SYNTAXID_EXT                 0x12
#define S7COMM_SYNTAXID_PBC_ID              0x13        /* R_ID for PBC */
#define S7COMM_SYNTAXID_ALARM_LOCKFREESET   0x15        /* Alarm lock/free dataset */
#define S7COMM_SYNTAXID_ALARM_INDSET        0x16        /* Alarm indication dataset */
#define S7COMM_SYNTAXID_ALARM_ACKSET        0x19        /* Alarm acknowledge message dataset */
#define S7COMM_SYNTAXID_ALARM_QUERYREQSET   0x1a        /* Alarm query request dataset */
#define S7COMM_SYNTAXID_NOTIFY_INDSET       0x1c        /* Notify indication dataset */
#define S7COMM_SYNTAXID_NCK                 0x82        /* Sinumerik NCK HMI access (current units) */
#define S7COMM_SYNTAXID_NCK_METRIC          0x83        /* Sinumerik NCK HMI access metric units */
#define S7COMM_SYNTAXID_NCK_INCH            0x84        /* Sinumerik NCK HMI access inch */
#define S7COMM_SYNTAXID_DRIVEESANY          0xa2        /* seen on Drive ES Starter with routing over S7 */
#define S7COMM_SYNTAXID_1200SYM             0xb2        /* Symbolic address mode of S7-1200 */
#define S7COMM_SYNTAXID_DBREAD              0xb0        /* Kind of DB block read, seen only at an S7-400 */

static const value_string item_syntaxid_names[] = {
    { S7COMM_SYNTAXID_S7ANY,                "S7ANY" },
    { S7COMM_SYNTAXID_SHORT,                "ParameterShort" },
    { S7COMM_SYNTAXID_EXT,                  "ParameterExtended" },
    { S7COMM_SYNTAXID_PBC_ID,               "PBC-R_ID" },
    { S7COMM_SYNTAXID_ALARM_LOCKFREESET,    "ALARM_LOCKFREE" },
    { S7COMM_SYNTAXID_ALARM_INDSET,         "ALARM_IND" },
    { S7COMM_SYNTAXID_ALARM_ACKSET,         "ALARM_ACK" },
    { S7COMM_SYNTAXID_ALARM_QUERYREQSET,    "ALARM_QUERYREQ" },
    { S7COMM_SYNTAXID_NOTIFY_INDSET,        "NOTIFY_IND" },
    { S7COMM_SYNTAXID_NCK,                  "NCK" },
    { S7COMM_SYNTAXID_NCK_METRIC,           "NCK_M" },
    { S7COMM_SYNTAXID_NCK_INCH,             "NCK_I" },
    { S7COMM_SYNTAXID_DRIVEESANY,           "DRIVEESANY" },
    { S7COMM_SYNTAXID_1200SYM,              "1200SYM" },
    { S7COMM_SYNTAXID_DBREAD,               "DBREAD" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Transport sizes in data
 */
#define S7COMM_DATA_TRANSPORT_SIZE_NULL     0
#define S7COMM_DATA_TRANSPORT_SIZE_BBIT     3           /* bit access, len is in bits */
#define S7COMM_DATA_TRANSPORT_SIZE_BBYTE    4           /* byte/word/dword access, len is in bits */
#define S7COMM_DATA_TRANSPORT_SIZE_BINT     5           /* integer access, len is in bits */
#define S7COMM_DATA_TRANSPORT_SIZE_BDINT    6           /* integer access, len is in bytes */
#define S7COMM_DATA_TRANSPORT_SIZE_BREAL    7           /* real access, len is in bytes */
#define S7COMM_DATA_TRANSPORT_SIZE_BSTR     9           /* octet string, len is in bytes */
#define S7COMM_DATA_TRANSPORT_SIZE_NCKADDR1 17          /* NCK address description, fixed length */
#define S7COMM_DATA_TRANSPORT_SIZE_NCKADDR2 18          /* NCK address description, fixed length */

static const value_string data_transportsizenames[] = {
    { S7COMM_DATA_TRANSPORT_SIZE_NULL,      "NULL" },
    { S7COMM_DATA_TRANSPORT_SIZE_BBIT,      "BIT" },
    { S7COMM_DATA_TRANSPORT_SIZE_BBYTE,     "BYTE/WORD/DWORD" },
    { S7COMM_DATA_TRANSPORT_SIZE_BINT,      "INTEGER" },
    { S7COMM_DATA_TRANSPORT_SIZE_BDINT,     "DINTEGER" },
    { S7COMM_DATA_TRANSPORT_SIZE_BREAL,     "REAL" },
    { S7COMM_DATA_TRANSPORT_SIZE_BSTR,      "OCTET STRING" },
    { S7COMM_DATA_TRANSPORT_SIZE_NCKADDR1,  "NCK ADDRESS1" },
    { S7COMM_DATA_TRANSPORT_SIZE_NCKADDR2,  "NCK ADDRESS2" },
    { 0,                                    NULL }
};
/**************************************************************************
 * Returnvalues of an item response
 */

const value_string s7comm_item_return_valuenames[] = {
    { S7COMM_ITEM_RETVAL_RESERVED,              "Reserved" },
    { S7COMM_ITEM_RETVAL_DATA_HW_FAULT,         "Hardware error" },
    { S7COMM_ITEM_RETVAL_DATA_ACCESS_FAULT,     "Accessing the object not allowed" },
    { S7COMM_ITEM_RETVAL_DATA_OUTOFRANGE,       "Invalid address" },
    { S7COMM_ITEM_RETVAL_DATA_NOT_SUP,          "Data type not supported" },
    { S7COMM_ITEM_RETVAL_DATA_SIZEMISMATCH,     "Data type inconsistent" },
    { S7COMM_ITEM_RETVAL_DATA_ERR,              "Object does not exist" },
    { S7COMM_ITEM_RETVAL_DATA_OK,               "Success" },
    { 0,                                        NULL }
};
/**************************************************************************
 * Block Types, used when blocktype is transferred as string
 */
#define S7COMM_BLOCKTYPE_OB                 0x3038      /* '08' */
#define S7COMM_BLOCKTYPE_CMOD               0x3039      /* '09' */
#define S7COMM_BLOCKTYPE_DB                 0x3041      /* '0A' */
#define S7COMM_BLOCKTYPE_SDB                0x3042      /* '0B' */
#define S7COMM_BLOCKTYPE_FC                 0x3043      /* '0C' */
#define S7COMM_BLOCKTYPE_SFC                0x3044      /* '0D' */
#define S7COMM_BLOCKTYPE_FB                 0x3045      /* '0E' */
#define S7COMM_BLOCKTYPE_SFB                0x3046      /* '0F' */

static const value_string blocktype_names[] = {
    { S7COMM_BLOCKTYPE_OB,                  "OB" },
    { S7COMM_BLOCKTYPE_CMOD,                "CMod" },
    { S7COMM_BLOCKTYPE_DB,                  "DB" },
    { S7COMM_BLOCKTYPE_SDB,                 "SDB" },
    { S7COMM_BLOCKTYPE_FC,                  "FC" },
    { S7COMM_BLOCKTYPE_SFC,                 "SFC" },
    { S7COMM_BLOCKTYPE_FB,                  "FB" },
    { S7COMM_BLOCKTYPE_SFB,                 "SFB" },
    { 0,                                    NULL }
};


static const value_string blocktype_attribute1_names[] = {
    { '_',                                  "Complete Module" },
    { '$',                                  "Module header for up-loading" },
    { 0,                                    NULL }
};

static const value_string blocktype_attribute2_names[] = {
    { 'P',                                  "Passive (copied, but not chained) module" },
    { 'A',                                  "Active embedded module" },
    { 'B',                                  "Active as well as passive module" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Subblk types
 */
#define S7COMM_SUBBLKTYPE_NONE              0x00
#define S7COMM_SUBBLKTYPE_OB                0x08
#define S7COMM_SUBBLKTYPE_DB                0x0a
#define S7COMM_SUBBLKTYPE_SDB               0x0b
#define S7COMM_SUBBLKTYPE_FC                0x0c
#define S7COMM_SUBBLKTYPE_SFC               0x0d
#define S7COMM_SUBBLKTYPE_FB                0x0e
#define S7COMM_SUBBLKTYPE_SFB               0x0f

static const value_string subblktype_names[] = {
    { S7COMM_SUBBLKTYPE_NONE,               "Not set" },
    { S7COMM_SUBBLKTYPE_OB,                 "OB" },
    { S7COMM_SUBBLKTYPE_DB,                 "DB" },
    { S7COMM_SUBBLKTYPE_SDB,                "SDB" },
    { S7COMM_SUBBLKTYPE_FC,                 "FC" },
    { S7COMM_SUBBLKTYPE_SFC,                "SFC" },
    { S7COMM_SUBBLKTYPE_FB,                 "FB" },
    { S7COMM_SUBBLKTYPE_SFB,                "SFB" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Block security
 */
#define S7COMM_BLOCKSECURITY_OFF            0
#define S7COMM_BLOCKSECURITY_KNOWHOWPROTECT 3

static const value_string blocksecurity_names[] = {
    { S7COMM_BLOCKSECURITY_OFF,             "None" },
    { S7COMM_BLOCKSECURITY_KNOWHOWPROTECT,  "Know How Protect" },
    { 0,                                    NULL }
};
/**************************************************************************
 * Block Languages
 */
static const value_string blocklanguage_names[] = {
    { 0x00,                                 "Not defined" },
    { 0x01,                                 "AWL" },
    { 0x02,                                 "KOP" },
    { 0x03,                                 "FUP" },
    { 0x04,                                 "SCL" },
    { 0x05,                                 "DB" },
    { 0x06,                                 "GRAPH" },
    { 0x07,                                 "SDB" },
    { 0x08,                                 "CPU-DB" },                     /* DB was created from Plc programm (CREAT_DB) */
    { 0x11,                                 "SDB (after overall reset)" },  /* another SDB, don't know what it means, in SDB 1 and SDB 2, uncertain*/
    { 0x12,                                 "SDB (Routing)" },              /* another SDB, in SDB 999 and SDB 1000 (routing information), uncertain */
    { 0x29,                                 "ENCRYPT" },                    /* block is encrypted with S7-Block-Privacy */
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of types in userdata parameter part
 */

static const value_string userdata_type_names[] = {
    { S7COMM_UD_TYPE_IND,                   "Indication" },
    { S7COMM_UD_TYPE_REQ,                   "Request" },
    { S7COMM_UD_TYPE_RES,                   "Response" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Subfunctions only used in Sinumerik NC file download
 */
#define S7COMM_NCPRG_FUNCREQUESTDOWNLOAD    1
#define S7COMM_NCPRG_FUNCDOWNLOADBLOCK      2
#define S7COMM_NCPRG_FUNCCONTDOWNLOAD       3
#define S7COMM_NCPRG_FUNCDOWNLOADENDED      4
#define S7COMM_NCPRG_FUNCSTARTUPLOAD        6
#define S7COMM_NCPRG_FUNCUPLOAD             7
#define S7COMM_NCPRG_FUNCCONTUPLOAD         8

static const value_string userdata_ncprg_subfunc_names[] = {
    { S7COMM_NCPRG_FUNCREQUESTDOWNLOAD,     "Request download" },
    { S7COMM_NCPRG_FUNCDOWNLOADBLOCK,       "Download block" },
    { S7COMM_NCPRG_FUNCCONTDOWNLOAD,        "Continue download" },
    { S7COMM_NCPRG_FUNCDOWNLOADENDED,       "Download ended" },
    { S7COMM_NCPRG_FUNCSTARTUPLOAD,         "Start upload" },
    { S7COMM_NCPRG_FUNCUPLOAD,              "Upload" },
    { S7COMM_NCPRG_FUNCCONTUPLOAD,          "Continue upload" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Subfunctions for Data Record Routing to Profibus
 */
#define S7COMM_DRR_FUNCINIT                 1
#define S7COMM_DRR_FUNCFINISH               2
#define S7COMM_DRR_FUNCDATA                 3

static const value_string userdata_drr_subfunc_names[] = {
    { S7COMM_DRR_FUNCINIT,                  "DRR Init" },
    { S7COMM_DRR_FUNCFINISH,                "DRR Finish" },
    { S7COMM_DRR_FUNCDATA,                  "DRR Data" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Userdata Parameter, last data unit
 */
#define S7COMM_UD_LASTDATAUNIT_YES          0x00
#define S7COMM_UD_LASTDATAUNIT_NO           0x01

static const value_string userdata_lastdataunit_names[] = {
    { S7COMM_UD_LASTDATAUNIT_YES,           "Yes" },
    { S7COMM_UD_LASTDATAUNIT_NO,            "No" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of Function groups in userdata parameter part
 */
#define S7COMM_UD_FUNCGROUP_TIS             0x01
#define S7COMM_UD_FUNCGROUP_CYCLIC          0x02
#define S7COMM_UD_FUNCGROUP_BLOCK           0x03
#define S7COMM_UD_FUNCGROUP_CPU             0x04
#define S7COMM_UD_FUNCGROUP_SEC             0x05                    /* Security functions e.g. plc password */
#define S7COMM_UD_FUNCGROUP_PBC_BSEND       0x06                    /* PBC = Programmable Block Communication (PBK in german) */
#define S7COMM_UD_FUNCGROUP_TIME            0x07
#define S7COMM_UD_FUNCGROUP_NCPRG           0x3f
#define S7COMM_UD_FUNCGROUP_DRR             0x20

static const value_string userdata_functiongroup_names[] = {
    { S7COMM_UD_FUNCGROUP_TIS,              "Programmer commands" },
    { S7COMM_UD_FUNCGROUP_CYCLIC,           "Cyclic services" },    /* to read data from plc without a request */
    { S7COMM_UD_FUNCGROUP_BLOCK,            "Block functions" },
    { S7COMM_UD_FUNCGROUP_CPU,              "CPU functions" },
    { S7COMM_UD_FUNCGROUP_SEC,              "Security" },
    { S7COMM_UD_FUNCGROUP_PBC_BSEND,        "PBC BSEND" },
    { S7COMM_UD_FUNCGROUP_TIME,             "Time functions" },
    { S7COMM_UD_FUNCGROUP_NCPRG,            "NC programming" },
    { S7COMM_UD_FUNCGROUP_DRR,              "DR Routing" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Variable status: Area of data request
 *
 * Low       Hi
 * 0=M       0=BOOL
 * 1=E       1=BYTE
 * 2=A       2=WORD
 * 3=PEx     3=DWORD
 * 7=DB
 * 54=TIMER
 * 64=COUNTER
 */
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MX      0x00
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MB      0x01
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MW      0x02
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MD      0x03
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EX      0x10
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EB      0x11
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EW      0x12
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_ED      0x13
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AX      0x20
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AB      0x21
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AW      0x22
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AD      0x23
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEB     0x31
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEW     0x32
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PED     0x33
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBX     0x70
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBB     0x71
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBW     0x72
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBD     0x73
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_T       0x54
#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_C       0x64

static const value_string userdata_tis_varstat_area_names[] = {
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MX,       "MX" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MB,       "MB" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MW,       "MW" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MD,       "MD" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EB,       "IB" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EX,       "IX" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EW,       "IW" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_ED,       "ID" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AX,       "QX" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AB,       "QB" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AW,       "QW" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AD,       "QD" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEB,      "PIB" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEW,      "PIW" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PED,      "PID" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBX,      "DBX" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBB,      "DBB" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBW,      "DBW" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBD,      "DBD" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_T,        "TIMER" },
    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_C,        "COUNTER" },
    { 0,                                        NULL }
};

/**************************************************************************
 * Names of userdata subfunctions in group 1 (Programmer commands)
 * In szl dataset 0x0132/2 these are defined as "Test and installation functions TIS".
 * The methods supported by the CPU are listed in the funkt_n bits.
 */
#define S7COMM_UD_SUBF_TIS_BLOCKSTAT        0x01
#define S7COMM_UD_SUBF_TIS_VARSTAT          0x02
#define S7COMM_UD_SUBF_TIS_OUTISTACK        0x03
#define S7COMM_UD_SUBF_TIS_OUTBSTACK        0x04
#define S7COMM_UD_SUBF_TIS_OUTLSTACK        0x05
#define S7COMM_UD_SUBF_TIS_TIMEMEAS         0x06
#define S7COMM_UD_SUBF_TIS_FORCESEL         0x07
#define S7COMM_UD_SUBF_TIS_MODVAR           0x08
#define S7COMM_UD_SUBF_TIS_FORCE            0x09
#define S7COMM_UD_SUBF_TIS_BREAKPOINT       0x0a
#define S7COMM_UD_SUBF_TIS_EXITHOLD         0x0b
#define S7COMM_UD_SUBF_TIS_MEMORYRES        0x0c
#define S7COMM_UD_SUBF_TIS_DISABLEJOB       0x0d
#define S7COMM_UD_SUBF_TIS_ENABLEJOB        0x0e
#define S7COMM_UD_SUBF_TIS_DELETEJOB        0x0f
#define S7COMM_UD_SUBF_TIS_READJOBLIST      0x10
#define S7COMM_UD_SUBF_TIS_READJOB          0x11
#define S7COMM_UD_SUBF_TIS_REPLACEJOB       0x12
#define S7COMM_UD_SUBF_TIS_BLOCKSTAT2       0x13
#define S7COMM_UD_SUBF_TIS_FLASHLED         0x16

static const value_string userdata_tis_subfunc_names[] = {
    { S7COMM_UD_SUBF_TIS_BLOCKSTAT,         "Block status" },
    { S7COMM_UD_SUBF_TIS_VARSTAT,           "Variable status" },
    { S7COMM_UD_SUBF_TIS_OUTISTACK,         "Output ISTACK" },
    { S7COMM_UD_SUBF_TIS_OUTBSTACK,         "Output BSTACK" },
    { S7COMM_UD_SUBF_TIS_OUTLSTACK,         "Output LSTACK" },
    { S7COMM_UD_SUBF_TIS_TIMEMEAS,          "Time measurement from to" },       /* never seen yet */
    { S7COMM_UD_SUBF_TIS_FORCESEL,          "Force selection" },
    { S7COMM_UD_SUBF_TIS_MODVAR,            "Modify variable" },
    { S7COMM_UD_SUBF_TIS_FORCE,             "Force" },
    { S7COMM_UD_SUBF_TIS_BREAKPOINT,        "Breakpoint" },
    { S7COMM_UD_SUBF_TIS_EXITHOLD,          "Exit HOLD" },
    { S7COMM_UD_SUBF_TIS_MEMORYRES,         "Memory reset" },
    { S7COMM_UD_SUBF_TIS_DISABLEJOB,        "Disable job" },
    { S7COMM_UD_SUBF_TIS_ENABLEJOB,         "Enable job" },
    { S7COMM_UD_SUBF_TIS_DELETEJOB,         "Delete job" },
    { S7COMM_UD_SUBF_TIS_READJOBLIST,       "Read job list" },
    { S7COMM_UD_SUBF_TIS_READJOB,           "Read job" },
    { S7COMM_UD_SUBF_TIS_REPLACEJOB,        "Replace job" },
    { S7COMM_UD_SUBF_TIS_BLOCKSTAT2,        "Block status v2" },
    { S7COMM_UD_SUBF_TIS_FLASHLED,          "Flash LED" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Variable status: Trigger point
 */
static const value_string userdata_varstat_trgevent_names[] = {
    { 0x0000,                               "Immediately" },
    { 0x0100,                               "System Trigger" },
    { 0x0200,                               "System checkpoint main cycle start" },
    { 0x0300,                               "System checkpoint main cycle end" },
    { 0x0400,                               "Mode transition RUN-STOP" },
    { 0x0500,                               "After code address" },
    { 0x0600,                               "Code address area" },
    { 0x0601,                               "Code address area with call environment" },  /* Call conditions like opened DB/DI or called block */
    { 0x0700,                               "Data address" },
    { 0x0800,                               "Data address area" },
    { 0x0900,                               "Local data address" },
    { 0x0a00,                               "Local data address area" },
    { 0x0b00,                               "Range trigger" },
    { 0x0c00,                               "Before code address" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of userdata subfunctions in group 2 (cyclic data)
 */
#define S7COMM_UD_SUBF_CYCLIC_TRANSF        0x01
#define S7COMM_UD_SUBF_CYCLIC_UNSUBSCRIBE   0x04
#define S7COMM_UD_SUBF_CYCLIC_CHANGE        0x05
#define S7COMM_UD_SUBF_CYCLIC_CHANGE_MOD    0x07
#define S7COMM_UD_SUBF_CYCLIC_RDREC         0x08

static const value_string userdata_cyclic_subfunc_names[] = {
    { S7COMM_UD_SUBF_CYCLIC_TRANSF,         "Cyclic transfer" },
    { S7COMM_UD_SUBF_CYCLIC_UNSUBSCRIBE,    "Unsubscribe" },
    { S7COMM_UD_SUBF_CYCLIC_CHANGE,         "Change driven transfer" },
    { S7COMM_UD_SUBF_CYCLIC_CHANGE_MOD,     "Change driven transfer modify" },
    { S7COMM_UD_SUBF_CYCLIC_RDREC,          "RDREC" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Timebase for cyclic services
 */
static const value_string cycl_interval_timebase_names[] = {
    { 0,                                    "100 milliseconds" },
    { 1,                                    "1 second" },
    { 2,                                    "10 seconds" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of userdata subfunctions in group 3 (Block functions)
 */
#define S7COMM_UD_SUBF_BLOCK_LIST           0x01
#define S7COMM_UD_SUBF_BLOCK_LISTTYPE       0x02
#define S7COMM_UD_SUBF_BLOCK_BLOCKINFO      0x03

static const value_string userdata_block_subfunc_names[] = {
    { S7COMM_UD_SUBF_BLOCK_LIST,            "List blocks" },
    { S7COMM_UD_SUBF_BLOCK_LISTTYPE,        "List blocks of type" },
    { S7COMM_UD_SUBF_BLOCK_BLOCKINFO,       "Get block info" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of userdata subfunctions in group 4 (CPU functions)
 */
#define S7COMM_UD_SUBF_CPU_SCAN_IND         0x09
#define S7COMM_UD_SUBF_CPU_AR_SEND_IND      0x10

static const value_string userdata_cpu_subfunc_names[] = {
    { S7COMM_UD_SUBF_CPU_READSZL,           "Read SZL" },
    { S7COMM_UD_SUBF_CPU_MSGS,              "Message service" },                /* Header constant is also different here */
    { S7COMM_UD_SUBF_CPU_DIAGMSG,           "Diagnostic message" },             /* Diagnostic message from PLC */
    { S7COMM_UD_SUBF_CPU_ALARM8_IND,        "ALARM_8 indication" },             /* PLC is indicating an ALARM message, using ALARM_8 SFBs */
    { S7COMM_UD_SUBF_CPU_NOTIFY_IND,        "NOTIFY indication" },              /* PLC is indicating a NOTIFY message, using NOTIFY SFBs */
    { S7COMM_UD_SUBF_CPU_ALARM8LOCK,        "ALARM_8 lock" },                   /* Lock an ALARM message from HMI/SCADA */
    { S7COMM_UD_SUBF_CPU_ALARM8UNLOCK,      "ALARM_8 unlock" },                 /* Unlock an ALARM message from HMI/SCADA */
    { S7COMM_UD_SUBF_CPU_SCAN_IND,          "SCAN indication" },                /* PLC is indicating a SCAN message */
    { S7COMM_UD_SUBF_CPU_AR_SEND_IND,       "AR_SEND indication" },             /* PLC is indicating a AR_SEND message */
    { S7COMM_UD_SUBF_CPU_ALARMS_IND,        "ALARM_S indication" },             /* PLC is indicating an ALARM message, using ALARM_S/ALARM_D SFCs */
    { S7COMM_UD_SUBF_CPU_ALARMSQ_IND,       "ALARM_SQ indication" },            /* PLC is indicating an ALARM message, using ALARM_SQ/ALARM_DQ SFCs */
    { S7COMM_UD_SUBF_CPU_ALARMQUERY,        "ALARM query" },                    /* HMI/SCADA query of ALARMs */
    { S7COMM_UD_SUBF_CPU_ALARMACK,          "ALARM ack" },                      /* Alarm was acknowledged in HMI/SCADA */
    { S7COMM_UD_SUBF_CPU_ALARMACK_IND,      "ALARM ack indication" },           /* Alarm acknowledge indication from CPU to HMI */
    { S7COMM_UD_SUBF_CPU_ALARM8LOCK_IND,    "ALARM lock indication" },          /* Alarm lock indication from CPU to HMI */
    { S7COMM_UD_SUBF_CPU_ALARM8UNLOCK_IND,  "ALARM unlock indication" },        /* Alarm unlock indication from CPU to HMI */
    { S7COMM_UD_SUBF_CPU_NOTIFY8_IND,       "NOTIFY_8 indication" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of userdata subfunctions in group 5 (Security?)
 */
#define S7COMM_UD_SUBF_SEC_PASSWD           0x01

static const value_string userdata_sec_subfunc_names[] = {
    { S7COMM_UD_SUBF_SEC_PASSWD,            "PLC password" },
    { 0,                                    NULL }
};

/**************************************************************************
 * Names of userdata subfunctions in group 7 (Time functions)
 */
#define S7COMM_UD_SUBF_TIME_READ            0x01
#define S7COMM_UD_SUBF_TIME_SET             0x02
#define S7COMM_UD_SUBF_TIME_READF           0x03
#define S7COMM_UD_SUBF_TIME_SET2            0x04

static const value_string userdata_time_subfunc_names[] = {
    { S7COMM_UD_SUBF_TIME_READ,             "Read clock" },
    { S7COMM_UD_SUBF_TIME_SET,              "Set clock" },
    { S7COMM_UD_SUBF_TIME_READF,            "Read clock (following)" },
    { S7COMM_UD_SUBF_TIME_SET2,             "Set clock" },
    { 0,                                    NULL }
};

/*******************************************************************************************************
 * Weekday names in DATE_AND_TIME
 */
static const value_string weekdaynames[] = {
    { 0,                                    "Undefined" },
    { 1,                                    "Sunday" },
    { 2,                                    "Monday" },
    { 3,                                    "Tuesday" },
    { 4,                                    "Wednesday" },
    { 5,                                    "Thursday" },
    { 6,                                    "Friday" },
    { 7,                                    "Saturday" },
    { 0,                                    NULL }
};

/**************************************************************************
 **************************************************************************/

/**************************************************************************
 * Flags for LID access
 */
#define S7COMM_TIA1200_VAR_ENCAPS_LID       0x2
#define S7COMM_TIA1200_VAR_ENCAPS_IDX       0x3
#define S7COMM_TIA1200_VAR_OBTAIN_LID       0x4
#define S7COMM_TIA1200_VAR_OBTAIN_IDX       0x5
#define S7COMM_TIA1200_VAR_PART_START       0x6
#define S7COMM_TIA1200_VAR_PART_LEN         0x7

static const value_string tia1200_var_lid_flag_names[] = {
    { S7COMM_TIA1200_VAR_ENCAPS_LID,        "Encapsulated LID" },
    { S7COMM_TIA1200_VAR_ENCAPS_IDX,        "Encapsulated Index" },
    { S7COMM_TIA1200_VAR_OBTAIN_LID,        "Obtain by LID" },
    { S7COMM_TIA1200_VAR_OBTAIN_IDX,        "Obtain by Index" },
    { S7COMM_TIA1200_VAR_PART_START,        "Part Start Address" },
    { S7COMM_TIA1200_VAR_PART_LEN,          "Part Length" },
    { 0,                                    NULL }
};

/**************************************************************************
 * TIA 1200 Area Names for variable access
 */
#define S7COMM_TIA1200_VAR_ITEM_AREA1_DB    0x8a0e              /* Reading DB, 2 byte DB-Number following */
#define S7COMM_TIA1200_VAR_ITEM_AREA1_IQMCT 0x0000              /* Reading I/Q/M/C/T, 2 Byte detail area following */

static const value_string tia1200_var_item_area1_names[] = {
    { S7COMM_TIA1200_VAR_ITEM_AREA1_DB,     "DB" },
    { S7COMM_TIA1200_VAR_ITEM_AREA1_IQMCT,  "IQMCT" },
    { 0,                                    NULL }
};

#define S7COMM_TIA1200_VAR_ITEM_AREA2_I     0x50
#define S7COMM_TIA1200_VAR_ITEM_AREA2_Q     0x51
#define S7COMM_TIA1200_VAR_ITEM_AREA2_M     0x52
#define S7COMM_TIA1200_VAR_ITEM_AREA2_C     0x53
#define S7COMM_TIA1200_VAR_ITEM_AREA2_T     0x54

static const value_string tia1200_var_item_area2_names[] = {
    { S7COMM_TIA1200_VAR_ITEM_AREA2_I,      "Inputs (I)" },
    { S7COMM_TIA1200_VAR_ITEM_AREA2_Q,      "Outputs (Q)" },
    { S7COMM_TIA1200_VAR_ITEM_AREA2_M,      "Flags (M)" },
    { S7COMM_TIA1200_VAR_ITEM_AREA2_C,      "Counter (C)" },
    { S7COMM_TIA1200_VAR_ITEM_AREA2_T,      "Timer (T)" },
    { 0,                                    NULL }
};

/**************************************************************************
 * NCK areas
 */
#define S7COMM_NCK_AREA_N_NCK               0
#define S7COMM_NCK_AREA_B_MODEGROUP         1
#define S7COMM_NCK_AREA_C_CHANNEL           2
#define S7COMM_NCK_AREA_A_AXIS              3
#define S7COMM_NCK_AREA_T_TOOL              4
#define S7COMM_NCK_AREA_V_FEEDDRIVE         5
#define S7COMM_NCK_AREA_H_MAINDRIVE         6
#define S7COMM_NCK_AREA_M_MMC               7

static const value_string nck_area_names[] = {
    { S7COMM_NCK_AREA_N_NCK,                "N - NCK" },
    { S7COMM_NCK_AREA_B_MODEGROUP,          "B - Mode group" },
    { S7COMM_NCK_AREA_C_CHANNEL,            "C - Channel" },
    { S7COMM_NCK_AREA_A_AXIS,               "A - Axis" },
    { S7COMM_NCK_AREA_T_TOOL,               "T - Tool" },
    { S7COMM_NCK_AREA_V_FEEDDRIVE,          "V - Feed drive" },
    { S7COMM_NCK_AREA_H_MAINDRIVE,          "M - Main drive" },
    { S7COMM_NCK_AREA_M_MMC,                "M - MMC" },
    { 0,                                    NULL }
};

static const value_string nck_module_names[] = {
    { 0x10,                                 "Y - Global system data" },
    { 0x11,                                 "YNCFL - NCK instruction groups" },
    { 0x12,                                 "FU - NCU global settable frames" },
    { 0x13,                                 "FA - Active NCU global frames" },
    { 0x14,                                 "TO - Tool data" },
    { 0x15,                                 "RP - Arithmetic parameters" },
    { 0x16,                                 "SE - Setting data" },
    { 0x17,                                 "SGUD - SGUD-Block" },
    { 0x18,                                 "LUD - Local userdata" },
    { 0x19,                                 "TC - Toolholder parameters" },
    { 0x1a,                                 "M - Machine data" },
    { 0x1c,                                 "WAL - Working area limitation" },
    { 0x1e,                                 "DIAG - Internal diagnostic data" },
    { 0x1f,                                 "CC - Unknown" },
    { 0x20,                                 "FE - Channel-specific external frame" },
    { 0x21,                                 "TD - Tool data: General data" },
    { 0x22,                                 "TS - Tool edge data: Monitoring data" },
    { 0x23,                                 "TG - Tool data: Grinding-specific data" },
    { 0x24,                                 "TU - Tool data" },
    { 0x25,                                 "TUE - Tool edge data, userdefined data" },
    { 0x26,                                 "TV - Tool data, directory" },
    { 0x27,                                 "TM - Magazine data: General data" },
    { 0x28,                                 "TP - Magazine data: Location data" },
    { 0x29,                                 "TPM - Magazine data: Multiple assignment of location data" },
    { 0x2a,                                 "TT - Magazine data: Location typ" },
    { 0x2b,                                 "TMV - Magazine data: Directory" },
    { 0x2c,                                 "TMC - Magazine data: Configuration data" },
    { 0x2d,                                 "MGUD - MGUD-Block" },
    { 0x2e,                                 "UGUD - UGUD-Block" },
    { 0x2f,                                 "GUD4 - GUD4-Block" },
    { 0x30,                                 "GUD5 - GUD5-Block" },
    { 0x31,                                 "GUD6 - GUD6-Block" },
    { 0x32,                                 "GUD7 - GUD7-Block" },
    { 0x33,                                 "GUD8 - GUD8-Block" },
    { 0x34,                                 "GUD9 - GUD9-Block" },
    { 0x35,                                 "PA - Channel-specific protection zones" },
    { 0x36,                                 "GD1 - SGUD-Block GD1" },
    { 0x37,                                 "NIB - State data: Nibbling" },
    { 0x38,                                 "ETP - Types of events" },
    { 0x39,                                 "ETPD - Data lists for protocolling" },
    { 0x3a,                                 "SYNACT - Channel-specific synchronous actions" },
    { 0x3b,                                 "DIAGN - Diagnostic data" },
    { 0x3c,                                 "VSYN - Channel-specific user variables for synchronous actions" },
    { 0x3d,                                 "TUS - Tool data: user monitoring data" },
    { 0x3e,                                 "TUM - Tool data: user magazine data" },
    { 0x3f,                                 "TUP - Tool data: user magazine place data" },
    { 0x40,                                 "TF - Parameterizing, return parameters of _N_TMGETT, _N_TSEARC" },
    { 0x41,                                 "FB - Channel-specific base frames" },
    { 0x42,                                 "SSP2 - State data: Spindle" },
    { 0x43,                                 "PUD - programmglobale Benutzerdaten" },
    { 0x44,                                 "TOS - Edge-related location-dependent fine total offsets" },
    { 0x45,                                 "TOST - Edge-related location-dependent fine total offsets, transformed" },
    { 0x46,                                 "TOE - Edge-related coarse total offsets, setup offsets" },
    { 0x47,                                 "TOET - Edge-related coarse total offsets, transformed setup offsets" },
    { 0x48,                                 "AD - Adapter data" },
    { 0x49,                                 "TOT - Edge data: Transformed offset data" },
    { 0x4a,                                 "AEV - Working offsets: Directory" },
    { 0x4b,                                 "YFAFL - NCK instruction groups (Fanuc)" },
    { 0x4c,                                 "FS - System-Frame" },
    { 0x4d,                                 "SD - Servo data" },
    { 0x4e,                                 "TAD - Application-specific data" },
    { 0x4f,                                 "TAO - Application-specific cutting edge data" },
    { 0x50,                                 "TAS - Application-specific monitoring data" },
    { 0x51,                                 "TAM - Application-specific magazine data" },
    { 0x52,                                 "TAP - Application-specific magazine location data" },
    { 0x53,                                 "MEM - Unknown" },
    { 0x54,                                 "SALUC - Alarm actions: List in reverse chronological order" },
    { 0x55,                                 "AUXFU - Auxiliary functions" },
    { 0x56,                                 "TDC - Tool/Tools" },
    { 0x57,                                 "CP - Generic coupling" },
    { 0x6e,                                 "SDME - Unknown" },
    { 0x6f,                                 "SPARPI - Program pointer on interruption" },
    { 0x70,                                 "SEGA - State data: Geometry axes in tool offset memory (extended)" },
    { 0x71,                                 "SEMA - State data: Machine axes (extended)" },
    { 0x72,                                 "SSP - State data: Spindle" },
    { 0x73,                                 "SGA - State data: Geometry axes in tool offset memory" },
    { 0x74,                                 "SMA - State data: Machine axes" },
    { 0x75,                                 "SALAL - Alarms: List organized according to time" },
    { 0x76,                                 "SALAP - Alarms: List organized according to priority" },
    { 0x77,                                 "SALA - Alarms: List organized according to time" },
    { 0x78,                                 "SSYNAC - Synchronous actions" },
    { 0x79,                                 "SPARPF - Program pointers for block search and stop run" },
    { 0x7a,                                 "SPARPP - Program pointer in automatic operation" },
    { 0x7b,                                 "SNCF - Active G functions" },
    { 0x7d,                                 "SPARP - Part program information" },
    { 0x7e,                                 "SINF - Part-program-specific status data" },
    { 0x7f,                                 "S - State data" },
    { 0x80,                                 "0x80 - Unknown" },
    { 0x81,                                 "0x81 - Unknown" },
    { 0x82,                                 "0x82 - Unknown" },
    { 0x83,                                 "0x83 - Unknown" },
    { 0x84,                                 "0x84 - Unknown" },
    { 0x85,                                 "0x85 - Unknown" },
    { 0xfd,                                 "0 - Internal" },
    { 0,                                    NULL }
};
static value_string_ext nck_module_names_ext = VALUE_STRING_EXT_INIT(nck_module_names);

static int hf_s7comm_tia1200_item_reserved1;          /* 1 Byte Reserved (always 0xff?) */
static int hf_s7comm_tia1200_item_area1;              /* 2 Byte2 Root area (DB or IQMCT) */
static int hf_s7comm_tia1200_item_area2;              /* 2 Bytes detail area (I/Q/M/C/T) */
static int hf_s7comm_tia1200_item_area2unknown;       /* 2 Bytes detail area for possible unknown or not seen areas */
static int hf_s7comm_tia1200_item_dbnumber;           /* 2 Bytes DB number */
static int hf_s7comm_tia1200_item_crc;                /* 4 Bytes CRC */

static int hf_s7comm_tia1200_substructure_item;       /* Substructure */
static int hf_s7comm_tia1200_var_lid_flags;           /* LID Flags */
static int hf_s7comm_tia1200_item_value;

/**************************************************************************
 **************************************************************************/

/* Header Block */
static int hf_s7comm_header;
static int hf_s7comm_header_protid;                   /* Header Byte  0 */
static int hf_s7comm_header_rosctr;                   /* Header Bytes 1 */
static int hf_s7comm_header_redid;                    /* Header Bytes 2, 3 */
static int hf_s7comm_header_pduref;                   /* Header Bytes 4, 5 */
static int hf_s7comm_header_parlg;                    /* Header Bytes 6, 7 */
static int hf_s7comm_header_datlg;                    /* Header Bytes 8, 9 */
static int hf_s7comm_header_errcls;                   /* Header Byte 10, only available at type 2 or 3 */
static int hf_s7comm_header_errcod;                   /* Header Byte 11, only available at type 2 or 3 */
/* Parameter Block */
static int hf_s7comm_param;
static int hf_s7comm_param_errcod;                    /* Parameter part: Error code */
static int hf_s7comm_param_service;                   /* Parameter part: service */
static int hf_s7comm_param_itemcount;                 /* Parameter part: item count */
static int hf_s7comm_param_data;                      /* Parameter part: data */
static int hf_s7comm_param_neg_pdu_length;            /* Parameter part: Negotiate PDU length */
static int hf_s7comm_param_setup_reserved1;           /* Parameter part: Reserved byte in communication setup pdu*/

static int hf_s7comm_param_maxamq_calling;            /* Parameter part: Max AmQ calling */
static int hf_s7comm_param_maxamq_called;             /* Parameter part: Max AmQ called */

/* Item data */
static int hf_s7comm_param_item;
static int hf_s7comm_param_subitem;                   /* Substructure */
static int hf_s7comm_item_varspec;                    /* Variable specification */
static int hf_s7comm_item_varspec_length;             /* Length of following address specification */
static int hf_s7comm_item_syntax_id;                  /* Syntax Id */
static int hf_s7comm_item_transport_size;             /* Transport size, 1 Byte*/
static int hf_s7comm_item_length;                     /* length, 2 Bytes*/
static int hf_s7comm_item_db;                         /* DB/M/E/A, 2 Bytes */
static int hf_s7comm_item_area;                       /* Area code, 1 byte */
static int hf_s7comm_item_address;                    /* Bit address, 3 Bytes */
static int hf_s7comm_item_address_byte;               /* address: Byte address */
static int hf_s7comm_item_address_bit;                /* address: Bit address */
static int hf_s7comm_item_address_nr;                 /* address: Timer/Counter/block number */
/* Special variable read with Syntax-Id 0xb0 (DBREAD) */
static int hf_s7comm_item_dbread_numareas;            /* Number of areas following, 1 Byte*/
static int hf_s7comm_item_dbread_length;              /* length, 1 Byte*/
static int hf_s7comm_item_dbread_db;                  /* DB number, 2 Bytes*/
static int hf_s7comm_item_dbread_startadr;            /* Start address, 2 Bytes*/
/* Reading frequency inverter parameters via routing */
static int hf_s7comm_item_driveesany_unknown1;        /* Unknown value 1, 1 Byte */
static int hf_s7comm_item_driveesany_unknown2;        /* Unknown value 2, 2 Bytes */
static int hf_s7comm_item_driveesany_unknown3;        /* Unknown value 3, 2 Bytes */
static int hf_s7comm_item_driveesany_parameter_nr;    /* Parameter number, 2 Bytes */
static int hf_s7comm_item_driveesany_parameter_idx;   /* Parameter index, 2 Bytes */
/* NCK access with Syntax-Id 0x82 */
static int hf_s7comm_item_nck_areaunit;               /* Bitmask: aaauuuuu: a=area, u=unit */
static int hf_s7comm_item_nck_area;
static int hf_s7comm_item_nck_unit;
static int hf_s7comm_item_nck_column;
static int hf_s7comm_item_nck_line;
static int hf_s7comm_item_nck_module;
static int hf_s7comm_item_nck_linecount;

static int hf_s7comm_data;
static int hf_s7comm_data_returncode;                 /* return code, 1 byte */
static int hf_s7comm_data_transport_size;             /* transport size 1 byte */
static int hf_s7comm_data_length;                     /* Length of data, 2 Bytes */

static int hf_s7comm_data_item;

static int hf_s7comm_readresponse_data;
static int hf_s7comm_data_fillbyte;

/* timefunction: s7 timestamp */
static int hf_s7comm_data_ts;
static int hf_s7comm_data_ts_reserved;
static int hf_s7comm_data_ts_year1;                   /* first byte of BCD coded year, should be ignored */
static int hf_s7comm_data_ts_year2;                   /* second byte of BCD coded year, if 00...89 then it's 2000...2089, else 1990...1999*/
static int hf_s7comm_data_ts_month;
static int hf_s7comm_data_ts_day;
static int hf_s7comm_data_ts_hour;
static int hf_s7comm_data_ts_minute;
static int hf_s7comm_data_ts_second;
static int hf_s7comm_data_ts_millisecond;
static int hf_s7comm_data_ts_weekday;

/* userdata, block services */
static int hf_s7comm_userdata_data;

static int hf_s7comm_userdata_param_type;
static int hf_s7comm_userdata_param_funcgroup;
static int hf_s7comm_userdata_param_subfunc_prog;
static int hf_s7comm_userdata_param_subfunc_cyclic;
static int hf_s7comm_userdata_param_subfunc_block;
static int hf_s7comm_userdata_param_subfunc_cpu;
static int hf_s7comm_userdata_param_subfunc_sec;
static int hf_s7comm_userdata_param_subfunc_time;
static int hf_s7comm_userdata_param_subfunc_ncprg;
static int hf_s7comm_userdata_param_subfunc_drr;
static int hf_s7comm_userdata_param_subfunc;          /* for all other subfunctions */
static int hf_s7comm_userdata_param_seq_num;
static int hf_s7comm_userdata_param_dataunitref;
static int hf_s7comm_userdata_param_dataunit;

/* block functions, list blocks of type */
static int hf_s7comm_ud_blockinfo_block_type;         /* Block type, 2 bytes */
static int hf_s7comm_ud_blockinfo_block_num;          /* Block number, 2 bytes as int */
static int hf_s7comm_ud_blockinfo_block_cnt;          /* Count, 2 bytes as int */
static int hf_s7comm_ud_blockinfo_block_flags;        /* Block flags (unknown), 1 byte */
static int hf_s7comm_ud_blockinfo_block_lang;         /* Block language, 1 byte, stringlist blocklanguage_names */
/* block functions, get block infos */
static int hf_s7comm_ud_blockinfo_block_num_ascii;    /* Block number, 5 bytes, ASCII*/
static int hf_s7comm_ud_blockinfo_filesys;            /* Filesystem, 1 byte, ASCII*/
static int hf_s7comm_ud_blockinfo_res_infolength;     /* Length of Info, 2 bytes as int */
static int hf_s7comm_ud_blockinfo_res_unknown2;       /* Unknown blockinfo 2, 2 bytes, HEX*/
static int hf_s7comm_ud_blockinfo_res_const3;         /* Constant 3, 2 bytes, ASCII */
static int hf_s7comm_ud_blockinfo_res_unknown;        /* Unknown byte(s) */
static int hf_s7comm_ud_blockinfo_subblk_type;        /* Subblk type, 1 byte, stringlist subblktype_names */
static int hf_s7comm_ud_blockinfo_load_mem_len;       /* Length load memory, 4 bytes, int */
static int hf_s7comm_ud_blockinfo_blocksecurity;      /* Block Security, 4 bytes, stringlist blocksecurity_names*/
static int hf_s7comm_ud_blockinfo_interface_timestamp;/* Interface Timestamp, string */
static int hf_s7comm_ud_blockinfo_code_timestamp;     /* Code Timestamp, string */
static int hf_s7comm_ud_blockinfo_ssb_len;            /* SSB length, 2 bytes, int */
static int hf_s7comm_ud_blockinfo_add_len;            /* ADD length, 2 bytes, int */
static int hf_s7comm_ud_blockinfo_localdata_len;      /* Length localdata, 2 bytes, int */
static int hf_s7comm_ud_blockinfo_mc7_len;            /* Length MC7 code, 2 bytes, int */
static int hf_s7comm_ud_blockinfo_author;             /* Author, 8 bytes, ASCII */
static int hf_s7comm_ud_blockinfo_family;             /* Family, 8 bytes, ASCII */
static int hf_s7comm_ud_blockinfo_headername;         /* Name (Header), 8 bytes, ASCII */
static int hf_s7comm_ud_blockinfo_headerversion;      /* Version (Header), 8 bytes, ASCII */
static int hf_s7comm_ud_blockinfo_checksum;           /* Block checksum, 2 bytes, HEX */
static int hf_s7comm_ud_blockinfo_reserved1;          /* Reserved 1, 4 bytes, HEX */
static int hf_s7comm_ud_blockinfo_reserved2;          /* Reserved 2, 4 bytes, HEX */

static int hf_s7comm_userdata_blockinfo_flags;        /* Some flags in Block info response */
static int hf_s7comm_userdata_blockinfo_linked;       /* Some flags in Block info response */
static int hf_s7comm_userdata_blockinfo_standard_block;
static int hf_s7comm_userdata_blockinfo_nonretain;    /* Some flags in Block info response */
static int ett_s7comm_userdata_blockinfo_flags;
static int * const s7comm_userdata_blockinfo_flags_fields[] = {
    &hf_s7comm_userdata_blockinfo_linked,
    &hf_s7comm_userdata_blockinfo_standard_block,
    &hf_s7comm_userdata_blockinfo_nonretain,
    NULL
};

/* Programmer commands / Test and installation (TIS) functions */
static int hf_s7comm_tis_parameter;
static int hf_s7comm_tis_data;
static int hf_s7comm_tis_parametersize;
static int hf_s7comm_tis_datasize;
static int hf_s7comm_tis_param1;
static int hf_s7comm_tis_param2;
static const value_string tis_param2_names[] = {    /* Values and their meaning are not always clearly defined in every function */
    { 0,                                    "Update Monitor Variables / Activate Modify Values"},
    { 1,                                    "Monitor Variable / Modify Variable" },
    { 2,                                    "Modify Variable permanent" },
    { 256,                                  "Force immediately" },
    { 0,                                    NULL }
};
static int hf_s7comm_tis_param3;
static const value_string tis_param3_names[] = {
    { 0,                                    "Every cycle (permanent)" },
    { 1,                                    "Once" },
    { 2,                                    "Always (force)" },
    { 0,                                    NULL }
};
static int hf_s7comm_tis_answersize;
static int hf_s7comm_tis_param5;
static int hf_s7comm_tis_param6;
static int hf_s7comm_tis_param7;
static int hf_s7comm_tis_param8;
static int hf_s7comm_tis_param9;
static int hf_s7comm_tis_trgevent;
static int hf_s7comm_tis_res_param1;
static int hf_s7comm_tis_res_param2;
static int hf_s7comm_tis_job_function;
static int hf_s7comm_tis_job_seqnr;
static int hf_s7comm_tis_job_reserved;



/* B/I/L Stack */
static int hf_s7comm_tis_interrupted_blocktype;
static int hf_s7comm_tis_interrupted_blocknr;
static int hf_s7comm_tis_interrupted_address;
static int hf_s7comm_tis_interrupted_prioclass;
static int hf_s7comm_tis_continued_blocktype;
static int hf_s7comm_tis_continued_blocknr;
static int hf_s7comm_tis_continued_address;
static int hf_s7comm_tis_breakpoint_blocktype;
static int hf_s7comm_tis_breakpoint_blocknr;
static int hf_s7comm_tis_breakpoint_address;
static int hf_s7comm_tis_breakpoint_reserved;

static int hf_s7comm_tis_p_callenv;
static const value_string tis_p_callenv_names[] = {
    { 0,                                   "Specified call environment"},
    { 2,                                   "Specified global and/or instance data block"},
    { 0,                                    NULL }
};
static int hf_s7comm_tis_p_callcond;
static const value_string tis_p_callcond_names[] = {
    { 0x0000,                               "Not set" },
    { 0x0001,                               "On block number" },
    { 0x0101,                               "On block number with code address" },
    { 0x0a00,                               "On DB1 (DB) content" },
    { 0x000a,                               "On DB2 (DI) content" },
    { 0x0a0a,                               "On DB1 (DB) and DB2 (DI) content" },
    { 0,                                    NULL }
};
static int hf_s7comm_tis_p_callcond_blocktype;
static int hf_s7comm_tis_p_callcond_blocknr;
static int hf_s7comm_tis_p_callcond_address;


static int hf_s7comm_tis_register_db1_type;
static int hf_s7comm_tis_register_db2_type;
static int hf_s7comm_tis_register_db1_nr;
static int hf_s7comm_tis_register_db2_nr;
static int hf_s7comm_tis_register_accu1;
static int hf_s7comm_tis_register_accu2;
static int hf_s7comm_tis_register_accu3;
static int hf_s7comm_tis_register_accu4;
static int hf_s7comm_tis_register_ar1;
static int hf_s7comm_tis_register_ar2;
static int hf_s7comm_tis_register_stw;
static int hf_s7comm_tis_exithold_until;
static const value_string tis_exithold_until_names[] = {
    { 0,                                    "Next breakpoint" },
    { 1,                                    "Next statement" },
    { 0,                                    NULL }
};
static int hf_s7comm_tis_exithold_res1;
static int hf_s7comm_tis_bstack_nest_depth;
static int hf_s7comm_tis_bstack_reserved;
static int hf_s7comm_tis_istack_reserved;
static int hf_s7comm_tis_lstack_reserved;
static int hf_s7comm_tis_lstack_size;
static int hf_s7comm_tis_lstack_data;
static int hf_s7comm_tis_blockstat_flagsunknown;
static int hf_s7comm_tis_blockstat_number_of_lines;
static int hf_s7comm_tis_blockstat_line_address;
static int hf_s7comm_tis_blockstat_data;
static int hf_s7comm_tis_blockstat_reserved;

/* Organization block local data */
static int hf_s7comm_ob_ev_class;
static int hf_s7comm_ob_scan_1;
static int hf_s7comm_ob_strt_inf;
static int hf_s7comm_ob_flt_id;
static int hf_s7comm_ob_priority;
static int hf_s7comm_ob_number;
static int hf_s7comm_ob_reserved_1;
static int hf_s7comm_ob_reserved_2;
static int hf_s7comm_ob_reserved_3;
static int hf_s7comm_ob_reserved_4;
static int hf_s7comm_ob_reserved_4_dw;
static int hf_s7comm_ob_prev_cycle;
static int hf_s7comm_ob_min_cycle;
static int hf_s7comm_ob_max_cycle;
static int hf_s7comm_ob_period_exe;
static int hf_s7comm_ob_sign;
static int hf_s7comm_ob_dtime;
static int hf_s7comm_ob_phase_offset;
static int hf_s7comm_ob_exec_freq;
static int hf_s7comm_ob_io_flag;
static int hf_s7comm_ob_mdl_addr;
static int hf_s7comm_ob_point_addr;
static int hf_s7comm_ob_inf_len;
static int hf_s7comm_ob_alarm_type;
static int hf_s7comm_ob_alarm_slot;
static int hf_s7comm_ob_alarm_spec;
static int hf_s7comm_ob_error_info;
static int hf_s7comm_ob_err_ev_class;
static int hf_s7comm_ob_err_ev_num;
static int hf_s7comm_ob_err_ob_priority;
static int hf_s7comm_ob_err_ob_num;
static int hf_s7comm_ob_rack_cpu;
static int hf_s7comm_ob_8x_fault_flags;
static int hf_s7comm_ob_mdl_type_b;
static int hf_s7comm_ob_mdl_type_w;
static int hf_s7comm_ob_rack_num;
static int hf_s7comm_ob_racks_flt;
static int hf_s7comm_ob_strtup;
static int hf_s7comm_ob_stop;
static int hf_s7comm_ob_strt_info;
static int hf_s7comm_ob_sw_flt;
static int hf_s7comm_ob_blk_type;
static int hf_s7comm_ob_flt_reg;
static int hf_s7comm_ob_flt_blk_num;
static int hf_s7comm_ob_prg_addr;
static int hf_s7comm_ob_mem_area;
static int hf_s7comm_ob_mem_addr;

static int hf_s7comm_diagdata_req_block_type;
static int hf_s7comm_diagdata_req_block_num;
static int hf_s7comm_diagdata_req_startaddr_awl;
static int hf_s7comm_diagdata_req_saz;

/* Flags for requested registers in diagnostic data telegrams */
static int hf_s7comm_diagdata_registerflag;           /* Registerflags */
static int hf_s7comm_diagdata_registerflag_stw;       /* STW = Status word */
static int hf_s7comm_diagdata_registerflag_accu1;     /* Accumulator 1 */
static int hf_s7comm_diagdata_registerflag_accu2;     /* Accumulator 2 */
static int hf_s7comm_diagdata_registerflag_ar1;       /* Addressregister 1 */
static int hf_s7comm_diagdata_registerflag_ar2;       /* Addressregister 2 */
static int hf_s7comm_diagdata_registerflag_db1;       /* Datablock register 1 */
static int hf_s7comm_diagdata_registerflag_db2;       /* Datablock register 2 */
static int ett_s7comm_diagdata_registerflag;
static int * const s7comm_diagdata_registerflag_fields[] = {
    &hf_s7comm_diagdata_registerflag_stw,
    &hf_s7comm_diagdata_registerflag_accu1,
    &hf_s7comm_diagdata_registerflag_accu2,
    &hf_s7comm_diagdata_registerflag_ar1,
    &hf_s7comm_diagdata_registerflag_ar2,
    &hf_s7comm_diagdata_registerflag_db1,
    &hf_s7comm_diagdata_registerflag_db2,
    NULL
};

static heur_dissector_list_t s7comm_heur_subdissector_list;

static expert_field ei_s7comm_data_blockcontrol_block_num_invalid;
static expert_field ei_s7comm_ud_blockinfo_block_num_ascii_invalid;

/* PI service name IDs. Index represents the index in pi_service_names */
typedef enum
{
    S7COMM_PI_UNKNOWN = 0,
    S7COMM_PI_INSE,
    S7COMM_PI_INS2,
    S7COMM_PI_DELE,
    S7COMM_PIP_PROGRAM,
    S7COMM_PI_MODU,
    S7COMM_PI_GARB,
    S7COMM_PI_N_LOGIN_,
    S7COMM_PI_N_LOGOUT,
    S7COMM_PI_N_CANCEL,
    S7COMM_PI_N_DASAVE,
    S7COMM_PI_N_DIGIOF,
    S7COMM_PI_N_DIGION,
    S7COMM_PI_N_DZERO_,
    S7COMM_PI_N_ENDEXT,
    S7COMM_PI_N_F_OPER,
    S7COMM_PI_N_OST_OF,
    S7COMM_PI_N_OST_ON,
    S7COMM_PI_N_SCALE_,
    S7COMM_PI_N_SETUFR,
    S7COMM_PI_N_STRTLK,
    S7COMM_PI_N_STRTUL,
    S7COMM_PI_N_TMRASS,
    S7COMM_PI_N_F_DELE,
    S7COMM_PI_N_EXTERN,
    S7COMM_PI_N_EXTMOD,
    S7COMM_PI_N_F_DELR,
    S7COMM_PI_N_F_XFER,
    S7COMM_PI_N_LOCKE_,
    S7COMM_PI_N_SELECT,
    S7COMM_PI_N_SRTEXT,
    S7COMM_PI_N_F_CLOS,
    S7COMM_PI_N_F_OPEN,
    S7COMM_PI_N_F_SEEK,
    S7COMM_PI_N_ASUP__,
    S7COMM_PI_N_CHEKDM,
    S7COMM_PI_N_CHKDNO,
    S7COMM_PI_N_CONFIG,
    S7COMM_PI_N_CRCEDN,
    S7COMM_PI_N_DELECE,
    S7COMM_PI_N_CREACE,
    S7COMM_PI_N_CREATO,
    S7COMM_PI_N_DELETO,
    S7COMM_PI_N_CRTOCE,
    S7COMM_PI_N_DELVAR,
    S7COMM_PI_N_F_COPY,
    S7COMM_PI_N_F_DMDA,
    S7COMM_PI_N_F_PROR,
    S7COMM_PI_N_F_PROT,
    S7COMM_PI_N_F_RENA,
    S7COMM_PI_N_FINDBL,
    S7COMM_PI_N_IBN_SS,
    S7COMM_PI_N_MMCSEM,
    S7COMM_PI_N_NCKMOD,
    S7COMM_PI_N_NEWPWD,
    S7COMM_PI_N_SEL_BL,
    S7COMM_PI_N_SETTST,
    S7COMM_PI_N_TMAWCO,
    S7COMM_PI_N_TMCRTC,
    S7COMM_PI_N_TMCRTO,
    S7COMM_PI_N_TMFDPL,
    S7COMM_PI_N_TMFPBP,
    S7COMM_PI_N_TMGETT,
    S7COMM_PI_N_TMMVTL,
    S7COMM_PI_N_TMPCIT,
    S7COMM_PI_N_TMPOSM,
    S7COMM_PI_N_TRESMO,
    S7COMM_PI_N_TSEARC
} pi_service_e;

/* Description for PI service names */
static const string_string pi_service_names[] = {
    { "UNKNOWN",                            "PI-Service is currently unknown" },
    { "_INSE",                              "PI-Service _INSE (Activates a PLC module)" },
    { "_INS2",                              "PI-Service _INS2 (Activates a PLC module)" },
    { "_DELE",                              "PI-Service _DELE (Removes module from the PLC's passive file system)" },
    { "P_PROGRAM",                          "PI-Service P_PROGRAM (PLC Start / Stop)" },
    { "_MODU",                              "PI-Service _MODU (PLC Copy Ram to Rom)" },
    { "_GARB",                              "PI-Service _GARB (Compress PLC memory)" },
    { "_N_LOGIN_",                          "PI-Service _N_LOGIN_ (Login)" },
    { "_N_LOGOUT",                          "PI-Service _N_LOGOUT (Logout)" },
    { "_N_CANCEL",                          "PI-Service _N_CANCEL (Cancels NC alarm)" },
    { "_N_DASAVE",                          "PI-Service _N_DASAVE (PI-Service for copying data from SRAM to FLASH)" },
    { "_N_DIGIOF",                          "PI-Service _N_DIGIOF (Turns off digitizing)" },
    { "_N_DIGION",                          "PI-Service _N_DIGION (Turns on digitizing)" },
    { "_N_DZERO_",                          "PI-Service _N_DZERO_ (Set all D nos. invalid for function \"unique D no.\")" },
    { "_N_ENDEXT",                          "PI-Service _N_ENDEXT ()" },
    { "_N_F_OPER",                          "PI-Service _N_F_OPER (Opens a file read-only)" },
    { "_N_OST_OF",                          "PI-Service _N_OST_OF (Overstore OFF)" },
    { "_N_OST_ON",                          "PI-Service _N_OST_ON (Overstore ON)" },
    { "_N_SCALE_",                          "PI-Service _N_SCALE_ (Unit of measurement setting (metric<->INCH))" },
    { "_N_SETUFR",                          "PI-Service _N_SETUFR (Activates user frame)" },
    { "_N_STRTLK",                          "PI-Service _N_STRTLK (The global start disable is set)" },
    { "_N_STRTUL",                          "PI-Service _N_STRTUL (The global start disable is reset)" },
    { "_N_TMRASS",                          "PI-Service _N_TMRASS (Resets the Active status)" },
    { "_N_F_DELE",                          "PI-Service _N_F_DELE (Deletes file)" },
    { "_N_EXTERN",                          "PI-Service _N_EXTERN (Selects external program for execution)" },
    { "_N_EXTMOD",                          "PI-Service _N_EXTMOD (Selects external program for execution)" },
    { "_N_F_DELR",                          "PI-Service _N_F_DELR (Delete file even without access rights)" },
    { "_N_F_XFER",                          "PI-Service _N_F_XFER (Selects file for uploading)" },
    { "_N_LOCKE_",                          "PI-Service _N_LOCKE_ (Locks the active file for editing)" },
    { "_N_SELECT",                          "PI-Service _N_SELECT (Selects program for execution)" },
    { "_N_SRTEXT",                          "PI-Service _N_SRTEXT (A file is being marked in /_N_EXT_DIR)" },
    { "_N_F_CLOS",                          "PI-Service _N_F_CLOS (Closes file)" },
    { "_N_F_OPEN",                          "PI-Service _N_F_OPEN (Opens file)" },
    { "_N_F_SEEK",                          "PI-Service _N_F_SEEK (Position the file search pointer)" },
    { "_N_ASUP__",                          "PI-Service _N_ASUP__ (Assigns interrupt)" },
    { "_N_CHEKDM",                          "PI-Service _N_CHEKDM (Start uniqueness check on D numbers)" },
    { "_N_CHKDNO",                          "PI-Service _N_CHKDNO (Check whether the tools have unique D numbers)" },
    { "_N_CONFIG",                          "PI-Service _N_CONFIG (Reconfigures machine data)" },
    { "_N_CRCEDN",                          "PI-Service _N_CRCEDN (Creates a cutting edge by specifying an edge no.)" },
    { "_N_DELECE",                          "PI-Service _N_DELECE (Deletes a cutting edge)" },
    { "_N_CREACE",                          "PI-Service _N_CREACE (Creates a cutting edge)" },
    { "_N_CREATO",                          "PI-Service _N_CREATO (Creates a tool)" },
    { "_N_DELETO",                          "PI-Service _N_DELETO (Deletes tool)" },
    { "_N_CRTOCE",                          "PI-Service _N_CRTOCE (Generate tool with specified edge number)" },
    { "_N_DELVAR",                          "PI-Service _N_DELVAR (Delete data block)" },
    { "_N_F_COPY",                          "PI-Service _N_F_COPY (Copies file within the NCK)" },
    { "_N_F_DMDA",                          "PI-Service _N_F_DMDA (Deletes MDA memory)" },
    { "_N_F_PROR",                          "PI-Service _N_F_PROR" },
    { "_N_F_PROT",                          "PI-Service _N_F_PROT (Assigns a protection level to a file)" },
    { "_N_F_RENA",                          "PI-Service _N_F_RENA (Renames file)" },
    { "_N_FINDBL",                          "PI-Service _N_FINDBL (Activates search)" },
    { "_N_IBN_SS",                          "PI-Service _N_IBN_SS (Sets the set-up switch)" },
    { "_N_MMCSEM",                          "PI-Service _N_MMCSEM (MMC-Semaphore)" },
    { "_N_NCKMOD",                          "PI-Service _N_NCKMOD (The mode in which the NCK will work is being set)" },
    { "_N_NEWPWD",                          "PI-Service _N_NEWPWD (New password)" },
    { "_N_SEL_BL",                          "PI-Service _N_SEL_BL (Selects a new block)" },
    { "_N_SETTST",                          "PI-Service _N_SETTST (Activate tools for replacement tool group)" },
    { "_N_TMAWCO",                          "PI-Service _N_TMAWCO (Set the active wear group in one magazine)" },
    { "_N_TMCRTC",                          "PI-Service _N_TMCRTC (Create tool with specified edge number)" },
    { "_N_TMCRTO",                          "PI-Service _N_TMCRTO (Creates tool in the tool management)" },
    { "_N_TMFDPL",                          "PI-Service _N_TMFDPL (Searches an empty place for loading)" },
    { "_N_TMFPBP",                          "PI-Service _N_TMFPBP (Searches for empty location)" },
    { "_N_TMGETT",                          "PI-Service _N_TMGETT (Determines T-number for specific toolID with Duplono)" },
    { "_N_TMMVTL",                          "PI-Service _N_TMMVTL (Loads or unloads a tool)" },
    { "_N_TMPCIT",                          "PI-Service _N_TMPCIT (Sets increment value of the piece counter)" },
    { "_N_TMPOSM",                          "PI-Service _N_TMPOSM (Positions a magazine or tool)" },
    { "_N_TRESMO",                          "PI-Service _N_TRESMO (Reset monitoring values)" },
    { "_N_TSEARC",                          "PI-Service _N_TSEARC (Complex search via search screenforms)" },
    { NULL,                                 NULL }
};

/* Function 0x28 (PI Start) */
static int hf_s7comm_piservice_unknown1;   /* Unknown bytes */
static int hf_s7comm_piservice_parameterblock;
static int hf_s7comm_piservice_parameterblock_len;
static int hf_s7comm_piservice_servicename;

static int ett_s7comm_piservice_parameterblock;

static int hf_s7comm_piservice_string_len;
static int hf_s7comm_pi_n_x_addressident;
static int hf_s7comm_pi_n_x_password;
static int hf_s7comm_pi_n_x_filename;
static int hf_s7comm_pi_n_x_editwindowname;
static int hf_s7comm_pi_n_x_seekpointer;
static int hf_s7comm_pi_n_x_windowsize;
static int hf_s7comm_pi_n_x_comparestring;
static int hf_s7comm_pi_n_x_skipcount;
static int hf_s7comm_pi_n_x_interruptnr;
static int hf_s7comm_pi_n_x_priority;
static int hf_s7comm_pi_n_x_liftfast;
static int hf_s7comm_pi_n_x_blsync;
static int hf_s7comm_pi_n_x_magnr;
static int hf_s7comm_pi_n_x_dnr;
static int hf_s7comm_pi_n_x_spindlenumber;
static int hf_s7comm_pi_n_x_wznr;
static int hf_s7comm_pi_n_x_class;
static int hf_s7comm_pi_n_x_tnr;
static int hf_s7comm_pi_n_x_toolnumber;
static int hf_s7comm_pi_n_x_cenumber;
static int hf_s7comm_pi_n_x_datablocknumber;
static int hf_s7comm_pi_n_x_firstcolumnnumber;
static int hf_s7comm_pi_n_x_lastcolumnnumber;
static int hf_s7comm_pi_n_x_firstrownumber;
static int hf_s7comm_pi_n_x_lastrownumber;
static int hf_s7comm_pi_n_x_direction;
static int hf_s7comm_pi_n_x_sourcefilename;
static int hf_s7comm_pi_n_x_destinationfilename;
static int hf_s7comm_pi_n_x_channelnumber;
static int hf_s7comm_pi_n_x_protection;
static int hf_s7comm_pi_n_x_oldfilename;
static int hf_s7comm_pi_n_x_newfilename;
static int hf_s7comm_pi_n_x_findmode;
static int hf_s7comm_pi_n_x_switch;
static int hf_s7comm_pi_n_x_functionnumber;
static int hf_s7comm_pi_n_x_semaphorevalue;
static int hf_s7comm_pi_n_x_onoff;
static int hf_s7comm_pi_n_x_mode;
static int hf_s7comm_pi_n_x_factor;
static int hf_s7comm_pi_n_x_passwordlevel;
static int hf_s7comm_pi_n_x_linenumber;
static int hf_s7comm_pi_n_x_weargroup;
static int hf_s7comm_pi_n_x_toolstatus;
static int hf_s7comm_pi_n_x_wearsearchstrat;
static int hf_s7comm_pi_n_x_toolid;
static int hf_s7comm_pi_n_x_duplonumber;
static int hf_s7comm_pi_n_x_edgenumber;
static int hf_s7comm_pi_n_x_placenr;
static int hf_s7comm_pi_n_x_placerefnr;
static int hf_s7comm_pi_n_x_magrefnr;
static int hf_s7comm_pi_n_x_magnrfrom;
static int hf_s7comm_pi_n_x_placenrfrom;
static int hf_s7comm_pi_n_x_magnrto;
static int hf_s7comm_pi_n_x_placenrto;
static int hf_s7comm_pi_n_x_halfplacesleft;
static int hf_s7comm_pi_n_x_halfplacesright;
static int hf_s7comm_pi_n_x_halfplacesup;
static int hf_s7comm_pi_n_x_halfplacesdown;
static int hf_s7comm_pi_n_x_placetype;
static int hf_s7comm_pi_n_x_searchdirection;
static int hf_s7comm_pi_n_x_toolname;
static int hf_s7comm_pi_n_x_placenrsource;
static int hf_s7comm_pi_n_x_magnrsource;
static int hf_s7comm_pi_n_x_placenrdestination;
static int hf_s7comm_pi_n_x_magnrdestination;
static int hf_s7comm_pi_n_x_incrementnumber;
static int hf_s7comm_pi_n_x_monitoringmode;
static int hf_s7comm_pi_n_x_kindofsearch;

static int hf_s7comm_data_plccontrol_argument;        /* Argument, 2 Bytes as char */
static int hf_s7comm_data_plccontrol_block_cnt;       /* Number of blocks, 1 Byte as int */
static int hf_s7comm_data_pi_inse_unknown;
static int hf_s7comm_data_plccontrol_part2_len;       /* Length part 2 in bytes, 1 Byte as Int */

/* block control functions */
static int hf_s7comm_data_blockcontrol_unknown1;      /* for all unknown bytes in blockcontrol */
static int hf_s7comm_data_blockcontrol_errorcode;     /* Error code 2 bytes as int, 0 is no error */
static int hf_s7comm_data_blockcontrol_uploadid;
static int hf_s7comm_data_blockcontrol_file_ident;    /* File identifier, as ASCII */
static int hf_s7comm_data_blockcontrol_block_type;    /* Block type, 2 Byte */
static int hf_s7comm_data_blockcontrol_block_num;     /* Block number, 5 Bytes, ASCII */
static int hf_s7comm_data_blockcontrol_dest_filesys;  /* Destination filesystem, 1 Byte, ASCII */
static int hf_s7comm_data_blockcontrol_part2_len;     /* Length part 2 in bytes, 1 Byte Int */
static int hf_s7comm_data_blockcontrol_part2_unknown; /* Unknown char, ASCII */
static int hf_s7comm_data_blockcontrol_loadmem_len;   /* Length load memory in bytes, ASCII */
static int hf_s7comm_data_blockcontrol_mc7code_len;   /* Length of MC7 code in bytes, ASCII */
static int hf_s7comm_data_blockcontrol_filename_len;
static int hf_s7comm_data_blockcontrol_filename;
static int hf_s7comm_data_blockcontrol_upl_lenstring_len;
static int hf_s7comm_data_blockcontrol_upl_lenstring;

static int hf_s7comm_data_blockcontrol_functionstatus;
static int hf_s7comm_data_blockcontrol_functionstatus_more;
static int hf_s7comm_data_blockcontrol_functionstatus_error;
static int ett_s7comm_data_blockcontrol_status;
static int * const s7comm_data_blockcontrol_status_fields[] = {
    &hf_s7comm_data_blockcontrol_functionstatus_more,
    &hf_s7comm_data_blockcontrol_functionstatus_error,
    NULL
};

static int ett_s7comm_plcfilename;
static int hf_s7comm_data_ncprg_unackcount;
static int hf_s7comm_data_ncprg_filelength;
static int hf_s7comm_data_ncprg_filetime;
static int hf_s7comm_data_ncprg_filepath;
static int hf_s7comm_data_ncprg_filedata;

/* Data record routing to Profibus */
static int hf_s7comm_data_drr_data;

/* Variable status */
static int hf_s7comm_varstat_unknown;                  /* Unknown byte(s), hex */
static int hf_s7comm_varstat_item_count;               /* Item count, 2 bytes, int */
static int hf_s7comm_varstat_req_memory_area;          /* Memory area, 1 byte, stringlist userdata_tis_varstat_area_names  */
static int hf_s7comm_varstat_req_repetition_factor;    /* Repetition factor, 1 byte as int */
static int hf_s7comm_varstat_req_db_number;            /* DB number, 2 bytes as int */
static int hf_s7comm_varstat_req_startaddress;         /* Startaddress, 2 bytes as int */
static int hf_s7comm_varstat_req_bitpos;

/* cyclic services */
static int hf_s7comm_cycl_interval_timebase;          /* Interval timebase, 1 byte, int */
static int hf_s7comm_cycl_interval_time;              /* Interval time, 1 byte, int */
static int hf_s7comm_cycl_function;
static int hf_s7comm_cycl_jobid;

/* Read record */
static int hf_s7comm_rdrec_mlen;                      /* Max. length in bytes of the data record data to be read */
static int hf_s7comm_rdrec_index;                     /* Data record number */
static int hf_s7comm_rdrec_id;                        /* Diagnostic address */
static int hf_s7comm_rdrec_statuslen;                 /* Length of optional status data */
static int hf_s7comm_rdrec_statusdata;                /* Optional status data */
static int hf_s7comm_rdrec_recordlen;                 /* Length of data record data read */
static int hf_s7comm_rdrec_data;                      /* The read data record */
static int hf_s7comm_rdrec_reserved1;

/* PBC, Programmable Block Functions */
static int hf_s7comm_pbc_unknown;                     /* unknown, 1 byte */
static int hf_s7comm_pbc_bsend_r_id;                  /* Request ID R_ID, 4 bytes as hex */
static int hf_s7comm_pbc_bsend_len;
static int hf_s7comm_pbc_usend_unknown1;
static int hf_s7comm_pbc_usend_r_id;
static int hf_s7comm_pbc_usend_unknown2;
static int hf_s7comm_pbc_arsend_ar_id;
static int hf_s7comm_pbc_arsend_ret;
static int hf_s7comm_pbc_arsend_unknown;
static int hf_s7comm_pbc_arsend_len;

/* Alarm messages */
static int hf_s7comm_cpu_alarm_message_item;
static int hf_s7comm_cpu_alarm_message_obj_item;
static int hf_s7comm_cpu_alarm_message_function;
static int hf_s7comm_cpu_alarm_message_nr_objects;
static int hf_s7comm_cpu_alarm_message_nr_add_values;
static int hf_s7comm_cpu_alarm_message_eventid;
static int hf_s7comm_cpu_alarm_message_timestamp_coming;
static int hf_s7comm_cpu_alarm_message_timestamp_going;
static int hf_s7comm_cpu_alarm_message_associated_value;
static int hf_s7comm_cpu_alarm_message_eventstate;
static int hf_s7comm_cpu_alarm_message_state;
static int hf_s7comm_cpu_alarm_message_ackstate_coming;
static int hf_s7comm_cpu_alarm_message_ackstate_going;
static int hf_s7comm_cpu_alarm_message_event_coming;
static int hf_s7comm_cpu_alarm_message_event_going;
static int hf_s7comm_cpu_alarm_message_event_lastchanged;
static int hf_s7comm_cpu_alarm_message_event_reserved;
static int hf_s7comm_cpu_alarm_message_scan_unknown1;
static int hf_s7comm_cpu_alarm_message_scan_unknown2;

static int hf_s7comm_cpu_alarm_message_signal_sig1;
static int hf_s7comm_cpu_alarm_message_signal_sig2;
static int hf_s7comm_cpu_alarm_message_signal_sig3;
static int hf_s7comm_cpu_alarm_message_signal_sig4;
static int hf_s7comm_cpu_alarm_message_signal_sig5;
static int hf_s7comm_cpu_alarm_message_signal_sig6;
static int hf_s7comm_cpu_alarm_message_signal_sig7;
static int hf_s7comm_cpu_alarm_message_signal_sig8;
static int ett_s7comm_cpu_alarm_message_signal;
static int * const s7comm_cpu_alarm_message_signal_fields[] = {
    &hf_s7comm_cpu_alarm_message_signal_sig1,
    &hf_s7comm_cpu_alarm_message_signal_sig2,
    &hf_s7comm_cpu_alarm_message_signal_sig3,
    &hf_s7comm_cpu_alarm_message_signal_sig4,
    &hf_s7comm_cpu_alarm_message_signal_sig5,
    &hf_s7comm_cpu_alarm_message_signal_sig6,
    &hf_s7comm_cpu_alarm_message_signal_sig7,
    &hf_s7comm_cpu_alarm_message_signal_sig8,
    NULL
};

static int hf_s7comm_cpu_alarm_query_unknown1;
static int hf_s7comm_cpu_alarm_query_querytype;
static int hf_s7comm_cpu_alarm_query_unknown2;
static int hf_s7comm_cpu_alarm_query_alarmtype;
static int hf_s7comm_cpu_alarm_query_completelen;
static int hf_s7comm_cpu_alarm_query_datasetlen;
static int hf_s7comm_cpu_alarm_query_resunknown1;

/* CPU diagnostic messages */
static int hf_s7comm_cpu_diag_msg_item;
static int hf_s7comm_cpu_diag_msg_eventid;
static int hf_s7comm_cpu_diag_msg_eventid_class;
static int hf_s7comm_cpu_diag_msg_eventid_ident_entleave;
static int hf_s7comm_cpu_diag_msg_eventid_ident_diagbuf;
static int hf_s7comm_cpu_diag_msg_eventid_ident_interr;
static int hf_s7comm_cpu_diag_msg_eventid_ident_exterr;
static int hf_s7comm_cpu_diag_msg_eventid_nr;
static int hf_s7comm_cpu_diag_msg_prioclass;
static int hf_s7comm_cpu_diag_msg_obnumber;
static int hf_s7comm_cpu_diag_msg_datid;
static int hf_s7comm_cpu_diag_msg_info1;
static int hf_s7comm_cpu_diag_msg_info2;

static int ett_s7comm_cpu_diag_msg_eventid;
static int * const s7comm_cpu_diag_msg_eventid_fields[] = {
    &hf_s7comm_cpu_diag_msg_eventid_class,
    &hf_s7comm_cpu_diag_msg_eventid_ident_entleave,
    &hf_s7comm_cpu_diag_msg_eventid_ident_diagbuf,
    &hf_s7comm_cpu_diag_msg_eventid_ident_interr,
    &hf_s7comm_cpu_diag_msg_eventid_ident_exterr,
    &hf_s7comm_cpu_diag_msg_eventid_nr,
    NULL
};

static const true_false_string tfs_s7comm_cpu_diag_msg_eventid_ident_entleave = {
    "Event entering",
    "Event leaving"
};

static const value_string cpu_diag_msg_eventid_class_names[] = {
    { 0x01,                                 "Standard OB events" },
    { 0x02,                                 "Synchronous errors" },
    { 0x03,                                 "Asynchronous errors" },
    { 0x04,                                 "Mode transitions" },
    { 0x05,                                 "Run-time events" },
    { 0x06,                                 "Communication events" },
    { 0x07,                                 "Events for fail-safe and fault-tolerant systems" },
    { 0x08,                                 "Standardized diagnostic data on modules" },
    { 0x09,                                 "Predefined user events" },
    { 0x0a,                                 "Freely definable events" },
    { 0x0b,                                 "Freely definable events" },
    { 0x0c,                                 "Reserved" },
    { 0x0d,                                 "Reserved" },
    { 0x0e,                                 "Reserved" },
    { 0x0f,                                 "Events for modules other than CPUs" },
    { 0,                                    NULL }
};

static const value_string cpu_diag_eventid_fix_names[] = {
    { 0x113A,                               "Start request for cyclic interrupt OB with special handling (S7-300 only)" },
    { 0x1155,                               "Status alarm for PROFIBUS DP" },
    { 0x1156,                               "Update interrupt for PROFIBUS DP" },
    { 0x1157,                               "Manufacturer interrupt for PROFIBUS DP" },
    { 0x1158,                               "Status interrupt for PROFINET IO" },
    { 0x1159,                               "Update interrupt for PROFINET IO" },
    { 0x115A,                               "Manufacturer interrupt for PROFINET IO" },
    { 0x115B,                               "IO: Profile-specific interrupt" },
    { 0x116A,                               "Technology synchronization interrupt" },
    { 0x1381,                               "Request for manual warm restart" },
    { 0x1382,                               "Request for automatic warm restart" },
    { 0x1383,                               "Request for manual hot restart" },
    { 0x1384,                               "Request for automatic hot restart" },
    { 0x1385,                               "Request for manual cold restart" },
    { 0x1386,                               "Request for automatic cold restart" },
    { 0x1387,                               "Master CPU: request for manual cold restart" },
    { 0x1388,                               "Master CPU: request for automatic cold restart" },
    { 0x138A,                               "Master CPU: request for manual warm restart" },
    { 0x138B,                               "Master CPU: request for automatic warm restart" },
    { 0x138C,                               "Standby CPU: request for manual hot restart" },
    { 0x138D,                               "Standby CPU: request for automatic hot restart" },
    { 0x2521,                               "BCD conversion error" },
    { 0x2522,                               "Area length error when reading" },
    { 0x2523,                               "Area length error when writing" },
    { 0x2524,                               "Area error when reading" },
    { 0x2525,                               "Area error when writing" },
    { 0x2526,                               "Timer number error" },
    { 0x2527,                               "Counter number error" },
    { 0x2528,                               "Alignment error when reading" },
    { 0x2529,                               "Alignment error when writing" },
    { 0x2530,                               "Write error when accessing the DB" },
    { 0x2531,                               "Write error when accessing the DI" },
    { 0x2532,                               "Block number error when opening a DB" },
    { 0x2533,                               "Block number error when opening a DI" },
    { 0x2534,                               "Block number error when calling an FC" },
    { 0x2535,                               "Block number error when calling an FB" },
    { 0x253A,                               "DB not loaded" },
    { 0x253C,                               "FC not loaded" },
    { 0x253D,                               "SFC not loaded" },
    { 0x253E,                               "FB not loaded" },
    { 0x253F,                               "SFB not loaded" },
    { 0x2942,                               "I/O access error, reading" },
    { 0x2943,                               "I/O access error, writing" },
    { 0x3267,                               "End of module reconfiguration" },
    { 0x3367,                               "Start of module reconfiguration" },
    { 0x34A4,                               "PROFInet Interface DB can be addressed again" },
    { 0x3501,                               "Cycle time exceeded" },
    { 0x3502,                               "User interface (OB or FRB) request error" },
    { 0x3503,                               "Delay too long processing a priority class" },
    { 0x3505,                               "Time-of-day interrupt(s) skipped due to new clock setting" },
    { 0x3506,                               "Time-of-day interrupt(s) skipped when changing to RUN after HOLD" },
    { 0x3507,                               "Multiple OB request errors caused internal buffer overflow" },
    { 0x3508,                               "Synchronous cycle interrupt-timing error" },
    { 0x3509,                               "Interrupt loss due to excess interrupt load" },
    { 0x350A,                               "Resume RUN mode after CiR" },
    { 0x350B,                               "Technology synchronization interrupt - timing error" },
    { 0x3571,                               "Nesting depth too high in nesting levels" },
    { 0x3572,                               "Nesting depth for Master Control Relays too high" },
    { 0x3573,                               "Nesting depth too high after synchronous errors" },
    { 0x3574,                               "Nesting depth for block calls (U stack) too high" },
    { 0x3575,                               "Nesting depth for block calls (B stack) too high" },
    { 0x3576,                               "Local data allocation error" },
    { 0x3578,                               "Unknown instruction" },
    { 0x357A,                               "Jump instruction to target outside of the block" },
    { 0x3582,                               "Memory error detected and corrected by operating system" },
    { 0x3583,                               "Accumulation of detected and corrected memo errors" },
    { 0x3585,                               "Error in the PC operating system (only for LC RTX)" },
    { 0x3587,                               "Multi-bit memory error detected and corrected" },
    { 0x35A1,                               "User interface (OB or FRB) not found" },
    { 0x35A2,                               "OB not loaded (started by SFC or operating system due to configuration)" },
    { 0x35A3,                               "Error when operating system accesses a block" },
    { 0x35A4,                               "PROFInet Interface DB cannot be addressed" },
    { 0x35D2,                               "Diagnostic entries cannot be sent at present" },
    { 0x35D3,                               "Synchronization frames cannot be sent" },
    { 0x35D4,                               "Illegal time jump resulting from synchronization" },
    { 0x35D5,                               "Error adopting the synchronization time" },
    { 0x35E1,                               "Incorrect frame ID in GD" },
    { 0x35E2,                               "GD packet status cannot be entered in DB" },
    { 0x35E3,                               "Frame length error in GD" },
    { 0x35E4,                               "Illegal GD packet number received" },
    { 0x35E5,                               "Error accessing DB in communication SFBs for configured S7 connections" },
    { 0x35E6,                               "GD total status cannot be entered in DB" },
    { 0x3821,                               "BATTF: failure on at least one backup battery of the central rack, problem eliminated" },
    { 0x3822,                               "BAF: failure of backup voltage on central rack, problem eliminated" },
    { 0x3823,                               "24 volt supply failure on central rack, problem eliminated" },
    { 0x3825,                               "BATTF: failure on at least one backup battery of the redundant central rack, problem eliminated" },
    { 0x3826,                               "BAF: failure of backup voltage on redundant central rack, problem eliminated" },
    { 0x3827,                               "24 volt supply failure on redundant central rack, problem eliminated" },
    { 0x3831,                               "BATTF: failure of at least one backup battery of the expansion rack, problem eliminated" },
    { 0x3832,                               "BAF: failure of backup voltage on expansion rack, problem eliminated" },
    { 0x3833,                               "24 volt supply failure on at least one expansion rack, problem eliminated" },
    { 0x3842,                               "Module OK" },
    { 0x3854,                               "PROFINET IO interface submodule/submodule and matches the configured interface submodule/submodule" },
    { 0x3855,                               "PROFINET IO interface submodule/submodule inserted, but does not match the configured interface submodule/submodule" },
    { 0x3856,                               "PROFINET IO interface submodule/submodule inserted, but error in module parameter assignment" },
    { 0x3858,                               "PROFINET IO interface submodule access error corrected" },
    { 0x3861,                               "Module/interface module inserted, module type OK" },
    { 0x3863,                               "Module/interface module plugged in, but wrong module type" },
    { 0x3864,                               "Module/interface module plugged in, but causing problem (type ID unreadable)" },
    { 0x3865,                               "Module plugged in, but error in module parameter assignment" },
    { 0x3866,                               "Module can be addressed again, load voltage error removed" },
    { 0x3881,                               "Interface error leaving state" },
    { 0x3884,                               "Interface module plugged in" },
    { 0x38B3,                               "I/O access error when updating the process image input table" },
    { 0x38B4,                               "I/O access error when transferring the process image to the output modules" },
    { 0x38C1,                               "Expansion rack operational again (1 to 21), leaving state" },
    { 0x38C2,                               "Expansion rack operational again but mismatch between setpoint and actual configuration" },
    { 0x38C4,                               "Distributed I/Os: station failure, leaving state" },
    { 0x38C5,                               "Distributed I/Os: station fault, leaving state" },
    { 0x38C6,                               "Expansion rack operational again, but error(s) in module parameter assignment" },
    { 0x38C7,                               "DP: station operational again, but error(s) in module parameter assignment" },
    { 0x38C8,                               "DP: station operational again, but mismatch between setpoint and actual configuration" },
    { 0x38CB,                               "PROFINET IO station operational again" },
    { 0x38CC,                               "PROFINET IO station error corrected" },
    { 0x3921,                               "BATTF: failure on at least one backup battery of the central rack" },
    { 0x3922,                               "BAF: failure of backup voltage on central rack" },
    { 0x3923,                               "24 volt supply failure on central rack" },
    { 0x3925,                               "BATTF: failure on at least one backup battery of the redundant central rack" },
    { 0x3926,                               "BAF: failure of backup voltage on redundant central rack" },
    { 0x3927,                               "24 volt supply failure on redundant central rack" },
    { 0x3931,                               "BATTF: failure of at least one backup battery of the expansion rack" },
    { 0x3932,                               "BAF: failure of backup voltage on expansion rack" },
    { 0x3933,                               "24 volt supply failure on at least one expansion rack" },
    { 0x3942,                               "Module error" },
    { 0x3951,                               "PROFINET IO submodule removed" },
    { 0x3954,                               "PROFINET IO interface submodule/submodule removed" },
    { 0x3961,                               "Module/interface module removed, cannot be addressed" },
    { 0x3966,                               "Module cannot be addressed, load voltage error" },
    { 0x3968,                               "Module reconfiguration has ended with error" },
    { 0x3981,                               "Interface error entering state" },
    { 0x3984,                               "Interface module removed" },
    { 0x3986,                               "Performance of an H-Sync link negatively affected" },
    { 0x39B1,                               "I/O access error when updating the process image input table" },
    { 0x39B2,                               "I/O access error when transferring the process image to the output modules" },
    { 0x39B3,                               "I/O access error when updating the process image input table" },
    { 0x39B4,                               "I/O access error when transferring the process image to the output modules" },
    { 0x39C1,                               "Expansion rack failure (1 to 21), entering state" },
    { 0x39C3,                               "Distributed I/Os: master system failure entering state" },
    { 0x39C4,                               "Distributed I/Os: station failure, entering state" },
    { 0x39C5,                               "Distributed I/Os: station fault, entering state" },
    { 0x39CA,                               "PROFINET IO system failure" },
    { 0x39CB,                               "PROFINET IO station failure" },
    { 0x39CC,                               "PROFINET IO station error" },
    { 0x39CD,                               "PROFINET IO station operational again, but expected configuration does not match actual configuration" },
    { 0x39CE,                               "PROFINET IO station operational again, but error(s) in module parameter assignment" },
    { 0x42F3,                               "Checksum error detected and corrected by the operating system" },
    { 0x42F4,                               "Standby CPU: connection/update via SFC90 is locked in the master CPU" },
    { 0x4300,                               "Backed-up power on" },
    { 0x4301,                               "Mode transition from STOP to STARTUP" },
    { 0x4302,                               "Mode transition from STARTUP to RUN" },
    { 0x4303,                               "STOP caused by stop switch being activated" },
    { 0x4304,                               "STOP caused by PG STOP operation or by SFB 20 STOP" },
    { 0x4305,                               "HOLD: breakpoint reached" },
    { 0x4306,                               "HOLD: breakpoint exited" },
    { 0x4307,                               "Memory reset started by PG operation" },
    { 0x4308,                               "Memory reset started by switch setting" },
    { 0x4309,                               "Memory reset started automatically (power on not backed up)" },
    { 0x430A,                               "HOLD exited, transition to STOP" },
    { 0x430D,                               "STOP caused by other CPU in multicomputing" },
    { 0x430E,                               "Memory reset executed" },
    { 0x430F,                               "STOP on the module due to STOP on a CPU" },
    { 0x4318,                               "Start of CiR" },
    { 0x4319,                               "CiR completed" },
    { 0x4357,                               "Module watchdog started" },
    { 0x4358,                               "All modules are ready for operation" },
    { 0x43B0,                               "Firmware update was successful" },
    { 0x43B4,                               "Error in firmware fuse" },
    { 0x43B6,                               "Firmware updates canceled by redundant modules" },
    { 0x43D3,                               "STOP on standby CPU" },
    { 0x43DC,                               "Abort during link-up with switchover" },
    { 0x43DE,                               "Updating aborted due to monitoring time being exceeded during the n-th attempt, new update attempt initiated" },
    { 0x43DF,                               "Updating aborted for final time due to monitoring time being exceeded after completing the maximum amount of attempts. User intervention required" },
    { 0x43E0,                               "Change from solo mode after link-up" },
    { 0x43E1,                               "Change from link-up after updating" },
    { 0x43E2,                               "Change from updating to redundant mode" },
    { 0x43E3,                               "Master CPU: change from redundant mode to solo mode" },
    { 0x43E4,                               "Standby CPU: change from redundant mode after error-search mode" },
    { 0x43E5,                               "Standby CPU: change from error-search mode after link-up or STOP" },
    { 0x43E6,                               "Link-up aborted on the standby CPU" },
    { 0x43E7,                               "Updating aborted on the standby CPU" },
    { 0x43E8,                               "Standby CPU: change from link-up after startup" },
    { 0x43E9,                               "Standby CPU: change from startup after updating" },
    { 0x43F1,                               "Reserve-master switchover" },
    { 0x43F2,                               "Coupling of incompatible H-CPUs blocked by system program" },
    { 0x4510,                               "STOP violation of the CPU's data range" },
    { 0x4520,                               "DEFECTIVE: STOP not possible" },
    { 0x4521,                               "DEFECTIVE: failure of instruction processing processor" },
    { 0x4522,                               "DEFECTIVE: failure of clock chip" },
    { 0x4523,                               "DEFECTIVE: failure of clock pulse generator" },
    { 0x4524,                               "DEFECTIVE: failure of timer update function" },
    { 0x4525,                               "DEFECTIVE: failure of multicomputing synchronization" },
    { 0x4527,                               "DEFECTIVE: failure of I/O access monitoring" },
    { 0x4528,                               "DEFECTIVE: failure of scan time monitoring" },
    { 0x4530,                               "DEFECTIVE: memory test error in internal memory" },
    { 0x4532,                               "DEFECTIVE: failure of core resources" },
    { 0x4536,                               "DEFECTIVE: switch defective" },
    { 0x4540,                               "STOP: Memory expansion of the internal work memory has gaps. First memory expansion too small or missing" },
    { 0x4541,                               "STOP caused by priority class system" },
    { 0x4542,                               "STOP caused by object management system" },
    { 0x4543,                               "STOP caused by test functions" },
    { 0x4544,                               "STOP caused by diagnostic system" },
    { 0x4545,                               "STOP caused by communication system" },
    { 0x4546,                               "STOP caused by CPU memory management" },
    { 0x4547,                               "STOP caused by process image management" },
    { 0x4548,                               "STOP caused by I/O management" },
    { 0x454A,                               "STOP caused by configuration: an OB deselected with STEP 7 was being loaded into the CPU during STARTUP" },
    { 0x4550,                               "DEFECTIVE: internal system error" },
    { 0x4555,                               "No restart possible, monitoring time elapsed" },
    { 0x4556,                               "STOP: memory reset request from communication system / due to data inconsistency" },
    { 0x4562,                               "STOP caused by programming error (OB not loaded or not possible)" },
    { 0x4563,                               "STOP caused by I/O access error (OB not loaded or not possible)" },
    { 0x4567,                               "STOP caused by H event" },
    { 0x4568,                               "STOP caused by time error (OB not loaded or not possible)" },
    { 0x456A,                               "STOP caused by diagnostic interrupt (OB not loaded or not possible)" },
    { 0x456B,                               "STOP caused by removing/inserting module (OB not loaded or not possible)" },
    { 0x456C,                               "STOP caused by CPU hardware error (OB not loaded or not possible, or no FRB)" },
    { 0x456D,                               "STOP caused by program sequence error (OB not loaded or not possible)" },
    { 0x456E,                               "STOP caused by communication error (OB not loaded or not possible)" },
    { 0x456F,                               "STOP caused by rack failure OB (OB not loaded or not possible)" },
    { 0x4570,                               "STOP caused by process interrupt (OB not loaded or not possible)" },
    { 0x4571,                               "STOP caused by nesting stack error" },
    { 0x4572,                               "STOP caused by master control relay stack error" },
    { 0x4573,                               "STOP caused by exceeding the nesting depth for synchronous errors" },
    { 0x4574,                               "STOP caused by exceeding interrupt stack nesting depth in the priority class stack" },
    { 0x4575,                               "STOP caused by exceeding block stack nesting depth in the priority class stack" },
    { 0x4576,                               "STOP caused by error when allocating the local data" },
    { 0x4578,                               "STOP caused by unknown opcode" },
    { 0x457A,                               "STOP caused by code length error" },
    { 0x457B,                               "STOP caused by DB not being loaded on on-board I/Os" },
    { 0x457D,                               "Reset/clear request because the version of the internal interface to the integrated technology was changed" },
    { 0x457F,                               "STOP caused by STOP command" },
    { 0x4580,                               "STOP: back-up buffer contents inconsistent (no transition to RUN)" },
    { 0x4590,                               "STOP caused by overloading the internal functions" },
    { 0x45D5,                               "LINK-UP rejected due to mismatched CPU memory configuration of the sub-PLC" },
    { 0x45D6,                               "LINK-UP rejected due to mismatched system program of the sub-PLC" },
    { 0x45D8,                               "DEFECTIVE: hardware fault detected due to other error" },
    { 0x45D9,                               "STOP due to SYNC module error" },
    { 0x45DA,                               "STOP due to synchronization error between H CPUs" },
    { 0x45DD,                               "LINK-UP rejected due to running test or other online functions" },
    { 0x4926,                               "DEFECTIVE: failure of the watchdog for I/O access" },
    { 0x4931,                               "STOP or DEFECTIVE: memory test error in memory submodule" },
    { 0x4933,                               "Checksum error" },
    { 0x4934,                               "DEFECTIVE: memory not available" },
    { 0x4935,                               "DEFECTIVE: cancelled by watchdog/processor exceptions" },
    { 0x4949,                               "STOP caused by continuous hardware interrupt" },
    { 0x494D,                               "STOP caused by I/O error" },
    { 0x494E,                               "STOP caused by power failure" },
    { 0x494F,                               "STOP caused by configuration error" },
    { 0x4959,                               "One or more modules not ready for operation" },
    { 0x497C,                               "STOP caused by integrated technology" },
    { 0x49A0,                               "STOP caused by parameter assignment error or non-permissible variation of setpoint and actual extension: Start-up blocked" },
    { 0x49A1,                               "STOP caused by parameter assignment error: memory reset request" },
    { 0x49A2,                               "STOP caused by error in parameter modification: startup disabled" },
    { 0x49A3,                               "STOP caused by error in parameter modification: memory reset request" },
    { 0x49A4,                               "STOP: inconsistency in configuration data" },
    { 0x49A5,                               "STOP: distributed I/Os: inconsistency in the loaded configuration information" },
    { 0x49A6,                               "STOP: distributed I/Os: invalid configuration information" },
    { 0x49A7,                               "STOP: distributed I/Os: no configuration information" },
    { 0x49A8,                               "STOP: error indicated by the interface module for the distributed I/Os" },
    { 0x49B1,                               "Firmware update data incorrect" },
    { 0x49B2,                               "Firmware update: hardware version does not match firmware" },
    { 0x49B3,                               "Firmware update: module type does not match firmware" },
    { 0x49D0,                               "LINK-UP aborted due to violation of coordination rules" },
    { 0x49D1,                               "LINK-UP/UPDATE sequence aborted" },
    { 0x49D2,                               "Standby CPU changed to STOP due to STOP on the master CPU during link-up" },
    { 0x49D4,                               "STOP on a master, since partner CPU is also a master (link-up error)" },
    { 0x49D7,                               "LINK-UP rejected due to change in user program or in configuration" },
    { 0x510F,                               "A problem as occurred with WinLC. This problem has caused the CPU to go into STOP mode or has caused a fault in the CPU" },
    { 0x530D,                               "New startup information in the STOP mode" },
    { 0x5311,                               "Startup despite Not Ready message from module(s)" },
    { 0x5371,                               "Distributed I/Os: end of the synchronization with a DP master" },
    { 0x5380,                               "Diagnostic buffer entries of interrupt and asynchronous errors disabled" },
    { 0x5395,                               "Distributed I/Os: reset of a DP master" },
    { 0x53A2,                               "Download of technology firmware successful" },
    { 0x53A4,                               "Download of technology DB not successful" },
    { 0x53FF,                               "Reset to factory setting" },
    { 0x5445,                               "Start of System reconfiguration in RUN mode" },
    { 0x5481,                               "All licenses for runtime software are complete again" },
    { 0x5498,                               "No more inconsistency with DP master systems due to CiR" },
    { 0x5545,                               "Start of System reconfiguration in RUN mode" },
    { 0x5581,                               "One or several licenses for runtime software are missing" },
    { 0x558A,                               "Difference between the MLFB of the configured and inserted CPU" },
    { 0x558B,                               "Difference in the firmware version of the configured and inserted CPU" },
    { 0x5598,                               "Start of possible inconsistency with DP master systems due to CiR" },
    { 0x55A5,                               "Version conflict: internal interface with integrated technology" },
    { 0x55A6,                               "The maximum number of technology objects has been exceeded" },
    { 0x55A7,                               "A technology DB of this type is already present" },
    { 0x5879,                               "Diagnostic message from DP interface: EXTF LED off" },
    { 0x5960,                               "Parameter assignment error when switching" },
    { 0x5961,                               "Parameter assignment error" },
    { 0x5962,                               "Parameter assignment error preventing startup" },
    { 0x5963,                               "Parameter assignment error with memory reset request" },
    { 0x5966,                               "Parameter assignment error when switching" },
    { 0x5969,                               "Parameter assignment error with startup blocked" },
    { 0x596A,                               "PROFINET IO: IP address of an IO device already present" },
    { 0x596B,                               "IP address of an Ethernet interface already exists" },
    { 0x596C,                               "Name of an Ethernet interface already exists" },
    { 0x596D,                               "The existing network configuration does not mach the system requirements or configuration" },
    { 0x5979,                               "Diagnostic message from DP interface: EXTF LED on" },
    { 0x597C,                               "DP Global Control command failed or moved" },
    { 0x59A0,                               "The interrupt can not be associated in the CPU" },
    { 0x59A1,                               "Configuration error in the integrated technology" },
    { 0x59A3,                               "Error when downloading the integrated technology" },
    { 0x6253,                               "Firmware update: End of firmware download over the network" },
    { 0x6316,                               "Interface error when starting programmable controller" },
    { 0x6353,                               "Firmware update: Start of firmware download over the network" },
    { 0x6390,                               "Formatting of Micro Memory Card complete" },
    { 0x6500,                               "Connection ID exists twice on module" },
    { 0x6501,                               "Connection resources inadequate" },
    { 0x6502,                               "Error in the connection description" },
    { 0x6510,                               "CFB structure error detected in instance DB when evaluating EPROM" },
    { 0x6514,                               "GD packet number exists twice on the module" },
    { 0x6515,                               "Inconsistent length specifications in GD configuration information" },
    { 0x6521,                               "No memory submodule and no internal memory available" },
    { 0x6522,                               "Illegal memory submodule: replace submodule and reset memory" },
    { 0x6523,                               "Memory reset request due to error accessing submodule" },
    { 0x6524,                               "Memory reset request due to error in block header" },
    { 0x6526,                               "Memory reset request due to memory replacement" },
    { 0x6527,                               "Memory replaced, therefore restart not possible" },
    { 0x6528,                               "Object handling function in the STOP/HOLD mode, no restart possible" },
    { 0x6529,                               "No startup possible during the \"load user program\" function" },
    { 0x652A,                               "No startup because block exists twice in user memory" },
    { 0x652B,                               "No startup because block is too long for submodule - replace submodule" },
    { 0x652C,                               "No startup due to illegal OB on submodule" },
    { 0x6532,                               "No startup because illegal configuration information on submodule" },
    { 0x6533,                               "Memory reset request because of invalid submodule content" },
    { 0x6534,                               "No startup: block exists more than once on submodule" },
    { 0x6535,                               "No startup: not enough memory to transfer block from submodule" },
    { 0x6536,                               "No startup: submodule contains an illegal block number" },
    { 0x6537,                               "No startup: submodule contains a block with an illegal length" },
    { 0x6538,                               "Local data or write-protection ID (for DB) of a block illegal for CPU" },
    { 0x6539,                               "Illegal command in block (detected by compiler)" },
    { 0x653A,                               "Memory reset request because local OB data on submodule too short" },
    { 0x6543,                               "No startup: illegal block type" },
    { 0x6544,                               "No startup: attribute \"relevant for processing\" illegal" },
    { 0x6545,                               "Source language illegal" },
    { 0x6546,                               "Maximum amount of configuration information reached" },
    { 0x6547,                               "Parameter assignment error assigning parameters to modules (not on P bus, cancel download)" },
    { 0x6548,                               "Plausibility error during block check" },
    { 0x6549,                               "Structure error in block" },
    { 0x6550,                               "A block has an error in the CRC" },
    { 0x6551,                               "A block has no CRC" },
    { 0x6560,                               "SCAN overflow" },
    { 0x6805,                               "Resource problem on configured connections, eliminated" },
    { 0x6881,                               "Interface error leaving state" },
    { 0x6905,                               "Resource problem on configured connections" },
    { 0x6981,                               "Interface error entering state" },
    { 0x72A2,                               "Failure of a DP master or a DP master system" },
    { 0x72A3,                               "Redundancy restored on the DP slave" },
    { 0x72DB,                               "Safety program: safety mode disabled" },
    { 0x72E0,                               "Loss of redundancy in communication, problem eliminated" },
    { 0x7301,                               "Loss of redundancy (1 of 2) due to failure of a CPU" },
    { 0x7302,                               "Loss of redundancy (1 of 2) due to STOP on the standby triggered by user" },
    { 0x7303,                               "H system (1 of 2) changed to redundant mode" },
    { 0x7323,                               "Discrepancy found in operating system data" },
    { 0x7331,                               "Standby-master switchover due to master failure" },
    { 0x7333,                               "Standby-master switchover due to system modification during runtime" },
    { 0x7334,                               "Standby-master switchover due to communication error at the synchronization module" },
    { 0x7340,                               "Synchronization error in user program due to elapsed wait time" },
    { 0x7341,                               "Synchronization error in user program due to waiting at different synchronization points" },
    { 0x7342,                               "Synchronization error in operating system due to waiting at different synchronization points" },
    { 0x7343,                               "Synchronization error in operating system due to elapsed wait time" },
    { 0x7344,                               "Synchronization error in operating system due to incorrect data" },
    { 0x734A,                               "The \"Re-enable\" job triggered by SFC 90 \"H_CTRL\" was executed" },
    { 0x73A3,                               "Loss of redundancy on the DP slave" },
    { 0x73C1,                               "Update process canceled" },
    { 0x73C2,                               "Updating aborted due to monitoring time being exceeded during the n-th attempt (1 = n = max. possible number of update attempts after abort due to excessive monitoring time)" },
    { 0x73D8,                               "Safety mode disabled" },
    { 0x73DB,                               "Safety program: safety mode enabled" },
    { 0x73E0,                               "Loss of redundancy in communication" },
    { 0x74DD,                               "Safety program: Shutdown of a fail-save runtime group disabled" },
    { 0x74DE,                               "Safety program: Shutdown of the F program disabled" },
    { 0x74DF,                               "Start of F program initialization" },
    { 0x7520,                               "Error in RAM comparison" },
    { 0x7521,                               "Error in comparison of process image output value" },
    { 0x7522,                               "Error in comparison of memory bits, timers, or counters" },
    { 0x75D1,                               "Safety program: Internal CPU error" },
    { 0x75D2,                               "Safety program error: Cycle time time-out" },
    { 0x75D6,                               "Data corrupted in safety program prior to the output to F I/O" },
    { 0x75D7,                               "Data corrupted in safety program prior to the output to partner F-CPU" },
    { 0x75D9,                               "Invalid REAL number in a DB" },
    { 0x75DA,                               "Safety program: Error in safety data format" },
    { 0x75DC,                               "Runtime group, internal protocol error" },
    { 0x75DD,                               "Safety program: Shutdown of a fail-save runtime group enabled" },
    { 0x75DE,                               "Safety program: Shutdown of the F program enabled" },
    { 0x75DF,                               "End of F program initialization" },
    { 0x75E1,                               "Safety program: Error in FB \"F_PLK\" or \"F_PLK_O\" or \"F_CYC_CO\" or \"F_TEST\" or \"F_TESTC\"" },
    { 0x75E2,                               "Safety program: Area length error" },
    { 0x7852,                               "SYNC module inserted" },
    { 0x7855,                               "SYNC module eliminated" },
    { 0x78D3,                               "Communication error between PROFIsafe and F I/O" },
    { 0x78D4,                               "Error in safety relevant communication between F CPUs" },
    { 0x78D5,                               "Error in safety relevant communication between F CPUs" },
    { 0x78E3,                               "F-I/O device input channel depassivated" },
    { 0x78E4,                               "F-I/O device output channel depassivated" },
    { 0x78E5,                               "F-I/O device depassivated" },
    { 0x7934,                               "Standby-master switchover due to connection problem at the SYNC module" },
    { 0x7950,                               "Synchronization module missing" },
    { 0x7951,                               "Change at the SYNC module without Power On" },
    { 0x7952,                               "SYNC module removed" },
    { 0x7953,                               "Change at the SYNC-module without reset" },
    { 0x7954,                               "SYNC module: rack number assigned twice" },
    { 0x7955,                               "SYNC module error" },
    { 0x7956,                               "Illegal rack number set on SYNC module" },
    { 0x7960,                               "Redundant I/O: Time-out of discrepancy time at digital input, error is not yet localized" },
    { 0x7961,                               "Redundant I/O, digital input error: Signal change after expiration of the discrepancy time" },
    { 0x7962,                               "Redundant I/O: Digital input error" },
    { 0x796F,                               "Redundant I/O: The I/O was globally disabled" },
    { 0x7970,                               "Redundant I/O: Digital output error" },
    { 0x7980,                               "Redundant I/O: Time-out of discrepancy time at analog input" },
    { 0x7981,                               "Redundant I/O: Analog input error" },
    { 0x7990,                               "Redundant I/O: Analog output error" },
    { 0x79D3,                               "Communication error between PROFIsafe and F I/O" },
    { 0x79D4,                               "Error in safety relevant communication between F CPUs" },
    { 0x79D5,                               "Error in safety relevant communication between F CPUs" },
    { 0x79E3,                               "F-I/O device input channel passivated" },
    { 0x79E4,                               "F-I/O device output channel passivated" },
    { 0x79E5,                               "F-I/O device passivated" },
    { 0x79E6,                               "Inconsistent safety program" },
    { 0x79E7,                               "Simulation block (F system block) loaded" },
    { 0,                                    NULL }
};
static value_string_ext cpu_diag_eventid_fix_names_ext = VALUE_STRING_EXT_INIT(cpu_diag_eventid_fix_names);

static const value_string cpu_diag_eventid_0x8_0x9_names[] = {
    { 0x8000,                               "Module fault/OK" },
    { 0x8001,                               "Internal error" },
    { 0x8002,                               "External error" },
    { 0x8003,                               "Channel error" },
    { 0x8004,                               "No external auxiliary voltage" },
    { 0x8005,                               "No front connector" },
    { 0x8006,                               "No parameter assignment" },
    { 0x8007,                               "Incorrect parameters in module" },
    { 0x8030,                               "User submodule incorrect/not found" },
    { 0x8031,                               "Communication problem" },
    { 0x8032,                               "Operating mode: RUN/STOP (STOP: entering state, RUN: leaving state)" },
    { 0x8033,                               "Time monitoring responded (watchdog)" },
    { 0x8034,                               "Internal module power failure" },
    { 0x8035,                               "BATTF: battery exhausted" },
    { 0x8036,                               "Total backup failed" },
    { 0x8040,                               "Expansion rack failed" },
    { 0x8041,                               "Processor failure" },
    { 0x8042,                               "EPROM error" },
    { 0x8043,                               "RAM error" },
    { 0x8044,                               "ADC/DAC error" },
    { 0x8045,                               "Fuse blown" },
    { 0x8046,                               "Hardware interrupt lost Any" },
    { 0x8050,                               "Configuration/parameter assignment error" },
    { 0x8051,                               "Common mode error" },
    { 0x8052,                               "Short circuit to phase" },
    { 0x8053,                               "Short circuit to ground" },
    { 0x8054,                               "Wire break" },
    { 0x8055,                               "Reference channel error" },
    { 0x8056,                               "Below measuring range" },
    { 0x8057,                               "Above measuring range Analog input" },
    { 0x8060,                               "Configuration/parameter assignment error" },
    { 0x8061,                               "Common mode error" },
    { 0x8062,                               "Short circuit to phase" },
    { 0x8063,                               "Short circuit to ground" },
    { 0x8064,                               "Wire break" },
    { 0x8066,                               "No load voltage" },
    { 0x8070,                               "Configuration/parameter assignment error" },
    { 0x8071,                               "Chassis ground fault" },
    { 0x8072,                               "Short circuit to phase (sensor)" },
    { 0x8073,                               "Short circuit to ground (sensor)" },
    { 0x8074,                               "Wire break" },
    { 0x8075,                               "No sensor power supply Digital input" },
    { 0x8080,                               "Configuration/parameter assignment error" },
    { 0x8081,                               "Chassis ground fault" },
    { 0x8082,                               "Short circuit to phase" },
    { 0x8083,                               "Short circuit to ground" },
    { 0x8084,                               "Wire break" },
    { 0x8085,                               "Fuse tripped" },
    { 0x8086,                               "No load voltage" },
    { 0x8087,                               "Excess temperature Digital output" },
    { 0x80B0,                               "Counter module, signal A faulty" },
    { 0x80B1,                               "Counter module, signal B faulty" },
    { 0x80B2,                               "Counter module, signal N faulty" },
    { 0x80B3,                               "Counter module, incorrect value passed between the channels" },
    { 0x80B4,                               "Counter module, 5.2 V sensor supply faulty" },
    { 0x80B5,                               "Counter module, 24 V sensor supply faulty" },
    { 0x9001,                               "Automatic/Manual mode (coming=man,going=auto)" },
    { 0x9002,                               "OPEN/CLOSED, ON/OFF" },
    { 0x9003,                               "Manual command enable" },
    { 0x9004,                               "Unit protective command (OPEN/CLOSED)" },
    { 0x9005,                               "Process enable" },
    { 0x9006,                               "System protection command" },
    { 0x9007,                               "Process value monitoring responded" },
    { 0x9008,                               "Manipulated variable monitoring responded" },
    { 0x9009,                               "System deviation greater than permitted" },
    { 0x900A,                               "Limit position error" },
    { 0x900B,                               "Runtime error" },
    { 0x900C,                               "Command execution error (sequencer)" },
    { 0x900D,                               "Operating status running > OPEN" },
    { 0x900E,                               "Operating status running > CLOSED" },
    { 0x900F,                               "Command blocking" },
    { 0x9011,                               "Process status OPEN/ON" },
    { 0x9012,                               "Process status CLOSED/OFF" },
    { 0x9013,                               "Process status intermediate position" },
    { 0x9014,                               "Process status ON via AUTO" },
    { 0x9015,                               "Process status ON via manual" },
    { 0x9016,                               "Process status ON via protective command" },
    { 0x9017,                               "Process status OFF via AUTO" },
    { 0x9018,                               "Process status OFF via manual" },
    { 0x9019,                               "Process status OFF via protective command" },
    { 0x9021,                               "Function error on approach" },
    { 0x9022,                               "Function error on leaving" },
    { 0x9031,                               "Actuator (DE/WE) limit position OPEN" },
    { 0x9032,                               "Actuator (DE/WE) limit position not OPEN" },
    { 0x9033,                               "Actuator (DE/WE) limit position CLOSED" },
    { 0x9034,                               "Actuator (DE/WE) limit position not CLOSED" },
    { 0x9041,                               "Illegal status, tolerance time elapsed" },
    { 0x9042,                               "Illegal status, tolerance time not elapsed" },
    { 0x9043,                               "Interlock error, tolerance time = 0" },
    { 0x9044,                               "Interlock error, tolerance time > 0" },
    { 0x9045,                               "No reaction" },
    { 0x9046,                               "Final status exited illegally, tolerance time = 0" },
    { 0x9047,                               "Final status exited illegally, tolerance time > 0" },
    { 0x9050,                               "Upper limit of signal range USR" },
    { 0x9051,                               "Upper limit of measuring range UMR" },
    { 0x9052,                               "Lower limit of signal range LSR" },
    { 0x9053,                               "Lower limit of measuring range LMR" },
    { 0x9054,                               "Upper alarm limit UAL" },
    { 0x9055,                               "Upper warning limit UWL" },
    { 0x9056,                               "Upper tolerance limit UTL" },
    { 0x9057,                               "Lower tolerance limit LTL" },
    { 0x9058,                               "Lower warning limit LWL" },
    { 0x9059,                               "Lower alarm limit LAL" },
    { 0x9060,                               "GRAPH7 step entering/leaving" },
    { 0x9061,                               "GRAPH7 interlock error" },
    { 0x9062,                               "GRAPH7 execution error" },
    { 0x9063,                               "GRAPH7 error noted" },
    { 0x9064,                               "GRAPH7 error acknowledged" },
    { 0x9070,                               "Trend exceeded in positive direction" },
    { 0x9071,                               "Trend exceeded in negative direction" },
    { 0x9072,                               "No reaction" },
    { 0x9073,                               "Final state exited illegally" },
    { 0x9080,                               "Limit value exceeded, tolerance time = 0" },
    { 0x9081,                               "Limit value exceeded, tolerance time > 0" },
    { 0x9082,                               "Below limit value, tolerance time = 0" },
    { 0x9083,                               "Below limit value, tolerance time > 0" },
    { 0x9084,                               "Gradient exceeded, tolerance time = 0" },
    { 0x9085,                               "Gradient exceeded, tolerance time > 0" },
    { 0x9086,                               "Below gradient, tolerance time = 0" },
    { 0x9087,                               "Below gradient, tolerance time > 0" },
    { 0x9090,                               "User parameter assignment error entering/leaving" },
    { 0x90F0,                               "Overflow" },
    { 0x90F1,                               "Underflow" },
    { 0x90F2,                               "Division by 0" },
    { 0x90F3,                               "Illegal calculation operation" },
    { 0,                                    NULL }
};
static value_string_ext cpu_diag_eventid_0x8_0x9_names_ext = VALUE_STRING_EXT_INIT(cpu_diag_eventid_0x8_0x9_names);

/**************************************************************************
 * Type of alarmquery in alarm query request
 */
#define S7COMM_ALARM_MESSAGE_QUERYTYPE_BYALARMTYPE      1
#define S7COMM_ALARM_MESSAGE_QUERYTYPE_BYEVENTID        3

static const value_string alarm_message_querytype_names[] = {
    { S7COMM_ALARM_MESSAGE_QUERYTYPE_BYALARMTYPE,      "ByAlarmtype" },
    { S7COMM_ALARM_MESSAGE_QUERYTYPE_BYEVENTID,        "ByEventID" },
    { 0,                                                NULL }
};

/**************************************************************************
 * Alarmtype in alarm query
 */
#define S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_SCAN       1
#define S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_ALARM_8    2
#define S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_ALARM_S    4

static const value_string alarm_message_query_alarmtype_names[] = {
    { S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_SCAN,        "SCAN" },
    { S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_ALARM_8,     "ALARM_8" },
    { S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_ALARM_S,     "ALARM_S" },
    { 0,                                                NULL }
};

/* CPU message service */
static int hf_s7comm_cpu_msgservice_subscribe_events;
static int hf_s7comm_cpu_msgservice_subscribe_events_modetrans;
static int hf_s7comm_cpu_msgservice_subscribe_events_system;
static int hf_s7comm_cpu_msgservice_subscribe_events_userdefined;
static int hf_s7comm_cpu_msgservice_subscribe_events_alarms;
static int ett_s7comm_cpu_msgservice_subscribe_events;
static int * const s7comm_cpu_msgservice_subscribe_events_fields[] = {
    &hf_s7comm_cpu_msgservice_subscribe_events_modetrans,
    &hf_s7comm_cpu_msgservice_subscribe_events_system,
    &hf_s7comm_cpu_msgservice_subscribe_events_userdefined,
    &hf_s7comm_cpu_msgservice_subscribe_events_alarms,
    NULL
};
static int hf_s7comm_cpu_msgservice_req_reserved1;
static int hf_s7comm_cpu_msgservice_username;
static int hf_s7comm_cpu_msgservice_almtype;
static int hf_s7comm_cpu_msgservice_req_reserved2;
static int hf_s7comm_cpu_msgservice_res_result;
static int hf_s7comm_cpu_msgservice_res_reserved1;
static int hf_s7comm_cpu_msgservice_res_reserved2;
static int hf_s7comm_cpu_msgservice_res_reserved3;

#define S7COMM_CPU_MSG_ALMTYPE_SCAN_ABORT               0
#define S7COMM_CPU_MSG_ALMTYPE_SCAN_INITIATE            1
#define S7COMM_CPU_MSG_ALMTYPE_ALARM_ABORT              4
#define S7COMM_CPU_MSG_ALMTYPE_ALARM_INITIATE           5
#define S7COMM_CPU_MSG_ALMTYPE_AR_SEND_ABORT            6
#define S7COMM_CPU_MSG_ALMTYPE_AR_SEND_INITIATE         7
#define S7COMM_CPU_MSG_ALMTYPE_ALARM_S_ABORT            8
#define S7COMM_CPU_MSG_ALMTYPE_ALARM_S_INITIATE         9

static const value_string cpu_msgservice_almtype_names[] = {
    { S7COMM_CPU_MSG_ALMTYPE_SCAN_ABORT,                "SCAN_ABORT" },
    { S7COMM_CPU_MSG_ALMTYPE_SCAN_INITIATE,             "SCAN_INITIATE" },
    { S7COMM_CPU_MSG_ALMTYPE_ALARM_ABORT,               "ALARM_ABORT" },
    { S7COMM_CPU_MSG_ALMTYPE_ALARM_INITIATE,            "ALARM_INITIATE" },
    { S7COMM_CPU_MSG_ALMTYPE_AR_SEND_ABORT,             "AR_SEND_ABORT" },
    { S7COMM_CPU_MSG_ALMTYPE_AR_SEND_INITIATE,          "AR_SEND_INITIATE" },
    { S7COMM_CPU_MSG_ALMTYPE_ALARM_S_ABORT,             "ALARM_S_ABORT" },
    { S7COMM_CPU_MSG_ALMTYPE_ALARM_S_INITIATE,          "ALARM_S_INITIATE" },
    { 0,                                                NULL }
};

static int hf_s7comm_modetrans_param_unknown1;
static int hf_s7comm_modetrans_param_mode;
static const value_string modetrans_param_mode_names[] = {
    { 0,                                    "STOP" },
    { 1,                                    "Warm Restart" },
    { 2,                                    "RUN" },
    { 3,                                    "Hot Restart" },
    { 4,                                    "HOLD" },
    { 6,                                    "Cold Restart" },
    { 9,                                    "RUN_R (H-System redundant)" },
    { 11,                                   "LINK-UP" },
    { 12,                                   "UPDATE" },
    { 0,                                    NULL }
};
static int hf_s7comm_modetrans_param_unknown2;

/* These fields used when reassembling S7COMM fragments */
static int hf_s7comm_fragments;
static int hf_s7comm_fragment;
static int hf_s7comm_fragment_overlap;
static int hf_s7comm_fragment_overlap_conflict;
static int hf_s7comm_fragment_multiple_tails;
static int hf_s7comm_fragment_too_long_fragment;
static int hf_s7comm_fragment_error;
static int hf_s7comm_fragment_count;
static int hf_s7comm_reassembled_in;
static int hf_s7comm_reassembled_length;
static int ett_s7comm_fragment;
static int ett_s7comm_fragments;

static const fragment_items s7comm_frag_items = {
    /* Fragment subtrees */
    &ett_s7comm_fragment,
    &ett_s7comm_fragments,
    /* Fragment fields */
    &hf_s7comm_fragments,
    &hf_s7comm_fragment,
    &hf_s7comm_fragment_overlap,
    &hf_s7comm_fragment_overlap_conflict,
    &hf_s7comm_fragment_multiple_tails,
    &hf_s7comm_fragment_too_long_fragment,
    &hf_s7comm_fragment_error,
    &hf_s7comm_fragment_count,
    /* Reassembled in field */
    &hf_s7comm_reassembled_in,
    /* Reassembled length field */
    &hf_s7comm_reassembled_length,
    /* Reassembled data field */
    NULL,
    /* Tag */
    "S7COMM fragments"
};

static reassembly_table s7comm_reassembly_table;

/* These are the ids of the subtrees that we are creating */
static int ett_s7comm;                                        /* S7 communication tree, parent of all other subtree */
static int ett_s7comm_header;                                 /* Subtree for header block */
static int ett_s7comm_param;                                  /* Subtree for parameter block */
static int ett_s7comm_param_item;                             /* Subtree for items in parameter block */
static int ett_s7comm_param_subitem;                          /* Subtree for subitems under items in parameter block */
static int ett_s7comm_data;                                   /* Subtree for data block */
static int ett_s7comm_data_item;                              /* Subtree for an item in data block */
static int ett_s7comm_item_address;                           /* Subtree for an address (byte/bit) */
static int ett_s7comm_cpu_alarm_message;                      /* Subtree for an alarm message */
static int ett_s7comm_cpu_alarm_message_object;               /* Subtree for an alarm message block*/
static int ett_s7comm_cpu_alarm_message_timestamp;            /* Subtree for an alarm message timestamp */
static int ett_s7comm_cpu_alarm_message_associated_value;     /* Subtree for an alarm message associated value */
static int ett_s7comm_cpu_diag_msg;                           /* Subtree for a CPU diagnostic message */
static int ett_s7comm_prog_parameter;
static int ett_s7comm_prog_data;

static const char mon_names[][4] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };

/*******************************************************************************************************
 *
 * Converts a siemens special timestamp to a string of 25+1 bytes length (e.g. "Apr 15, 2009 12:49:30.520").
 * The timestamp is 6 bytes long, one word is the number of days since 1.1.1984, and 4 bytes milliseconds of the day
 *
 *******************************************************************************************************/
static void
s7comm_get_timestring_from_s7time(tvbuff_t *tvb, unsigned offset, char *str, int max)
{
    uint16_t days;
    uint32_t day_msec;
    struct tm *mt;
    time_t t;

    day_msec = tvb_get_ntohl(tvb, offset);
    days = tvb_get_ntohs(tvb, offset + 4);

    t = 441763200L;             /* 1.1.1984 00:00:00 */
    t += (uint32_t)days * (24*60*60);
    t += day_msec / 1000;
    mt = gmtime(&t);
    str[0] = '\0';
    if (mt != NULL) {
        snprintf(str, max, "%s %2d, %d %02d:%02d:%02d.%03d", mon_names[mt->tm_mon], mt->tm_mday,
            mt->tm_year + 1900, mt->tm_hour, mt->tm_min, mt->tm_sec, day_msec % 1000);
    }
}

/*******************************************************************************************************
 *
 * Helper for time functions
 * Get int from bcd
 *
 *******************************************************************************************************/
static uint8_t
s7comm_uint8_from_bcd(uint8_t i)
{
    return 10 * (i /16) + (i % 16);
}

/*******************************************************************************************************
 *
 * Helper for time functions
 * Add a BCD coded timestamp (10/8 Bytes length) to tree
 *
 *******************************************************************************************************/
static uint32_t
s7comm_add_timestamp_to_tree(tvbuff_t *tvb,
                             proto_tree *tree,
                             uint32_t offset,
                             bool append_text,
                             bool has_ten_bytes)          /* if this is false the [0] reserved and [1] year bytes are missing */
{
    uint8_t timestamp[10];
    uint8_t i;
    uint8_t tmp;
    uint8_t year_org;
    uint16_t msec;
    nstime_t tv;
    proto_item *item = NULL;
    proto_item *time_tree = NULL;
    struct tm mt;
    int timestamp_size = 10;

    if (has_ten_bytes) {
        /* The low nibble of byte 10 is weekday, the high nibble the LSD of msec */
        for (i = 0; i < 9; i++) {
            timestamp[i] = s7comm_uint8_from_bcd(tvb_get_uint8(tvb, offset + i));
        }
        tmp = tvb_get_uint8(tvb, offset + 9) >> 4;
    } else {
        /* this is a 8 byte timestamp, where the reserved and the year byte is missing */
        timestamp_size = 8;
        timestamp[0] = 0;
        timestamp[1] = 19;  /* start with 19.., will be corrected later */
        for (i = 0; i < 7; i++) {
            timestamp[i + 2] = s7comm_uint8_from_bcd(tvb_get_uint8(tvb, offset + i));
        }
        tmp = tvb_get_uint8(tvb, offset + 7) >> 4;
    }
    timestamp[9] = s7comm_uint8_from_bcd(tmp);

    msec = (uint16_t)timestamp[8] * 10 + (uint16_t)timestamp[9];
    year_org = timestamp[1];
    /* year special: ignore the first byte, since some cpus give 1914 for 2014
     * if second byte is below 89, it's 2000..2089, if over 90 it's 1990..1999
     */
    if (timestamp[2] < 89) {
        timestamp[1] = 20;
    }
    /* convert time to nstime_t */
    mt.tm_year = (timestamp[1] * 100 + timestamp[2]) - 1900;
    mt.tm_mon = timestamp[3] - 1;
    mt.tm_mday = timestamp[4];
    mt.tm_hour = timestamp[5];
    mt.tm_min = timestamp[6];
    mt.tm_sec = timestamp[7];
    mt.tm_isdst = -1;
    tv.secs = mktime(&mt);
    tv.nsecs = msec * 1000000;
    if (mt.tm_mon >= 0 && mt.tm_mon <= 11) {
        item = proto_tree_add_time_format(tree, hf_s7comm_data_ts, tvb, offset, timestamp_size, &tv,
            "S7 Timestamp: %s %2d, %d %02d:%02d:%02d.%03d", mon_names[mt.tm_mon], mt.tm_mday,
            mt.tm_year + 1900, mt.tm_hour, mt.tm_min, mt.tm_sec,
            msec);
        time_tree = proto_item_add_subtree(item, ett_s7comm_data_item);

        /* timefunction: s7 timestamp */
        if (has_ten_bytes) {
            proto_tree_add_uint(time_tree, hf_s7comm_data_ts_reserved, tvb, offset, 1, timestamp[0]);
            offset += 1;
            proto_tree_add_uint(time_tree, hf_s7comm_data_ts_year1, tvb, offset, 1, year_org);
            offset += 1;
        }
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_year2, tvb, offset, 1, timestamp[2]);
        offset += 1;
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_month, tvb, offset, 1, timestamp[3]);
        offset += 1;
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_day, tvb, offset, 1, timestamp[4]);
        offset += 1;
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_hour, tvb, offset, 1, timestamp[5]);
        offset += 1;
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_minute, tvb, offset, 1, timestamp[6]);
        offset += 1;
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_second, tvb, offset, 1, timestamp[7]);
        offset += 1;
        proto_tree_add_uint(time_tree, hf_s7comm_data_ts_millisecond, tvb, offset, 2, msec);
        proto_tree_add_item(time_tree, hf_s7comm_data_ts_weekday, tvb, offset, 2, ENC_BIG_ENDIAN);
        offset += 2;

        if (append_text == true) {
            proto_item_append_text(tree, "(Timestamp: %s %2d, %d %02d:%02d:%02d.%03d)", mon_names[mt.tm_mon], mt.tm_mday,
                mt.tm_year + 1900, mt.tm_hour, mt.tm_min, mt.tm_sec,
                msec);
        }
    } else {
        /* If the timestamp is invalid, continue as best as we can */
        if (has_ten_bytes) {
            offset += 10;
        }
        else {
            offset += 8;
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * Generate a comma separated string for registerflags
 *
 *******************************************************************************************************/
static void
make_registerflag_string(char *str, uint8_t flags, int max)
{
    (void) g_strlcpy(str, "", max);
    if (flags & 0x01) (void) g_strlcat(str, "STW, ", max);
    if (flags & 0x02) (void) g_strlcat(str, "ACCU1, ", max);
    if (flags & 0x04) (void) g_strlcat(str, "ACCU2, ", max);
    if (flags & 0x08) (void) g_strlcat(str, "AR1, ", max);
    if (flags & 0x10) (void) g_strlcat(str, "AR2, ", max);
    if (flags & 0x20) (void) g_strlcat(str, "DB1, ", max);
    if (flags & 0x40) (void) g_strlcat(str, "DB2, ", max);
    if (strlen(str) > 2)
        str[strlen(str) - 2 ] = '\0';
}

/*******************************************************************************************************
 *
 * Addressdefinition for Syntax ID S7-ANY (Step 7 Classic 300/400 or 1200/1500 not optimized)
 * type == 0x12, length == 10, syntax-ID == 0x10
 *
 *******************************************************************************************************/
static uint32_t
s7comm_syntaxid_s7any(tvbuff_t *tvb,
                      uint32_t offset,
                      proto_tree *tree)
{
    uint32_t t_size = 0;
    uint32_t len = 0;
    uint32_t db = 0;
    uint32_t area = 0;
    uint32_t a_address = 0;
    uint32_t bytepos = 0;
    uint32_t bitpos = 0;
    proto_item *address_item = NULL;
    proto_tree *address_item_tree = NULL;

    /* Transport size, 1 byte */
    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_transport_size, tvb, offset, 1, ENC_BIG_ENDIAN, &t_size);
    offset += 1;
    /* Special handling of data record */
    area = tvb_get_uint8(tvb, offset + 4);     /* peek area first */
    if (area == S7COMM_AREA_DATARECORD) {
        /* MLEN, 2 bytes */
        proto_tree_add_item_ret_uint(tree, hf_s7comm_rdrec_mlen, tvb, offset, 2, ENC_BIG_ENDIAN, &len);
        offset += 2;
        /* INDEX, 2 bytes */
        proto_tree_add_item_ret_uint(tree, hf_s7comm_rdrec_index, tvb, offset, 2, ENC_BIG_ENDIAN, &db);
        offset += 2;
        /* Area, 1 byte */
        proto_tree_add_uint(tree, hf_s7comm_item_area, tvb, offset, 1, area);
        offset += 1;
        /* ID, 3 bytes */
        proto_tree_add_item_ret_uint(tree, hf_s7comm_rdrec_id, tvb, offset, 3, ENC_BIG_ENDIAN, &a_address);
        offset += 3;
        proto_item_append_text(tree, " (RECORD MLEN=%d INDEX=0x%04x ID=%d)", len, db, a_address);
    } else {
        /* Length, 2 bytes */
        proto_tree_add_item_ret_uint(tree, hf_s7comm_item_length, tvb, offset, 2, ENC_BIG_ENDIAN, &len);
        offset += 2;
        /* DB number, 2 bytes */
        proto_tree_add_item_ret_uint(tree, hf_s7comm_item_db, tvb, offset, 2, ENC_BIG_ENDIAN, &db);
        offset += 2;
        /* Area, 1 byte */
        proto_tree_add_uint(tree, hf_s7comm_item_area, tvb, offset, 1, area);
        offset += 1;
        /* Address, 3 bytes */
        address_item = proto_tree_add_item_ret_uint(tree, hf_s7comm_item_address, tvb, offset, 3, ENC_BIG_ENDIAN, &a_address);
        address_item_tree = proto_item_add_subtree(address_item, ett_s7comm_item_address);
        bytepos = a_address / 8;
        bitpos = a_address % 8;
        /* build a full address to show item data directly beside the item */
        proto_item_append_text(tree, " (%s", val_to_str(area, item_areanames_short, "unknown area 0x%02x"));
        if (area == S7COMM_AREA_TIMER || area == S7COMM_AREA_COUNTER) {
            proto_item_append_text(tree, " %d)", a_address);
            proto_tree_add_uint(address_item_tree, hf_s7comm_item_address_nr, tvb, offset, 3, a_address);
        } else {
            proto_tree_add_uint(address_item_tree, hf_s7comm_item_address_byte, tvb, offset, 3, a_address);
            proto_tree_add_uint(address_item_tree, hf_s7comm_item_address_bit, tvb, offset, 3, a_address);
            if (area == S7COMM_AREA_DB) {
                proto_item_append_text(tree, " %d.DBX", db);
            } else if (area == S7COMM_AREA_DI) {
                proto_item_append_text(tree, " %d.DIX", db);
            }
            proto_item_append_text(tree, " %d.%d %s %d)",
                bytepos, bitpos, val_to_str(t_size, item_transportsizenames, "Unknown transport size: 0x%02x"), len);
        }
        offset += 3;
    }
    return offset;
}
/*******************************************************************************************************
 *
 * Addressdefinition to read a DB area (S7-400 special)
 * type == 0x12, length >= 7, syntax-ID == 0xb0
 *
 *******************************************************************************************************/
static uint32_t
s7comm_syntaxid_dbread(tvbuff_t *tvb,
                       uint32_t offset,
                       proto_tree *tree)
{
    uint32_t number_of_areas = 0;
    uint32_t len = 0;
    uint32_t db = 0;
    uint32_t bytepos = 0;
    uint32_t i;
    proto_item *sub_item = NULL;
    proto_tree *sub_item_tree = NULL;

    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_dbread_numareas, tvb, offset, 1, ENC_BIG_ENDIAN, &number_of_areas);
    proto_item_append_text(tree, " (%d Data-Areas of Syntax-Id DBREAD)", number_of_areas);
    offset += 1;
    for (i = 0; i < number_of_areas; i++) {
        sub_item = proto_tree_add_item(tree, hf_s7comm_param_subitem, tvb, offset, 5, ENC_NA);
        sub_item_tree = proto_item_add_subtree(sub_item, ett_s7comm_param_subitem);
        proto_tree_add_item_ret_uint(sub_item_tree, hf_s7comm_item_dbread_length, tvb, offset, 1, ENC_BIG_ENDIAN, &len);
        offset += 1;
        proto_tree_add_item_ret_uint(sub_item_tree, hf_s7comm_item_dbread_db, tvb, offset, 2, ENC_BIG_ENDIAN, &db);
        offset += 2;
        proto_tree_add_item_ret_uint(sub_item_tree, hf_s7comm_item_dbread_startadr, tvb, offset, 2, ENC_BIG_ENDIAN, &bytepos);
        offset += 2;
        /* Display in pseudo S7-Any Format */
        proto_item_append_text(sub_item, " [%d]: (DB%d.DBB %d BYTE %d)", i+1, db, bytepos, len);
    }
    return offset;
}

/*******************************************************************************************************
 *
 * Addressdefinition for TIA S7 1200 symbolic address mode
 * type == 0x12, length >= 14, syntax-ID == 0xb2
 *
 *******************************************************************************************************/
static uint32_t
s7comm_syntaxid_1200sym(tvbuff_t *tvb,
                        uint32_t offset,
                        proto_tree *tree,
                        uint8_t varspec_length)
{
    uint32_t tia_var_area1 = 0;
    uint32_t tia_var_area2 = 0;
    uint8_t tia_lid_flags = 0;
    uint32_t tia_value = 0;
    uint16_t i;
    proto_item *sub_item = NULL;
    proto_tree *sub_item_tree = NULL;

    proto_item_append_text(tree, " 1200 symbolic address");
    /* first byte in address seems always to be 0xff */
    proto_tree_add_item(tree, hf_s7comm_tia1200_item_reserved1, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    /* When Bytes 2/3 == 0, then Bytes 4/5 defines the area as known from classic 300/400 address mode.
     * When Bytes 2/3 == 0x8a0e then Bytes 4/5 are containing the DB number.
     */
    proto_tree_add_item_ret_uint(tree, hf_s7comm_tia1200_item_area1, tvb, offset, 2, ENC_BIG_ENDIAN, &tia_var_area1);
    offset += 2;
    tia_var_area2 = tvb_get_ntohs(tvb, offset);
    if (tia_var_area1 == S7COMM_TIA1200_VAR_ITEM_AREA1_IQMCT) {
        proto_tree_add_uint(tree, hf_s7comm_tia1200_item_area2, tvb, offset, 2, tia_var_area2);
        proto_item_append_text(tree, " - Accessing %s", val_to_str(tia_var_area2, tia1200_var_item_area2_names, "Unknown IQMCT Area: 0x%04x"));
        offset += 2;
    } else if (tia_var_area1 == S7COMM_TIA1200_VAR_ITEM_AREA1_DB) {
        proto_tree_add_uint(tree, hf_s7comm_tia1200_item_dbnumber, tvb, offset, 2, tia_var_area2);
        proto_item_append_text(tree, " - Accessing DB%d", tia_var_area2);
        offset += 2;
    } else {
        /* for current unknown areas */
        proto_tree_add_uint(tree, hf_s7comm_tia1200_item_area2unknown, tvb, offset, 2, tia_var_area2);
        proto_item_append_text(tree, " - Unknown area specification");
        offset += 2;
    }
    proto_tree_add_item(tree, hf_s7comm_tia1200_item_crc, tvb, offset, 4, ENC_BIG_ENDIAN);
    offset += 4;

    for (i = 0; i < (varspec_length - 10) / 4; i++) {
        sub_item = proto_tree_add_item(tree, hf_s7comm_tia1200_substructure_item, tvb, offset, 4, ENC_NA);
        sub_item_tree = proto_item_add_subtree(sub_item, ett_s7comm_param_subitem);
        tia_lid_flags = tvb_get_uint8(tvb, offset) >> 4;
        proto_tree_add_item(sub_item_tree, hf_s7comm_tia1200_var_lid_flags, tvb, offset, 1, ENC_BIG_ENDIAN);
        tia_value = tvb_get_ntohl(tvb, offset) & 0x0fffffff;
        proto_item_append_text(sub_item, " [%d]: %s, Value: %u", i + 1,
            val_to_str(tia_lid_flags, tia1200_var_lid_flag_names, "Unknown flags: 0x%02x"),
            tia_value
        );
        proto_tree_add_item(sub_item_tree, hf_s7comm_tia1200_item_value, tvb, offset, 4, ENC_BIG_ENDIAN);
        offset += 4;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * Addressdefinition for Sinumeric NCK access
 * type == 0x12, length == 8, syntax-ID == 0x82 or == 0x83 or == 0x84
 *
 *******************************************************************************************************/
static uint32_t
s7comm_syntaxid_nck(tvbuff_t *tvb,
                    uint32_t offset,
                    proto_tree *tree)
{
    uint32_t area = 0;
    uint32_t nck_area = 0;
    uint32_t nck_unit = 0;
    uint32_t nck_column = 0;
    uint32_t nck_line = 0;
    uint32_t nck_module = 0;

    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_nck_areaunit, tvb, offset, 1, ENC_BIG_ENDIAN, &area);
    nck_area = area >> 5;
    nck_unit = area & 0x1f;
    proto_tree_add_item(tree, hf_s7comm_item_nck_area, tvb, offset, 1, ENC_BIG_ENDIAN);
    proto_tree_add_item(tree, hf_s7comm_item_nck_unit, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_nck_column, tvb, offset, 2, ENC_BIG_ENDIAN, &nck_column);
    offset += 2;
    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_nck_line, tvb, offset, 2, ENC_BIG_ENDIAN, &nck_line);
    offset += 2;
    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_nck_module, tvb, offset, 1, ENC_BIG_ENDIAN, &nck_module);
    offset += 1;
    proto_tree_add_item(tree, hf_s7comm_item_nck_linecount, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_item_append_text(tree, " (NCK Area:%d Unit:%d Column:%d Line:%d Module:0x%02x)",
        nck_area, nck_unit, nck_column, nck_line, nck_module);
    return offset;
}

/*******************************************************************************************************
 *
 * Addressdefinition for accessing Multimaster / Sinamics frequency convertes via routing from DriveES.
 * type == 0x12, length == 10, syntax-ID == 0x82
 *
 *******************************************************************************************************/
static uint32_t
s7comm_syntaxid_driveesany(tvbuff_t *tvb,
                           uint32_t offset,
                           proto_tree *tree)
{
    uint32_t nr = 0;
    uint32_t idx = 0;

    proto_tree_add_item(tree, hf_s7comm_item_driveesany_unknown1, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(tree, hf_s7comm_item_driveesany_unknown2, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item(tree, hf_s7comm_item_driveesany_unknown3, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_driveesany_parameter_nr, tvb, offset, 2, ENC_BIG_ENDIAN, &nr);
    offset += 2;
    proto_tree_add_item_ret_uint(tree, hf_s7comm_item_driveesany_parameter_idx, tvb, offset, 2, ENC_BIG_ENDIAN, &idx);
    offset += 2;
    proto_item_append_text(tree, " (DriveES Parameter: %d[%d])", nr, idx);
    return offset;
}

/*******************************************************************************************************
 *
 * Dissect the parameter details of a read/write request (Items)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_param_item(tvbuff_t *tvb,
                         uint32_t offset,
                         proto_tree *sub_tree,
                         uint8_t item_no)
{
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;
    uint8_t var_spec_type = 0;
    uint8_t var_spec_length = 0;
    uint8_t var_spec_syntax_id = 0;

    var_spec_type = tvb_get_uint8(tvb, offset);
    var_spec_length = tvb_get_uint8(tvb, offset + 1);
    var_spec_syntax_id = tvb_get_uint8(tvb, offset + 2);

    /* Insert a new tree for every item */
    item = proto_tree_add_item(sub_tree, hf_s7comm_param_item, tvb, offset, var_spec_length + 2, ENC_NA);
    item_tree = proto_item_add_subtree(item, ett_s7comm_param_item);
    proto_item_append_text(item, " [%d]:", item_no + 1);

    /* Item head, constant 3 bytes */
    proto_tree_add_item(item_tree, hf_s7comm_item_varspec, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(item_tree, hf_s7comm_item_varspec_length, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(item_tree, hf_s7comm_item_syntax_id, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;

    if (var_spec_type == 0x12 && var_spec_length == 10 && var_spec_syntax_id == S7COMM_SYNTAXID_S7ANY) {
        /* Step 7 Classic 300 400 */
        offset = s7comm_syntaxid_s7any(tvb, offset, item_tree);
    } else if (var_spec_type == 0x12 && var_spec_length >= 7 && var_spec_syntax_id == S7COMM_SYNTAXID_DBREAD) {
        /* S7-400 special address mode (kind of cyclic read) */
        offset = s7comm_syntaxid_dbread(tvb, offset, item_tree);
    } else if (var_spec_type == 0x12 && var_spec_length >= 14 && var_spec_syntax_id == S7COMM_SYNTAXID_1200SYM) {
        /* TIA S7 1200 symbolic address mode */
        offset = s7comm_syntaxid_1200sym(tvb, offset, item_tree, var_spec_length);
    } else if (var_spec_type == 0x12 && var_spec_length == 8
               && ((var_spec_syntax_id == S7COMM_SYNTAXID_NCK)
                   || (var_spec_syntax_id == S7COMM_SYNTAXID_NCK_METRIC)
                   || (var_spec_syntax_id == S7COMM_SYNTAXID_NCK_INCH))) {
        /* Sinumerik NCK access */
        offset = s7comm_syntaxid_nck(tvb, offset, item_tree);
    } else if (var_spec_type == 0x12 && var_spec_length == 10 && var_spec_syntax_id == S7COMM_SYNTAXID_DRIVEESANY) {
        /* Accessing frequency inverter parameters (via routing) */
        offset = s7comm_syntaxid_driveesany(tvb, offset, item_tree);
    }
    else {
        /* var spec, length and syntax id are still added to tree here */
        offset += var_spec_length - 1;
        proto_item_append_text(item_tree, " Unknown variable specification");
    }
    return offset;
}

/*******************************************************************************************************
 *
 * Decode parameter part of a PDU for setup communication
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_pdu_setup_communication(tvbuff_t *tvb,
                                      proto_tree *tree,
                                      uint32_t offset)
{
    proto_tree_add_item(tree, hf_s7comm_param_setup_reserved1, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(tree, hf_s7comm_param_maxamq_calling, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item(tree, hf_s7comm_param_maxamq_called, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item(tree, hf_s7comm_param_neg_pdu_length, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: Response -> Function Write  -> Data part
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_response_write_data(tvbuff_t *tvb,
                                  proto_tree *tree,
                                  uint8_t item_count,
                                  uint32_t offset)
{
    uint8_t ret_val = 0;
    uint8_t i = 0;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;

    for (i = 0; i < item_count; i++) {
        ret_val = tvb_get_uint8(tvb, offset);
        /* Insert a new tree for every item */
        item = proto_tree_add_item(tree, hf_s7comm_data_item, tvb, offset, 1, ENC_NA);
        item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
        proto_item_append_text(item, " [%d]: (%s)", i+1, val_to_str(ret_val, s7comm_item_return_valuenames, "Unknown code: 0x%02x"));
        proto_tree_add_uint(item_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
        offset += 1;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: Response -> Function Read  -> Data part
 *           Request  -> Function Write -> Data part
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_response_read_data(tvbuff_t *tvb,
                                 proto_tree *tree,
                                 uint8_t item_count,
                                 uint32_t offset)
{
    uint8_t ret_val = 0;
    uint8_t tsize = 0;
    uint16_t len = 0, len2 = 0;
    uint16_t head_len = 4;           /* 1 byte res-code, 1 byte transp-size, 2 bytes len */
    uint8_t i = 0;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;

    /* Maybe this is only valid for Sinumerik NCK: Pre-check transport-size
     * If transport size is 0x11 or 0x12, then an array with requested NCK areas will follow.
     */
    tsize = tvb_get_uint8(tvb, offset + 1);
    if (tsize == S7COMM_DATA_TRANSPORT_SIZE_NCKADDR1 || tsize == S7COMM_DATA_TRANSPORT_SIZE_NCKADDR2) {
        proto_tree_add_item(tree, hf_s7comm_data_returncode, tvb, offset, 1, ENC_BIG_ENDIAN);
        proto_tree_add_uint(tree, hf_s7comm_data_transport_size, tvb, offset + 1, 1, tsize);
        offset += 2;
        for (i = 0; i < item_count; i++) {
            offset = s7comm_decode_param_item(tvb, offset, tree, i);
        }
    } else {
        /* Standard */
        for (i = 0; i < item_count; i++) {
            ret_val = tvb_get_uint8(tvb, offset);
            if (ret_val == S7COMM_ITEM_RETVAL_RESERVED ||
                ret_val == S7COMM_ITEM_RETVAL_DATA_OK ||
                ret_val == S7COMM_ITEM_RETVAL_DATA_ERR
                ) {
                tsize = tvb_get_uint8(tvb, offset + 1);
                len = tvb_get_ntohs(tvb, offset + 2);
                /* calculate length in bytes */
                if (tsize == S7COMM_DATA_TRANSPORT_SIZE_BBIT ||
                    tsize == S7COMM_DATA_TRANSPORT_SIZE_BBYTE ||
                    tsize == S7COMM_DATA_TRANSPORT_SIZE_BINT
                    ) {     /* given length is in number of bits */
                    if (len % 8) { /* len is not a multiple of 8, then round up to next number */
                        len /= 8;
                        len = len + 1;
                    } else {
                        len /= 8;
                    }
                }

                /* the PLC places extra bytes at the end of all but last result, if length is not a multiple of 2 */
                if ((len % 2) && (i < (item_count-1))) {
                    len2 = len + 1;
                } else {
                    len2 = len;
                }
            }
            /* Insert a new tree for every item */
            item = proto_tree_add_item(tree, hf_s7comm_data_item, tvb, offset, len + head_len, ENC_NA);
            item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
            proto_item_append_text(item, " [%d]: (%s)", i+1, val_to_str(ret_val, s7comm_item_return_valuenames, "Unknown code: 0x%02x"));

            proto_tree_add_uint(item_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
            proto_tree_add_uint(item_tree, hf_s7comm_data_transport_size, tvb, offset + 1, 1, tsize);
            proto_tree_add_uint(item_tree, hf_s7comm_data_length, tvb, offset + 2, 2, len);
            offset += head_len;

            if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK || ret_val == S7COMM_ITEM_RETVAL_RESERVED) {
                proto_tree_add_item(item_tree, hf_s7comm_readresponse_data, tvb, offset, len, ENC_NA);
                offset += len;
                if (len != len2) {
                    proto_tree_add_item(item_tree, hf_s7comm_data_fillbyte, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                }
            }
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: Request or Response -> Function 0x29 (PLC control functions -> STOP)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_plc_controls_param_hex29(tvbuff_t *tvb,
                                       proto_tree *tree,
                                       uint32_t offset)
{
    uint8_t len;

    /* The first byte 0x29 is checked and inserted to tree outside, so skip it here */
    offset += 1;
    /* Meaning of first 5 bytes (Part 1) is unknown */
    proto_tree_add_item(tree, hf_s7comm_piservice_unknown1, tvb, offset, 5, ENC_NA);
    offset += 5;
    /* Part 2 */
    len = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(tree, hf_s7comm_data_plccontrol_part2_len, tvb, offset, 1, len);
    offset += 1;
    /* Function as string */
    proto_tree_add_item(tree, hf_s7comm_piservice_servicename, tvb, offset, len, ENC_ASCII);
    offset += len;

    return offset;
}

/*******************************************************************************************************
 * PI_START Parameters: Decodes a parameter array with string values.
 *******************************************************************************************************/
static uint32_t
s7comm_decode_pistart_parameters(tvbuff_t *tvb,
                                 packet_info *pinfo,
                                 proto_tree *tree,
                                 proto_tree *param_tree,
                                 const uint8_t *servicename,
                                 uint8_t nfields,      /* number of fields used */
                                 unsigned hf[],          /* array with header fields */
                                 uint32_t offset)
{
    uint8_t i;
    uint8_t len;
    wmem_strbuf_t *args_buf;
    args_buf = wmem_strbuf_create(pinfo->pool);

    for (i = 0; i < nfields; i++) {
        len = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(param_tree, hf_s7comm_piservice_string_len, tvb, offset, 1, len);
        offset += 1;
        proto_tree_add_item(param_tree, hf[i], tvb, offset, len, ENC_ASCII|ENC_NA);
        wmem_strbuf_append(args_buf, "\"");
        wmem_strbuf_append(args_buf, tvb_format_text(pinfo->pool, tvb, offset, len));
        if (i < nfields-1) {
            wmem_strbuf_append(args_buf, "\", ");
        } else {
            wmem_strbuf_append(args_buf, "\"");
        }
        offset += len + (len % 2 == 0);
    }
    proto_item_append_text(param_tree, ": (%s)", wmem_strbuf_get_str(args_buf));
    proto_item_append_text(tree, " -> %s(%s)", servicename, wmem_strbuf_get_str(args_buf));
    col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s(%s)", servicename, wmem_strbuf_get_str(args_buf));

    return offset;
}

/*******************************************************************************************************
 * PI-Service
 *******************************************************************************************************/
static uint32_t
s7comm_decode_pi_service(tvbuff_t *tvb,
                         packet_info *pinfo,
                         proto_tree *tree,
                         uint16_t plength,
                         uint32_t offset)
{
    uint16_t len, paramlen;
    uint32_t startoffset;
    uint32_t paramoffset;
    uint8_t count;
    uint8_t i;
    const uint8_t *servicename;
    const uint8_t *str;
    const uint8_t *str1;
    uint16_t blocktype;
    unsigned hf[13];
    int pi_servicename_idx;
    const char *pi_servicename_descr;

    proto_item *item = NULL;
    proto_item *itemadd = NULL;
    proto_tree *param_tree = NULL;
    proto_tree *file_tree = NULL;

    int32_t num = -1;
    bool num_valid;

    startoffset = offset;

    /* The first byte is checked and inserted to tree outside, so skip it here */
    offset += 1;

    /* First part is unknown, 7 bytes */
    proto_tree_add_item(tree, hf_s7comm_piservice_unknown1, tvb, offset, 7, ENC_NA);
    offset += 7;

    if (offset - startoffset >= plength) {
        return offset;
    }
    /* Parameter block */
    paramlen = tvb_get_ntohs(tvb, offset);
    proto_tree_add_uint(tree, hf_s7comm_piservice_parameterblock_len, tvb, offset, 2, paramlen);
    offset += 2;

    paramoffset = offset;
    item = proto_tree_add_item(tree, hf_s7comm_piservice_parameterblock, tvb, offset, paramlen, ENC_NA);
    param_tree = proto_item_add_subtree(item, ett_s7comm_piservice_parameterblock);
    offset += paramlen;

    /* PI servicename */
    len = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(tree, hf_s7comm_piservice_string_len, tvb, offset, 1, len);
    offset += 1;
    item = proto_tree_add_item_ret_string(tree, hf_s7comm_piservice_servicename, tvb, offset, len, ENC_ASCII|ENC_NA, pinfo->pool, &servicename);
    offset += len;

    /* get the index position in pi_service_names, and add infotext with description to the item */
    pi_servicename_descr = try_str_to_str_idx((const char*)servicename, pi_service_names, &pi_servicename_idx);
    if (pi_servicename_idx < 0) {
        pi_servicename_idx = S7COMM_PI_UNKNOWN;
        pi_servicename_descr = "Unknown PI Service";
    }
    proto_item_append_text(item, " [%s]", pi_servicename_descr);

    /* Work parameter data, depending on servicename */
    switch (pi_servicename_idx) {
        case S7COMM_PI_INSE:
        case S7COMM_PI_INS2:
        case S7COMM_PI_DELE:
            count = tvb_get_uint8(tvb, paramoffset);                   /* number of blocks following */
            proto_tree_add_uint(param_tree, hf_s7comm_data_plccontrol_block_cnt, tvb, paramoffset, 1, count);
            paramoffset += 1;
            /* Unknown, is always 0x00 */
            proto_tree_add_item(param_tree, hf_s7comm_data_pi_inse_unknown, tvb, paramoffset, 1, ENC_BIG_ENDIAN);
            paramoffset += 1;
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s(", servicename);
            for (i = 0; i < count; i++) {
                item = proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_filename, tvb, paramoffset, 8, ENC_ASCII);
                file_tree = proto_item_add_subtree(item, ett_s7comm_plcfilename);
                blocktype = tvb_get_ntohs(tvb, paramoffset);
                itemadd = proto_tree_add_item(file_tree, hf_s7comm_data_blockcontrol_block_type, tvb, paramoffset, 2, ENC_ASCII);
                proto_item_append_text(itemadd, " (%s)", val_to_str(blocktype, blocktype_names, "Unknown Block type: 0x%04x"));
                paramoffset += 2;
                proto_tree_add_item_ret_string(file_tree, hf_s7comm_data_blockcontrol_block_num, tvb, paramoffset, 5, ENC_ASCII|ENC_NA, pinfo->pool, &str);
                paramoffset += 5;
                num_valid = ws_strtoi32((const char*)str, NULL, &num);
                proto_item_append_text(file_tree, " [%s ",
                    val_to_str(blocktype, blocktype_names, "Unknown Block type: 0x%04x"));
                col_append_str(pinfo->cinfo, COL_INFO,
                    val_to_str(blocktype, blocktype_names, "Unknown Block type: 0x%04x"));
                if (num_valid) {
                    proto_item_append_text(file_tree, "%d]", num);
                    col_append_fstr(pinfo->cinfo, COL_INFO, "%d", num);
                } else {
                    expert_add_info(pinfo, file_tree, &ei_s7comm_data_blockcontrol_block_num_invalid);
                    proto_item_append_text(file_tree, "NaN]");
                    col_append_str(pinfo->cinfo, COL_INFO, "NaN");
                }
                if (i+1 < count) {
                    col_append_str(pinfo->cinfo, COL_INFO, ", ");
                }
                itemadd = proto_tree_add_item(file_tree, hf_s7comm_data_blockcontrol_dest_filesys, tvb, paramoffset, 1, ENC_ASCII);
                proto_item_append_text(itemadd, " (%s)", char_val_to_str(tvb_get_uint8(tvb, paramoffset), blocktype_attribute2_names, "Unknown filesys"));
                paramoffset += 1;
            }
            col_append_str(pinfo->cinfo, COL_INFO, ")");
            break;
        case S7COMM_PIP_PROGRAM:
        case S7COMM_PI_MODU:
        case S7COMM_PI_GARB:
            if (paramlen == 0) {
                proto_item_append_text(param_tree, ": ()");
                proto_item_append_text(tree, " -> %s()", servicename);
                col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s()", servicename);
            } else {
                proto_tree_add_item_ret_string(param_tree, hf_s7comm_data_plccontrol_argument, tvb, paramoffset, paramlen, ENC_ASCII|ENC_NA, pinfo->pool, &str1);
                proto_item_append_text(param_tree, ": (\"%s\")", str1);
                proto_item_append_text(tree, " -> %s(\"%s\")", servicename, str1);
                col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s(\"%s\")", servicename, str1);
            }
            break;
        case S7COMM_PI_N_LOGIN_:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_password;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_LOGOUT:
        case S7COMM_PI_N_CANCEL:
        case S7COMM_PI_N_DASAVE:
        case S7COMM_PI_N_DIGIOF:
        case S7COMM_PI_N_DIGION:
        case S7COMM_PI_N_DZERO_:
        case S7COMM_PI_N_ENDEXT:
        case S7COMM_PI_N_OST_OF:
        case S7COMM_PI_N_OST_ON:
        case S7COMM_PI_N_SCALE_:
        case S7COMM_PI_N_SETUFR:
        case S7COMM_PI_N_STRTLK:
        case S7COMM_PI_N_STRTUL:
        case S7COMM_PI_N_TMRASS:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 1, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_DELE:
        case S7COMM_PI_N_EXTERN:
        case S7COMM_PI_N_EXTMOD:
        case S7COMM_PI_N_F_DELR:
        case S7COMM_PI_N_F_XFER:
        case S7COMM_PI_N_LOCKE_:
        case S7COMM_PI_N_SELECT:
        case S7COMM_PI_N_SRTEXT:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_filename;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_CLOS:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_editwindowname;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_OPEN:
        case S7COMM_PI_N_F_OPER:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_filename;
            hf[2] = hf_s7comm_pi_n_x_editwindowname;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_SEEK:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_editwindowname;
            hf[2] = hf_s7comm_pi_n_x_seekpointer;
            hf[3] = hf_s7comm_pi_n_x_windowsize;
            hf[4] = hf_s7comm_pi_n_x_comparestring;
            hf[5] = hf_s7comm_pi_n_x_skipcount;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 6, hf, paramoffset);
            break;
        case S7COMM_PI_N_ASUP__:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_interruptnr;
            hf[2] = hf_s7comm_pi_n_x_priority;
            hf[3] = hf_s7comm_pi_n_x_liftfast;
            hf[4] = hf_s7comm_pi_n_x_blsync;
            hf[5] = hf_s7comm_pi_n_x_filename;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 6, hf, paramoffset);
            break;
        case S7COMM_PI_N_CHEKDM:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_magnr;
            hf[2] = hf_s7comm_pi_n_x_dnr;
            hf[3] = hf_s7comm_pi_n_x_spindlenumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_CHKDNO:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_wznr;
            hf[2] = hf_s7comm_pi_n_x_wznr;
            hf[3] = hf_s7comm_pi_n_x_dnr;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_CONFIG:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_class;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_CRCEDN:
        case S7COMM_PI_N_DELECE:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_tnr;
            hf[2] = hf_s7comm_pi_n_x_dnr;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_CREACE:
        case S7COMM_PI_N_CREATO:
        case S7COMM_PI_N_DELETO:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolnumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_CRTOCE:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolnumber;
            hf[2] = hf_s7comm_pi_n_x_cenumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_DELVAR:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_datablocknumber;
            hf[2] = hf_s7comm_pi_n_x_firstcolumnnumber;
            hf[3] = hf_s7comm_pi_n_x_lastcolumnnumber;
            hf[4] = hf_s7comm_pi_n_x_firstrownumber;
            hf[5] = hf_s7comm_pi_n_x_lastrownumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 6, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_COPY:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_direction;
            hf[2] = hf_s7comm_pi_n_x_sourcefilename;
            hf[3] = hf_s7comm_pi_n_x_destinationfilename;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_DMDA:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_channelnumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_PROR:
        case S7COMM_PI_N_F_PROT:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_filename;
            hf[2] = hf_s7comm_pi_n_x_protection;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_F_RENA:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_oldfilename;
            hf[2] = hf_s7comm_pi_n_x_newfilename;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_FINDBL:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_findmode;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_IBN_SS:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_switch;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_MMCSEM:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_functionnumber;
            hf[2] = hf_s7comm_pi_n_x_semaphorevalue;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_NCKMOD:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_onoff;
            hf[2] = hf_s7comm_pi_n_x_mode;
            hf[3] = hf_s7comm_pi_n_x_factor;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_NEWPWD:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_password;
            hf[2] = hf_s7comm_pi_n_x_passwordlevel;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_SEL_BL:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_linenumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 2, hf, paramoffset);
            break;
        case S7COMM_PI_N_SETTST:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_magnr;
            hf[2] = hf_s7comm_pi_n_x_weargroup;
            hf[3] = hf_s7comm_pi_n_x_toolstatus;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMAWCO:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_magnr;
            hf[2] = hf_s7comm_pi_n_x_weargroup;
            hf[3] = hf_s7comm_pi_n_x_wearsearchstrat;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMCRTC:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolid;
            hf[2] = hf_s7comm_pi_n_x_toolnumber;
            hf[3] = hf_s7comm_pi_n_x_duplonumber;
            hf[4] = hf_s7comm_pi_n_x_edgenumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 5, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMCRTO:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolid;
            hf[2] = hf_s7comm_pi_n_x_toolnumber;
            hf[3] = hf_s7comm_pi_n_x_duplonumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMFDPL:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolnumber;
            hf[2] = hf_s7comm_pi_n_x_placenr;
            hf[3] = hf_s7comm_pi_n_x_magnr;
            hf[4] = hf_s7comm_pi_n_x_placerefnr;
            hf[5] = hf_s7comm_pi_n_x_magrefnr;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 6, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMFPBP:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_magnrfrom;
            hf[2] = hf_s7comm_pi_n_x_placenrfrom;
            hf[3] = hf_s7comm_pi_n_x_magnrto;
            hf[4] = hf_s7comm_pi_n_x_placenrto;
            hf[5] = hf_s7comm_pi_n_x_magrefnr;
            hf[6] = hf_s7comm_pi_n_x_placerefnr;
            hf[7] = hf_s7comm_pi_n_x_halfplacesleft;
            hf[8] = hf_s7comm_pi_n_x_halfplacesright;
            hf[9] = hf_s7comm_pi_n_x_halfplacesup;
            hf[10] = hf_s7comm_pi_n_x_halfplacesdown;
            hf[11] = hf_s7comm_pi_n_x_placetype;
            hf[12] = hf_s7comm_pi_n_x_searchdirection;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 13, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMGETT:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolname;
            hf[2] = hf_s7comm_pi_n_x_duplonumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMMVTL:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolnumber;
            hf[2] = hf_s7comm_pi_n_x_placenrsource;
            hf[3] = hf_s7comm_pi_n_x_magnrsource;
            hf[4] = hf_s7comm_pi_n_x_placenrdestination;
            hf[5] = hf_s7comm_pi_n_x_magnrdestination;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 6, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMPCIT:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_spindlenumber;
            hf[2] = hf_s7comm_pi_n_x_incrementnumber;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 3, hf, paramoffset);
            break;
        case S7COMM_PI_N_TMPOSM:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolnumber;
            hf[2] = hf_s7comm_pi_n_x_toolid;
            hf[3] = hf_s7comm_pi_n_x_duplonumber;
            hf[4] = hf_s7comm_pi_n_x_placenrsource;
            hf[5] = hf_s7comm_pi_n_x_magnrsource;
            hf[6] = hf_s7comm_pi_n_x_placenrdestination;
            hf[7] = hf_s7comm_pi_n_x_magnrdestination;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 8, hf, paramoffset);
            break;
        case S7COMM_PI_N_TRESMO:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_toolnumber;
            hf[2] = hf_s7comm_pi_n_x_dnr;
            hf[3] = hf_s7comm_pi_n_x_monitoringmode;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 4, hf, paramoffset);
            break;
        case S7COMM_PI_N_TSEARC:
            hf[0] = hf_s7comm_pi_n_x_addressident;
            hf[1] = hf_s7comm_pi_n_x_magnrfrom;
            hf[2] = hf_s7comm_pi_n_x_placenrfrom;
            hf[3] = hf_s7comm_pi_n_x_magnrto;
            hf[4] = hf_s7comm_pi_n_x_placenrto;
            hf[5] = hf_s7comm_pi_n_x_magrefnr;
            hf[6] = hf_s7comm_pi_n_x_placerefnr;
            hf[7] = hf_s7comm_pi_n_x_searchdirection;
            hf[8] = hf_s7comm_pi_n_x_kindofsearch;
            s7comm_decode_pistart_parameters(tvb, pinfo, tree, param_tree, servicename, 9, hf, paramoffset);
            break;
        default:
            /* Don't know how to interpret the parameters, show only the PI servicename */
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]", servicename);
    }
    return offset;
}

/*******************************************************************************************************
 *
 * Decode a blockname/filename used in block/file upload/download
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_plc_controls_filename(tvbuff_t *tvb,
                                    packet_info *pinfo,
                                    proto_tree *param_tree,
                                    uint32_t offset)
{
    uint8_t len;
    const uint8_t *str;
    uint16_t blocktype;
    bool is_plcfilename;
    proto_item *item = NULL;
    proto_item *itemadd = NULL;
    proto_tree *file_tree = NULL;

    len = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(param_tree, hf_s7comm_data_blockcontrol_filename_len, tvb, offset, 1, len);
    offset += 1;
    item = proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_filename, tvb, offset, len, ENC_ASCII);
    /* The filename when uploading from PLC has a well known structure, which can be further dissected.
     * An upload from a NC is a simple filename string with no deeper structure.
     * Check for PLC filename, by checking some fixed fields.
     */
    is_plcfilename = false;
    if (len == 9) {
        blocktype = tvb_get_ntohs(tvb, offset + 1);
        if ((tvb_get_uint8(tvb, offset) == '_') && (blocktype >= S7COMM_BLOCKTYPE_OB) && (blocktype <= S7COMM_BLOCKTYPE_SFB)) {
            int32_t num = 1;
            bool num_valid;
            is_plcfilename = true;
            file_tree = proto_item_add_subtree(item, ett_s7comm_plcfilename);
            itemadd = proto_tree_add_item(file_tree, hf_s7comm_data_blockcontrol_file_ident, tvb, offset, 1, ENC_ASCII);
            proto_item_append_text(itemadd, " (%s)", val_to_str(tvb_get_uint8(tvb, offset), blocktype_attribute1_names, "Unknown identifier: %c"));
            offset += 1;
            itemadd = proto_tree_add_item(file_tree, hf_s7comm_data_blockcontrol_block_type, tvb, offset, 2, ENC_ASCII);
            proto_item_append_text(itemadd, " (%s)", val_to_str(blocktype, blocktype_names, "Unknown Block type: 0x%04x"));
            offset += 2;
            proto_tree_add_item_ret_string(file_tree, hf_s7comm_data_blockcontrol_block_num, tvb, offset, 5, ENC_ASCII|ENC_NA, pinfo->pool, &str);
            offset += 5;
            num_valid = ws_strtoi32((const char*)str, NULL, &num);
            proto_item_append_text(file_tree, " [%s",
                val_to_str(blocktype, blocktype_names, "Unknown Block type: 0x%04x"));
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> Block:[%s",
                val_to_str(blocktype, blocktype_names, "Unknown Block type: 0x%04x"));
            if (num_valid) {
                proto_item_append_text(file_tree, "%d]", num);
                col_append_fstr(pinfo->cinfo, COL_INFO, "%d]", num);
            } else {
                expert_add_info(pinfo, file_tree, &ei_s7comm_data_blockcontrol_block_num_invalid);
                proto_item_append_text(file_tree, "NaN]");
                col_append_str(pinfo->cinfo, COL_INFO, "NaN]");
            }
            itemadd = proto_tree_add_item(file_tree, hf_s7comm_data_blockcontrol_dest_filesys, tvb, offset, 1, ENC_ASCII);
            proto_item_append_text(itemadd, " (%s)", char_val_to_str(tvb_get_uint8(tvb, offset), blocktype_attribute2_names, "Unknown filesys"));
            offset += 1;
        }
    }
    if (is_plcfilename == false) {
        str = tvb_get_string_enc(pinfo->pool, tvb, offset, len, ENC_ASCII);
        col_append_fstr(pinfo->cinfo, COL_INFO, " File:[%s]", str);
        offset += len;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: Request or Response -> Function 0x1d, 0x1e, 0x1f (block control functions) for upload
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_plc_controls_updownload(tvbuff_t *tvb,
                                      packet_info *pinfo,
                                      proto_tree *tree,
                                      proto_tree *param_tree,
                                      uint16_t plength,
                                      uint16_t dlength,
                                      uint32_t offset,
                                      uint8_t rosctr)
{
    uint8_t len;
    uint8_t function;
    uint32_t errorcode;
    const char *errorcode_text;
    proto_item *item = NULL;
    proto_tree *data_tree = NULL;

    function = tvb_get_uint8(tvb, offset);
    offset += 1;
    errorcode = 0;

    switch (function) {
        /*---------------------------------------------------------------------*/
        case S7COMM_FUNCREQUESTDOWNLOAD:
            if (rosctr == S7COMM_ROSCTR_JOB) {
                proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                    ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                offset += 1;
                proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 2, ENC_NA);
                offset += 2;
                /* on upload this is the upload-id, here it is anything else (or not used ) */
                proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 4, ENC_NA);
                offset += 4;
                offset = s7comm_decode_plc_controls_filename(tvb, pinfo, param_tree, offset);
                if (plength > 18) {
                    len = tvb_get_uint8(tvb, offset);
                    proto_tree_add_uint(param_tree, hf_s7comm_data_blockcontrol_part2_len, tvb, offset, 1, len);
                    offset += 1;
                    /* first byte unknown '1' */
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_part2_unknown, tvb, offset, 1, ENC_ASCII);
                    offset += 1;
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_loadmem_len, tvb, offset, 6, ENC_ASCII);
                    offset += 6;
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_mc7code_len, tvb, offset, 6, ENC_ASCII);
                    offset += 6;
                }
            } else if (rosctr == S7COMM_ROSCTR_ACK_DATA) {
                if (plength >= 2) {
                    proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                        ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                    offset += 1;
                }
            }
            break;
        /*---------------------------------------------------------------------*/
        case S7COMM_FUNCSTARTUPLOAD:
            proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_uploadid, tvb, offset, 4, ENC_NA);
            offset += 4;
            if (rosctr == S7COMM_ROSCTR_JOB) {
                offset = s7comm_decode_plc_controls_filename(tvb, pinfo, param_tree, offset);
            } else if (rosctr == S7COMM_ROSCTR_ACK_DATA) {
                if (plength > 8) {
                    /* If uploading from a PLC, the response has a string with the length
                     * of the complete module in bytes, which maybe transferred/split into many PDUs.
                     * On a NC file upload, there are no such fields.
                     */
                    len = tvb_get_uint8(tvb, offset);
                    proto_tree_add_uint(param_tree, hf_s7comm_data_blockcontrol_upl_lenstring_len, tvb, offset, 1, len);
                    offset += 1;
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_upl_lenstring, tvb, offset, len, ENC_ASCII);
                    offset += len;
                }
            }
            break;
        /*---------------------------------------------------------------------*/
        case S7COMM_FUNCUPLOAD:
        case S7COMM_FUNCDOWNLOADBLOCK:
            if (rosctr == S7COMM_ROSCTR_JOB) {
                proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                    ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                offset += 1;
                proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 2, ENC_NA);
                offset += 2;
                if (function == S7COMM_FUNCUPLOAD) {
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_uploadid, tvb, offset, 4, ENC_NA);
                    offset += 4;
                } else {
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 4, ENC_NA);
                    offset += 4;
                    offset = s7comm_decode_plc_controls_filename(tvb, pinfo, param_tree, offset);
                }
            } else if (rosctr == S7COMM_ROSCTR_ACK_DATA) {
                if (plength >= 2) {
                    proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                        ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                    offset += 1;
                }
                if (dlength > 0) {
                    item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
                    data_tree = proto_item_add_subtree(item, ett_s7comm_data);
                    proto_tree_add_item(data_tree, hf_s7comm_data_length, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_readresponse_data, tvb, offset, dlength - 4, ENC_NA);
                    offset += dlength - 4;
                }
            }
            break;
        /*---------------------------------------------------------------------*/
        case S7COMM_FUNCENDUPLOAD:
        case S7COMM_FUNCDOWNLOADENDED:
            if (rosctr == S7COMM_ROSCTR_JOB) {
                proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                    ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                offset += 1;
                item = proto_tree_add_item_ret_uint(param_tree, hf_s7comm_data_blockcontrol_errorcode, tvb, offset, 2, ENC_BIG_ENDIAN, &errorcode);
                /* here it uses the same errorcode from parameter part */
                if ((errorcode_text = try_val_to_str_ext(errorcode, &param_errcode_names_ext))) {
                    proto_item_append_text(item, " (%s)", errorcode_text);
                }
                offset += 2;
                if (function == S7COMM_FUNCENDUPLOAD) {
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_uploadid, tvb, offset, 4, ENC_NA);
                    offset += 4;
                } else {
                    proto_tree_add_item(param_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 4, ENC_NA);
                    offset += 4;
                    offset = s7comm_decode_plc_controls_filename(tvb, pinfo, param_tree, offset);
                }
            } else if (rosctr == S7COMM_ROSCTR_ACK_DATA) {
                if (plength >= 2) {
                    proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                        ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                    offset += 1;
                }
            }
            break;
    }
    /* if an error occurred show in info column */
    if (errorcode > 0) {
        col_append_fstr(pinfo->cinfo, COL_INFO, " -> Errorcode:[0x%04x]", errorcode);
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Block status (0x13 or 0x01)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_blockstat(tvbuff_t *tvb,
                               proto_tree *td_tree,
                               uint16_t td_size,
                               uint8_t type,
                               uint8_t subfunc,
                               uint32_t offset)
{
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;
    uint16_t line_nr;
    uint16_t line_cnt;
    uint16_t item_size = 4;
    uint8_t registerflags;
    char str_flags[80];

    if (type == S7COMM_UD_TYPE_REQ) {
        if (subfunc == S7COMM_UD_SUBF_TIS_BLOCKSTAT2) {
            proto_tree_add_item(td_tree, hf_s7comm_tis_blockstat_flagsunknown, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            line_cnt = tvb_get_uint8(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_tis_blockstat_number_of_lines, tvb, offset, 1, line_cnt);
            offset += 1;
            proto_tree_add_item(td_tree, hf_s7comm_tis_blockstat_reserved, tvb, offset, 1, ENC_NA);
            offset += 1;
        } else {
            proto_tree_add_item(td_tree, hf_s7comm_tis_blockstat_reserved, tvb, offset, 1, ENC_NA);
            offset += 1;
            line_cnt = (td_size - 2) / 2;
        }
        proto_tree_add_bitmask(td_tree, tvb, offset, hf_s7comm_diagdata_registerflag,
            ett_s7comm_diagdata_registerflag, s7comm_diagdata_registerflag_fields, ENC_BIG_ENDIAN);
        offset += 1;

        if (subfunc == S7COMM_UD_SUBF_TIS_BLOCKSTAT2) {
            item_size = 4;
        } else {
            item_size = 2;
        }
        for (line_nr = 0; line_nr < line_cnt; line_nr++) {
            item = proto_tree_add_item(td_tree, hf_s7comm_data_item, tvb, offset, item_size, ENC_NA);
            item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
            if (subfunc == S7COMM_UD_SUBF_TIS_BLOCKSTAT2) {
                proto_tree_add_item(item_tree, hf_s7comm_tis_blockstat_line_address, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
            }
            proto_tree_add_item(item_tree, hf_s7comm_tis_blockstat_reserved, tvb, offset, 1, ENC_NA);
            offset += 1;
            registerflags = tvb_get_uint8(tvb, offset);
            make_registerflag_string(str_flags, registerflags, sizeof(str_flags));
            proto_item_append_text(item, " [%d]: (%s)", line_nr+1, str_flags);
            proto_tree_add_bitmask(item_tree, tvb, offset, hf_s7comm_diagdata_registerflag,
                ett_s7comm_diagdata_registerflag, s7comm_diagdata_registerflag_fields, ENC_BIG_ENDIAN);
            offset += 1;
        }
    } else if (type == S7COMM_UD_TYPE_IND) {
        /* The response data can only be dissected when the requested registers for each line
         * from the job setup is known. As the STW is only 16 Bits and all other registers 32 Bits,
         * this has no fixed structure.
         * The only thing that can be shown is the start address. Next the requested registers,
         * the start address of next line with the requested registers and so on.
         */
        proto_tree_add_item(td_tree, hf_s7comm_diagdata_req_startaddr_awl, tvb, offset, 2, ENC_BIG_ENDIAN);
        offset += 2;
        proto_tree_add_item(td_tree, hf_s7comm_tis_blockstat_data, tvb, offset, td_size - 2, ENC_NA);
        offset += (td_size - 2);
    } else {
        /* TODO: Show unknown data as raw bytes */
        proto_tree_add_item(td_tree, hf_s7comm_tis_blockstat_reserved, tvb, offset, td_size, ENC_NA);
        offset += td_size;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Item address
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_item_address(tvbuff_t *tvb,
                                  uint32_t offset,
                                  proto_tree *sub_tree,
                                  uint16_t item_no,
                                  char *add_text)
{
    uint32_t bytepos = 0;
    uint16_t len = 0;
    uint16_t bitpos = 0;
    uint16_t db = 0;
    uint8_t area = 0;
    proto_item *item = NULL;

    /* Insert a new tree with 6 bytes for every item */
    item = proto_tree_add_item(sub_tree, hf_s7comm_param_item, tvb, offset, 6, ENC_NA);

    sub_tree = proto_item_add_subtree(item, ett_s7comm_param_item);

    proto_item_append_text(item, " [%d]%s:", item_no + 1, add_text);

    /* Area, 1 byte */
    area = tvb_get_uint8(tvb, offset);
    proto_tree_add_item(sub_tree, hf_s7comm_varstat_req_memory_area, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;

    /* Length (repetition factor), 1 byte. If area is a bit address, then this is the bit number.
     * The area is a bit address when the low nibble is zero.
     */
    if (area & 0x0f) {
        len = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(sub_tree, hf_s7comm_varstat_req_repetition_factor, tvb, offset, 1, len);
        offset += 1;
    } else {
        bitpos = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(sub_tree, hf_s7comm_varstat_req_bitpos, tvb, offset, 1, bitpos);
        offset += 1;
    }

    /* DB number, 2 bytes */
    db = tvb_get_ntohs(tvb, offset);
    proto_tree_add_uint(sub_tree, hf_s7comm_varstat_req_db_number, tvb, offset, 2, db);
    offset += 2;

    /* byte offset, 2 bytes */
    bytepos = tvb_get_ntohs(tvb, offset);
    proto_tree_add_uint(sub_tree, hf_s7comm_varstat_req_startaddress, tvb, offset, 2, bytepos);
    offset += 2;

    /* build a full address to show item data directly beside the item */
    switch (area) {
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MX:
            proto_item_append_text(sub_tree, " (M%d.%d)", bytepos, bitpos);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MB:
            proto_item_append_text(sub_tree, " (M%d.0 BYTE %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MW:
            proto_item_append_text(sub_tree, " (M%d.0 WORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MD:
            proto_item_append_text(sub_tree, " (M%d.0 DWORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EX:
            proto_item_append_text(sub_tree, " (I%d.%d)", bytepos, bitpos);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EB:
            proto_item_append_text(sub_tree, " (I%d.0 BYTE %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EW:
            proto_item_append_text(sub_tree, " (I%d.0 WORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_ED:
            proto_item_append_text(sub_tree, " (I%d.0 DWORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AX:
            proto_item_append_text(sub_tree, " (Q%d.%d)", bytepos, bitpos);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AB:
            proto_item_append_text(sub_tree, " (Q%d.0 BYTE %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AW:
            proto_item_append_text(sub_tree, " (Q%d.0 WORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AD:
            proto_item_append_text(sub_tree, " (Q%d.0 DWORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEB:
            proto_item_append_text(sub_tree, " (PI%d.0 BYTE %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEW:
            proto_item_append_text(sub_tree, " (PI%d.0 WORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PED:
            proto_item_append_text(sub_tree, " (PI%d.0 DWORD %d)", bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBX:
            proto_item_append_text(sub_tree, " (DB%d.DBX%d.%d)", db, bytepos, bitpos);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBB:
            proto_item_append_text(sub_tree, " (DB%d.DBX%d.0 BYTE %d)", db, bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBW:
            proto_item_append_text(sub_tree, " (DB%d.DBX%d.0 WORD %d)", db, bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBD:
            proto_item_append_text(sub_tree, " (DB%d.DBX%d.0 DWORD %d)", db, bytepos, len);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_T:
            /* it's possible to read multiple timers */
            if (len >1)
                proto_item_append_text(sub_tree, " (T %d..%d)", bytepos, bytepos + len - 1);
            else
                proto_item_append_text(sub_tree, " (T %d)", bytepos);
            break;
        case S7COMM_UD_SUBF_TIS_VARSTAT_AREA_C:
            /* it's possible to read multiple counters */
            if (len >1)
                proto_item_append_text(sub_tree, " (C %d..%d)", bytepos, bytepos + len - 1);
            else
                proto_item_append_text(sub_tree, " (C %d)", bytepos);
            break;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Item value
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_item_value(tvbuff_t *tvb,
                                uint32_t offset,
                                proto_tree *sub_tree,
                                uint16_t item_no,
                                char *add_text)
{
    uint16_t len = 0, len2 = 0;
    uint8_t ret_val = 0;
    uint8_t tsize = 0;
    uint8_t head_len = 4;

    proto_item *item = NULL;

    ret_val = tvb_get_uint8(tvb, offset);
    if (ret_val == S7COMM_ITEM_RETVAL_RESERVED ||
        ret_val == S7COMM_ITEM_RETVAL_DATA_OK ||
        ret_val == S7COMM_ITEM_RETVAL_DATA_ERR
        ) {
        tsize = tvb_get_uint8(tvb, offset + 1);
        len = tvb_get_ntohs(tvb, offset + 2);

        if (tsize == S7COMM_DATA_TRANSPORT_SIZE_BBYTE || tsize == S7COMM_DATA_TRANSPORT_SIZE_BINT) {
            len /= 8;
        }
        /* the PLC places extra bytes at the end if length is not a multiple of 2 */
        if (len % 2) {
            len2 = len + 1;
        } else {
            len2 = len;
        }
    }
    /* Insert a new tree for every item */
    item = proto_tree_add_item(sub_tree, hf_s7comm_data_item, tvb, offset, len + head_len, ENC_NA);
    sub_tree = proto_item_add_subtree(item, ett_s7comm_data_item);

    proto_item_append_text(item, " [%d]%s: (%s)", item_no + 1, add_text, val_to_str(ret_val, s7comm_item_return_valuenames, "Unknown code: 0x%02x"));

    proto_tree_add_uint(sub_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
    proto_tree_add_uint(sub_tree, hf_s7comm_data_transport_size, tvb, offset + 1, 1, tsize);
    proto_tree_add_uint(sub_tree, hf_s7comm_data_length, tvb, offset + 2, 2, len);

    offset += head_len;
    if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK || ret_val == S7COMM_ITEM_RETVAL_RESERVED) {
        proto_tree_add_item(sub_tree, hf_s7comm_readresponse_data, tvb, offset, len, ENC_NA);
        offset += len;
        if (len != len2) {
            proto_tree_add_item(sub_tree, hf_s7comm_data_fillbyte, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Force (0x09)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_force(tvbuff_t *tvb,
                           proto_tree *td_tree,
                           uint8_t type,
                           uint32_t offset)
{
    uint16_t item_count;
    uint16_t i;
    uint8_t ret_val = 0;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;

    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            item_count = tvb_get_ntohs(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_varstat_item_count, tvb, offset, 2, item_count);
            offset += 2;
            for (i = 0; i < item_count; i++) {
                offset = s7comm_decode_ud_tis_item_address(tvb, offset, td_tree, i, " Address to force");
            }
            for (i = 0; i < item_count; i++) {
                offset = s7comm_decode_ud_tis_item_value(tvb, offset, td_tree, i, " Value to force");
            }
            break;
        case S7COMM_UD_TYPE_IND:
            item_count = tvb_get_ntohs(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_varstat_item_count, tvb, offset, 2, item_count);
            offset += 2;
            for (i = 0; i < item_count; i++) {
                item = proto_tree_add_item(td_tree, hf_s7comm_data_item, tvb, offset, 1, ENC_NA);
                item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
                ret_val = tvb_get_uint8(tvb, offset);
                proto_tree_add_uint(item_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
                proto_item_append_text(item, " [%d]: (%s)", i + 1, val_to_str(ret_val, s7comm_item_return_valuenames, "Unknown code: 0x%02x"));
                offset += 1;
            }
            if (item_count % 2) {
                proto_tree_add_item(item_tree, hf_s7comm_data_fillbyte, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
            }
            break;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands / Test and installation functions
 *           Dissects the parameter part
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_param(tvbuff_t *tvb,
                           proto_tree *tree,
                           uint8_t type,
                           uint16_t tp_size,
                           uint32_t offset)
{
    uint32_t start_offset;
    uint32_t callenv_setup = 0;
    proto_item *item = NULL;
    proto_tree *tp_tree = NULL;

    start_offset = offset;
    if (tp_size > 0) {
        item = proto_tree_add_item(tree, hf_s7comm_tis_parameter, tvb, offset, tp_size, ENC_NA);
        tp_tree = proto_item_add_subtree(item, ett_s7comm_prog_parameter);
        if (type == S7COMM_UD_TYPE_REQ) {
            if (tp_size >= 4) {
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param1, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param2, tvb, offset, 2, ENC_NA);
                offset += 2;
            }
            if (tp_size >= 20) {
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param3, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_answersize, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param5, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param6, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param7, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param8, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_param9, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_trgevent, tvb, offset, 2, ENC_NA);
                offset += 2;
            }
            if (tp_size >= 26) {
                proto_tree_add_item(tp_tree, hf_s7comm_diagdata_req_block_type, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_diagdata_req_block_num, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_diagdata_req_startaddr_awl, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
            }
            if (tp_size >= 28) {
                proto_tree_add_item(tp_tree, hf_s7comm_diagdata_req_saz, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
            }
            if (tp_size >= 36) {
                proto_tree_add_item_ret_uint(tp_tree, hf_s7comm_tis_p_callenv, tvb, offset, 2, ENC_BIG_ENDIAN, &callenv_setup);
                offset += 2;
                proto_tree_add_item(tp_tree, hf_s7comm_tis_p_callcond, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                if (callenv_setup == 2) {
                    proto_tree_add_item(tp_tree, hf_s7comm_tis_register_db1_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(tp_tree, hf_s7comm_tis_register_db2_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
                } else {
                    proto_tree_add_item(tp_tree, hf_s7comm_tis_p_callcond_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(tp_tree, hf_s7comm_tis_p_callcond_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    if (tp_size >= 38) {
                        proto_tree_add_item(tp_tree, hf_s7comm_tis_p_callcond_address, tvb, offset, 2, ENC_BIG_ENDIAN);
                    }
                }
            }
        } else {
            proto_tree_add_item(tp_tree, hf_s7comm_tis_res_param1, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(tp_tree, hf_s7comm_tis_res_param2, tvb, offset, 2, ENC_NA);
        }
    }
    /* May be we don't know all values when here, so set offset to the given length */
    return start_offset + tp_size;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Disable job (0x0d), Enable job (0x0e),
 *                                                                   Delete job (0x0f), Read job list (0x10),
 *                                                                   Read job (0x11)
 *
 *******************************************************************************************************/
static uint32_t
// NOLINTNEXTLINE(misc-no-recursion)
s7comm_decode_ud_tis_jobs(tvbuff_t *tvb,
                          proto_tree *td_tree,
                          uint16_t td_size,
                          uint8_t type,
                          uint8_t subfunc,
                          uint32_t offset)
{
    uint16_t i;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;
    uint16_t job_tp_size;
    uint16_t job_td_size;
    proto_tree *job_td_tree = NULL;
    uint8_t job_subfunc;

    if (type == S7COMM_UD_TYPE_REQ) {
        switch (subfunc) {
            case S7COMM_UD_SUBF_TIS_DELETEJOB:
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_reserved, tvb, offset, 2, ENC_NA);
                offset += 2;
                /* fallthrough */
            case S7COMM_UD_SUBF_TIS_ENABLEJOB:
            case S7COMM_UD_SUBF_TIS_DISABLEJOB:
            case S7COMM_UD_SUBF_TIS_READJOB:
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_function, tvb, offset, 1, ENC_NA);
                offset += 1;
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_seqnr, tvb, offset, 1, ENC_NA);
                offset += 1;
                break;
            case S7COMM_UD_SUBF_TIS_READJOBLIST:
                /* 4 bytes, possible as filter? */
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_reserved, tvb, offset, 2, ENC_NA);
                offset += 2;
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_reserved, tvb, offset, 2, ENC_NA);
                offset += 2;
                break;
            case S7COMM_UD_SUBF_TIS_REPLACEJOB:
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_reserved, tvb, offset, 2, ENC_NA);
                offset += 2;
                /* The job which has to be replaced */
                job_subfunc = tvb_get_uint8(tvb, offset);
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_function, tvb, offset, 1, ENC_NA);
                offset += 1;
                proto_tree_add_item(td_tree, hf_s7comm_tis_job_seqnr, tvb, offset, 1, ENC_NA);
                offset += 1;
                job_tp_size = tvb_get_ntohs(tvb, offset);
                proto_tree_add_item(td_tree, hf_s7comm_tis_parametersize, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                job_td_size = tvb_get_ntohs(tvb, offset);
                proto_tree_add_item(td_tree, hf_s7comm_tis_datasize, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                /* New job parameter tree */
                if (job_tp_size > 0) {
                    offset = s7comm_decode_ud_tis_param(tvb, td_tree, S7COMM_UD_TYPE_REQ, job_tp_size, offset);
                }
                /* New job data tree */
                if (job_td_size > 0) {
                    // We recurse here, but we'll run out of packet before we run out of stack.
                    offset = s7comm_decode_ud_tis_data(tvb, td_tree, S7COMM_UD_TYPE_REQ, job_subfunc, job_td_size, offset);
                }
                break;
        }
    } else {
        switch (subfunc) {
            case S7COMM_UD_SUBF_TIS_READJOBLIST:
                /* 4 bytes each job:
                 * - 2 bytes job id
                 * - 2 bytes status: 1=active, 0=idle/pending?
                 */
                for (i = 0; i < td_size / 4; i++) {
                    item = proto_tree_add_item(td_tree, hf_s7comm_data_item, tvb, offset, 4, ENC_NA);
                    item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
                    proto_item_append_text(item, " [%d] Job", i + 1);

                    proto_tree_add_item(item_tree, hf_s7comm_tis_job_function, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(item_tree, hf_s7comm_tis_job_seqnr, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(item_tree, hf_s7comm_tis_job_reserved, tvb, offset, 2, ENC_NA);
                    offset += 2;
                }
                break;
            case S7COMM_UD_SUBF_TIS_READJOB:
                /* This includes the same data as in the job request. With the disadvantage that is does
                 * not contain information of the function, so the data can't be further dissected.
                 * We need to know the function from the request.
                 */
                job_tp_size = tvb_get_ntohs(tvb, offset);
                proto_tree_add_item(td_tree, hf_s7comm_tis_parametersize, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                job_td_size = tvb_get_ntohs(tvb, offset);
                proto_tree_add_item(td_tree, hf_s7comm_tis_datasize, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                /* Job parameter tree */
                if (job_tp_size > 0) {
                    offset = s7comm_decode_ud_tis_param(tvb, td_tree, S7COMM_UD_TYPE_REQ, job_tp_size, offset);
                }
                /* Job data tree */
                if (job_td_size > 0) {
                    item = proto_tree_add_item(td_tree, hf_s7comm_tis_data, tvb, offset, job_td_size, ENC_NA);
                    job_td_tree = proto_item_add_subtree(item, ett_s7comm_prog_data);
                    proto_tree_add_item(job_td_tree, hf_s7comm_tis_job_reserved, tvb, offset, job_td_size, ENC_NA);
                    offset += job_td_size;
                }
                break;
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Variable status (0x03)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_varstat(tvbuff_t *tvb,
                             proto_tree *td_tree,
                             uint8_t type,
                             uint32_t offset)
{
    uint16_t item_count;
    uint16_t i;

    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            item_count = tvb_get_ntohs(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_varstat_item_count, tvb, offset, 2, item_count);
            offset += 2;
            for (i = 0; i < item_count; i++) {
                offset = s7comm_decode_ud_tis_item_address(tvb, offset, td_tree, i, " Address to read");
            }
            break;
        case S7COMM_UD_TYPE_IND:
            item_count = tvb_get_ntohs(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_varstat_item_count, tvb, offset, 2, item_count);
            offset += 2;
            for (i = 0; i < item_count; i++) {
                offset = s7comm_decode_ud_tis_item_value(tvb, offset, td_tree, i, " Read data");
            }
            break;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Modify variable (0x08)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_modvar(tvbuff_t *tvb,
                            proto_tree *td_tree,
                            uint8_t type,
                            uint32_t offset)
{
    uint16_t item_count;
    uint16_t i;
    uint8_t ret_val = 0;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;

    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            item_count = tvb_get_ntohs(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_varstat_item_count, tvb, offset, 2, item_count);
            offset += 2;
            for (i = 0; i < item_count; i++) {
                offset = s7comm_decode_ud_tis_item_address(tvb, offset, td_tree, i, " Address to write");
            }
            for (i = 0; i < item_count; i++) {
                offset = s7comm_decode_ud_tis_item_value(tvb, offset, td_tree, i, " Data to write");
            }
            break;
        case S7COMM_UD_TYPE_IND:
            item_count = tvb_get_ntohs(tvb, offset);
            proto_tree_add_uint(td_tree, hf_s7comm_varstat_item_count, tvb, offset, 2, item_count);
            offset += 2;
            for (i = 0; i < item_count; i++) {
                item = proto_tree_add_item(td_tree, hf_s7comm_data_item, tvb, offset, 1, ENC_NA);
                item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
                ret_val = tvb_get_uint8(tvb, offset);
                proto_tree_add_uint(item_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
                proto_item_append_text(item, " [%d]: (%s)", i + 1, val_to_str(ret_val, s7comm_item_return_valuenames, "Unknown code: 0x%02x"));
                offset += 1;
            }
            if (item_count % 2) {
                proto_tree_add_item(item_tree, hf_s7comm_data_fillbyte, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
            }
            break;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Output ISTACK (0x03)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_istack(tvbuff_t *tvb,
                            proto_tree *td_tree,
                            uint8_t type,
                            uint32_t offset)
{
    uint8_t ob_number = 0;
    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
            offset += 2;
            break;
        case S7COMM_UD_TYPE_RES:
        case S7COMM_UD_TYPE_IND:
            proto_tree_add_item(td_tree, hf_s7comm_tis_continued_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_continued_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_continued_address, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db1_type, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db2_type, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db1_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db2_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_accu1, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_accu2, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_accu3, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_accu4, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_ar1, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_ar2, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_stw, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_address, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 4, ENC_NA);
            offset += 4;
            /* read the OB number first */
            ob_number = tvb_get_uint8(tvb, offset + 3);
            switch (ob_number) {
                case 1:     /* Cyclic execution */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_scan_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_prev_cycle, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_min_cycle, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_max_cycle, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                case 10:    /* Time of day interrupt 0..7 */
                case 11:
                case 12:
                case 13:
                case 14:
                case 15:
                case 16:
                case 17:
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_inf, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_period_exe, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_3, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_4, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                case 20:    /* Time delay interrupt 0..3 */
                case 21:
                case 22:
                case 23:
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_inf, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_scan_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_sign, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_dtime, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    break;
                case 30:    /* Cyclic interrupt 0..8 */
                case 31:
                case 32:
                case 33:
                case 34:
                case 35:
                case 36:
                case 37:
                case 38:
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_inf, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_phase_offset, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_3, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_exec_freq, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                case 40:    /* Hardware interrupt 0..8 */
                case 41:
                case 42:
                case 43:
                case 44:
                case 45:
                case 46:
                case 47:
                case 48:
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_inf, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_io_flag, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_point_addr, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    break;
                case 55:    /* DP Statusalarm */
                case 56:    /* DP Updatealarm */
                case 57:    /* DP Specific alarm */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_inf, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_io_flag, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_inf_len, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_alarm_type, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_alarm_slot, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_alarm_spec, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    break;
                case 80:    /* Cycle time fault */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_error_info, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ev_num, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ob_num, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    break;
                case 81:    /* Power supply fault */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_rack_cpu, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_3, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_4, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                case 82:    /* I/O Point fault 1 */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_io_flag, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_8x_fault_flags, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_type_b, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_8x_fault_flags, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_8x_fault_flags, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    break;
                case 83:    /* I/O Point fault 2 */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_io_flag, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_rack_num, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_type_w, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                case 84:    /* CPU fault */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_3, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_4_dw, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    break;
                case 85:    /* OB not loaded fault */
                case 87:    /* Communication Fault */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_3, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ev_num, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_err_ob_num, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    break;
                case 86:    /* Loss of rack fault */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_id, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mdl_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_racks_flt, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    break;
                case 90:    /* Background cycle */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_inf, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_3, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_4_dw, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    break;
                case 100:    /* Complete restart */
                case 101:    /* Restart */
                case 102:    /* Cold restart */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strtup, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_2, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_stop, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_strt_info, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    break;
                case 121:    /* Programming Error */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_sw_flt, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_blk_type, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_reserved_1, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_reg, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_blk_num, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_prg_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                case 122:    /* Module Access Error */
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_sw_flt, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_blk_type, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mem_area, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_mem_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_flt_blk_num, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_prg_addr, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    break;
                default:
                    proto_tree_add_item(td_tree, hf_s7comm_ob_ev_class, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_priority, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_ob_number, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    proto_tree_add_item(td_tree, hf_s7comm_tis_istack_reserved, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    break;
            }
            offset = s7comm_add_timestamp_to_tree(tvb, td_tree, offset, false, false);
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Output BSTACK (0x04)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_bstack(tvbuff_t *tvb,
                            proto_tree *td_tree,
                            uint16_t td_size,
                            uint8_t type,
                            uint32_t offset)
{
    uint16_t i;
    uint16_t blocktype;
    uint16_t blocknumber;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;
    int rem;
    uint32_t replen;

    /* Possible firmware bug in IM151-8 CPU, where also the date size information
     * in the header is 4 bytes too short.
     */
    replen = tvb_reported_length_remaining(tvb, offset);
    if (replen < td_size) {
        /* TODO: Show this mismatch? We fix the length here. */
        td_size = replen;
    }
    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            proto_tree_add_item(td_tree, hf_s7comm_tis_bstack_reserved, tvb, offset, 2, ENC_NA);
            offset += 2;
            break;
        case S7COMM_UD_TYPE_RES:
        case S7COMM_UD_TYPE_IND:
            rem = td_size;
            i = 1;
            while (rem > 16) {
                item = proto_tree_add_item(td_tree, hf_s7comm_data_item, tvb, offset, 16, ENC_NA);
                item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
                blocktype = tvb_get_ntohs(tvb, offset);
                proto_tree_add_item(item_tree, hf_s7comm_tis_interrupted_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                blocknumber = tvb_get_ntohs(tvb, offset);
                proto_tree_add_item(item_tree, hf_s7comm_tis_interrupted_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(item_tree, hf_s7comm_tis_interrupted_address, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(item_tree, hf_s7comm_tis_register_db1_type, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
                proto_tree_add_item(item_tree, hf_s7comm_tis_register_db2_type, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
                proto_tree_add_item(item_tree, hf_s7comm_tis_register_db1_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(item_tree, hf_s7comm_tis_register_db2_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
                offset += 2;
                proto_tree_add_item(item_tree, hf_s7comm_tis_bstack_reserved, tvb, offset, 4, ENC_NA);
                offset += 4;
                proto_item_append_text(item, " [%d] BSTACK entry for: %s %d", i++,
                    val_to_str(blocktype, subblktype_names, "Unknown Subblk type: 0x%02x"), blocknumber);
                rem -= 16;
                if (blocktype == S7COMM_SUBBLKTYPE_OB) {
                    proto_tree_add_item(item_tree, hf_s7comm_tis_interrupted_prioclass, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(item_tree, hf_s7comm_tis_bstack_reserved, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_item(item_tree, hf_s7comm_tis_bstack_reserved, tvb, offset, 2, ENC_NA);
                    offset += 2;
                    rem -= 4;
                    if (rem >= 8) {
                        offset = s7comm_add_timestamp_to_tree(tvb, item_tree, offset, false, false);
                        rem -= 8;
                    } else {
                        proto_tree_add_item(item_tree, hf_s7comm_tis_bstack_reserved, tvb, offset, rem, ENC_NA);
                        offset += rem;
                        break;
                    }
                }
            }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Output LSTACK (0x05)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_lstack(tvbuff_t *tvb,
                            proto_tree *td_tree,
                            uint8_t type,
                            uint32_t offset)
{
    uint16_t len;

    if (type == S7COMM_UD_TYPE_REQ) {
        proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_prioclass, tvb, offset, 1, ENC_NA);
        offset += 1;
        proto_tree_add_item(td_tree, hf_s7comm_tis_bstack_nest_depth, tvb, offset, 1, ENC_NA);
        offset += 1;
    } else {
        proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
        offset += 2;
        proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
        offset += 2;
        proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_address, tvb, offset, 2, ENC_NA);
        offset += 2;
        len = tvb_get_ntohs(tvb, offset);
        proto_tree_add_item(td_tree, hf_s7comm_tis_lstack_size, tvb, offset, 2, ENC_NA);
        offset += 2;
        proto_tree_add_item(td_tree, hf_s7comm_tis_lstack_data, tvb, offset, len, ENC_NA);
        offset += len;
        proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_prioclass, tvb, offset, 1, ENC_NA);
        offset += 1;
        proto_tree_add_item(td_tree, hf_s7comm_tis_lstack_reserved, tvb, offset, 1, ENC_NA);
        offset += 1;
        proto_tree_add_item(td_tree, hf_s7comm_tis_lstack_reserved, tvb, offset, 2, ENC_NA);
        offset += 2;
        offset = s7comm_add_timestamp_to_tree(tvb, td_tree, offset, false, false);
    }
    return offset;
}
/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Exit Hold (0x0b)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_exithold(tvbuff_t *tvb,
                              proto_tree *td_tree,
                              uint8_t type,
                              uint32_t offset)
{
    /* Only request with data payload was seen */
    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            proto_tree_add_item(td_tree, hf_s7comm_tis_exithold_until, tvb, offset, 1, ENC_NA);
            offset += 1;
            proto_tree_add_item(td_tree, hf_s7comm_tis_exithold_res1, tvb, offset, 1, ENC_NA);
            offset += 1;
            break;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands -> Breakpoint (0x0a)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_breakpoint(tvbuff_t *tvb,
                                proto_tree *td_tree,
                                uint8_t type,
                                uint32_t offset)
{
    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            proto_tree_add_item(td_tree, hf_s7comm_tis_breakpoint_reserved, tvb, offset, 2, ENC_NA);
            offset += 2;
            break;
        case S7COMM_UD_TYPE_RES:
        case S7COMM_UD_TYPE_IND:
            /* Info: Both blocknumbers and addresses are the same on online-blockview inside a block.
             * On return out of a block, the first address contains the current breakpoint, the second
             * address the address from where it was returned (previous block).
             */
            proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_interrupted_address, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_breakpoint_blocktype, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_breakpoint_blocknr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_breakpoint_address, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_breakpoint_reserved, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_stw, tvb, offset, 2, ENC_NA);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_accu1, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_accu2, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_ar1, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_ar2, tvb, offset, 4, ENC_NA);
            offset += 4;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db1_type, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db2_type, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db1_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            proto_tree_add_item(td_tree, hf_s7comm_tis_register_db2_nr, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands / Test and installation functions
 *           Dissects the data part
 *
 *******************************************************************************************************/
static uint32_t
// NOLINTNEXTLINE(misc-no-recursion)
s7comm_decode_ud_tis_data(tvbuff_t *tvb,
                          proto_tree *tree,
                          uint8_t type,
                          uint8_t subfunc,
                          uint16_t td_size,
                          uint32_t offset)
{
    proto_item *item = NULL;
    proto_tree *td_tree = NULL;

    if (td_size > 0) {
        item = proto_tree_add_item(tree, hf_s7comm_tis_data, tvb, offset, td_size, ENC_NA);
        td_tree = proto_item_add_subtree(item, ett_s7comm_prog_data);
        switch (subfunc) {
            case S7COMM_UD_SUBF_TIS_OUTISTACK:
                offset = s7comm_decode_ud_tis_istack(tvb, td_tree, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_OUTBSTACK:
                offset = s7comm_decode_ud_tis_bstack(tvb, td_tree, td_size, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_OUTLSTACK:
                offset = s7comm_decode_ud_tis_lstack(tvb, td_tree, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_BREAKPOINT:
                offset = s7comm_decode_ud_tis_breakpoint(tvb, td_tree, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_EXITHOLD:
                offset = s7comm_decode_ud_tis_exithold(tvb, td_tree, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_BLOCKSTAT:
            case S7COMM_UD_SUBF_TIS_BLOCKSTAT2:
                offset = s7comm_decode_ud_tis_blockstat(tvb, td_tree, td_size, type, subfunc, offset);
                break;
            case S7COMM_UD_SUBF_TIS_VARSTAT:
                offset = s7comm_decode_ud_tis_varstat(tvb, td_tree, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_DISABLEJOB:
            case S7COMM_UD_SUBF_TIS_ENABLEJOB:
            case S7COMM_UD_SUBF_TIS_DELETEJOB:
            case S7COMM_UD_SUBF_TIS_READJOBLIST:
            case S7COMM_UD_SUBF_TIS_READJOB:
            case S7COMM_UD_SUBF_TIS_REPLACEJOB:
                // We recurse here, but we'll run out of packet before we run out of stack.
                offset = s7comm_decode_ud_tis_jobs(tvb, td_tree, td_size, type, subfunc, offset);
                break;
            case S7COMM_UD_SUBF_TIS_MODVAR:
                offset = s7comm_decode_ud_tis_modvar(tvb, td_tree, type, offset);
                break;
            case S7COMM_UD_SUBF_TIS_FORCE:
                offset = s7comm_decode_ud_tis_force(tvb, td_tree, type, offset);
                break;
            default:
                proto_tree_add_item(td_tree, hf_s7comm_varstat_unknown, tvb, offset, td_size, ENC_NA);
                offset += td_size;
                break;
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 1 -> Programmer commands / Test and installation functions
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_tis_subfunc(tvbuff_t *tvb,
                             proto_tree *data_tree,
                             uint8_t type,
                             uint8_t subfunc,
                             uint32_t offset)
{
    uint16_t tp_size = 0;
    uint16_t td_size = 0;

    tp_size = tvb_get_ntohs(tvb, offset);
    proto_tree_add_item(data_tree, hf_s7comm_tis_parametersize, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    td_size = tvb_get_ntohs(tvb, offset);
    proto_tree_add_item(data_tree, hf_s7comm_tis_datasize, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    /* Parameter tree */
    offset = s7comm_decode_ud_tis_param(tvb, data_tree, type, tp_size, offset);
    /* Data tree */
    offset = s7comm_decode_ud_tis_data(tvb, data_tree, type, subfunc, td_size, offset);
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 5 -> Security functions?
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_security_subfunc(tvbuff_t *tvb,
                                  proto_tree *data_tree,
                                  uint32_t dlength,
                                  uint32_t offset)
{
    /* Display dataset as raw bytes. Maybe this part can be extended with further knowledge. */
    proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, dlength, ENC_NA);
    offset += dlength;

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 6 -> PBC, Programmable Block Functions (e.g. BSEND/BRECV), before reassembly
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_pbc_bsend_pre_reass(tvbuff_t *tvb,
                                     packet_info *pinfo,
                                     proto_tree *data_tree,
                                     uint8_t type,
                                     uint16_t *dlength,
                                     uint32_t *r_id,              /* R_ID of the PBC communication */
                                     uint32_t offset)
{
    if ((type == S7COMM_UD_TYPE_REQ || type == S7COMM_UD_TYPE_RES) && (*dlength >= 8)) {
        proto_tree_add_item(data_tree, hf_s7comm_item_varspec, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(data_tree, hf_s7comm_item_varspec_length, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(data_tree, hf_s7comm_item_syntax_id, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        /* 0x00 when passive partners is sending, 0xcc when active partner is sending? */
        proto_tree_add_item(data_tree, hf_s7comm_pbc_unknown, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(data_tree, hf_s7comm_pbc_bsend_r_id, tvb, offset, 4, ENC_BIG_ENDIAN);
        *r_id = tvb_get_ntohl(tvb, offset);
        col_append_fstr(pinfo->cinfo, COL_INFO, " R_ID=0x%X", *r_id);
        offset += 4;
        *dlength -= 8;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 6 -> PBC, Programmable Block Functions (e.g. BSEND/BRECV)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_pbc_bsend_subfunc(tvbuff_t *tvb,
                             proto_tree *data_tree,
                             uint32_t dlength,
                             uint32_t offset,
                             packet_info *pinfo,
                             proto_tree *tree)
{
    proto_tree_add_item(data_tree, hf_s7comm_pbc_bsend_len, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, dlength - 2, ENC_NA);

    /* dissect data */
    if (tvb_reported_length_remaining(tvb, offset) > 0) {
        struct tvbuff *next_tvb = tvb_new_subset_remaining(tvb,  offset);
        heur_dtbl_entry_t *hdtbl_entry;
        if (!dissector_try_heuristic(s7comm_heur_subdissector_list, next_tvb, pinfo, tree, &hdtbl_entry, NULL)) {
            call_data_dissector(next_tvb, pinfo, data_tree);
        }
    }

    offset += (dlength - 2);

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> PBC, Programmable Block Function USEND
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_usend(tvbuff_t *tvb,
                       proto_tree *tree,
                       uint32_t dlength,
                       uint32_t offset)
{
    proto_item *item = NULL;
    proto_tree *data_tree = NULL;
    proto_tree *item_tree = NULL;
    uint8_t tsize;
    uint16_t len;
    uint16_t len2;
    uint8_t ret_val;
    uint8_t item_count;
    uint8_t i;

    item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
    data_tree = proto_item_add_subtree(item, ett_s7comm_data);

    ret_val = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(data_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
    offset += 1;

    proto_tree_add_item(data_tree, hf_s7comm_pbc_usend_unknown1, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;

    item_count = tvb_get_uint8(tvb, offset + 1); /* max. 4 possible */
    proto_tree_add_uint(data_tree, hf_s7comm_param_itemcount, tvb, offset, 2, item_count);
    offset += 2;

    for (i = 0; i < item_count; i++) {
        tsize = tvb_get_uint8(tvb, offset + 1);
        len = tvb_get_ntohs(tvb, offset + 2);
        /* calculate length in bytes */
        if (tsize == S7COMM_DATA_TRANSPORT_SIZE_BBIT ||
            tsize == S7COMM_DATA_TRANSPORT_SIZE_BBYTE ||
            tsize == S7COMM_DATA_TRANSPORT_SIZE_BINT
            ) {
            if (len % 8) {
                len /= 8;
                len = len + 1;
            } else {
                len /= 8;
            }
        }

        if ((len % 2) && (i < (item_count-1))) {
            len2 = len + 1;
        } else {
            len2 = len;
        }

        item = proto_tree_add_item(data_tree, hf_s7comm_data_item, tvb, offset, len + 4, ENC_NA);
        item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
        proto_item_append_text(item, " [%d]", i+1);
        proto_tree_add_item(item_tree, hf_s7comm_pbc_usend_unknown2, tvb, offset, 1, ENC_BIG_ENDIAN);
        proto_tree_add_uint(item_tree, hf_s7comm_data_transport_size, tvb, offset + 1, 1, tsize);
        proto_tree_add_uint(item_tree, hf_s7comm_data_length, tvb, offset + 2, 2, len);
        offset += 4;

        proto_tree_add_item(item_tree, hf_s7comm_readresponse_data, tvb, offset, len, ENC_NA);
        offset += len;
        if (len != len2) {
            proto_tree_add_item(item_tree, hf_s7comm_data_fillbyte, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
        }
    }

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> NC programming functions (file download/upload), before reassembly
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_ncprg_pre_reass(tvbuff_t *tvb,
                                 proto_tree *data_tree,
                                 uint8_t type,
                                 uint8_t subfunc,
                                 uint16_t *dlength,
                                 uint32_t offset)
{
    if ((type == S7COMM_UD_TYPE_RES || type == S7COMM_UD_TYPE_IND) &&
        (subfunc == S7COMM_NCPRG_FUNCDOWNLOADBLOCK ||
         subfunc == S7COMM_NCPRG_FUNCUPLOAD ||
         subfunc == S7COMM_NCPRG_FUNCSTARTUPLOAD)) {
        proto_tree_add_item(data_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 2, ENC_NA);
        offset += 2;
        *dlength -= 2;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> NC programming functions (file download/upload)
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_ncprg_subfunc(tvbuff_t *tvb,
                               packet_info *pinfo,
                               proto_tree *data_tree,
                               uint8_t type,
                               uint8_t subfunc,
                               uint32_t dlength,
                               uint32_t offset)
{
    const uint8_t *str_filename;
    uint32_t string_end_offset;
    uint32_t string_len;
    uint32_t filelength;
    uint32_t start_offset;

    if (dlength >= 2) {
        if (type == S7COMM_UD_TYPE_REQ && subfunc == S7COMM_NCPRG_FUNCREQUESTDOWNLOAD) {
            proto_tree_add_item_ret_string(data_tree, hf_s7comm_data_blockcontrol_filename, tvb, offset, dlength,
                                           ENC_ASCII|ENC_NA, pinfo->pool, &str_filename);
            col_append_fstr(pinfo->cinfo, COL_INFO, " File:[%s]", str_filename);
            offset += dlength;
        } else if (type == S7COMM_UD_TYPE_REQ && subfunc == S7COMM_NCPRG_FUNCSTARTUPLOAD) {
            proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_unackcount, tvb, offset, 1, ENC_NA);
            offset += 1;
            dlength -= 1;
            proto_tree_add_item(data_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 1, ENC_NA);
            offset += 1;
            dlength -= 1;
            proto_tree_add_item_ret_string(data_tree, hf_s7comm_data_blockcontrol_filename, tvb, offset, dlength,
                                           ENC_ASCII|ENC_NA, pinfo->pool, &str_filename);
            col_append_fstr(pinfo->cinfo, COL_INFO, " File:[%s]", str_filename);
            offset += dlength;
        } else if (type == S7COMM_UD_TYPE_RES && subfunc == S7COMM_NCPRG_FUNCREQUESTDOWNLOAD) {
                proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_unackcount, tvb, offset, 1, ENC_NA);
                offset += 1;
                proto_tree_add_item(data_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 1, ENC_NA);
                offset += 1;
        } else if (type == S7COMM_UD_TYPE_IND && (subfunc == S7COMM_NCPRG_FUNCCONTUPLOAD || subfunc == S7COMM_NCPRG_FUNCCONTDOWNLOAD)) {
                proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_unackcount, tvb, offset, 1, ENC_NA);
                offset += 1;
                proto_tree_add_item(data_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 1, ENC_NA);
                offset += 1;
        } else if ((type == S7COMM_UD_TYPE_RES || type == S7COMM_UD_TYPE_IND) &&
                (subfunc == S7COMM_NCPRG_FUNCDOWNLOADBLOCK ||
                 subfunc == S7COMM_NCPRG_FUNCUPLOAD ||
                 subfunc == S7COMM_NCPRG_FUNCSTARTUPLOAD)) {
            start_offset = offset;
            /* file length may be contain only spaces when downloading a directory */
            proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_filelength, tvb, offset, 8, ENC_ASCII);
            offset += 8;
            proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_filetime, tvb, offset, 16, ENC_ASCII);
            offset += 16;
            /* File path and file data aren't always there */
            if (dlength > 24) {
                if (subfunc == S7COMM_NCPRG_FUNCDOWNLOADBLOCK || subfunc == S7COMM_NCPRG_FUNCSTARTUPLOAD || subfunc == S7COMM_NCPRG_FUNCUPLOAD) {
                    string_end_offset = tvb_find_uint8(tvb, offset, dlength-8-16, 0x0a);
                    if (string_end_offset > 0) {
                        string_len = string_end_offset - offset + 1;    /* include 0x0a */
                        proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_filepath, tvb, offset, string_len, ENC_ASCII);
                        offset += string_len;
                        filelength = dlength - (offset - start_offset);
                        proto_tree_add_item(data_tree, hf_s7comm_data_ncprg_filedata, tvb, offset, filelength, ENC_NA);
                        offset += filelength;
                    }
                }
            }
        } else {
            proto_tree_add_item(data_tree, hf_s7comm_data_blockcontrol_unknown1, tvb, offset, 2, ENC_NA);
            offset += 2;
            dlength -= 2;
            if (dlength >= 4) {
                proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, dlength, ENC_NA);
                offset += dlength;
            }
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Data record routing to Profibus
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_drr_subfunc(tvbuff_t *tvb,
                             proto_tree *tree,
                             uint32_t dlength,
                             uint32_t offset)
{
    /* As a start add only a data block. At least there are min. 6 bytes of a header.
     * At some point of the data, parts of the Profinet dissector may be reusable,
     * as there's an overlap between the Profibus and Profinet Specification.
     */
    if (dlength > 0) {
        proto_tree_add_item(tree, hf_s7comm_data_drr_data, tvb, offset, dlength, ENC_NA);
        offset += dlength;
    }

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Message services -> AR_SEND parameters on initiate/abort
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_message_service_ar_send_args(tvbuff_t *tvb,
                                           packet_info *pinfo,
                                           proto_tree *tree,
                                           uint8_t type,
                                           uint32_t offset)
{
    uint8_t item_count;
    uint8_t i;
    uint32_t ar_id;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;

    item_count = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(tree, hf_s7comm_param_itemcount, tvb, offset, 1, item_count);
    offset += 1;

    for (i = 0; i < item_count; i++) {
        if (type == S7COMM_UD_TYPE_REQ) {
            item = proto_tree_add_item(tree, hf_s7comm_data_item, tvb, offset, 8, ENC_NA);
            item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
            proto_tree_add_item(item_tree, hf_s7comm_item_varspec, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(item_tree, hf_s7comm_item_varspec_length, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(item_tree, hf_s7comm_item_syntax_id, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(item_tree, hf_s7comm_pbc_arsend_unknown, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item_ret_uint(item_tree, hf_s7comm_pbc_arsend_ar_id, tvb, offset, 4, ENC_BIG_ENDIAN, &ar_id);
            col_append_fstr(pinfo->cinfo, COL_INFO, "%s0x%X", (i == 0) ? " AR_ID=" : ",", ar_id);
            proto_item_append_text(item, " [%d]: AR_ID=0x%X", i+1, ar_id);
            offset += 4;
        } else if (type == S7COMM_UD_TYPE_RES) {
            item = proto_tree_add_item(tree, hf_s7comm_data_item, tvb, offset, 1, ENC_NA);
            item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
            proto_item_append_text(item, " [%d]", i+1);
            /* Kind of return code. But from what was captured, it doesn't matter if the AR_ID of the request is not available */
            proto_tree_add_item(item_tree, hf_s7comm_pbc_arsend_ret, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
        }
    }
    /* Fill byte on response if number of items is uneven */
    if (type == S7COMM_UD_TYPE_RES && (item_count % 2)) {
        proto_tree_add_item(tree, hf_s7comm_data_fillbyte, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Message services
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_message_service(tvbuff_t *tvb,
                              packet_info *pinfo,
                              proto_tree *data_tree,
                              uint8_t type,
                              uint32_t dlength,
                              uint32_t offset)
{
    uint8_t events;
    uint8_t almtype;
    char events_string[42];

    switch (type) {
        case S7COMM_UD_TYPE_REQ:
            events = tvb_get_uint8(tvb, offset);
            proto_tree_add_bitmask(data_tree, tvb, offset, hf_s7comm_cpu_msgservice_subscribe_events,
                ett_s7comm_cpu_msgservice_subscribe_events, s7comm_cpu_msgservice_subscribe_events_fields, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_req_reserved1, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;

            (void) g_strlcpy(events_string, "", sizeof(events_string));
            if (events & 0x01) (void) g_strlcat(events_string, "MODE,", sizeof(events_string));    /* Change in mode-transition: Stop, Run, by Push and Function-group=0, Subfunction: 0=Stop, 1=Warm Restart, 2=RUN */
            if (events & 0x02) (void) g_strlcat(events_string, "SYS,", sizeof(events_string));     /* System diagnostics */
            if (events & 0x04) (void) g_strlcat(events_string, "USR,", sizeof(events_string));     /* User-defined diagnostic messages */
            if (events & 0x08) (void) g_strlcat(events_string, "-4-,", sizeof(events_string));     /* currently unknown flag */
            if (events & 0x10) (void) g_strlcat(events_string, "-5-,", sizeof(events_string));     /* currently unknown flag */
            if (events & 0x20) (void) g_strlcat(events_string, "-6-,", sizeof(events_string));     /* currently unknown flag */
            if (events & 0x40) (void) g_strlcat(events_string, "-7-,", sizeof(events_string));     /* currently unknown flag */
            if (events & 0x80) (void) g_strlcat(events_string, "ALM,", sizeof(events_string));     /* Program block message, type of message in additional field */
            if (strlen(events_string) > 2)
                events_string[strlen(events_string) - 1 ] = '\0';
            col_append_fstr(pinfo->cinfo, COL_INFO, " SubscribedEvents=(%s)", events_string);

            proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_username, tvb, offset, 8, ENC_ASCII);
            offset += 8;
            if ((events & 0x80) && (dlength > 10)) {
                almtype = tvb_get_uint8(tvb, offset);
                proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_almtype, tvb, offset, 1, ENC_BIG_ENDIAN);
                col_append_fstr(pinfo->cinfo, COL_INFO, " AlmType=%s", val_to_str(almtype, cpu_msgservice_almtype_names, "Unknown type: 0x%02x"));
                offset += 1;
                if (almtype == S7COMM_CPU_MSG_ALMTYPE_AR_SEND_INITIATE || almtype == S7COMM_CPU_MSG_ALMTYPE_AR_SEND_ABORT) {
                    offset = s7comm_decode_message_service_ar_send_args(tvb, pinfo, data_tree, type, offset);
                } else {
                    proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_req_reserved2, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                }
            }
            break;
        case S7COMM_UD_TYPE_RES:
            proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_res_result, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_res_reserved1, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            if (dlength > 2) {
                almtype = tvb_get_uint8(tvb, offset);
                proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_almtype, tvb, offset, 1, ENC_BIG_ENDIAN);
                col_append_fstr(pinfo->cinfo, COL_INFO, " AlmType=%s", val_to_str(almtype, cpu_msgservice_almtype_names, "Unknown type: 0x%02x"));
                offset += 1;
                if (almtype == S7COMM_CPU_MSG_ALMTYPE_AR_SEND_INITIATE || almtype == S7COMM_CPU_MSG_ALMTYPE_AR_SEND_ABORT) {
                    offset = s7comm_decode_message_service_ar_send_args(tvb, pinfo, data_tree, type, offset);
                } else {
                    proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_res_reserved2, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                    proto_tree_add_item(data_tree, hf_s7comm_cpu_msgservice_res_reserved3, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                }
            }
            break;
    }

    return offset;
}

/*******************************************************************************************************
 *
 *  PDU Type: User Data -> AR_SEND, before reassembly
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_cpu_ar_send_pre_reass(tvbuff_t *tvb,
                                       packet_info *pinfo,
                                       proto_tree *data_tree,
                                       uint16_t *dlength,
                                       uint32_t offset)
{
    uint32_t ar_id;

    if (*dlength >= 8) {
        proto_tree_add_item(data_tree, hf_s7comm_item_varspec, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(data_tree, hf_s7comm_item_varspec_length, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(data_tree, hf_s7comm_item_syntax_id, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(data_tree, hf_s7comm_pbc_arsend_unknown, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item_ret_uint(data_tree, hf_s7comm_pbc_arsend_ar_id, tvb, offset, 4, ENC_BIG_ENDIAN, &ar_id);
        col_append_fstr(pinfo->cinfo, COL_INFO, " AR_ID=0x%X", ar_id);
        offset += 4;

        *dlength -= 8;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> AR_SEND
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_cpu_ar_send(tvbuff_t *tvb,
                             proto_tree *data_tree,
                             uint32_t offset)
{
    uint32_t len;

    /* Only the first fragment contains the length. As we get the length after reassembly, it's ok. */
    proto_tree_add_item_ret_uint(data_tree, hf_s7comm_pbc_arsend_len, tvb, offset, 2, ENC_LITTLE_ENDIAN, &len);
    offset += 2;

    proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, len, ENC_NA);
    offset += len;

    return offset;
}
/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 4 -> alarm, main tree for all except query response
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_cpu_alarm_main(tvbuff_t *tvb,
                                packet_info *pinfo,
                                proto_tree *data_tree,
                                uint8_t type,
                                uint8_t subfunc,
                                uint32_t offset)
{
    uint32_t start_offset;
    uint32_t asc_start_offset;
    uint32_t msg_obj_start_offset;
    uint32_t ev_id;
    proto_item *msg_item = NULL;
    proto_tree *msg_item_tree = NULL;
    proto_item *msg_obj_item = NULL;
    proto_tree *msg_obj_item_tree = NULL;
    proto_item *msg_work_item = NULL;
    proto_tree *msg_work_item_tree = NULL;
    uint8_t nr_objects;
    uint8_t i;
    uint8_t syntax_id;
    uint8_t nr_of_additional_values;
    uint8_t signalstate;
    uint8_t sig_nr;
    uint8_t ret_val;
    uint8_t querytype;
    uint8_t varspec_length;

    start_offset = offset;

    msg_item = proto_tree_add_item(data_tree, hf_s7comm_cpu_alarm_message_item, tvb, offset, 0, ENC_NA);
    msg_item_tree = proto_item_add_subtree(msg_item, ett_s7comm_cpu_alarm_message);

    switch (subfunc) {
        case S7COMM_UD_SUBF_CPU_SCAN_IND:
            proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_scan_unknown1, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            msg_work_item = proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_timestamp_coming, tvb, offset, 8, ENC_NA);
            msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_timestamp);
            offset = s7comm_add_timestamp_to_tree(tvb, msg_work_item_tree, offset, true, false);
            proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_scan_unknown2, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            break;
        case S7COMM_UD_SUBF_CPU_ALARM8_IND:
        case S7COMM_UD_SUBF_CPU_ALARMACK_IND:
        case S7COMM_UD_SUBF_CPU_ALARMSQ_IND:
        case S7COMM_UD_SUBF_CPU_ALARMS_IND:
        case S7COMM_UD_SUBF_CPU_NOTIFY_IND:
        case S7COMM_UD_SUBF_CPU_NOTIFY8_IND:
            msg_work_item = proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_timestamp_coming, tvb, offset, 8, ENC_NA);
            msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_timestamp);
            offset = s7comm_add_timestamp_to_tree(tvb, msg_work_item_tree, offset, true, false);
            break;
    }
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_function, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    nr_objects = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(msg_item_tree, hf_s7comm_cpu_alarm_message_nr_objects, tvb, offset, 1, nr_objects);
    offset += 1;
    for (i = 0; i < nr_objects; i++) {
        msg_obj_start_offset = offset;
        msg_obj_item = proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_obj_item, tvb, offset, 0, ENC_NA);
        msg_obj_item_tree = proto_item_add_subtree(msg_obj_item, ett_s7comm_cpu_alarm_message_object);
        proto_item_append_text(msg_obj_item_tree, " [%d]", i+1);
        if (type == S7COMM_UD_TYPE_REQ || type == S7COMM_UD_TYPE_IND) {
            proto_tree_add_item(msg_obj_item_tree, hf_s7comm_item_varspec, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            varspec_length = tvb_get_uint8(tvb, offset);
            proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_item_varspec_length, tvb, offset, 1, varspec_length);
            offset += 1;
            syntax_id = tvb_get_uint8(tvb, offset);
            proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_item_syntax_id, tvb, offset, 1, syntax_id);
            offset += 1;
            switch (syntax_id) {
                case S7COMM_SYNTAXID_ALARM_LOCKFREESET:
                case S7COMM_SYNTAXID_ALARM_INDSET:
                case S7COMM_SYNTAXID_NOTIFY_INDSET:
                case S7COMM_SYNTAXID_ALARM_ACKSET:
                    nr_of_additional_values = tvb_get_uint8(tvb, offset);
                    proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_nr_add_values, tvb, offset, 1, nr_of_additional_values);
                    offset += 1;
                    ev_id = tvb_get_ntohl(tvb, offset);
                    proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_eventid, tvb, offset, 4, ev_id);
                    offset += 4;
                    proto_item_append_text(msg_obj_item_tree, ": EventID=0x%08x", ev_id);
                    col_append_fstr(pinfo->cinfo, COL_INFO, " EventID=0x%08x", ev_id);
                    if (syntax_id == S7COMM_SYNTAXID_ALARM_INDSET || syntax_id == S7COMM_SYNTAXID_NOTIFY_INDSET) {
                        signalstate = tvb_get_uint8(tvb, offset);
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_eventstate,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                        /* show SIG with True values for a quick overview in info-column */
                        if (signalstate > 0) {
                            col_append_str(pinfo->cinfo, COL_INFO, " On=[");
                            for (sig_nr = 0; sig_nr < 8; sig_nr++) {
                                if (signalstate & 0x01) {
                                    signalstate >>= 1;
                                    if (signalstate == 0) {
                                        col_append_fstr(pinfo->cinfo, COL_INFO, "SIG_%d", sig_nr + 1);
                                    } else {
                                        col_append_fstr(pinfo->cinfo, COL_INFO, "SIG_%d,", sig_nr + 1);
                                    }
                                } else {
                                    signalstate >>= 1;
                                }
                            }
                            col_append_str(pinfo->cinfo, COL_INFO, "]");
                        }
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_state,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                    }
                    if (syntax_id == S7COMM_SYNTAXID_ALARM_INDSET || syntax_id == S7COMM_SYNTAXID_ALARM_ACKSET || syntax_id == S7COMM_SYNTAXID_NOTIFY_INDSET) {
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_ackstate_going,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_ackstate_coming,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                    }
                    if (syntax_id == S7COMM_SYNTAXID_NOTIFY_INDSET) {
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_event_going,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_event_coming,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                        proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_event_lastchanged,
                            ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                        proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_event_reserved, tvb, offset, 1, ENC_BIG_ENDIAN);
                        offset += 1;
                    }
                    if (syntax_id == S7COMM_SYNTAXID_ALARM_INDSET || syntax_id == S7COMM_SYNTAXID_NOTIFY_INDSET) {
                        if (nr_of_additional_values > 0) {
                            asc_start_offset = offset;
                            msg_work_item = proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_associated_value, tvb, offset, 0, ENC_NA);
                            msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_associated_value);
                            offset = s7comm_decode_response_read_data(tvb, msg_work_item_tree, nr_of_additional_values, offset);
                            proto_item_set_len(msg_work_item_tree, offset - asc_start_offset);
                        }
                    }
                    break;
                case S7COMM_SYNTAXID_ALARM_QUERYREQSET:
                    proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_unknown1, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                    querytype = tvb_get_uint8(tvb, offset);
                    proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_querytype, tvb, offset, 1, querytype);
                    offset += 1;
                    proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_unknown2, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                    ev_id = tvb_get_ntohl(tvb, offset);
                    /* there is a querytype=8, which only occurs when a previous SZL request 0x131 index 0x10 has a missing flag in funk_1 */
                    switch (querytype) {
                        case S7COMM_ALARM_MESSAGE_QUERYTYPE_BYALARMTYPE:
                            proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_alarmtype, tvb, offset, 4, ENC_BIG_ENDIAN);
                            col_append_fstr(pinfo->cinfo, COL_INFO, " ByAlarmtype=%s",
                                val_to_str(ev_id, alarm_message_query_alarmtype_names, "Unknown Alarmtype: %u"));
                            break;
                        case S7COMM_ALARM_MESSAGE_QUERYTYPE_BYEVENTID:
                            proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_eventid, tvb, offset, 4, ENC_BIG_ENDIAN);
                            col_append_fstr(pinfo->cinfo, COL_INFO, " ByEventID=0x%08x", ev_id);
                            break;
                        default:
                            break;
                    }
                    offset += 4;
                    break;
                default:
                    /* for current unknown syntax id, set offset to end of dataset. The varspec_length includes
                     * the byte for the syntax_id, so minus one.
                     */
                    offset += (varspec_length - 1);
                    break;
            }
        } else if (type == S7COMM_UD_TYPE_RES) {
            ret_val = tvb_get_uint8(tvb, offset);
            proto_item_append_text(msg_obj_item_tree, ": (%s)", val_to_str(ret_val, s7comm_item_return_valuenames, "Unknown code: 0x%02x"));
            proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
            offset += 1;
        }
        proto_item_set_len(msg_obj_item_tree, offset - msg_obj_start_offset);
    }
    proto_item_set_len(msg_item_tree, offset - start_offset);
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 4 -> alarm query response
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_cpu_alarm_query_response(tvbuff_t *tvb,
                                          proto_tree *data_tree,
                                          uint32_t offset)
{
    proto_item *msg_item = NULL;
    proto_tree *msg_item_tree = NULL;
    proto_item *msg_obj_item = NULL;
    proto_tree *msg_obj_item_tree = NULL;
    proto_item *msg_work_item = NULL;
    proto_tree *msg_work_item_tree = NULL;
    uint32_t start_offset;
    uint32_t msg_obj_start_offset;
    uint32_t asc_start_offset;
    uint32_t ev_id;
    uint8_t returncode;
    uint8_t alarmtype;
    uint16_t complete_length;
    int32_t remaining_length;
    bool cont;

    start_offset = offset;
    msg_item = proto_tree_add_item(data_tree, hf_s7comm_cpu_alarm_message_item, tvb, offset, 0, ENC_NA);
    msg_item_tree = proto_item_add_subtree(msg_item, ett_s7comm_cpu_alarm_message);

    /* Maybe this value here is something different, always 0x00 or 0x01 */
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_function, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_nr_objects, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    returncode = tvb_get_uint8(tvb, offset);
    proto_tree_add_uint(msg_item_tree, hf_s7comm_data_returncode, tvb, offset, 1, returncode);
    offset += 1;
    proto_tree_add_item(msg_item_tree, hf_s7comm_data_transport_size, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    complete_length = tvb_get_ntohs(tvb, offset);
    proto_tree_add_uint(msg_item_tree, hf_s7comm_cpu_alarm_query_completelen, tvb, offset, 2, complete_length);
    remaining_length = (int32_t)complete_length;
    offset += 2;

    if (returncode == S7COMM_ITEM_RETVAL_DATA_OK) {
        do {
            msg_obj_start_offset = offset;
            msg_obj_item = proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_alarm_message_obj_item, tvb, offset, 0, ENC_NA);
            msg_obj_item_tree = proto_item_add_subtree(msg_obj_item, ett_s7comm_cpu_alarm_message_object);

            proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_datasetlen, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_resunknown1, tvb, offset, 2, ENC_BIG_ENDIAN);
            offset += 2;
            /* begin of count dataset length */
            alarmtype = tvb_get_uint8(tvb, offset);
            proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_alarmtype, tvb, offset, 1, alarmtype);
            proto_item_append_text(msg_obj_item_tree, " (Alarmtype=%s)", val_to_str(alarmtype, alarm_message_query_alarmtype_names, "Unknown Alarmtype: %u"));
            offset += 1;
            ev_id = tvb_get_ntohl(tvb, offset);
            proto_tree_add_uint(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_eventid, tvb, offset, 4, ev_id);
            proto_item_append_text(msg_obj_item_tree, ": EventID=0x%08x", ev_id);
            offset += 4;
            proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_query_resunknown1, tvb, offset, 1, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_eventstate,
                ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_ackstate_going,
                ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
            offset += 1;
            proto_tree_add_bitmask(msg_obj_item_tree, tvb, offset, hf_s7comm_cpu_alarm_message_ackstate_coming,
                ett_s7comm_cpu_alarm_message_signal, s7comm_cpu_alarm_message_signal_fields, ENC_BIG_ENDIAN);
            offset += 1;
            if (alarmtype == S7COMM_ALARM_MESSAGE_QUERY_ALARMTYPE_ALARM_S) {
                /* 8 bytes timestamp (coming)*/
                msg_work_item = proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_timestamp_coming, tvb, offset, 8, ENC_NA);
                msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_timestamp);
                offset = s7comm_add_timestamp_to_tree(tvb, msg_work_item_tree, offset, true, false);
                /* Associated value of coming alarm */
                asc_start_offset = offset;
                msg_work_item = proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_associated_value, tvb, offset, 0, ENC_NA);
                msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_associated_value);
                offset = s7comm_decode_response_read_data(tvb, msg_work_item_tree, 1, offset);
                proto_item_set_len(msg_work_item_tree, offset - asc_start_offset);
                /* 8 bytes timestamp (going)
                 * If all bytes in timestamp are zero, then the message is still active. */
                msg_work_item = proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_timestamp_going, tvb, offset, 8, ENC_NA);
                msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_timestamp);
                offset = s7comm_add_timestamp_to_tree(tvb, msg_work_item_tree, offset, true, false);
                /* Associated value of going alarm  */
                asc_start_offset = offset;
                msg_work_item = proto_tree_add_item(msg_obj_item_tree, hf_s7comm_cpu_alarm_message_associated_value, tvb, offset, 0, ENC_NA);
                msg_work_item_tree = proto_item_add_subtree(msg_work_item, ett_s7comm_cpu_alarm_message_associated_value);
                offset = s7comm_decode_response_read_data(tvb, msg_work_item_tree, 1, offset);
                proto_item_set_len(msg_work_item_tree, offset - asc_start_offset);
            }
            remaining_length = remaining_length - (offset - msg_obj_start_offset);
            proto_item_set_len(msg_obj_item_tree, offset - msg_obj_start_offset);
            /* when complete_length is 0xffff, then loop until terminating null */
            if (complete_length == 0xffff) {
                cont = (tvb_get_uint8(tvb, offset) > 0);
            } else {
                cont = (remaining_length > 0);
            }
        } while (cont);
    }
    proto_item_set_len(msg_item_tree, offset - start_offset);

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 4 -> diagnostic message
 * Also used as a dataset in the diagnostic buffer, read with SZL-ID 0x00a0 index 0.
 *
 *******************************************************************************************************/
uint32_t
s7comm_decode_ud_cpu_diagnostic_message(tvbuff_t *tvb,
                                        packet_info *pinfo,
                                        bool add_info_to_col,
                                        proto_tree *data_tree,
                                        uint32_t offset)
{
    proto_item *msg_item = NULL;
    proto_tree *msg_item_tree = NULL;
    uint16_t eventid;
    uint16_t eventid_masked;
    const char *event_text;
    bool has_text = false;

    msg_item = proto_tree_add_item(data_tree, hf_s7comm_cpu_diag_msg_item, tvb, offset, 20, ENC_NA);
    msg_item_tree = proto_item_add_subtree(msg_item, ett_s7comm_cpu_diag_msg);

    eventid = tvb_get_ntohs(tvb, offset);
    if ((eventid >= 0x8000) && (eventid <= 0x9fff)) {
        eventid_masked = eventid & 0xf0ff;
        if ((event_text = try_val_to_str_ext(eventid_masked, &cpu_diag_eventid_0x8_0x9_names_ext))) {
            if (add_info_to_col) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " Event='%s'", event_text);
            }
            has_text = true;
        } else {
            if (add_info_to_col) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " EventID=0x%04x", eventid);
            }
        }
    } else if ((eventid >= 0x1000) && (eventid < 0x8000)) {
        if ((event_text = try_val_to_str_ext(eventid, &cpu_diag_eventid_fix_names_ext))) {
            if (add_info_to_col) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " Event='%s'", event_text);
            }
            has_text = true;
        } else {
            if (add_info_to_col) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " EventID=0x%04x", eventid);
            }
        }
    } else {
        if (add_info_to_col) {
            col_append_fstr(pinfo->cinfo, COL_INFO, " EventID=0x%04x", eventid);
        }
    }
    proto_tree_add_bitmask(msg_item_tree, tvb, offset, hf_s7comm_cpu_diag_msg_eventid,
            ett_s7comm_cpu_diag_msg_eventid, s7comm_cpu_diag_msg_eventid_fields, ENC_BIG_ENDIAN);
    if (has_text) {
        proto_item_append_text(msg_item_tree, ": Event='%s'", event_text);
    } else {
        proto_item_append_text(msg_item_tree, ": EventID=0x%04x", eventid);
    }
    offset += 2;
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_diag_msg_prioclass, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_diag_msg_obnumber, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_diag_msg_datid, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_diag_msg_info1, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    proto_tree_add_item(msg_item_tree, hf_s7comm_cpu_diag_msg_info2, tvb, offset, 4, ENC_BIG_ENDIAN);
    offset += 4;
    offset = s7comm_add_timestamp_to_tree(tvb, msg_item_tree, offset, false, false);

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 7 -> time functions
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_time_subfunc(tvbuff_t *tvb,
                              proto_tree *data_tree,
                              uint8_t type,
                              uint8_t subfunc,
                              uint8_t ret_val,             /* Return value in data part */
                              uint32_t dlength,
                              uint32_t offset)
{
    bool know_data = false;

    switch (subfunc) {
        case S7COMM_UD_SUBF_TIME_READ:
        case S7COMM_UD_SUBF_TIME_READF:
            if (type == S7COMM_UD_TYPE_RES) {
                if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK) {
                    proto_item_append_text(data_tree, ": ");
                    offset = s7comm_add_timestamp_to_tree(tvb, data_tree, offset, true, true);
                }
                know_data = true;
            }
            break;
        case S7COMM_UD_SUBF_TIME_SET:
        case S7COMM_UD_SUBF_TIME_SET2:
            if (type == S7COMM_UD_TYPE_REQ) {
                if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK) {
                    proto_item_append_text(data_tree, ": ");
                    offset = s7comm_add_timestamp_to_tree(tvb, data_tree, offset, true, true);
                }
                know_data = true;
            }
            break;
        default:
            break;
    }

    if (know_data == false && dlength > 0) {
        proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, dlength, ENC_NA);
        offset += dlength;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 3 -> block functions
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_block_subfunc(tvbuff_t *tvb,
                               packet_info *pinfo,
                               proto_tree *data_tree,
                               uint8_t type,
                               uint8_t subfunc,
                               uint8_t ret_val,             /* Return value in data part */
                               uint8_t tsize,               /* transport size in data part */
                               uint32_t dlength,
                               uint32_t offset)
{
    uint32_t count;
    uint32_t i;
    const uint8_t *pBlocknumber;
    uint16_t blocknumber;
    uint8_t blocktype;
    uint16_t blocktype16;
    bool know_data = false;
    proto_item *item = NULL;
    proto_tree *item_tree = NULL;
    proto_item *itemadd = NULL;
    char str_timestamp[30];
    char str_version[10];

    switch (subfunc) {
        /*************************************************
         * List blocks
         */
        case S7COMM_UD_SUBF_BLOCK_LIST:
            if (type == S7COMM_UD_TYPE_REQ) {
                /* Is this a possible combination? Never seen it... */

            } else if (type == S7COMM_UD_TYPE_RES) {
                count = dlength / 4;
                for (i = 0; i < count; i++) {
                    /* Insert a new tree of 4 byte length for every item */
                    item = proto_tree_add_item(data_tree, hf_s7comm_data_item, tvb, offset, 4, ENC_NA);
                    item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);
                    blocktype16 = tvb_get_ntohs(tvb, offset);
                    proto_item_append_text(item, " [%d]: (Block type %s)", i+1, val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    itemadd = proto_tree_add_item(item_tree, hf_s7comm_ud_blockinfo_block_type, tvb, offset, 2, ENC_ASCII);
                    proto_item_append_text(itemadd, " (%s)", val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    offset += 2;
                    proto_tree_add_item(item_tree, hf_s7comm_ud_blockinfo_block_cnt, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                }
                know_data = true;
            }
            break;
        /*************************************************
         * List blocks of type
         */
        case S7COMM_UD_SUBF_BLOCK_LISTTYPE:
            if (type == S7COMM_UD_TYPE_REQ) {
                if (tsize != S7COMM_DATA_TRANSPORT_SIZE_NULL) {
                    blocktype16 = tvb_get_ntohs(tvb, offset);
                    itemadd = proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_block_type, tvb, offset, 2, ENC_ASCII);
                    proto_item_append_text(itemadd, " (%s)", val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    col_append_fstr(pinfo->cinfo, COL_INFO, " Type:[%s]",
                        val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    proto_item_append_text(data_tree, ": (%s)",
                        val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    offset += 2;
                }
                know_data = true;

            } else if (type == S7COMM_UD_TYPE_RES) {
                if (tsize != S7COMM_DATA_TRANSPORT_SIZE_NULL) {
                    count = dlength / 4;

                    for (i = 0; i < count; i++) {
                        /* Insert a new tree of 4 byte length for every item */
                        item = proto_tree_add_item(data_tree, hf_s7comm_data_item, tvb, offset, 4, ENC_NA);
                        item_tree = proto_item_add_subtree(item, ett_s7comm_data_item);

                        proto_item_append_text(item, " [%d]: (Block number %d)", i+1, tvb_get_ntohs(tvb, offset));
                        proto_tree_add_item(item_tree, hf_s7comm_ud_blockinfo_block_num, tvb, offset, 2, ENC_BIG_ENDIAN);
                        offset += 2;
                        /* The first Byte is unknown, kind of flags? */
                        proto_tree_add_item(item_tree, hf_s7comm_ud_blockinfo_block_flags, tvb, offset, 1, ENC_BIG_ENDIAN);
                        offset += 1;
                        proto_tree_add_item(item_tree, hf_s7comm_ud_blockinfo_block_lang, tvb, offset, 1, ENC_BIG_ENDIAN);
                        offset += 1;
                    }
                }
                know_data = true;
            }
            break;
        /*************************************************
         * Get block infos
         */
        case S7COMM_UD_SUBF_BLOCK_BLOCKINFO:
            if (type == S7COMM_UD_TYPE_REQ) {
                if (tsize != S7COMM_DATA_TRANSPORT_SIZE_NULL) {
                    int32_t num = -1;
                    bool num_valid;
                    /* 8 Bytes of Data follow, 1./ 2. type, 3-7 blocknumber as ascii number */
                    blocktype16 = tvb_get_ntohs(tvb, offset);
                    itemadd = proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_block_type, tvb, offset, 2, ENC_ASCII);
                    proto_item_append_text(itemadd, " (%s)", val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    offset += 2;
                    proto_tree_add_item_ret_string(data_tree, hf_s7comm_ud_blockinfo_block_num_ascii, tvb, offset, 5, ENC_ASCII|ENC_NA, pinfo->pool, &pBlocknumber);
                    num_valid = ws_strtoi32((const char*)pBlocknumber, NULL, &num);
                    proto_item_append_text(data_tree, " [%s ",
                        val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    col_append_fstr(pinfo->cinfo, COL_INFO, " -> Block:[%s ",
                        val_to_str(blocktype16, blocktype_names, "Unknown Block type: 0x%04x"));
                    if (num_valid) {
                        proto_item_append_text(data_tree, "%d]", num);
                        col_append_fstr(pinfo->cinfo, COL_INFO, "%d]", num);
                    } else {
                        expert_add_info(pinfo, data_tree, &ei_s7comm_ud_blockinfo_block_num_ascii_invalid);
                        proto_item_append_text(data_tree, "NaN]");
                        col_append_str(pinfo->cinfo, COL_INFO, "NaN]");
                    }
                    offset += 5;
                    itemadd = proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_filesys, tvb, offset, 1, ENC_ASCII);
                    proto_item_append_text(itemadd, " (%s)", char_val_to_str(tvb_get_uint8(tvb, offset), blocktype_attribute2_names, "Unknown filesys"));
                    offset += 1;
                }
                know_data = true;

            } else if (type == S7COMM_UD_TYPE_RES) {
                /* 78 Bytes */
                if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK) {
                    itemadd = proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_block_type, tvb, offset, 2, ENC_ASCII);
                    proto_item_append_text(itemadd, " (%s)", val_to_str(tvb_get_ntohs(tvb, offset), blocktype_names, "Unknown Block type: 0x%04x"));
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_res_infolength, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_res_unknown2, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_res_const3, tvb, offset, 2, ENC_ASCII);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_res_unknown, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_bitmask(data_tree, tvb, offset, hf_s7comm_userdata_blockinfo_flags,
                        ett_s7comm_userdata_blockinfo_flags, s7comm_userdata_blockinfo_flags_fields, ENC_BIG_ENDIAN);
                    offset += 1;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_block_lang, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                    blocktype = tvb_get_uint8(tvb, offset);
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_subblk_type, tvb, offset, 1, ENC_BIG_ENDIAN);
                    offset += 1;
                    blocknumber = tvb_get_ntohs(tvb, offset);
                    proto_tree_add_uint(data_tree, hf_s7comm_ud_blockinfo_block_num, tvb, offset, 2, blocknumber);
                    /* Add block type and number to info column */
                    col_append_fstr(pinfo->cinfo, COL_INFO, " -> Block:[%s %d]",
                        val_to_str(blocktype, subblktype_names, "Unknown Subblk type: 0x%02x"),
                        blocknumber);
                    proto_item_append_text(data_tree, ": (Block:[%s %d])",
                        val_to_str(blocktype, subblktype_names, "Unknown Subblk type: 0x%02x"),
                        blocknumber);
                    offset += 2;
                    /* "Length Load mem" -> the length in Step7 Manager seems to be this length +6 bytes */
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_load_mem_len, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_blocksecurity, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    s7comm_get_timestring_from_s7time(tvb, offset, str_timestamp, sizeof(str_timestamp));
                    proto_tree_add_string(data_tree, hf_s7comm_ud_blockinfo_code_timestamp, tvb, offset, 6, str_timestamp);
                    offset += 6;
                    s7comm_get_timestring_from_s7time(tvb, offset, str_timestamp, sizeof(str_timestamp));
                    proto_tree_add_string(data_tree, hf_s7comm_ud_blockinfo_interface_timestamp, tvb, offset, 6, str_timestamp);
                    offset += 6;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_ssb_len, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_add_len, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_localdata_len, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_mc7_len, tvb, offset, 2, ENC_BIG_ENDIAN);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_author, tvb, offset, 8, ENC_ASCII);
                    offset += 8;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_family, tvb, offset, 8, ENC_ASCII);
                    offset += 8;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_headername, tvb, offset, 8, ENC_ASCII);
                    offset += 8;
                    snprintf(str_version, sizeof(str_version), "%d.%d", ((tvb_get_uint8(tvb, offset) & 0xf0) >> 4), tvb_get_uint8(tvb, offset) & 0x0f);
                    proto_tree_add_string(data_tree, hf_s7comm_ud_blockinfo_headerversion, tvb, offset, 1, str_version);
                    offset += 1;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_res_unknown, tvb, offset, 1, ENC_NA);
                    offset += 1;
                    proto_tree_add_checksum(data_tree, tvb, offset, hf_s7comm_ud_blockinfo_checksum, -1, NULL, pinfo, 0, ENC_BIG_ENDIAN, PROTO_CHECKSUM_NO_FLAGS);
                    offset += 2;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_reserved1, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                    proto_tree_add_item(data_tree, hf_s7comm_ud_blockinfo_reserved2, tvb, offset, 4, ENC_BIG_ENDIAN);
                    offset += 4;
                }
                know_data = true;
            }
            break;
        default:
            break;
    }
    if (know_data == false && dlength > 0) {
        proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, dlength, ENC_NA);
        offset += dlength;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 2 -> Read record
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_readrec(tvbuff_t *tvb,
                         proto_tree *tree,
                         uint8_t type,
                         uint32_t offset)
{
    uint32_t ret_val;
    uint32_t statuslen;
    uint32_t reclen;
    uint8_t item_count;

    if (type == S7COMM_UD_TYPE_REQ) {
        proto_tree_add_item(tree, hf_s7comm_rdrec_reserved1, tvb, offset, 1, ENC_NA);
        offset += 1;
        /* Although here is an item_count field, values above 1 aren't allowed or at least never seen */
        item_count = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(tree, hf_s7comm_param_itemcount, tvb, offset, 1, item_count);
        offset += 1;
        if (item_count > 0) {
            offset = s7comm_decode_param_item(tvb, offset, tree, 0);
        }
    } else if (type == S7COMM_UD_TYPE_RES) {
        /* The item with data is used for optional status code similar to the
         * STATUS output of SFB52 RDREC used in Plc code.
         */
        proto_tree_add_item(tree, hf_s7comm_rdrec_reserved1, tvb, offset, 1, ENC_NA);
        offset += 1;
        item_count = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(tree, hf_s7comm_param_itemcount, tvb, offset, 1, item_count);
        offset += 1;
        /* As all testsubjects have shown that no more than one item is allowed,
         * we decode only the first item here.
         */
        if (item_count > 0) {
            proto_tree_add_item_ret_uint(tree, hf_s7comm_data_returncode, tvb, offset, 1, ENC_BIG_ENDIAN, &ret_val);
            offset += 1;
            if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK) {
                proto_tree_add_item(tree, hf_s7comm_data_transport_size, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
            }
            proto_tree_add_item_ret_uint(tree, hf_s7comm_rdrec_statuslen, tvb, offset, 1, ENC_BIG_ENDIAN, &statuslen);
            offset += 1;
            if (statuslen > 0) {
                proto_tree_add_item(tree, hf_s7comm_rdrec_statusdata, tvb, offset, statuslen, ENC_NA);
                offset += statuslen;
            } else {
                offset += 1;    /* Fillbyte */
            }
            if (ret_val == S7COMM_ITEM_RETVAL_DATA_OK) {
                proto_tree_add_item_ret_uint(tree, hf_s7comm_rdrec_recordlen, tvb, offset, 2, ENC_BIG_ENDIAN, &reclen);
                offset += 2;
                if (reclen > 0) {
                    proto_tree_add_item(tree, hf_s7comm_rdrec_data, tvb, offset, reclen, ENC_NA);
                    offset += reclen;
                }
            }
        }
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data -> Function group 2 -> cyclic services
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_cyclic_subfunc(tvbuff_t *tvb,
                                packet_info *pinfo,
                                uint8_t seq_num,
                                proto_tree *data_tree,
                                uint8_t type,
                                uint8_t subfunc,
                                uint32_t dlength,
                                uint32_t offset)
{
    bool know_data = false;
    uint32_t offset_old;
    uint32_t len_item;
    uint8_t item_count;
    uint8_t i;
    uint8_t job_id;

    switch (subfunc)
    {
        case S7COMM_UD_SUBF_CYCLIC_CHANGE_MOD:
            if (type == S7COMM_UD_TYPE_REQ) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " JobID=%d", seq_num);
            }
            /* fall through */
        case S7COMM_UD_SUBF_CYCLIC_TRANSF:
        case S7COMM_UD_SUBF_CYCLIC_CHANGE:
            item_count = tvb_get_uint8(tvb, offset + 1);     /* first byte reserved??? */
            proto_tree_add_uint(data_tree, hf_s7comm_param_itemcount, tvb, offset, 2, item_count);
            offset += 2;
            if (type == S7COMM_UD_TYPE_REQ) {
                proto_tree_add_item(data_tree, hf_s7comm_cycl_interval_timebase, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
                proto_tree_add_item(data_tree, hf_s7comm_cycl_interval_time, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
                for (i = 0; i < item_count; i++) {
                    offset_old = offset;
                    offset = s7comm_decode_param_item(tvb, offset, data_tree, i);
                    /* if length is not a multiple of 2 and this is not the last item, then add a fill-byte */
                    len_item = offset - offset_old;
                    if ((len_item % 2) && (i < (item_count-1))) {
                        offset += 1;
                    }
                }
            } else if (type == S7COMM_UD_TYPE_RES || type == S7COMM_UD_TYPE_IND) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " JobID=%d", seq_num);
                offset = s7comm_decode_response_read_data(tvb, data_tree, item_count, offset);
            }
            know_data = true;
            break;
        case S7COMM_UD_SUBF_CYCLIC_UNSUBSCRIBE:
            if (type == S7COMM_UD_TYPE_REQ) {
                proto_tree_add_item(data_tree, hf_s7comm_cycl_function, tvb, offset, 1, ENC_BIG_ENDIAN);
                offset += 1;
                proto_tree_add_item(data_tree, hf_s7comm_cycl_jobid, tvb, offset, 1, ENC_BIG_ENDIAN);
                job_id = tvb_get_uint8(tvb, offset);
                col_append_fstr(pinfo->cinfo, COL_INFO, " JobID=%d", job_id);
                offset += 1;
                know_data = true;
            } else if (type == S7COMM_UD_TYPE_RES) {
                col_append_fstr(pinfo->cinfo, COL_INFO, " JobID=%d", seq_num);
            }
            break;
        case S7COMM_UD_SUBF_CYCLIC_RDREC:
            offset = s7comm_decode_ud_readrec(tvb, data_tree, type, offset);
            know_data = true;
            break;
    }

    if (know_data == false && dlength > 0) {
        proto_tree_add_item(data_tree, hf_s7comm_userdata_data, tvb, offset, dlength, ENC_NA);
        offset += dlength;
    }
    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: User Data: Data part and reassembly
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud_data(tvbuff_t *tvb,
                      packet_info *pinfo,
                      proto_tree *tree,
                      uint16_t dlength,
                      uint8_t type,
                      uint8_t funcgroup,
                      uint8_t subfunc,
                      uint8_t seq_num,
                      uint8_t data_unit_ref,
                      uint8_t last_data_unit,
                      uint32_t offset,
                      proto_tree *root_tree)
{
    proto_item *item = NULL;
    proto_tree *data_tree = NULL;
    uint8_t tsize;
    uint16_t len;
    uint8_t ret_val;
    uint32_t length_rem = 0;
    bool save_fragmented;
    uint32_t frag_id = 0;
    bool more_frags = false;
    bool is_fragmented = false;
    tvbuff_t* new_tvb = NULL;
    tvbuff_t* next_tvb = NULL;
    fragment_head *fd_head;
    char str_fragadd[32];

    /* The first 4 bytes of the data part of a userdata telegram are the same for all types.
     * This is also the minimum length of the data part.
     */
    if (dlength >= 4) {
        item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
        data_tree = proto_item_add_subtree(item, ett_s7comm_data);

        ret_val = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(data_tree, hf_s7comm_data_returncode, tvb, offset, 1, ret_val);
        offset += 1;
        /* Not definitely known part, kind of "transport size"? constant 0x09, 1 byte
         * The position is the same as in a data response/write telegram,
         */
        tsize = tvb_get_uint8(tvb, offset);
        proto_tree_add_uint(data_tree, hf_s7comm_data_transport_size, tvb, offset, 1, tsize);
        offset += 1;
        len = tvb_get_ntohs(tvb, offset);
        proto_tree_add_uint(data_tree, hf_s7comm_data_length, tvb, offset, 2, len);
        offset += 2;

        if (len >= 2) {
            more_frags = (last_data_unit == S7COMM_UD_LASTDATAUNIT_NO);
            /* Some packets have an additional header before the payload, which must be
             * extracted from the data before reassembly.
             */
            switch (funcgroup) {
                case S7COMM_UD_FUNCGROUP_NCPRG:
                    offset = s7comm_decode_ud_ncprg_pre_reass(tvb, data_tree, type, subfunc, &len, offset);
                    /* Unfortunately on NC programming the first PDU is always shown as reassembled also when not fragmented,
                     * because data_unit_ref may overflow and start again at 0 on big file transfers.
                     */
                    is_fragmented = true;
                    frag_id = seq_num;
                    break;
                case S7COMM_UD_FUNCGROUP_PBC_BSEND:
                    /* The R_ID is used for fragment identification */
                    offset = s7comm_decode_ud_pbc_bsend_pre_reass(tvb, pinfo, data_tree, type, &len, &frag_id, offset);
                    is_fragmented = data_unit_ref > 0 || seq_num > 0;
                    break;
                case S7COMM_UD_FUNCGROUP_CPU:
                    if (subfunc == S7COMM_UD_SUBF_CPU_AR_SEND_IND) {
                        offset = s7comm_decode_ud_cpu_ar_send_pre_reass(tvb, pinfo, data_tree, &len, offset);
                    }
                    /* fragment identification is always the same here */
                    is_fragmented = (data_unit_ref > 0);
                    frag_id = data_unit_ref;
                    break;
                default:
                    is_fragmented = (data_unit_ref > 0);
                    frag_id = data_unit_ref;
                    break;
            }
            /* Reassembly of fragmented data part */
            save_fragmented = pinfo->fragmented;
            if (is_fragmented) {            /* fragmented */
                pinfo->fragmented = true;
                /* NC programming uses a different method of fragment indication. The sequence number is used as reference-id,
                 * the data unit reference number is increased with every packet, as the sender does not need to wait for
                 * the acknowledge of the packet. Also different in NC programming is, that also when a packet is not
                 * fragmented, data_unit_ref is > 0 and "reassembled" would be displayed even when not fragmented (count number of fragments?)
                 * Using fragment number does not work here, as it's only one byte. And if there are more than 255 fragments this would fail.
                 */
                fd_head = fragment_add_seq_next(&s7comm_reassembly_table,
                                                tvb, offset, pinfo,
                                                frag_id,               /* ID for fragments belonging together */
                                                NULL,                  /* void *data */
                                                len,                   /* fragment length - to the end */
                                                more_frags);           /* More fragments? */
                snprintf(str_fragadd, sizeof(str_fragadd), " id=%d", frag_id);
                new_tvb = process_reassembled_data(tvb, offset, pinfo,
                    "Reassembled S7COMM", fd_head, &s7comm_frag_items,
                    NULL, tree);
                if (new_tvb) { /* take it all */
                    /* add reassembly info only when there's more than one fragment */
                    if (fd_head && fd_head->next) {
                        col_append_fstr(pinfo->cinfo, COL_INFO, " (S7COMM reassembled%s)", str_fragadd);
                        proto_item_append_text(data_tree, " (S7COMM reassembled%s)", str_fragadd);
                    }
                    next_tvb = new_tvb;
                    offset = 0;
                } else { /* make a new subset */
                    next_tvb = tvb_new_subset_length(tvb, offset, -1);
                    col_append_fstr(pinfo->cinfo, COL_INFO, " (S7COMM fragment%s)", str_fragadd);
                    proto_item_append_text(data_tree, " (S7COMM fragment%s)", str_fragadd);
                    offset = 0;
                }
            } else { /* Not fragmented */
                next_tvb = tvb;
            }
            pinfo->fragmented = save_fragmented;
            length_rem = tvb_reported_length_remaining(next_tvb, offset);

            if (last_data_unit == S7COMM_UD_LASTDATAUNIT_YES && length_rem > 0) {
                switch (funcgroup) {
                    case S7COMM_UD_FUNCGROUP_TIS:
                        offset = s7comm_decode_ud_tis_subfunc(next_tvb, data_tree, type, subfunc, offset);
                        break;
                    case S7COMM_UD_FUNCGROUP_CYCLIC:
                        offset = s7comm_decode_ud_cyclic_subfunc(next_tvb, pinfo, seq_num, data_tree, type, subfunc, length_rem, offset);
                        break;
                    case S7COMM_UD_FUNCGROUP_BLOCK:
                        offset = s7comm_decode_ud_block_subfunc(next_tvb, pinfo, data_tree, type, subfunc, ret_val, tsize, length_rem, offset);
                        break;
                    case S7COMM_UD_FUNCGROUP_CPU:
                        switch (subfunc) {
                            case S7COMM_UD_SUBF_CPU_READSZL:
                                offset = s7comm_decode_ud_cpu_szl_subfunc(next_tvb, pinfo, data_tree, type, ret_val, length_rem, offset);
                                break;
                            case S7COMM_UD_SUBF_CPU_NOTIFY_IND:
                            case S7COMM_UD_SUBF_CPU_NOTIFY8_IND:
                            case S7COMM_UD_SUBF_CPU_ALARMSQ_IND:
                            case S7COMM_UD_SUBF_CPU_ALARMS_IND:
                            case S7COMM_UD_SUBF_CPU_SCAN_IND:
                            case S7COMM_UD_SUBF_CPU_ALARMACK:
                            case S7COMM_UD_SUBF_CPU_ALARMACK_IND:
                            case S7COMM_UD_SUBF_CPU_ALARM8_IND:
                            case S7COMM_UD_SUBF_CPU_ALARM8LOCK:
                            case S7COMM_UD_SUBF_CPU_ALARM8LOCK_IND:
                            case S7COMM_UD_SUBF_CPU_ALARM8UNLOCK:
                            case S7COMM_UD_SUBF_CPU_ALARM8UNLOCK_IND:
                                offset = s7comm_decode_ud_cpu_alarm_main(next_tvb, pinfo, data_tree, type, subfunc, offset);
                                break;
                            case S7COMM_UD_SUBF_CPU_ALARMQUERY:
                                if (type == S7COMM_UD_TYPE_RES) {
                                    offset = s7comm_decode_ud_cpu_alarm_query_response(next_tvb, data_tree, offset);
                                } else {
                                    offset = s7comm_decode_ud_cpu_alarm_main(next_tvb, pinfo, data_tree, type, subfunc, offset);
                                }
                                break;
                            case S7COMM_UD_SUBF_CPU_DIAGMSG:
                                offset = s7comm_decode_ud_cpu_diagnostic_message(next_tvb, pinfo, true, data_tree, offset);
                                break;
                            case S7COMM_UD_SUBF_CPU_MSGS:
                                offset = s7comm_decode_message_service(next_tvb, pinfo, data_tree, type, length_rem, offset);
                                break;
                            case S7COMM_UD_SUBF_CPU_AR_SEND_IND:
                                offset = s7comm_decode_ud_cpu_ar_send(next_tvb, data_tree, offset);
                                break;
                            default:
                                /* print other currently unknown data as raw bytes */
                                proto_tree_add_item(data_tree, hf_s7comm_userdata_data, next_tvb, offset, length_rem, ENC_NA);
                                break;
                        }
                        break;
                    case S7COMM_UD_FUNCGROUP_SEC:
                        offset = s7comm_decode_ud_security_subfunc(next_tvb, data_tree, length_rem, offset);
                        break;
                    case S7COMM_UD_FUNCGROUP_PBC_BSEND:
                        offset = s7comm_decode_ud_pbc_bsend_subfunc(next_tvb, data_tree, length_rem, offset, pinfo, root_tree);
                        break;
                    case S7COMM_UD_FUNCGROUP_TIME:
                        offset = s7comm_decode_ud_time_subfunc(next_tvb, data_tree, type, subfunc, ret_val, length_rem, offset);
                        break;
                    case S7COMM_UD_FUNCGROUP_NCPRG:
                        offset = s7comm_decode_ud_ncprg_subfunc(next_tvb, pinfo, data_tree, type, subfunc, length_rem, offset);
                        break;
                    case S7COMM_UD_FUNCGROUP_DRR:
                        offset = s7comm_decode_ud_drr_subfunc(next_tvb, data_tree, length_rem, offset);
                        break;
                    default:
                        break;
                }
            }
        }
    }
    return offset;
}

/*******************************************************************************************************
 *******************************************************************************************************
 *
 * PDU Type: User Data
 *
 *******************************************************************************************************
 *******************************************************************************************************/
static uint32_t
s7comm_decode_ud(tvbuff_t *tvb,
                 packet_info *pinfo,
                 proto_tree *tree,
                 uint16_t plength,
                 uint16_t dlength,
                 uint32_t offset,
                 proto_tree *root_tree)
{
    proto_item *item = NULL;
    proto_tree *param_tree = NULL;

    uint32_t errorcode;
    uint32_t offset_temp;
    uint8_t function;
    uint8_t type;
    uint8_t funcgroup;
    uint8_t subfunc;
    uint8_t mode;
    uint8_t data_unit_ref = 0;
    uint8_t last_data_unit = 0;
    uint8_t seq_num;
    uint32_t r_id;
    uint8_t varspec_syntax_id = 0;

    /* Add parameter tree */
    item = proto_tree_add_item(tree, hf_s7comm_param, tvb, offset, plength, ENC_NA);
    param_tree = proto_item_add_subtree(item, ett_s7comm_param);

    offset_temp = offset;

    function = tvb_get_uint8(tvb, offset_temp);
    proto_tree_add_uint(param_tree, hf_s7comm_param_service, tvb, offset_temp, 1, function);
    offset_temp += 1;

    /* It's like an itemcounter, but only the value of 1 is allowed. */
    proto_tree_add_item(param_tree, hf_s7comm_param_itemcount, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    offset_temp += 1;

    if (function == S7COMM_SERV_MODETRANS) {
        /* Mode transition indication needs a separate handling */
        proto_item_append_text(param_tree, ": ->(Mode transition indication)");
        col_append_str(pinfo->cinfo, COL_INFO, " Function:[Mode transition indication]");
        proto_tree_add_item(param_tree, hf_s7comm_modetrans_param_unknown1, tvb, offset_temp, 4, ENC_BIG_ENDIAN);
        offset_temp += 4;
        mode = tvb_get_uint8(tvb, offset_temp);
        proto_tree_add_uint(param_tree, hf_s7comm_modetrans_param_mode, tvb, offset_temp, 1, mode);
        offset_temp += 1;
        col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
            val_to_str(mode, modetrans_param_mode_names, "Unknown mode: 0x%02x"));
        proto_item_append_text(param_tree, " ->(%s)", val_to_str(mode, modetrans_param_mode_names, "Unknown mode: 0x%02x"));
        proto_tree_add_item(param_tree, hf_s7comm_modetrans_param_unknown2, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
        offset_temp += 1;
        /* No data part here */
        return offset_temp;
    }

    proto_tree_add_item(param_tree, hf_s7comm_item_varspec, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    offset_temp += 1;
    proto_tree_add_item(param_tree, hf_s7comm_item_varspec_length, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    offset_temp += 1;
    varspec_syntax_id = tvb_get_uint8(tvb, offset_temp);
    proto_tree_add_item(param_tree, hf_s7comm_item_syntax_id, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    offset_temp += 1;

    if (varspec_syntax_id == S7COMM_SYNTAXID_PBC_ID) {
        /* When the R_ID occurs here, it's USEND and needs a separate handling */
        proto_item_append_text(param_tree, ": (Indication) ->(USEND)");
        col_append_str(pinfo->cinfo, COL_INFO, " Function:[Indication] -> [USEND]");
        proto_tree_add_item(param_tree, hf_s7comm_pbc_unknown, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
        offset_temp += 1;
        proto_tree_add_item_ret_uint(param_tree, hf_s7comm_pbc_usend_r_id, tvb, offset_temp, 4, ENC_BIG_ENDIAN, &r_id);
        col_append_fstr(pinfo->cinfo, COL_INFO, " R_ID=0x%X", r_id);
        /* USEND data must fit in a single PDU. Fragmentation is not possible and we can dissect the data part here. */
        offset += plength; /* To start of data part */
        offset = s7comm_decode_ud_usend(tvb, tree, dlength, offset);
        /* Return here as all data is decoded */
        return offset;
    }

    /* Left 2 bits for indication/request/response
     * Right 6 bits for the function group
     */
    type = (tvb_get_uint8(tvb, offset_temp) & 0xc0) >> 6;
    funcgroup = (tvb_get_uint8(tvb, offset_temp) & 0x3f);
    proto_tree_add_item(param_tree, hf_s7comm_userdata_param_type, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    proto_tree_add_item(param_tree, hf_s7comm_userdata_param_funcgroup, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    offset_temp += 1;

    col_append_fstr(pinfo->cinfo, COL_INFO, " Function:[%s] -> [%s]",
        val_to_str(type, userdata_type_names, "Unknown type: 0x%02x"),
        val_to_str(funcgroup, userdata_functiongroup_names, "Unknown function group: 0x%02x")
        );
    proto_item_append_text(param_tree, ": (%s)", val_to_str(type, userdata_type_names, "Unknown type: 0x%02x"));
    proto_item_append_text(param_tree, " ->(%s)", val_to_str(funcgroup, userdata_functiongroup_names, "Unknown function group: 0x%02x"));

    /* 1 Byte subfunction */
    subfunc = tvb_get_uint8(tvb, offset_temp);
    switch (funcgroup) {
        case S7COMM_UD_FUNCGROUP_TIS:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_prog, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_tis_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_tis_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_CYCLIC:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_cyclic, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_cyclic_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_cyclic_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_BLOCK:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_block, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_block_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_block_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_CPU:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_cpu, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_cpu_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_cpu_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_SEC:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_sec, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_sec_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_sec_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_TIME:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_time, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_time_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_time_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_DRR:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_drr, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_drr_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_drr_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        case S7COMM_UD_FUNCGROUP_NCPRG:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc_ncprg, tvb, offset_temp, 1, subfunc);
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> [%s]",
                val_to_str(subfunc, userdata_ncprg_subfunc_names, "Unknown subfunc: 0x%02x"));
            proto_item_append_text(param_tree, " ->(%s)", val_to_str(subfunc, userdata_ncprg_subfunc_names, "Unknown subfunc: 0x%02x"));
            break;
        default:
            proto_tree_add_uint(param_tree, hf_s7comm_userdata_param_subfunc, tvb, offset_temp, 1, subfunc);
            break;
    }
    offset_temp += 1;
    /* 1 Byte sequence number */
    seq_num = tvb_get_uint8(tvb, offset_temp);
    proto_tree_add_item(param_tree, hf_s7comm_userdata_param_seq_num, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
    offset_temp += 1;
    if (varspec_syntax_id == S7COMM_SYNTAXID_EXT) {
        /* 1 Byte data unit reference. If packet is fragmented, all packets with this number belong together.
         * But there are function which use a different fragment identification methon.
         */
        data_unit_ref = tvb_get_uint8(tvb, offset_temp);
        proto_tree_add_item(param_tree, hf_s7comm_userdata_param_dataunitref, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
        offset_temp += 1;
        /* 1 Byte fragmented flag, if this is not the last data unit (telegram is fragmented) this is != 0 */
        last_data_unit = tvb_get_uint8(tvb, offset_temp);
        proto_tree_add_item(param_tree, hf_s7comm_userdata_param_dataunit, tvb, offset_temp, 1, ENC_BIG_ENDIAN);
        offset_temp += 1;
        proto_tree_add_item_ret_uint(param_tree, hf_s7comm_param_errcod, tvb, offset_temp, 2, ENC_BIG_ENDIAN, &errorcode);
        if (errorcode > 0) {
            col_append_fstr(pinfo->cinfo, COL_INFO, " -> Errorcode:[0x%04x]", errorcode);
        }
    }
    offset += plength;

    offset = s7comm_decode_ud_data(tvb, pinfo, tree, dlength, type, funcgroup, subfunc, seq_num, data_unit_ref, last_data_unit, offset, root_tree);

    return offset;
}

/*******************************************************************************************************
 *
 * PDU Type: Request or Response
 *
 *******************************************************************************************************/
static uint32_t
s7comm_decode_req_resp(tvbuff_t *tvb,
                       packet_info *pinfo,
                       proto_tree *tree,
                       uint16_t plength,
                       uint16_t dlength,
                       uint32_t offset,
                       uint8_t rosctr)
{
    proto_item *item = NULL;
    proto_tree *param_tree = NULL;
    proto_tree *data_tree = NULL;
    uint8_t function = 0;
    uint8_t item_count = 0;
    uint8_t i;
    uint32_t offset_old;
    uint32_t len;

    if (plength > 0) {
        /* Add parameter tree */
        item = proto_tree_add_item(tree, hf_s7comm_param, tvb, offset, plength, ENC_NA);
        param_tree = proto_item_add_subtree(item, ett_s7comm_param);
        /* Analyze function */
        function = tvb_get_uint8(tvb, offset);
        /* add param.function to info column */
        col_append_fstr(pinfo->cinfo, COL_INFO, " Function:[%s]", val_to_str(function, param_functionnames, "Unknown function: 0x%02x"));
        proto_tree_add_uint(param_tree, hf_s7comm_param_service, tvb, offset, 1, function);
        /* show param.function code at the tree */
        proto_item_append_text(param_tree, ": (%s)", val_to_str(function, param_functionnames, "Unknown function: 0x%02x"));
        offset += 1;

        if (rosctr == S7COMM_ROSCTR_JOB) {
            switch (function){
                case S7COMM_SERV_READVAR:
                case S7COMM_SERV_WRITEVAR:
                    item_count = tvb_get_uint8(tvb, offset);
                    proto_tree_add_uint(param_tree, hf_s7comm_param_itemcount, tvb, offset, 1, item_count);
                    offset += 1;
                    /* parse item data */
                    for (i = 0; i < item_count; i++) {
                        offset_old = offset;
                        offset = s7comm_decode_param_item(tvb, offset, param_tree, i);
                        /* if length is not a multiple of 2 and this is not the last item, then add a fill-byte */
                        len = offset - offset_old;
                        if ((len % 2) && (i < (item_count-1))) {
                            offset += 1;
                        }
                    }
                    /* in write-function there is a data part */
                    if ((function == S7COMM_SERV_WRITEVAR) && (dlength > 0)) {
                        item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
                        data_tree = proto_item_add_subtree(item, ett_s7comm_data);
                        /* Add returned data to data-tree */
                        offset = s7comm_decode_response_read_data(tvb, data_tree, item_count, offset);
                    }
                    break;
                case S7COMM_SERV_SETUPCOMM:
                    offset = s7comm_decode_pdu_setup_communication(tvb, param_tree, offset);
                    break;
                /* Special functions */
                case S7COMM_FUNCREQUESTDOWNLOAD:
                case S7COMM_FUNCDOWNLOADBLOCK:
                case S7COMM_FUNCDOWNLOADENDED:
                case S7COMM_FUNCSTARTUPLOAD:
                case S7COMM_FUNCUPLOAD:
                case S7COMM_FUNCENDUPLOAD:
                    offset = s7comm_decode_plc_controls_updownload(tvb, pinfo, tree, param_tree, plength, dlength, offset -1, rosctr);
                    break;
                case S7COMM_FUNCPISERVICE:
                    offset = s7comm_decode_pi_service(tvb, pinfo, param_tree, plength, offset -1);
                    break;
                case S7COMM_FUNC_PLC_STOP:
                    offset = s7comm_decode_plc_controls_param_hex29(tvb, param_tree, offset -1);
                    break;

                default:
                    /* Print unknown part as raw bytes */
                    if (plength > 1) {
                        proto_tree_add_item(param_tree, hf_s7comm_param_data, tvb, offset, plength - 1, ENC_NA);
                    }
                    offset += plength - 1; /* 1 byte function code */
                    if (dlength > 0) {
                        /* Add data tree
                         * First 2 bytes in data seem to be a length indicator of (dlength -4 ), so next 2 bytes
                         * seem to indicate something else. But I'm not sure, so leave it as it is.....
                         */
                        item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
                        data_tree = proto_item_add_subtree(item, ett_s7comm_data);
                        proto_tree_add_item(data_tree, hf_s7comm_readresponse_data, tvb, offset, dlength, ENC_NA);
                        offset += dlength;
                    }
                    break;
            }
        } else if (rosctr == S7COMM_ROSCTR_ACK_DATA) {
            switch (function){
                case S7COMM_SERV_READVAR:
                case S7COMM_SERV_WRITEVAR:
                    /* This is a read-response, so the requested data may follow when address in request was ok */
                    item_count = tvb_get_uint8(tvb, offset);
                    proto_tree_add_uint(param_tree, hf_s7comm_param_itemcount, tvb, offset, 1, item_count);
                    offset += 1;
                    /* Add data tree */
                    item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
                    data_tree = proto_item_add_subtree(item, ett_s7comm_data);
                    /* Add returned data to data-tree */
                    if ((function == S7COMM_SERV_READVAR) && (dlength > 0)) {
                        offset = s7comm_decode_response_read_data(tvb, data_tree, item_count, offset);
                    } else if ((function == S7COMM_SERV_WRITEVAR) && (dlength > 0)) {
                        offset = s7comm_decode_response_write_data(tvb, data_tree, item_count, offset);
                    }
                    break;
                case S7COMM_SERV_SETUPCOMM:
                    offset = s7comm_decode_pdu_setup_communication(tvb, param_tree, offset);
                    break;
                case S7COMM_FUNCREQUESTDOWNLOAD:
                case S7COMM_FUNCDOWNLOADBLOCK:
                case S7COMM_FUNCDOWNLOADENDED:
                case S7COMM_FUNCSTARTUPLOAD:
                case S7COMM_FUNCUPLOAD:
                case S7COMM_FUNCENDUPLOAD:
                    offset = s7comm_decode_plc_controls_updownload(tvb, pinfo, tree, param_tree, plength, dlength, offset -1, rosctr);
                    break;
                case S7COMM_FUNCPISERVICE:
                    if (plength >= 2) {
                        proto_tree_add_bitmask(param_tree, tvb, offset, hf_s7comm_data_blockcontrol_functionstatus,
                            ett_s7comm_data_blockcontrol_status, s7comm_data_blockcontrol_status_fields, ENC_BIG_ENDIAN);
                        offset += 1;
                    }
                    break;
                default:
                    /* Print unknown part as raw bytes */
                    if (plength > 1) {
                        proto_tree_add_item(param_tree, hf_s7comm_param_data, tvb, offset, plength - 1, ENC_NA);
                    }
                    offset += plength - 1; /* 1 byte function code */
                    if (dlength > 0) {
                        /* Add data tree
                         * First 2 bytes in data seem to be a length indicator of (dlength -4 ), so next 2 bytes
                         * seem to indicate something else. But I'm not sure, so leave it as it is.....
                         */
                        item = proto_tree_add_item(tree, hf_s7comm_data, tvb, offset, dlength, ENC_NA);
                        data_tree = proto_item_add_subtree(item, ett_s7comm_data);
                        proto_tree_add_item(data_tree, hf_s7comm_readresponse_data, tvb, offset, dlength, ENC_NA);
                        offset += dlength;
                    }
                    break;
            }
        }
    }
    return offset;
}

/*******************************************************************************************************
 *******************************************************************************************************
 *
 * S7-Protocol (main tree)
 *
 *******************************************************************************************************
 *******************************************************************************************************/
static bool
dissect_s7comm(tvbuff_t *tvb,
               packet_info *pinfo,
               proto_tree *tree,
               void *data _U_)
{
    proto_item *s7comm_item = NULL;
    proto_item *s7comm_sub_item = NULL;
    proto_tree *s7comm_tree = NULL;
    proto_tree *s7comm_header_tree = NULL;

    uint32_t offset = 0;

    uint8_t rosctr = 0;
    uint8_t hlength = 10;                /* Header 10 Bytes, when type 2 or 3 (Response) -> 12 Bytes */
    uint16_t plength = 0;
    uint16_t dlength = 0;
    uint16_t errorcode = 0;

    /*----------------- Heuristic Checks - Begin */
    /* 1) check for minimum length */
    if(tvb_captured_length(tvb) < S7COMM_MIN_TELEGRAM_LENGTH)
        return false;
    /* 2) first byte must be 0x32 */
    if (tvb_get_uint8(tvb, 0) != S7COMM_PROT_ID)
        return false;
    /* 3) second byte is a type field and only can contain values between 0x01-0x07 (1/2/3/7) */
    if (tvb_get_uint8(tvb, 1) < 0x01 || tvb_get_uint8(tvb, 1) > 0x07)
        return false;
    /*----------------- Heuristic Checks - End */

    col_set_str(pinfo->cinfo, COL_PROTOCOL, PROTO_TAG_S7COMM);
    col_clear(pinfo->cinfo, COL_INFO);
    col_append_sep_str(pinfo->cinfo, COL_INFO, " | ", "");

    rosctr = tvb_get_uint8(tvb, 1);                            /* Get the type byte */
    if (rosctr == 2 || rosctr == 3) hlength = 12;               /* Header 10 Bytes, when type 2 or 3 (response) -> 12 Bytes */

    /* display some infos in info-column of wireshark */
    col_append_fstr(pinfo->cinfo, COL_INFO, "ROSCTR:[%-8s]", val_to_str(rosctr, rosctr_names, "Unknown: 0x%02x"));

    s7comm_item = proto_tree_add_item(tree, proto_s7comm, tvb, 0, -1, ENC_NA);
    s7comm_tree = proto_item_add_subtree(s7comm_item, ett_s7comm);

    /* insert header tree */
    s7comm_sub_item = proto_tree_add_item(s7comm_tree, hf_s7comm_header,
                      tvb, offset, hlength, ENC_NA);

    /* insert sub-items in header tree */
    s7comm_header_tree = proto_item_add_subtree(s7comm_sub_item, ett_s7comm_header);

    /* Protocol Identifier, constant 0x32 */
    proto_tree_add_item(s7comm_header_tree, hf_s7comm_header_protid, tvb, offset, 1, ENC_BIG_ENDIAN);
    offset += 1;

    /* ROSCTR (Remote Operating Service Control) - PDU Type */
    proto_tree_add_uint(s7comm_header_tree, hf_s7comm_header_rosctr, tvb, offset, 1, rosctr);
    /* Show pdu type beside the header tree */
    proto_item_append_text(s7comm_header_tree, ": (%s)", val_to_str(rosctr, rosctr_names, "Unknown ROSCTR: 0x%02x"));
    offset += 1;
    /* Redundancy ID, reserved */
    proto_tree_add_item(s7comm_header_tree, hf_s7comm_header_redid, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    /* Protocol Data Unit Reference */
    proto_tree_add_item(s7comm_header_tree, hf_s7comm_header_pduref, tvb, offset, 2, ENC_BIG_ENDIAN);
    offset += 2;
    /* Parameter length */
    plength = tvb_get_ntohs(tvb, offset);
    proto_tree_add_uint(s7comm_header_tree, hf_s7comm_header_parlg, tvb, offset, 2, plength);
    offset += 2;
    /* Data length */
    dlength = tvb_get_ntohs(tvb, offset);
    proto_tree_add_uint(s7comm_header_tree, hf_s7comm_header_datlg, tvb, offset, 2, dlength);
    offset += 2;
    /* when type is 2 or 3 there are 2 bytes with errorclass and errorcode */
    if (hlength == 12) {
        errorcode = tvb_get_ntohs(tvb, offset);     /* this uses the same errorcodes (combined) from parameter part */
        proto_tree_add_item(s7comm_header_tree, hf_s7comm_header_errcls, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        proto_tree_add_item(s7comm_header_tree, hf_s7comm_header_errcod, tvb, offset, 1, ENC_BIG_ENDIAN);
        offset += 1;
        /* when there is an error, use the errorcode from parameterpart*/
        if (errorcode > 0) {
            s7comm_item = proto_tree_add_item(s7comm_header_tree, hf_s7comm_param_errcod, tvb, offset-2, 2, ENC_BIG_ENDIAN);
            proto_item_set_generated (s7comm_item);
        }
    }

    switch (rosctr) {
        case S7COMM_ROSCTR_JOB:
        case S7COMM_ROSCTR_ACK_DATA:
            s7comm_decode_req_resp(tvb, pinfo, s7comm_tree, plength, dlength, offset, rosctr);
            break;
        case S7COMM_ROSCTR_USERDATA:
            s7comm_decode_ud(tvb, pinfo, s7comm_tree, plength, dlength, offset, tree);
            break;
    }
    /* Add the errorcode from header as last entry in info column */
    if (errorcode > 0) {
        col_append_fstr(pinfo->cinfo, COL_INFO, " -> Errorcode:[0x%04x]", errorcode);
    }
    /* set fence as there may be more than one S7comm PDU in one frame */
    col_set_fence(pinfo->cinfo, COL_INFO);
    return true;
}

/*******************************************************************************************************
 * Reassembly of S7COMM
 *******************************************************************************************************/
static void
s7comm_defragment_init(void)
{
    reassembly_table_init(&s7comm_reassembly_table,
                          &addresses_ports_reassembly_table_functions);
}

/*******************************************************************************************************
 *******************************************************************************************************/
void
proto_register_s7comm (void)
{
    expert_module_t* expert_s7comm;

    /* format:
     * {&(field id), {name, abbrev, type, display, strings, bitmask, blurb, HFILL}}.
     */
    static hf_register_info hf[] = {
        { &hf_s7comm_header,
        { "Header", "s7comm.header", FT_NONE, BASE_NONE, NULL, 0x0,
          "This is the header of S7 communication", HFILL }},
        { &hf_s7comm_header_protid,
        { "Protocol Id", "s7comm.header.protid", FT_UINT8, BASE_HEX, NULL, 0x0,
          "Protocol Identification, 0x32 for S7", HFILL }},
        { &hf_s7comm_header_rosctr,
        { "ROSCTR", "s7comm.header.rosctr", FT_UINT8, BASE_DEC, VALS(rosctr_names), 0x0,
          "Remote Operating Service Control", HFILL }},
        { &hf_s7comm_header_redid,
        { "Redundancy Identification (Reserved)", "s7comm.header.redid", FT_UINT16, BASE_HEX, NULL, 0x0,
          "Redundancy Identification (Reserved), should be always 0x0000", HFILL }},
        { &hf_s7comm_header_pduref,
        { "Protocol Data Unit Reference", "s7comm.header.pduref", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_header_parlg,
        { "Parameter length", "s7comm.header.parlg", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Specifies the entire length of the parameter block in bytes", HFILL }},
        { &hf_s7comm_header_datlg,
        { "Data length", "s7comm.header.datlg", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Specifies the entire length of the data block in bytes", HFILL }},
        { &hf_s7comm_header_errcls,
        { "Error class", "s7comm.header.errcls", FT_UINT8, BASE_HEX, VALS(errcls_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_header_errcod,
        { "Error code", "s7comm.header.errcod", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_param,
        { "Parameter", "s7comm.param", FT_NONE, BASE_NONE, NULL, 0x0,
          "This is the parameter part of S7 communication", HFILL }},
        { &hf_s7comm_param_errcod,
        { "Error code", "s7comm.param.errcod", FT_UINT16, BASE_HEX | BASE_EXT_STRING, &param_errcode_names_ext, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_param_service,
        { "Function", "s7comm.param.func", FT_UINT8, BASE_HEX, VALS(param_functionnames), 0x0,
          "Indicates the function of parameter/data", HFILL }},
        { &hf_s7comm_param_maxamq_calling,
        { "Max AmQ (parallel jobs with ack) calling", "s7comm.param.maxamq_calling", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_param_maxamq_called,
        { "Max AmQ (parallel jobs with ack) called", "s7comm.param.maxamq_called", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_param_setup_reserved1,
        { "Reserved", "s7comm.param.setup_reserved1", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_param_neg_pdu_length,
        { "PDU length", "s7comm.param.pdu_length", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Negotiated PDU length", HFILL }},
        { &hf_s7comm_param_itemcount,
        { "Item count", "s7comm.param.itemcount", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Number of Items in parameter/data part", HFILL }},
        { &hf_s7comm_param_data,
        { "Parameter data", "s7comm.param.data", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_param_item,
        { "Item", "s7comm.param.item", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_param_subitem,
        { "Subitem", "s7comm.param.subitem", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_varspec,
        { "Variable specification", "s7comm.param.item.varspec", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_varspec_length,
        { "Length of following address specification", "s7comm.param.item.varspec_length", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_syntax_id,
        { "Syntax Id", "s7comm.param.item.syntaxid", FT_UINT8, BASE_HEX, VALS(item_syntaxid_names), 0x0,
          "Syntax Id, format type of following address specification", HFILL }},
        { &hf_s7comm_item_transport_size,
        { "Transport size", "s7comm.param.item.transp_size", FT_UINT8, BASE_DEC, VALS(item_transportsizenames), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_length,
        { "Length", "s7comm.param.item.length", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_db,
        { "DB number", "s7comm.param.item.db", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_area,
        { "Area", "s7comm.param.item.area", FT_UINT8, BASE_HEX, VALS(item_areanames), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_address,
        { "Address", "s7comm.param.item.address", FT_UINT24, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_address_byte,
        { "Byte Address", "s7comm.param.item.address.byte", FT_UINT24, BASE_DEC, NULL, 0x07fff8,
          NULL, HFILL }},
        { &hf_s7comm_item_address_bit,
        { "Bit Address", "s7comm.param.item.address.bit", FT_UINT24, BASE_DEC, NULL, 0x000007,
          NULL, HFILL }},
        { &hf_s7comm_item_address_nr,
        { "Number (T/C/BLOCK)", "s7comm.param.item.address.number", FT_UINT24, BASE_DEC, NULL, 0x00ffff,
          NULL, HFILL }},
        /* Special variable read with Syntax-Id 0xb0 (DBREAD) */
        { &hf_s7comm_item_dbread_numareas,
        { "Number of areas", "s7comm.param.item.dbread.numareas", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Number of area specifications following", HFILL }},
        { &hf_s7comm_item_dbread_length,
        { "Bytes to read", "s7comm.param.item.dbread.length", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Number of bytes to read", HFILL }},
        { &hf_s7comm_item_dbread_db,
        { "DB number", "s7comm.param.item.dbread.db", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_dbread_startadr,
        { "Start address", "s7comm.param.item.dbread.startaddress", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        /* Reading frequency inverter parameters via routing */
        { &hf_s7comm_item_driveesany_unknown1,
        { "DriveES Unknown 1", "s7comm.param.item.driveesany.unknown1", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_driveesany_unknown2,
        { "DriveES Unknown 2", "s7comm.param.item.driveesany.unknown2", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_driveesany_unknown3,
        { "DriveES Unknown 3", "s7comm.param.item.driveesany.unknown3", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_driveesany_parameter_nr,
        { "DriveES Parameter number", "s7comm.param.item.driveesany.parameternr", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_driveesany_parameter_idx,
        { "DriveES Parameter index", "s7comm.param.item.driveesany.parameteridx", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        /* NCK access with Syntax-Id 0x82 */
        { &hf_s7comm_item_nck_areaunit,
        { "NCK Area/Unit", "s7comm.param.item.nck.area_unit", FT_UINT8, BASE_HEX, NULL, 0x0,
          "NCK Area/Unit: Bitmask aaauuuuu: a=area, u=unit", HFILL }},
        { &hf_s7comm_item_nck_area,
        { "NCK Area", "s7comm.param.item.nck.area", FT_UINT8, BASE_DEC, VALS(nck_area_names), 0xe0,
          NULL, HFILL }},
        { &hf_s7comm_item_nck_unit,
        { "NCK Unit", "s7comm.param.item.nck.unit", FT_UINT8, BASE_DEC, NULL, 0x1f,
          NULL, HFILL }},
        { &hf_s7comm_item_nck_column,
        { "NCK Column number", "s7comm.param.item.nck.column", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_nck_line,
        { "NCK Line number", "s7comm.param.item.nck.line", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_nck_module,
        { "NCK Module", "s7comm.param.item.nck.module", FT_UINT8, BASE_HEX | BASE_EXT_STRING, &nck_module_names_ext, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_item_nck_linecount,
        { "NCK Linecount", "s7comm.param.item.nck.linecount", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_data,
        { "Data", "s7comm.data", FT_NONE, BASE_NONE, NULL, 0x0,
          "This is the data part of S7 communication", HFILL }},
        { &hf_s7comm_data_returncode,
        { "Return code", "s7comm.data.returncode", FT_UINT8, BASE_HEX, VALS(s7comm_item_return_valuenames), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_transport_size,
        { "Transport size", "s7comm.data.transportsize", FT_UINT8, BASE_HEX, VALS(data_transportsizenames), 0x0,
          "Data type / Transport size. If 3, 4 or 5 the following length gives the number of bits, otherwise the number of bytes.", HFILL }},
        { &hf_s7comm_data_length,
        { "Length", "s7comm.data.length", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Length of data", HFILL }},

        { &hf_s7comm_data_item,
        { "Item", "s7comm.data.item", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_readresponse_data,
        { "Data", "s7comm.resp.data", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_fillbyte,
        { "Fill byte", "s7comm.data.fillbyte", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_userdata_data,
        { "Data", "s7comm.data.userdata", FT_BYTES, BASE_NONE, NULL, 0x0,
          "Userdata data", HFILL }},

        /* Userdata parameter 8/12 Bytes len*/
        { &hf_s7comm_userdata_param_type,
        { "Type", "s7comm.param.userdata.type", FT_UINT8, BASE_DEC, VALS(userdata_type_names), 0xc0,
          "Type of parameter", HFILL }},
        { &hf_s7comm_userdata_param_funcgroup,
        { "Function group", "s7comm.param.userdata.funcgroup", FT_UINT8, BASE_DEC, VALS(userdata_functiongroup_names), 0x3f,
          NULL, HFILL }},

        { &hf_s7comm_userdata_param_subfunc_prog,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_tis_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_cyclic,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_cyclic_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_block,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_block_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_cpu,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_cpu_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_sec,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_sec_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_time,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_time_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_ncprg,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_ncprg_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_userdata_param_subfunc_drr,
        { "Subfunction", "s7comm.param.userdata.subfunc", FT_UINT8, BASE_DEC, VALS(userdata_drr_subfunc_names), 0x0,
          NULL, HFILL }},

        { &hf_s7comm_userdata_param_seq_num,
        { "Sequence number", "s7comm.param.userdata.seq_num", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_userdata_param_dataunitref,
        { "Data unit reference number", "s7comm.param.userdata.dataunitref", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Data unit reference number if PDU is fragmented", HFILL }},

        { &hf_s7comm_userdata_param_dataunit,
        { "Last data unit", "s7comm.param.userdata.lastdataunit", FT_UINT8, BASE_HEX, VALS(userdata_lastdataunit_names), 0x0,
          NULL, HFILL }},

        /* block functions / info */
        { &hf_s7comm_ud_blockinfo_block_type,
        { "Block type", "s7comm.blockinfo.blocktype", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_block_cnt,
        { "Block count", "s7comm.blockinfo.block_count", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_block_num,
        { "Block number", "s7comm.blockinfo.block_num", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_block_flags,
        { "Block flags (unknown)", "s7comm.blockinfo.flags", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_block_lang,
        { "Block language", "s7comm.blockinfo.block_lang", FT_UINT8, BASE_DEC, VALS(blocklanguage_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_block_num_ascii,
        { "Block number", "s7comm.data.blockinfo.block_number", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_filesys,
        { "Filesystem", "s7comm.data.blockinfo.filesys", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_res_infolength,
        { "Length of Info", "s7comm.blockinfo.res_infolength", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Length of Info in bytes", HFILL }},
        { &hf_s7comm_ud_blockinfo_res_unknown2,
        { "Unknown blockinfo 2", "s7comm.blockinfo.res_unknown2", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_res_const3,
        { "Constant 3", "s7comm.blockinfo.res_const3", FT_STRING, BASE_NONE, NULL, 0x0,
          "Possible constant 3, seems to be always 'pp'", HFILL }},
        { &hf_s7comm_ud_blockinfo_res_unknown,
        { "Unknown byte(s) blockinfo", "s7comm.blockinfo.res_unknown", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_subblk_type,
        { "Subblk type", "s7comm.blockinfo.subblk_type", FT_UINT8, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_load_mem_len,
        { "Length load memory", "s7comm.blockinfo.load_mem_len", FT_UINT32, BASE_DEC, NULL, 0x0,
          "Length of load memory in bytes", HFILL }},
        { &hf_s7comm_ud_blockinfo_blocksecurity,
        { "Block Security", "s7comm.blockinfo.blocksecurity", FT_UINT32, BASE_DEC, VALS(blocksecurity_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_interface_timestamp,
        { "Interface timestamp", "s7comm.blockinfo.interface_timestamp", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_code_timestamp,
        { "Code timestamp", "s7comm.blockinfo.code_timestamp", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_ssb_len,
        { "SSB length", "s7comm.blockinfo.ssb_len", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_add_len,
        { "ADD length", "s7comm.blockinfo.add_len", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_localdata_len,
        { "Localdata length", "s7comm.blockinfo.localdata_len", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Length of localdata in bytes", HFILL }},
        { &hf_s7comm_ud_blockinfo_mc7_len,
        { "MC7 code length", "s7comm.blockinfo.mc7_len", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Length of MC7 code in bytes", HFILL }},
        { &hf_s7comm_ud_blockinfo_author,
        { "Author", "s7comm.blockinfo.author", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_family,
        { "Family", "s7comm.blockinfo.family", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_headername,
        { "Name (Header)", "s7comm.blockinfo.headername", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_headerversion,
        { "Version (Header)", "s7comm.blockinfo.headerversion", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_checksum,
        { "Block checksum", "s7comm.blockinfo.checksum", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_reserved1,
        { "Reserved 1", "s7comm.blockinfo.reserved1", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ud_blockinfo_reserved2,
        { "Reserved 2", "s7comm.blockinfo.reserved2", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},

        /* Flags in blockinfo response */
        { &hf_s7comm_userdata_blockinfo_flags,
        { "Block flags", "s7comm.param.userdata.blockinfo.flags", FT_UINT8, BASE_HEX, NULL, 0xff,
          "Some block configuration flags", HFILL }},
         /* Bit : 0 -> DB Linked = true */
        { &hf_s7comm_userdata_blockinfo_linked,
        { "Linked", "s7comm.param.userdata.blockinfo.linked", FT_BOOLEAN, 8, TFS(&tfs_yes_no), 0x01,
          NULL, HFILL }},
        /* Bit : 1 -> Standard block = true */
        { &hf_s7comm_userdata_blockinfo_standard_block,
        { "Standard block", "s7comm.param.userdata.blockinfo.standard_block", FT_BOOLEAN, 8, TFS(&tfs_yes_no), 0x02,
          NULL, HFILL }},
        /* Bit : 5 -> DB Non Retain = true */
        { &hf_s7comm_userdata_blockinfo_nonretain,
        { "Non Retain", "s7comm.param.userdata.blockinfo.nonretain", FT_BOOLEAN, 8, TFS(&tfs_yes_no), 0x08,
          NULL, HFILL }},

        /* Programmer commands / Test and installation (TIS) functions */
        { &hf_s7comm_tis_parameter,
        { "TIS Parameter", "s7comm.tis.parameter", FT_NONE, BASE_NONE, NULL, 0x0,
          "TIS Test and Installation: Parameter", HFILL }},
        { &hf_s7comm_tis_data,
        { "TIS Data", "s7comm.cpu.tis.data", FT_NONE, BASE_NONE, NULL, 0x0,
          "TIS Test and Installation: Data", HFILL }},
        { &hf_s7comm_tis_parametersize,
        { "TIS Parameter size", "s7comm.tis.parametersize", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_datasize,
        { "TIS Data size", "s7comm.tis.datasize", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param1,
        { "TIS Parameter 1", "s7comm.tis.param1", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param2,
        { "TIS Parameter 2 - Trigger type", "s7comm.tis.param2", FT_UINT16, BASE_DEC, VALS(tis_param2_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param3,
        { "TIS Parameter 3 - Trigger frequency", "s7comm.tis.param3", FT_UINT16, BASE_DEC, VALS(tis_param3_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_answersize,
        { "TIS Parameter 4 - Answer size", "s7comm.tis.answersize", FT_UINT16, BASE_DEC, NULL, 0x0,
          "TIS Answer size: Expected data size of PLC answer to this job", HFILL }},
        { &hf_s7comm_tis_param5,
        { "TIS Parameter 5", "s7comm.tis.param5", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param6,
        { "TIS Parameter 6", "s7comm.tis.param6", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param7,
        { "TIS Parameter 7", "s7comm.tis.param7", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param8,
        { "TIS Parameter 8", "s7comm.tis.param8", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_param9,
        { "TIS Parameter 9", "s7comm.tis.param9", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_trgevent,
        { "TIS Parameter 10 - Trigger event", "s7comm.varstat.trgevent", FT_UINT16, BASE_HEX, VALS(userdata_varstat_trgevent_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_res_param1,
        { "TIS Response Parameter 1", "s7comm.tis.res.param1", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_res_param2,
        { "TIS Response Parameter 2", "s7comm.tis.res.param2", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_job_function,
        { "Job function", "s7comm.tis.job.function", FT_UINT8, BASE_DEC, VALS(userdata_tis_subfunc_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_job_seqnr,
        { "Job reference sequence number", "s7comm.tis.job.response_seq_num", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Job reference sequence number (find function setup with s7comm.param.userdata.seq_num)", HFILL }},
        { &hf_s7comm_tis_job_reserved,
        { "Job Reserved / Unknown", "s7comm.tis.job.reserved", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_interrupted_blocktype,
        { "Interrupted block type", "s7comm.tis.interrupted.blocktype", FT_UINT16, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_interrupted_blocknr,
        { "Interrupted block number", "s7comm.tis.interrupted.blocknumber", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_interrupted_address,
        { "Interrupted code address", "s7comm.tis.interrupted.address", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_interrupted_prioclass,
        { "Interrupted priority class", "s7comm.tis.interrupted.priorityclass", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_continued_blocktype,
        { "Continued block type", "s7comm.tis.continued.blocktype", FT_UINT16, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_continued_blocknr,
        { "Continued block number", "s7comm.tis.continued.blocknumber", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_continued_address,
        { "Continued code address", "s7comm.tis.continued.address", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_breakpoint_blocktype,
        { "Breakpoint block type", "s7comm.tis.breakpoint.blocktype", FT_UINT16, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_breakpoint_blocknr,
        { "Breakpoint block number", "s7comm.tis.breakpoint.blocknumber", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_breakpoint_address,
        { "Breakpoint code address", "s7comm.tis.breakpoint.address", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_breakpoint_reserved,
        { "Breakpoint Reserved / Unknown", "s7comm.tis.breakpoint.reserved", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_tis_p_callenv,
        { "Call environment setup", "s7comm.tis.callenv_setup", FT_UINT16, BASE_DEC, VALS(tis_p_callenv_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_p_callcond,
        { "Call condition", "s7comm.tis.callenv_cond", FT_UINT16, BASE_DEC, VALS(tis_p_callcond_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_p_callcond_blocktype,
        { "Call condition block type", "s7comm.tis.callenv_cond_blocktype", FT_UINT16, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_p_callcond_blocknr,
        { "Call condition block number", "s7comm.tis.callenv_cond_blocknumber", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_p_callcond_address,
        { "Call condition code address", "s7comm.tis.callenv_cond_blockaddress", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_tis_register_db1_type,
        { "Register DB1 content type", "s7comm.tis.db1.type", FT_UINT8, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_db2_type,
        { "Register DB2 content type", "s7comm.tis.db2.type", FT_UINT8, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_db1_nr,
        { "Register DB1 block number", "s7comm.tis.db1.number", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_db2_nr,
        { "Register DB2 block number", "s7comm.tis.db2.number", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_accu1,
        { "Register ACCU1", "s7comm.tis.accu1", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_accu2,
        { "Register ACCU2", "s7comm.tis.accu2", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_accu3,
        { "Register ACCU3", "s7comm.tis.accu3", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_accu4,
        { "Register ACCU4", "s7comm.tis.accu4", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_ar1,
        { "Register AR1", "s7comm.tis.ar1", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_ar2,
        { "Register AR2", "s7comm.tis.ar2", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_register_stw,
        { "Register STW", "s7comm.tis.stw", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_exithold_until,
        { "Exit HOLD state until", "s7comm.tis.exithold_until", FT_UINT8, BASE_DEC, VALS(tis_exithold_until_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_exithold_res1 ,
        { "Exit HOLD Reserved / Unknown", "s7comm.tis.exithold_res1", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_bstack_nest_depth,
        { "BSTACK nesting depth", "s7comm.tis.bstack.neting_depth", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_bstack_reserved,
        { "BSTACK Reserved / Unknown", "s7comm.tis.bstack.reserved", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_istack_reserved,
        { "ISTACK Reserved / Unknown", "s7comm.tis.istack.reserved", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_lstack_reserved,
        { "LSTACK Reserved / Unknown", "s7comm.tis.lstack.reserved", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_lstack_size,
        { "Localdata stack size", "s7comm.tis.lstack.size", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_lstack_data,
        { "Localdata stack data", "s7comm.tis.lstack.data", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_blockstat_flagsunknown,
        { "Blockstat flags", "s7comm.tis.blockstat.flagsunknown", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_blockstat_number_of_lines,
        { "Number of lines", "s7comm.tis.blockstat.number_of_lines", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_blockstat_line_address,
        { "Address", "s7comm.tis.blockstat.line_address", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_blockstat_data,
        { "Blockstatus data", "s7comm.tis.blockstat.data", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tis_blockstat_reserved,
        { "Blockstatus Reserved / Unknown", "s7comm.tis.blockstat.reserved", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        /* Organization block local data */
        { &hf_s7comm_ob_ev_class,
        { "OB Event class", "s7comm.ob.ev_class", FT_UINT8, BASE_HEX, NULL, 0x0,
          "OB Event class (Bits 0-3 = 1 (Coming event), Bits 4-7 = 1 (Event class 1))", HFILL }},
        { &hf_s7comm_ob_scan_1,
        { "OB Scan 1", "s7comm.ob.scan_1", FT_UINT8, BASE_HEX, NULL, 0x0,
          "OB Scan 1 (1=Cold restart scan 1 of OB 1), (3=Scan 2-n of OB 1)", HFILL }},
        { &hf_s7comm_ob_strt_inf,
        { "OB Start info", "s7comm.ob.strt_info", FT_UINT8, BASE_HEX, NULL, 0x0,
          "OB Start info (OB n has started)", HFILL }},
        { &hf_s7comm_ob_flt_id,
        { "OB Fault identification code", "s7comm.ob.flt_id", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_priority,
        { "OB Priority", "s7comm.ob.priority", FT_UINT8, BASE_DEC, NULL, 0x0,
          "OB Priority (1 is lowest)", HFILL }},
        { &hf_s7comm_ob_number,
        { "OB Number", "s7comm.ob.number", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_reserved_1,
        { "OB Reserved 1", "s7comm.ob.reserved_1", FT_UINT8, BASE_HEX, NULL, 0x0,
          "OB Reserved 1 (Reserved for System)", HFILL }},
        { &hf_s7comm_ob_reserved_2,
        { "OB Reserved 2", "s7comm.ob.reserved_2", FT_UINT8, BASE_HEX, NULL, 0x0,
          "OB Reserved 2 (Reserved for System)", HFILL }},
        { &hf_s7comm_ob_reserved_3,
        { "OB Reserved 3", "s7comm.ob.reserved_3", FT_UINT16, BASE_HEX, NULL, 0x0,
          "OB Reserved 3 (Reserved for System)", HFILL }},
        { &hf_s7comm_ob_reserved_4,
        { "OB Reserved 4", "s7comm.ob.reserved_4", FT_UINT16, BASE_HEX, NULL, 0x0,
          "OB Reserved 4 (Reserved for System)", HFILL }},
        { &hf_s7comm_ob_reserved_4_dw,
        { "OB Reserved 4", "s7comm.ob.reserved_4_dw", FT_UINT32, BASE_HEX, NULL, 0x0,
          "OB Reserved 4 (Reserved for System)", HFILL }},
        { &hf_s7comm_ob_prev_cycle,
        { "OB Cycle time of previous OB scan (ms)", "s7comm.ob.prev_cycle", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_min_cycle,
        { "OB Minimum cycle time of OB (ms)", "s7comm.ob.min_cycle", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_max_cycle,
        { "OB Maximum cycle time of OB (ms)", "s7comm.ob.max_cycle", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_period_exe,
        { "OB Period of execution", "s7comm.ob.period_exe", FT_UINT16, BASE_HEX, NULL, 0x0,
          "OB Period of execution (once, per minute/hour/day/week/month/year)", HFILL }},
        { &hf_s7comm_ob_sign,
        { "OB Identifier input (SIGN) attached to SRT_DINT", "s7comm.ob.sign", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_dtime,
        { "OB Delay time (DTIME) input to SRT_DINT instruction", "s7comm.ob.dtime", FT_UINT32, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_phase_offset,
        { "OB Phase offset (ms)", "s7comm.ob.phase_offset", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_exec_freq,
        { "OB Frequency of execution (ms)", "s7comm.ob.exec_freq", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_io_flag,
        { "OB IO flags", "s7comm.ob.io_flag", FT_UINT16, BASE_DEC, NULL, 0x0,
          "OB IO flags (0x54=input module, 0x55=output module)", HFILL }},
        { &hf_s7comm_ob_mdl_addr,
        { "OB Base address of module initiating interrupt", "s7comm.ob.mdl_addr", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_point_addr,
        { "OB Address of interrupt point on module", "s7comm.ob.point_addr", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_inf_len,
        { "OB Length of information", "s7comm.ob.inf_len", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_alarm_type,
        { "OB Type of alarm", "s7comm.ob.alarm_type", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_alarm_slot,
        { "OB Slot", "s7comm.ob.alarm_slot", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_alarm_spec,
        { "OB Specifier", "s7comm.ob.alarm_spec", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_error_info,
        { "OB Error information on event", "s7comm.ob.error_info", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_err_ev_class,
        { "OB Class of event causing error", "s7comm.ob.err_ev_class", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_err_ev_num,
        { "OB Number of event causing error", "s7comm.ob.err_ev_num", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_err_ob_priority,
        { "OB Priority of OB causing error", "s7comm.ob.err_ob_priority", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_err_ob_num,
        { "OB Number of OB causing error", "s7comm.ob.err_ob_num", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_rack_cpu,
        { "OB Rack / CPU number", "s7comm.ob.rack_cpu", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_8x_fault_flags,
        { "OB 8x Fault flags", "s7comm.ob.8x_fault_flags", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_mdl_type_b,
        { "OB Type of module", "s7comm.ob.mdl_type_b", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_mdl_type_w,
        { "OB Module type with point fault", "s7comm.ob.mdl_type_w", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_rack_num,
        { "OB Number of rack that has module with point fault", "s7comm.ob.rack_num", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_racks_flt,
        { "OB Racks in fault", "s7comm.ob.racks_flt", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_strtup,
        { "OB Method of startup", "s7comm.ob.strtup", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_stop,
        { "OB Event that caused CPU to stop", "s7comm.ob.stop", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_strt_info,
        { "OB Information on how system started", "s7comm.ob.strt_info", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_sw_flt,
        { "OB Software programming fault", "s7comm.ob.sw_flt", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_blk_type,
        { "OB Type of block fault occurred in", "s7comm.ob.blk_type", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_flt_reg,
        { "OB Specific register that caused fault", "s7comm.ob.flt_reg", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_flt_blk_num,
        { "OB Number of block that programming fault occurred in", "s7comm.ob.flt_blk_num", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_prg_addr,
        { "OB Address in block where programming fault occurred", "s7comm.ob.prg_addr", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_mem_area,
        { "OB Memory area where access error occurred", "s7comm.ob.mem_area", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_ob_mem_addr,
        { "OB Memory address where access error occurred", "s7comm.ob.mem_addr", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_diagdata_req_block_type,
        { "Block type", "s7comm.diagdata.req.blocktype", FT_UINT16, BASE_DEC, VALS(subblktype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_diagdata_req_block_num,
        { "Block number", "s7comm.diagdata.req.blocknumber", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_diagdata_req_startaddr_awl,
        { "Start address AWL", "s7comm.diagdata.req.startaddr_awl", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_diagdata_req_saz,
        { "Step address counter (SAZ)", "s7comm.diagdata.req.saz", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

         /* Flags for requested registers in diagnostic data telegrams */
        { &hf_s7comm_diagdata_registerflag,
        { "Registers", "s7comm.diagdata.register", FT_UINT8, BASE_HEX, NULL, 0x00,
          "Requested registers", HFILL }},
        { &hf_s7comm_diagdata_registerflag_stw,
        { "STW", "s7comm.diagdata.register.stw", FT_BOOLEAN, 8, NULL, 0x01,
          "STW / Status word", HFILL }},
        { &hf_s7comm_diagdata_registerflag_accu1,
        { "ACCU1", "s7comm.diagdata.register.accu1", FT_BOOLEAN, 8, NULL, 0x02,
          "ACCU1 / Accumulator 1", HFILL }},
        { &hf_s7comm_diagdata_registerflag_accu2,
        { "ACCU2", "s7comm.diagdata.register.accu2", FT_BOOLEAN, 8, NULL, 0x04,
          "ACCU2 / Accumulator 2", HFILL }},
        { &hf_s7comm_diagdata_registerflag_ar1,
        { "AR1", "s7comm.diagdata.register.ar1", FT_BOOLEAN, 8, NULL, 0x08,
          "AR1 / Addressregister 1", HFILL }},
        { &hf_s7comm_diagdata_registerflag_ar2,
        { "AR2", "s7comm.diagdata.register.ar2", FT_BOOLEAN, 8, NULL, 0x10,
          "AR2 / Addressregister 2", HFILL }},
        { &hf_s7comm_diagdata_registerflag_db1,
        { "DB1", "s7comm.diagdata.register.db1", FT_BOOLEAN, 8, NULL, 0x20,
          "DB1 (global)/ Datablock register 1", HFILL }},
        { &hf_s7comm_diagdata_registerflag_db2,
        { "DB2", "s7comm.diagdata.register.db2", FT_BOOLEAN, 8, NULL, 0x40,
          "DB2 (instance) / Datablock register 2", HFILL }},

        /* timefunction: s7 timestamp */
        { &hf_s7comm_data_ts,
        { "S7 Timestamp", "s7comm.data.ts", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x00,
          "S7 Timestamp, BCD coded", HFILL }},
        { &hf_s7comm_data_ts_reserved,
        { "S7 Timestamp - Reserved", "s7comm.data.ts_reserved", FT_UINT8, BASE_HEX, NULL, 0x00,
          "S7 Timestamp: Reserved byte", HFILL }},
        { &hf_s7comm_data_ts_year1,
        { "S7 Timestamp - Year 1", "s7comm.data.ts_year1", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded year thousands/hundreds, should be ignored (19 or 20)", HFILL }},
        { &hf_s7comm_data_ts_year2,
        { "S7 Timestamp - Year 2", "s7comm.data.ts_year2", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded year, if 00...89 then it's 2000...2089, else 1990...1999", HFILL }},
        { &hf_s7comm_data_ts_month,
        { "S7 Timestamp - Month", "s7comm.data.ts_month", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded month", HFILL }},
        { &hf_s7comm_data_ts_day,
        { "S7 Timestamp - Day", "s7comm.data.ts_day", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded day", HFILL }},
        { &hf_s7comm_data_ts_hour,
        { "S7 Timestamp - Hour", "s7comm.data.ts_hour", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded hour", HFILL }},
        { &hf_s7comm_data_ts_minute,
        { "S7 Timestamp - Minute", "s7comm.data.ts_minute", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded minute", HFILL }},
        { &hf_s7comm_data_ts_second,
        { "S7 Timestamp - Second", "s7comm.data.ts_second", FT_UINT8, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded second", HFILL }},
        { &hf_s7comm_data_ts_millisecond,
        { "S7 Timestamp - Milliseconds", "s7comm.data.ts_millisecond", FT_UINT16, BASE_DEC, NULL, 0x00,
          "S7 Timestamp: BCD coded milliseconds (left 3 nibbles)", HFILL }},
        { &hf_s7comm_data_ts_weekday,
        { "S7 Timestamp - Weekday", "s7comm.data.ts_weekday", FT_UINT16, BASE_DEC, VALS(weekdaynames), 0x000f,
          "S7 Timestamp: Weekday number (right nibble, 1=Su,2=Mo,..)", HFILL }},

        /* Function 0x28 (PI service) and 0x29 */
        { &hf_s7comm_piservice_unknown1,
        { "Unknown bytes", "s7comm.param.pistart.unknown1", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_piservice_parameterblock_len,
        { "Parameter block length", "s7comm.param.pistart.parameterblock_len", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Length of Parameter block in bytes", HFILL }},
        { &hf_s7comm_piservice_parameterblock,
        { "Parameter block", "s7comm.param.pistart.parameterblock", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_piservice_servicename,
        { "PI (program invocation) Service", "s7comm.param.pistart.servicename", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},

        /* PI Service parameters for NC services */
        { &hf_s7comm_piservice_string_len,
        { "String length", "s7comm.param.pi.n_x.string_len", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Length of the following string. If LengthByte + Stringlen is uneven, a fillbyte is added", HFILL }},
        { &hf_s7comm_pi_n_x_addressident,
        { "Addressidentification", "s7comm.param.pi.n_x.addressident", FT_STRING, BASE_NONE, NULL, 0x0,
          "Addressidentification (RangeID / Index)", HFILL }},
        { &hf_s7comm_pi_n_x_filename,
        { "Filename", "s7comm.param.pi.n_x.filename", FT_STRING, BASE_NONE, NULL, 0x0,
          "Name of the file or directory", HFILL }},
        { &hf_s7comm_pi_n_x_editwindowname,
        { "Editor Window Name", "s7comm.param.pi.n_x.editwindowname", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pi_n_x_password,
        { "Password", "s7comm.param.pi.n_x.password", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pi_n_x_seekpointer,
        { "Seek pointer", "s7comm.param.pi.n_x.seekpointer", FT_STRING, BASE_NONE, NULL, 0x0,
          "SeekPointer string with exact 9 digit/character(s)", HFILL }},
        { &hf_s7comm_pi_n_x_windowsize,
        { "Window size", "s7comm.param.pi.n_x.windowsize", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pi_n_x_comparestring,
        { "Compare String", "s7comm.param.pi.n_x.comparestring", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pi_n_x_skipcount,
        { "Skip Count", "s7comm.param.pi.n_x.skipcount", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pi_n_x_interruptnr,
        { "Interrupt Number", "s7comm.param.pi.n_x.interruptnr", FT_STRING, BASE_NONE, NULL, 0x0,
          "Interrupt Number: Interrupt number corresponds to the input number which caused the interrupt" , HFILL }},
        { &hf_s7comm_pi_n_x_priority,
        { "Priority", "s7comm.param.pi.n_x.priority", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_liftfast,
        { "Liftfast", "s7comm.param.pi.n_x.liftfast", FT_STRING, BASE_NONE, NULL, 0x0,
          "Liftfast: Indicates whether an interrupt routine should simultaneously cause a fast lift-off motion" , HFILL }},
        { &hf_s7comm_pi_n_x_blsync,
        { "Blsync", "s7comm.param.pi.n_x.blsync", FT_STRING, BASE_NONE, NULL, 0x0,
          "Blsync: Indicates whether the interrupt has to be synchronized to the next block end" , HFILL }},
        { &hf_s7comm_pi_n_x_magnr,
        { "Magnr", "s7comm.param.pi.n_x.magnr", FT_STRING, BASE_NONE, NULL, 0x0,
          "Magnr: Magazine number" , HFILL }},
        { &hf_s7comm_pi_n_x_dnr,
        { "DNr", "s7comm.param.pi.n_x.dnr", FT_STRING, BASE_NONE, NULL, 0x0,
          "DNr: D number" , HFILL }},
        { &hf_s7comm_pi_n_x_spindlenumber,
        { "Spindle Number", "s7comm.param.pi.n_x.spindlenumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pi_n_x_wznr,
        { "WZ-Nr", "s7comm.param.pi.n_x.wznr", FT_STRING, BASE_NONE, NULL, 0x0,
          "WZ-Nr: Tool number" , HFILL }},
        { &hf_s7comm_pi_n_x_class,
        { "Class", "s7comm.param.pi.n_x.class", FT_STRING, BASE_NONE, NULL, 0x0,
          "Class: Classify machine data" , HFILL }},
        { &hf_s7comm_pi_n_x_tnr,
        { "TNr", "s7comm.param.pi.n_x.tnr", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_toolnumber,
        { "Tool Number", "s7comm.param.pi.n_x.toolnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_cenumber,
        { "CE-Number", "s7comm.param.pi.n_x.cenumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_datablocknumber,
        { "Datablock Number", "s7comm.param.pi.n_x.datablocknumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_firstcolumnnumber,
        { "First Column Number", "s7comm.param.pi.n_x.firstcolumnnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_lastcolumnnumber,
        { "Last Column Number", "s7comm.param.pi.n_x.lastcolumnnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_firstrownumber,
        { "First Row Number", "s7comm.param.pi.n_x.firstrownnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_lastrownumber,
        { "Last Row Number", "s7comm.param.pi.n_x.lastrownnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_direction,
        { "Direction", "s7comm.param.pi.n_x.direction", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_sourcefilename,
        { "Source-Filename", "s7comm.param.pi.n_x.sourcefilename", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_destinationfilename,
        { "Destination-Filename", "s7comm.param.pi.n_x.destinationfilename", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_channelnumber,
        { "Channel Number", "s7comm.param.pi.n_x.channelnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_protection,
        { "Protection", "s7comm.param.pi.n_x.protection", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_oldfilename,
        { "Old Filename", "s7comm.param.pi.n_x.oldfilename", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_newfilename,
        { "New Filename", "s7comm.param.pi.n_x.newfilename", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_findmode,
        { "Findmode", "s7comm.param.pi.n_x.findmode", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_switch,
        { "Switch", "s7comm.param.pi.n_x.switch", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_functionnumber,
        { "Function Number", "s7comm.param.pi.n_x.functionnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_semaphorevalue,
        { "Semaphore Value", "s7comm.param.pi.n_x.semaphorevalue", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_onoff,
        { "OnOff", "s7comm.param.pi.n_x.onoff", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_mode,
        { "Mode", "s7comm.param.pi.n_x.mode", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_factor,
        { "Factor", "s7comm.param.pi.n_x.factor", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_passwordlevel,
        { "Password Level", "s7comm.param.pi.n_x.passwordlevel", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_linenumber,
        { "Line Number", "s7comm.param.pi.n_x.linenumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_weargroup,
        { "Wear Group", "s7comm.param.pi.n_x.weargroup", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_toolstatus,
        { "Tool Status", "s7comm.param.pi.n_x.toolstatus", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_wearsearchstrat,
        { "Search Strategy", "s7comm.param.pi.n_x.wearsearchstrat", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_toolid,
        { "Tool ID", "s7comm.param.pi.n_x.toolid", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_duplonumber,
        { "Duplo Number", "s7comm.param.pi.n_x.duplonumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_edgenumber,
        { "Edge Number", "s7comm.param.pi.n_x.edgenumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placenr,
        { "Place Number", "s7comm.param.pi.n_x.placenr", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placerefnr,
        { "Place Reference Number", "s7comm.param.pi.n_x.placerefnr", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_magrefnr,
        { "Magazine Reference Number", "s7comm.param.pi.n_x.magrefnr", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placenrfrom,
        { "Place Number from", "s7comm.param.pi.n_x.placenrfrom", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_magnrfrom,
        { "Magazine Number from", "s7comm.param.pi.n_x.magnrfrom", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placenrto,
        { "Place Number to", "s7comm.param.pi.n_x.placenrto", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_magnrto,
        { "Magazine Number to", "s7comm.param.pi.n_x.magnrto", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_halfplacesleft,
        { "Half places left", "s7comm.param.pi.n_x.halfplacesleft", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_halfplacesright,
        { "Half places right", "s7comm.param.pi.n_x.halfplacesright", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_halfplacesup,
        { "Half places up", "s7comm.param.pi.n_x.halfplacesup", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_halfplacesdown,
        { "Half places down", "s7comm.param.pi.n_x.halfplacesdown", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placetype,
        { "Place type index", "s7comm.param.pi.n_x.placetype", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_searchdirection,
        { "Search direction", "s7comm.param.pi.n_x.searchdirection", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_toolname,
        { "Tool Name", "s7comm.param.pi.n_x.toolname", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placenrsource,
        { "Place Number Source", "s7comm.param.pi.n_x.placenrsource", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_magnrsource,
        { "Magazine Number Source", "s7comm.param.pi.n_x.magnrsource", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_placenrdestination,
        { "Place Number Destination", "s7comm.param.pi.n_x.placenrdestination", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_magnrdestination,
        { "Magazine Number Destination", "s7comm.param.pi.n_x.magnrdestination", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_incrementnumber,
        { "Increment Number", "s7comm.param.pi.n_x.incrementnumber", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_monitoringmode,
        { "Monitoring mode", "s7comm.param.pi.n_x.monitoringmode", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},
        { &hf_s7comm_pi_n_x_kindofsearch,
        { "Kind of search", "s7comm.param.pi.n_x.kindofsearch", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL , HFILL }},

        { &hf_s7comm_data_pi_inse_unknown,
        { "Unknown byte", "s7comm.param.pi.inse.unknown", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},

        { &hf_s7comm_data_plccontrol_argument,
        { "Argument", "s7comm.param.pistart.argument", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_plccontrol_block_cnt,
        { "Number of blocks", "s7comm.data.plccontrol.block_cnt", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_plccontrol_part2_len,
        { "Length part 2", "s7comm.data.plccontrol.part2_len", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Length of part 2 in bytes", HFILL }},

        /* block control functions */
        { &hf_s7comm_data_blockcontrol_unknown1,
        { "Unknown byte(s) in blockcontrol", "s7comm.data.blockcontrol.unknown1", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_errorcode,
        { "Errorcode", "s7comm.data.blockcontrol.errorcode", FT_UINT16, BASE_HEX, NULL, 0x0,
          "Errorcode, 0 on success", HFILL }},
        { &hf_s7comm_data_blockcontrol_uploadid,
        { "UploadID", "s7comm.data.blockcontrol.uploadid", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_file_ident,
        { "File identifier", "s7comm.data.blockcontrol.file_identifier", FT_STRING, BASE_NONE, NULL, 0x0,
          "File identifier: '_'=complete module; '$'=Module header for up-loading", HFILL }},
        { &hf_s7comm_data_blockcontrol_block_type,
        { "Block type", "s7comm.data.blockcontrol.block_type", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_block_num,
        { "Block number", "s7comm.data.blockcontrol.block_number", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_dest_filesys,
        { "Destination filesystem", "s7comm.data.blockcontrol.dest_filesys", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_part2_len,
        { "Length part 2", "s7comm.data.blockcontrol.part2_len", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Length of part 2 in bytes", HFILL }},
        { &hf_s7comm_data_blockcontrol_part2_unknown,
        { "Unknown char before load mem", "s7comm.data.blockcontrol.part2_unknown", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_loadmem_len,
        { "Length of load memory", "s7comm.data.blockcontrol.loadmem_len", FT_STRING, BASE_NONE, NULL, 0x0,
          "Length of load memory in bytes", HFILL }},
        { &hf_s7comm_data_blockcontrol_mc7code_len,
        { "Length of MC7 code", "s7comm.data.blockcontrol.mc7code_len", FT_STRING, BASE_NONE, NULL, 0x0,
          "Length of MC7 code in bytes", HFILL }},

        { &hf_s7comm_data_blockcontrol_filename_len,
        { "Filename Length", "s7comm.param.blockcontrol.filename_len", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Length following filename in bytes", HFILL }},
        { &hf_s7comm_data_blockcontrol_filename,
        { "Filename", "s7comm.param.blockcontrol.filename", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_blockcontrol_upl_lenstring_len,
        { "Blocklengthstring Length", "s7comm.param.blockcontrol.upl_lenstring_len", FT_UINT8, BASE_DEC, NULL, 0x0,
          "Length following blocklength string in bytes", HFILL }},
        { &hf_s7comm_data_blockcontrol_upl_lenstring,
        { "Blocklength", "s7comm.param.blockcontrol.upl_lenstring", FT_STRING, BASE_NONE, NULL, 0x0,
          "Length of the complete uploadblock in bytes, may be split into many PDUs", HFILL }},
        { &hf_s7comm_data_blockcontrol_functionstatus,
        { "Function Status", "s7comm.param.blockcontrol.functionstatus", FT_UINT8, BASE_HEX, NULL, 0x0,
          "0=no error, 1=more data, 2=error", HFILL }},
        { &hf_s7comm_data_blockcontrol_functionstatus_more,
        { "More data following", "s7comm.param.blockcontrol.functionstatus.more", FT_BOOLEAN, 8, NULL, 0x01,
          "More data of the block/file can be retrieved with another request", HFILL }},
        { &hf_s7comm_data_blockcontrol_functionstatus_error,
        { "Error", "s7comm.param.blockcontrol.functionstatus.error", FT_BOOLEAN, 8, NULL, 0x02,
          "An error occurred", HFILL }},

        /* NC programming functions */
        { &hf_s7comm_data_ncprg_unackcount,
        { "Number of telegrams sent without acknowledge", "s7comm.data.ncprg.unackcount", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_ncprg_filelength,
        { "NC file length", "s7comm.data.ncprg.filelength", FT_STRING, BASE_NONE, NULL, 0x0,
          "NC file length: length of file date + file path", HFILL }},
        { &hf_s7comm_data_ncprg_filetime,
        { "NC file timestamp", "s7comm.data.ncprg.filetime", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_ncprg_filepath,
        { "NC file path", "s7comm.data.ncprg.filepath", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_data_ncprg_filedata,
        { "NC file data", "s7comm.data.ncprg.filedata", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},

        /* Data record routing to Profibus */
        { &hf_s7comm_data_drr_data,
        { "DRR Data", "s7comm.data.drr.data", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},

        /* Variable status */
        { &hf_s7comm_varstat_unknown,
        { "Unknown byte(s) varstat", "s7comm.varstat.unknown", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_varstat_item_count,
        { "Item count", "s7comm.varstat.item_count", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_varstat_req_memory_area,
        { "Memory area", "s7comm.varstat.req.memory_area", FT_UINT8, BASE_DEC, VALS(userdata_tis_varstat_area_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_varstat_req_repetition_factor,
        { "Repetition factor", "s7comm.varstat.req.repetition_factor", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_varstat_req_db_number,
        { "DB number", "s7comm.varstat.req.db_number", FT_UINT16, BASE_DEC, NULL, 0x0,
          "DB number, when area is DB", HFILL }},
        { &hf_s7comm_varstat_req_startaddress,
        { "Startaddress", "s7comm.varstat.req.startaddress", FT_UINT16, BASE_DEC, NULL, 0x0,
          "Startaddress / byteoffset", HFILL }},
        { &hf_s7comm_varstat_req_bitpos,
        { "Bitposition", "s7comm.varstat.req.bitpos", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

        /* cyclic services */
        { &hf_s7comm_cycl_interval_timebase,
        { "Interval timebase", "s7comm.cyclic.interval_timebase", FT_UINT8, BASE_DEC, VALS(cycl_interval_timebase_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cycl_interval_time,
        { "Interval time factor", "s7comm.cyclic.interval_time", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cycl_function,
        { "Function", "s7comm.cyclic.function", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cycl_jobid,
        { "Job-ID", "s7comm.cyclic.job_id", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

        /* Read record */
        { &hf_s7comm_rdrec_mlen,
        { "Rdrec Mlen", "s7comm.readrec.mlen", FT_UINT16, BASE_DEC, NULL, 0x0,
          "MLEN, Max. length in bytes of the data record data to be read", HFILL }},
        { &hf_s7comm_rdrec_index,
        { "Rdrec Index", "s7comm.readrec.index", FT_UINT16, BASE_HEX, NULL, 0x0,
          "INDEX, Data record number", HFILL }},
        { &hf_s7comm_rdrec_id,
        { "Rdrec ID", "s7comm.readrec.id", FT_UINT24, BASE_DEC, NULL, 0x0,
          "ID, Diagnostic address", HFILL }},
        { &hf_s7comm_rdrec_statuslen,
        { "Rdrec Status Len", "s7comm.readrec.statuslen", FT_UINT8, BASE_DEC, NULL, 0x0,
          "STATUS LEN, Length of status data", HFILL }},
        { &hf_s7comm_rdrec_statusdata,
        { "Rdrec Status", "s7comm.readrec.status", FT_BYTES, BASE_NONE, NULL, 0x0,
          "STATUS, Status data", HFILL }},
        { &hf_s7comm_rdrec_recordlen,
        { "Rdrec Len", "s7comm.readrec.len", FT_UINT16, BASE_DEC, NULL, 0x0,
          "LEN, Length of data record data read", HFILL }},
        { &hf_s7comm_rdrec_data,
        { "Rdrec Data", "s7comm.readrec.data", FT_BYTES, BASE_NONE, NULL, 0x0,
          "DATA, The read data record", HFILL }},
        { &hf_s7comm_rdrec_reserved1,
        { "Rdrec reserved", "s7comm.readrec.reserved1", FT_BYTES, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},

        /* PBC, Programmable Block Functions */
        { &hf_s7comm_pbc_unknown,
        { "PBC unknown", "s7comm.pbc.unknown", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_bsend_r_id,
        { "PBC BSEND R_ID", "s7comm.pbc.req.bsend.r_id", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_bsend_len,
        { "PBC BSEND LEN", "s7comm.pbc.req.bsend.len", FT_UINT32, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_usend_unknown1,
        { "PBC USEND unknown 1", "s7comm.pbc.usend.unknown1", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_usend_r_id,
        { "PBC USEND R_ID", "s7comm.pbc.usend.r_id", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_usend_unknown2,
        { "PBC USEND unknown 2", "s7comm.pbc.usend.unknown2", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_arsend_ret,
        { "PBC AR_SEND Returncode", "s7comm.pbc.arsend.ret", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_arsend_unknown,
        { "PBC AR_SEND unknown", "s7comm.pbc.arsend.unknown", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_arsend_ar_id,
        { "PBC AR_SEND AR_ID", "s7comm.pbc.arsend.ar_id", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_pbc_arsend_len,
        { "PBC AR_SEND LEN", "s7comm.pbc.arsend.len", FT_UINT32, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},

        /* CPU alarms */
        { &hf_s7comm_cpu_alarm_message_item,
        { "Alarm message", "s7comm.alarm.message", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_obj_item,
        { "Message object", "s7comm.alarm.message_object", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_function,
        { "Function identifier", "s7comm.alarm.function", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_nr_objects,
        { "Number of message objects", "s7comm.alarm.nr_objects", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_nr_add_values,
        { "Number of associated values", "s7comm.alarm.nr_add_values", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_eventid,
        { "EventID", "s7comm.alarm.event_id", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_timestamp_coming,
        { "Timestamp message coming", "s7comm.alarm.timestamp_coming", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_timestamp_going,
        { "Timestamp message going", "s7comm.alarm.timestamp_going", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_associated_value,
        { "Associated value(s)", "s7comm.alarm.associated_value", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_eventstate,
        { "EventState", "s7comm.alarm.eventstate", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig1,
        { "SIG_1", "s7comm.alarm.signal.sig1", FT_BOOLEAN, 8, NULL, 0x01,
          "Current state of Signal SIG_1", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig2,
        { "SIG_2", "s7comm.alarm.signal.sig2", FT_BOOLEAN, 8, NULL, 0x02,
          "Current state of Signal SIG_2", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig3,
        { "SIG_3", "s7comm.alarm.signal.sig3", FT_BOOLEAN, 8, NULL, 0x04,
          "Current state of Signal SIG_3", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig4,
        { "SIG_4", "s7comm.alarm.signal.sig4", FT_BOOLEAN, 8, NULL, 0x08,
          "Current state of Signal SIG_4", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig5,
        { "SIG_5", "s7comm.alarm.signal.sig5", FT_BOOLEAN, 8, NULL, 0x10,
          "Current state of Signal SIG_5", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig6,
        { "SIG_6", "s7comm.alarm.signal.sig6", FT_BOOLEAN, 8, NULL, 0x20,
          "Current state of Signal SIG_6", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig7,
        { "SIG_7", "s7comm.alarm.signal.sig7", FT_BOOLEAN, 8, NULL, 0x40,
          "Current state of Signal SIG_7", HFILL }},
        { &hf_s7comm_cpu_alarm_message_signal_sig8,
        { "SIG_8", "s7comm.alarm.signal.sig8", FT_BOOLEAN, 8, NULL, 0x80,
          "Current state of Signal SIG_8", HFILL }},
        { &hf_s7comm_cpu_alarm_message_state,
        { "State", "s7comm.alarm.state", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_ackstate_coming,
        { "AckState coming", "s7comm.alarm.ack_state.coming", FT_UINT8, BASE_HEX, NULL, 0x0,
          "Acknowledge state coming (1=Event acknowledged, 0=Event not acknowledged)", HFILL }},
        { &hf_s7comm_cpu_alarm_message_ackstate_going,
        { "AckState going", "s7comm.alarm.ack_state.going", FT_UINT8, BASE_HEX, NULL, 0x0,
          "Acknowledge state going (1=Event acknowledged, 0=Event not acknowledged)", HFILL }},
         { &hf_s7comm_cpu_alarm_message_event_coming,
        { "Event coming", "s7comm.alarm.event.coming", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_event_going,
        { "Event going", "s7comm.alarm.event.going", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_event_lastchanged,
        { "Event last changed", "s7comm.alarm.event.lastchanged", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_event_reserved,
        { "Reserved", "s7comm.alarm.event.reserved", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_scan_unknown1,
        { "SCAN unknown 1", "s7comm.alarm.scan.unknown1", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_message_scan_unknown2,
        { "SCAN unknown 2", "s7comm.alarm.scan.unknown2", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        /* Alarm message query */
        { &hf_s7comm_cpu_alarm_query_unknown1,
        { "Unknown/Reserved (1)", "s7comm.alarm.query.unknown1", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_query_querytype,
        { "Querytype", "s7comm.alarm.query.querytype", FT_UINT8, BASE_DEC, VALS(alarm_message_querytype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_query_unknown2,
        { "Unknown/Reserved (2)", "s7comm.alarm.query.unknown2", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_query_alarmtype,
        { "Alarmtype", "s7comm.alarm.query.alarmtype", FT_UINT32, BASE_DEC, VALS(alarm_message_query_alarmtype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_query_completelen,
        { "Complete data length", "s7comm.alarm.query.complete_length", FT_UINT32, BASE_DEC, NULL, 0x0,
          "Complete data length (with ALARM_S this is 0xffff, as they might be split into many telegrams)", HFILL }},
        { &hf_s7comm_cpu_alarm_query_datasetlen,
        { "Length of dataset", "s7comm.alarm.query.dataset_length", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_alarm_query_resunknown1,
        { "Unknown", "s7comm.alarm.query.resunknown1", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        /* CPU diagnostic messages */
        { &hf_s7comm_cpu_diag_msg_item,
        { "CPU diagnostic message", "s7comm.cpu.diag_msg", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid,
        { "Event ID", "s7comm.cpu.diag_msg.eventid", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid_class,
        { "Event class", "s7comm.cpu.diag_msg.eventid.class", FT_UINT16, BASE_HEX, VALS(cpu_diag_msg_eventid_class_names), 0xf000,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid_ident_entleave,
        { "Event entering state", "s7comm.cpu.diag_msg.eventid.ident.entleave", FT_BOOLEAN, 16, TFS(&tfs_s7comm_cpu_diag_msg_eventid_ident_entleave), 0x0100,
          "Event identifier: 0=Event leaving state,1=Event entering state", HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid_ident_diagbuf,
        { "Entry in diagnostic buffer", "s7comm.cpu.diag_msg.eventid.ident.diagbuf", FT_BOOLEAN, 16, NULL, 0x0200,
          "Event identifier: Entry in diagnostic buffer", HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid_ident_interr,
        { "Internal error", "s7comm.cpu.diag_msg.eventid.ident.interr", FT_BOOLEAN, 16, NULL, 0x0400,
          "Event identifier: Internal error", HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid_ident_exterr,
        { "External error", "s7comm.cpu.diag_msg.eventid.ident.exterr", FT_BOOLEAN, 16, NULL, 0x0800,
          "Event identifier: External error", HFILL }},
        { &hf_s7comm_cpu_diag_msg_eventid_nr,
        { "Event number", "s7comm.cpu.diag_msg.eventid.nr", FT_UINT16, BASE_HEX, NULL, 0x00ff,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_prioclass,
        { "Priority class", "s7comm.cpu.diag_msg.prioclass", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_obnumber,
        { "OB number", "s7comm.cpu.diag_msg.obnumber", FT_UINT8, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_datid,
        { "DatID", "s7comm.cpu.diag_msg.datid", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_info1,
        { "INFO1 Additional information 1", "s7comm.cpu.diag_msg.info1", FT_UINT16, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_diag_msg_info2,
        { "INFO2 Additional information 2", "s7comm.cpu.diag_msg.info2", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        /* CPU message service */
        { &hf_s7comm_cpu_msgservice_subscribe_events,
        { "Subscribed events", "s7comm.cpu.msg.events", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_subscribe_events_modetrans,
        { "Mode-transition", "s7comm.cpu.msg.events.modetrans", FT_BOOLEAN, 8, NULL, 0x01,
          "MODE: Register for mode-transition events via func-group=0 and subfunction=state", HFILL }},
        { &hf_s7comm_cpu_msgservice_subscribe_events_system,
        { "System-diagnostics", "s7comm.cpu.msg.events.system", FT_BOOLEAN, 8, NULL, 0x02,
          "SYS: Register for system diagnostic events", HFILL }},
        { &hf_s7comm_cpu_msgservice_subscribe_events_userdefined,
        { "Userdefined", "s7comm.cpu.msg.events.userdefined", FT_BOOLEAN, 8, NULL, 0x04,
          "USR: Register system user-defined diagnostic messages", HFILL }},
        { &hf_s7comm_cpu_msgservice_subscribe_events_alarms,
        { "Alarms", "s7comm.cpu.msg.events.alarms", FT_BOOLEAN, 8, NULL, 0x80,
          "ALM: Register alarm events (ALARM, SCAN, ALARM_S) type of event defined in additional field", HFILL }},
        { &hf_s7comm_cpu_msgservice_req_reserved1,
        { "Reserved/Unknown", "s7comm.cpu.msg.req_reserved1", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_username,
        { "Username", "s7comm.cpu.msg.username", FT_STRING, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_almtype,
        { "Alarm type", "s7comm.cpu.msg.almtype", FT_UINT8, BASE_DEC, VALS(cpu_msgservice_almtype_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_req_reserved2,
        { "Reserved/Unknown", "s7comm.cpu.msg.req_reserved2", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_res_result,
        { "Result", "s7comm.cpu.msg.res_result", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_res_reserved1,
        { "Reserved/Unknown", "s7comm.cpu.msg.res_reserved1", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_res_reserved2,
        { "Reserved/Unknown", "s7comm.cpu.msg.res_reserved2", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_cpu_msgservice_res_reserved3,
        { "Reserved/Unknown", "s7comm.cpu.msg.res_reserved3", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_modetrans_param_unknown1,
        { "Reserved/Unknown", "s7comm.param.modetrans.unknown1", FT_UINT32, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_modetrans_param_mode,
        { "Current mode", "s7comm.param.modetrans.mode", FT_UINT8, BASE_DEC, VALS(modetrans_param_mode_names), 0x0,
          NULL, HFILL }},
        { &hf_s7comm_modetrans_param_unknown2,
        { "Reserved/Unknown", "s7comm.param.modetrans.unknown2", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},

        /* TIA Portal stuff */
        { &hf_s7comm_tia1200_item_reserved1,
        { "1200 sym Reserved", "s7comm.tiap.item.reserved1", FT_UINT8, BASE_HEX, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tia1200_item_area1,
        { "1200 sym root area 1", "s7comm.tiap.item.area1", FT_UINT16, BASE_HEX, VALS(tia1200_var_item_area1_names), 0x0,
          "Area from where to read: DB or Inputs, Outputs, etc.", HFILL }},
        { &hf_s7comm_tia1200_item_area2,
        { "1200 sym root area 2", "s7comm.tiap.item.area2", FT_UINT16, BASE_HEX, VALS(tia1200_var_item_area2_names), 0x0,
          "Specifies the area from where to read", HFILL }},
        { &hf_s7comm_tia1200_item_area2unknown,
        { "1200 sym root area 2 unknown", "s7comm.tiap.item.area2unknown", FT_UINT16, BASE_HEX, NULL, 0x0,
          "For current unknown areas", HFILL }},
        { &hf_s7comm_tia1200_item_dbnumber,
        { "1200 sym root DB number", "s7comm.tiap.item.dbnumber", FT_UINT16, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tia1200_item_crc,
        { "1200 sym CRC", "s7comm.tiap.item.crc", FT_UINT32, BASE_HEX, NULL, 0x0,
          "CRC generated out of symbolic name with (x^32+x^31+x^30+x^29+x^28+x^26+x^23+x^21+x^19+x^18+x^15+x^14+x^13+x^12+x^9+x^8+x^4+x+1)", HFILL }},
        { &hf_s7comm_tia1200_var_lid_flags,
        { "LID flags", "s7comm.tiap.item.lid_flags", FT_UINT8, BASE_DEC, VALS(tia1200_var_lid_flag_names), 0xf0,
          NULL, HFILL }},
        { &hf_s7comm_tia1200_substructure_item,
        { "Substructure", "s7comm.tiap.item.substructure", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_tia1200_item_value,
        { "Value", "s7comm.tiap.item.value", FT_UINT32, BASE_DEC, NULL, 0x0fffffff,
          NULL, HFILL }},

        /* Fragment fields */
        { &hf_s7comm_fragment_overlap,
        { "Fragment overlap", "s7comm.fragment.overlap", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
          "Fragment overlaps with other fragments", HFILL }},
        { &hf_s7comm_fragment_overlap_conflict,
        { "Conflicting data in fragment overlap", "s7comm.fragment.overlap.conflict", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
          "Overlapping fragments contained conflicting data", HFILL }},
        { &hf_s7comm_fragment_multiple_tails,
        { "Multiple tail fragments found", "s7comm.fragment.multipletails", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
          "Several tails were found when defragmenting the packet", HFILL }},
        { &hf_s7comm_fragment_too_long_fragment,
        { "Fragment too long", "s7comm.fragment.toolongfragment", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
          "Fragment contained data past end of packet", HFILL }},
        { &hf_s7comm_fragment_error,
        { "Defragmentation error", "s7comm.fragment.error", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
          "Defragmentation error due to illegal fragments", HFILL }},
        { &hf_s7comm_fragment_count,
        { "Fragment count", "s7comm.fragment.count", FT_UINT32, BASE_DEC, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_reassembled_in,
        { "Reassembled in", "s7comm.reassembled.in", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
          "S7COMM fragments are reassembled in the given packet", HFILL }},
        { &hf_s7comm_reassembled_length,
        { "Reassembled S7COMM length", "s7comm.reassembled.length", FT_UINT32, BASE_DEC, NULL, 0x0,
          "The total length of the reassembled payload", HFILL }},
        { &hf_s7comm_fragment,
        { "S7COMM Fragment", "s7comm.fragment", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
        { &hf_s7comm_fragments,
        { "S7COMM Fragments", "s7comm.fragments", FT_NONE, BASE_NONE, NULL, 0x0,
          NULL, HFILL }},
    };

    static ei_register_info ei[] = {
        { &ei_s7comm_data_blockcontrol_block_num_invalid, { "s7comm.data.blockcontrol.block_number.invalid", PI_MALFORMED, PI_ERROR,
            "Block number must be a string containing an integer", EXPFILL }},
        { &ei_s7comm_ud_blockinfo_block_num_ascii_invalid, { "s7comm.data.blockinfo.block_number.invalid", PI_MALFORMED, PI_ERROR,
            "Block info must be a string containing an integer", EXPFILL }}
    };

    static int *ett[] = {
        &ett_s7comm,
        &ett_s7comm_header,
        &ett_s7comm_param,
        &ett_s7comm_param_item,
        &ett_s7comm_param_subitem,
        &ett_s7comm_data,
        &ett_s7comm_data_item,
        &ett_s7comm_item_address,
        &ett_s7comm_diagdata_registerflag,
        &ett_s7comm_userdata_blockinfo_flags,
        &ett_s7comm_cpu_alarm_message,
        &ett_s7comm_cpu_alarm_message_object,
        &ett_s7comm_cpu_alarm_message_signal,
        &ett_s7comm_cpu_alarm_message_timestamp,
        &ett_s7comm_cpu_alarm_message_associated_value,
        &ett_s7comm_cpu_diag_msg,
        &ett_s7comm_cpu_diag_msg_eventid,
        &ett_s7comm_cpu_msgservice_subscribe_events,
        &ett_s7comm_piservice_parameterblock,
        &ett_s7comm_data_blockcontrol_status,
        &ett_s7comm_plcfilename,
        &ett_s7comm_prog_parameter,
        &ett_s7comm_prog_data,
        &ett_s7comm_fragments,
        &ett_s7comm_fragment,
    };

    proto_s7comm = proto_register_protocol ("S7 Communication", "S7COMM", "s7comm");

    proto_register_field_array(proto_s7comm, hf, array_length (hf));

    s7comm_register_szl_types(proto_s7comm);

    proto_register_subtree_array(ett, array_length (ett));

    expert_s7comm = expert_register_protocol(proto_s7comm);
    expert_register_field_array(expert_s7comm, ei, array_length(ei));

    register_init_routine(s7comm_defragment_init);
    s7comm_heur_subdissector_list = register_heur_dissector_list_with_description("s7comm-bsend", "S7COMM BSEND/BRECV", proto_s7comm);
}

/* Register this protocol */
void
proto_reg_handoff_s7comm(void)
{
    /* register ourself as an heuristic cotp (ISO 8073) payload dissector */
    heur_dissector_add("cotp", dissect_s7comm, "S7 Communication over COTP", "s7comm_cotp", proto_s7comm, HEURISTIC_ENABLE);
    heur_dissector_add("cotp_is", dissect_s7comm, "S7 Communication over COTP (inactive subset)", "s7comm_cotp_is", proto_s7comm, HEURISTIC_ENABLE);
}

/*
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 *
 * Local variables:
 * c-basic-offset: 4
 * tab-width: 8
 * indent-tabs-mode: nil
 * End:
 *
 * vi: set shiftwidth=4 tabstop=8 expandtab:
 * :indentSize=4:tabSize=8:noTabs=true:
 */