Configuring S7-1500 EtherNet/IP Scanner for CompactLogix 5380

Architecture Overview

Connecting a SIMATIC S7-1500 (or S7-1200) master to multiple Allen-Bradley CompactLogix 5380 controllers in a WinCC Unified V18 SCADA environment is a common brownfield requirement. SIMATIC controllers do not ship with native EtherNet/IP field-device support. Instead, the protocol is implemented as a loadable function-block library that uses the CPU's Open User Communication (TCP/UDP) primitives on the integrated PROFINET port.

For a topology of one S7-1516-3 PN/DP master, six 5069-L3xxERM CompactLogix 5380 slaves, and one WinCC Unified PC RT V18 SCADA station, three workable communication paths exist:

1. S7-1500 as EtherNet/IP Scanner/Adapter (loadable FB library, no gateway).
2. Third-party real-time gateway (for example, Helmholz NT 100-RE-EN) translating PROFINET to EtherNet/IP.
3. WinCC Unified driver-direct to CompactLogix over EtherNet/IP (HMI Unified RT only on PC RT V18; unrestricted on HMI Unified RT).

Path 1, where the S7 acts as a data concentrator, is the most economical and lowest-latency option because it removes one protocol-translation hop. The WinCC Unified PC RT then reads the consolidated tags from the S7 over the native SIMATIC S7-1500 channel, which is unrestricted on PC RT V18.

Communication Path Comparison

For the user's stated configuration (1x S7-1516-3 PN/DP, 6x CompactLogix 5380, WinCC Unified PC RT V18, TIA Portal V18), path 1 is the recommended approach:

• WinCC Unified PC RT V18 supports the native SIMATIC S7-1500 channel without restriction.
• Path 1 keeps the Rockwell and Siemens traffic on a single industrial Ethernet segment with predictable RPI.
• No additional hardware procurement (no NT 100-RE-EN, no NXLIC-MASTER).
• Only one CPU needs engineering (the S7); the CompactLogix controllers keep their native EIP topology.

Native EtherNet/IP Capability on S7-1500/1200

SIMATIC controllers do not include EtherNet/IP as a built-in protocol of the operating system. CIP-class communication is implemented as a loadable function-block library that uses the controller's Open User Communication (OUC) primitives over TCP or UDP. The library is valid for any S7-1500 or S7-1200 OUC-capable interface, including the integrated PROFINET ports of the CPU and industrial Ethernet CMs/CPs.

The Siemens application example "EtherNet/IP Scanner - Connecting third-party I/O's using EtherNet/IP" provides:

• Function blocks for CIP Class 3 messaging (read/write assembly, Get_Attribute_Single, Set_Attribute_Single, Get_Attribute_All, Set_Attribute_All).
• Pre-built UDTs for common CompactLogix tag types (BOOL, SINT, INT, DINT, REAL, STRING).
• Sample TIA Portal V18 project for S7-1516-3 PN/DP.
• Sample Studio 5000 Logix Designer project for 5069-L320ERM.

Reference: TIA Portal V18 communication drivers to 3rd-party PLCs (SIOS ID 109815056).

TIA Portal V18 Driver Matrix

TIA Portal V18 (and Step 7 V18) provides a documented set of integrated communication drivers and loadable FBs for cross-vendor PLC linking. The matrix below summarizes the supported combinations as published in Siemens Industry Online Support entry ID 109815056:

For WinCC Unified V18, the SCADA-side driver matrix (SIOS entry 109813308) shows:

This is the root justification for the data-concentrator architecture: route all EIP traffic through the S7, then read the S7 from WinCC Unified PC RT V18 over PROFINET, which is the only universal, unrestricted channel on PC RT V18.

Application Example Library Details

The CIP Client / Scanner library (Siemens application example, "EtherNet/IP Scanner - Connecting third-party I/O's using EtherNet/IP") contains the following user-facing blocks:

• LCom_EipScanner (FB) - top-level scanner; manages connection list, RPI, and connection state.
• LCom_EipConnection (FB) - per-slave connection; handles forward-open, forward-close, heartbeat.
• LCom_EipMessage (FB) - explicit-message sender; used for CIP Class 3 reads/writes.
• LCom_ResolveName (FB) - DNS-style name resolution; resolves controller IP from symbolic tag.
• CIP_T_ReadBool, CIP_T_ReadDInt, CIP_T_ReadReal (FBs) - typed data readers.
• CIP_T_WriteBool, CIP_T_WriteDInt, CIP_T_WriteReal (FBs) - typed data writers.
• CIP_T_AttributeRead (FB) - generic CIP attribute read.
• LCom_Data (UDT) - UDT defining connection-IO direction, RPI, and connection-point path.

Connection limits on a single 5069-L320ERM (CompactLogix 5380):

• 32 EtherNet/IP Class 1 connections (CIP I/O).
• 64 EtherNet/IP Class 3 connections (CIP messaging).
• 256 sockets total.

With six 5380 slaves and one S7-1500 master using one Class 1 connection per slave, the master consumes 6/32 connections per 5380 - well within limits. If implicit I/O is replaced by explicit messaging only, only 6/64 Class 3 connections are consumed, leaving ample headroom for additional scanners (HMI panels, third-party gateways).

Reference: Siemens PLC-to-PLC Communications webinar (PDF).

Data Concentrator Topology

In this topology:

• Each CompactLogix 5380 publishes its process values through a CIP Server assembly (typically instance 100-103).
• The S7-1516-3 PN/DP runs the LCom_EipScanner FB, opening one Class 1 implicit connection to each 5380 with a configurable RPI (recommended 100 ms for HMI, 50 ms for control).
• All consolidated data is mirrored into a global S7 DB (for example, "DB_HMI_Mirror", 1024 bytes).
• WinCC Unified PC RT V18 reads the S7 DB through the native "SIMATIC S7-1500" channel, using a configured connection with the S7 CPU's IP address and rack/slot 0/1.
• The S7-CPU is reachable from the SCADA station via a SCALANCE XB208 managed switch (6GK5208-0BA00-2AB2), which provides IGMP snooping and PROFINET prioritization.

Hardware and Catalog References

The user-supplied BoM is reviewed below with cross-references to official Siemens catalog numbers and CIP-relevant specs.

CompactLogix 5380 selection by memory size:

• 5069-L320ERM - 4 MB user memory, 1 Gb dual-port DLR.
• 5069-L340ERM - 8 MB user memory.
• 5069-L350ERM - 16 MB user memory.
• 5069-L380ERM - 32 MB user memory.

Configuration Procedure

Prerequisites:

• TIA Portal V18 with S7-1500 CPU V2.9 or V3.0 support package installed.
• Step 7 V18 HSP for S7-1516-3 PN/DP (latest HSP for V18).
• LCom_EipScanner library downloaded from Siemens Industry Online Support.
• Studio 5000 Logix Designer v34 or later installed on engineering workstation.
• WinCC Unified V18 ES installed; WinCC Unified PC RT V18 licensed.
• SCALANCE XB208 configured for PROFINET prioritization (DSCP class 4 for PROFINET RT, DSCP class 5 for EIP implicit).

Step 1 - Configure CompactLogix 5380 as CIP Server:

1. In Studio 5000, open the 5380 project.
2. Add an Ethernet module if not present (5069-EN4TRX for DLR, or use the embedded port).
3. Right-click the Ethernet module -> "Properties" -> "Connection" tab.
4. Enable "EtherNet/IP Scanner Connection".
5. Define an input assembly at instance 100 (controller → scanner) and an output assembly at instance 101 (scanner → controller).
6. Create controller tags for the process data (for example, "HMI_Level", "HMI_Pressure", "HMI_Running").
7. Map the tags to the assembly data in the "Connection" tab using CIP tag mapping.
8. Download to the controller. Verify with "EtherNet/IP Node Status" in RSLinx.

Step 2 - Configure S7-1516-3 as EtherNet/IP Scanner:

1. In TIA Portal V18, open the S7-1500 project.
2. Add the LCom_EipScanner library (Options -> Global Libraries -> Retrieve).
3. Create a global DB "DB_EipConfig" with the connection list UDT (one row per CompactLogix):

   // Connection list UDT (DB_EipConfig.Connection[i])
   TYPE LCom_ConnectionData :
   STRUCT
       IP_Address      : STRING[15];   // "192.168.10.101"
       RPI_ms          : INT;          // 100
       InputAssembly   : INT;          // 100
       OutputAssembly  : INT;          // 101
       DataSizeIn      : INT;          // 100
       DataSizeOut     : INT;          // 100
       State           : INT;          // 0=Idle, 1=Connecting, 2=Established, 3=Timeout
       LastError       : DWORD;        // CIP error code (hex)
       Heartbeat       : INT;          // Incrementing counter (diagnostic)
   END_STRUCT;
   END_TYPE

4. Instantiate LCom_EipScanner in OB1 with the connection list as input.
5. Instantiate six LCom_EipConnection FBs, one per CompactLogix.
6. Wire each connection's "Connection_Data" output to a "T_CipRead" / "T_CipWrite" pair.
7. Map the consolidated data into DB_HMI_Mirror (e.g., DB_HMI_Mirror.PLC1_Level := Connection1.Data[0..3]).
8. Compile and download. Verify connection state in online view (all 6 should be "Established").

Step 3 - Configure WinCC Unified V18 HMI connection:

1. Open WinCC Unified V18 ES.
2. Add an HMI device -> "WinCC Unified PC RT".
3. In "Connections", add a new SIMATIC S7-1500/1200 connection:
   • IP: 192.168.10.1 (S7 CPU PROFINET port 1).
   • Rack: 0, Slot: 1.
   • Cycle: 100 ms.
4. Create HMI tags corresponding to the S7 DB_HMI_Mirror structure (mirror each 5380's data).
5. Configure screen elements to display the HMI tags.
6. Compile the project. Start the WinCC Unified PC RT. Verify tag quality is "Good".

Step 4 - Verify end-to-end:

1. Force a tag in CompactLogix 5380 #1 (e.g., HMI_Level = 123.4).
2. Confirm the value appears in the S7 DB_HMI_Mirror within 1 RPI cycle (i.e., ≤ 100 ms).
3. Confirm the HMI tag in WinCC Unified PC RT updates within 2 RPI cycles.
4. Repeat for all 6 CompactLogix controllers.
5. Disconnect the S7-PROFINET cable and verify WinCC Unified shows "Bad quality" within 5 seconds.

WinCC Unified V18 Connection Details

WinCC Unified PC RT V18 supports the following S7 connections natively (from SIOS entry 109813308):

For a PC RT V18 station reading Allen-Bradley tags directly, the user must apply the V19 firmware update. If the user is constrained to V18, the S7 data-concentrator architecture is the supported workaround.

Reference: WinCC Unified V18 communication drivers to 3rd-party PLCs (SIOS ID 109813308).

Gateway Alternative: Helmholz NT 100-RE-EN

If the S7-1500 CPU does not run the LCom library (e.g., older firmware, or different OUC port usage), the user can deploy a Helmholz NT 100-RE-EN PROFINET/EtherNet/IP/Modbus TCP gateway.

PROFINET to EtherNet/IP mapping in the gateway:

• A maximum of 256 bytes IN/OUT per PROFINET slot.
• 32 PROFINET slots per gateway.
• Slot configuration in TIA Portal as standard PROFINET IO device with input/output modules matching the CompactLogix assembly size.

Cost-benefit: The NT 100-RE-EN + NXLIC-MASTER is a one-time cost of approximately EUR 1500. If the S7 CPU is already deployed and has available OUC bandwidth, the LCom path is essentially free. Use the gateway only when:

• The S7 CPU is fully loaded and cannot run the LCom library.
• The user wants a non-Siemens SCADA on PC RT V18 to read Allen-Bradley directly through the gateway.
• The user requires a deterministic 10 ms update rate for a small, fixed number of signals (using 1 gateway per CompactLogix pair).

Verification, Diagnostics, and Troubleshooting

After commissioning, run the following verification matrix to validate the end-to-end data path:

TIA Portal V18 diagnostic locations:

• Online -> "Devices & networks" -> right-click S7 CPU -> "Online & Diagnostics" -> "EtherNet/IP diagnostics" - shows per-connection RPI statistics, error count, and last forward-open response code.
• Online -> "Program blocks" -> DB_EipConfig.Connection[i].Diag - exposes diagnostic information per connection.

CompactLogix 5380 diagnostics:

• "EtherNet/IP Node Status" in RSLinx - verify that the S7-1500 appears as a scanner with the expected connection count (6 Class 1).
• "Event Log" in Logix Designer - check for "Connection from <S7 IP> opened" / "closed" entries.
• "CIP Diagnostics" in Studio 5000 - per-assembly connection status.

WinCC Unified diagnostics:

• "Tag management" -> right-click the HMI connection -> "Status" - shows connection state, tag quality, and last update timestamp.
• "Performance Insights" - provides end-to-end update-time analysis if the optional Performance Insight V18 add-on is licensed.

CIP error codes encountered during forward-open:

Troubleshooting matrix:

Wireshark capture of EtherNet/IP traffic:

1. Install Wireshark on a port-mirrored engineering station connected to the SCALANCE XB208.
2. Apply capture filter: udp port 2222 or udp port 44818 or udp port 2221 (EtherNet/IP encapsulation ports).
3. Trigger a tag write in the S7 to verify a forward-open (service 0x54) and write request (service 0x4F).
4. Confirm CIP response codes (service 0xCC) in the response packets.

Specifications and Limits

S7-1500 as EtherNet/IP scanner - calculated limits (CPU 1516-3 PN/DP):

• Maximum simultaneous EtherNet/IP connections: 32 (limited by OUC resource blocks; firmware V2.9+) or 64 (firmware V3.0+).
• Maximum OUC connections total (PROFINET + TCP/UDP + EIP): 128 (S7-1500 limit; CPU-specific).
• Maximum data per EIP connection: 504 bytes (CIP standard).
• Recommended RPI range: 50-500 ms (depends on CPU load).
• Update time at RPI 100 ms, 6 connections, 100 bytes each: < 1 ms CPU time per cycle.

CompactLogix 5380 - connection limits (5069-L320ERM):

• Class 1 CIP I/O connections: 32.
• Class 3 CIP messaging connections: 64.
• Total sockets: 256.
• EtherNet/IP module update rate: 0.5-750 ms.
• Dual-port DLR switchover time: < 3 ms.

SCALANCE XB208 - switch specs (6GK5208-0BA00-2AB2):

• 8x RJ45 10/100 Mbps.
• PROFINET IO controller (Class C) compatible.
• IGMP snooping for multicast filtering.
• QoS / DSCP prioritization.
• Web-based management.
• Power: 24 V DC, 0.15 A.
• Operating temp: -10 deg C to +60 deg C.

Network bandwidth budget (assumed 100 Mbps, 70% utilization target):

• 6 x 100-byte EIP I/O updates at 100 ms RPI: 6 x 100 x 8 / 0.1 = 48,000 bps = 0.05% utilization.
• HMI tag polling: 200 HMI tags x 4 bytes at 100 ms: 200 x 32 / 0.1 = 64,000 bps = 0.06% utilization.
• PROFINET real-time: 1.5 Mbps reserved (1.5% of 100 Mbps).
• Total: ~ 2% utilization - well within the 70% target.

Migration notes from older Siemens controllers:

• S7-300/400 do not have the same OUC primitives as S7-1500/1200. For brownfield migrations, replace the legacy S7 with a S7-1500 first, then deploy the LCom library.
• ET 200S / ET 200pro with PN interface can be used as a proxy for legacy S7-300 I/O but does not support OUC in the same way as an S7-1500 CPU.
• WinCC Professional (V7.x) supports Allen-Bradley EIP directly; consider keeping WinCC Professional for direct EIP connections if the V19 patch cannot be applied to WinCC Unified PC RT V18.