Configuring Siemens CP1430TF ISO/TF Protocol for OPC Migration

Overview of the Legacy S5/S7 Communications Stack

Modernizing a Siemens S5/S7 supervision architecture that has accumulated over a decade typically involves three independent decisions: (1) which physical medium replaces the proprietary I/O boards in the PCs, (2) which OPC server replaces the legacy data source, and (3) how to host the entire stack inside a virtualized environment without breaking the deterministic timing the SCADA layer expects. The architecture described in the field problem consists of two S5 PLCs fitted with CP 1430 TF communications processors (order numbers 6GK1 143-0TA01 and 6GK1 143-0TA02), one S7-400 PLC fitted with a CP 443-1 Extended (6GK7 443-1EX11-0XE0), an SSV104 industrial Ethernet multiplexor, two supervision PCs running Wonderware InTouch 7 with the OPC Link option, and a history server running IndustrialSQL with DDE bridging. Each PC currently uses an Applicom ISO/TF or TCP card to put the supervisory network on the wire. The host operating system is Windows NT 4, locked by a proprietary third-party application that cannot be ported.

This reference walks through the field-proven sequence for replacing the Applicom card with a standard Ethernet adapter, identifying the active transport protocol on the CP 1430 TF (it is not TCP/IP by default), reading the CP's database file with COM 1430 TF, and selecting a compatible OPC server that can run inside a Windows NT 4 guest on VMware while still serving InTouch 7 and IndustrialSQL on the same or separate host.

Hardware Inventory and Order Number Verification

Confirm every PLC-side CP order number before designing the replacement path. The two order numbers mentioned in the field case are listed below with their distinguishing characteristics.

The CP 1430 TF and CP 1430 TCP are different products. The TF suffix denotes "Technological Functions," a Siemens proprietary transport that does not interwork with TCP/IP stacks. If TCP/IP is mandatory, a CP 1430 TCP must be sourced; this part is no longer in production and is generally available only as refurbished hardware at significant cost. The CP 443-1 Extended on the S7-400 already supports all relevant TCP variants and can coexist on the same physical Ethernet segment with the CP 1430 TF provided the segment runs at 10 Mbit/s half-duplex and uses repeater-style hubs rather than switched full-duplex connections.

Identifying the Active Protocol on the CP 1430 TF

The CP 1430 TF has two mutually exclusive transport modes selectable at configuration time:

• ISO Transport — ISO 8073 Class 4 over Ethernet (Ethertype 0x0600). Compatible with the ISO stack shipped with NCM (later Softnet) and with most third-party OPC servers.
• TF (Technological Functions) — Siemens proprietary application layer that exposes preconfigured variable names. TF always requires a Siemens CP at both ends; the PC side historically required either a CP 1413, an early Softnet TF runtime, or a CP 1430 TF set up as a gateway.

Before any replacement hardware or OPC server can be selected, the engineer must determine which mode the two CP 1430 TFs are running. Three independent methods are available; at least two should agree before proceeding.

Method 1: Static Program Analysis (S5 STL/FBD)

Examine the S5 user program for the Send/Receive (AG-Send/AG-Receive) call pattern. The CP 1430 TF is programmed through standard AG-Send (FB 244 on S5-135U/155U with COM 1430 TF, or the equivalent OB/FB blocks depending on CPU) and AG-Receive blocks. The interpretation of the call arguments is mode-specific.

• TF mode: The variable dictionary is loaded into the CP through COM 1430 TF; the S5 program calls only AG-Send with the parameter ANZW = 'ALL' (or equivalent "Send All" / "Receive All") to broadcast the predefined variable list. No job number is passed.
• ISO mode: The S5 program calls AG-Send/AG-Receive with an explicit job number (ANZW field) for each data area. Job numbers map 1:1 to transport connections configured in COM 1430 TF.

If the program contains only "Send All" / "Receive All" calls, TF is almost certainly active. If job-numbered calls dominate, ISO is the active mode. This is the first and fastest check; it does not require any tooling beyond the existing S5 source.

Method 2: COM 1430 TF Configuration File

The CP's database is stored as a .143 file by the COM 1430 TF configuration utility (also referenced as NCM COM 1430 TF in later Siemens documentation). The file describes the connections, transport mode, variable definitions, and CP IP/transport parameters. Reading the file is the definitive method.

Procedure:

1. Locate the .143 file on the engineering workstation or obtain a backup from the customer's archive. Typical extension variants are *.143 and *.C14.
2. Install COM 1430 TF on a Windows 9x / NT 4 / 2000 PC. The installer is approximately 30 MB; legacy Siemens diskettes or CD images are still available through the local Siemens representative.
3. Launch COM 1430 TF. In the project tree, select File → Open and point to the .143 file.
4. The configuration loads; the Connections and Variables views reveal the protocol.

Method 3: Wire Capture with Wireshark

Mirror the supervision segment with a SPAN port or a hub tap and capture traffic with Wireshark. The protocol mode is identified at a glance:

• ISO transport appears as ISO 8073 / OSI TP4 frames with Ethertype 0x0600 and TPDU lengths of typically 128–1024 bytes.
• TF frames carry a Siemens vendor Ethertype (historically 0x0600 as well, but with a distinctive Siemens LLC header and an S5TF marker in the first transport bytes).
• TCP/IP-based traffic is irrelevant for the CP 1430 TF — if all supervision traffic shows TCP/UDP, the CPs have already been swapped to CP 1430 TCP at some point and the protocol question is moot.

Capture duration of 60 seconds at peak shift turnover is usually sufficient to observe all configured jobs.

Physical Layer Conversion: AUI to RJ45

The CP 1430 TF exposes a 15-pin AUI (Attachment Unit Interface) female connector. Conversion to RJ45 requires a transceiver, not a simple pin adapter. Two practical options exist:

1. AUI-to-10BASE-T transceiver (also called "AUI media converter" or "AU-ETH"). Examples include the Black Box LE1500A-R3, the Transition Networks C/A-T-MEDIA, and Siemens' own discontinued 6GK1 900-0AA00. The transceiver clamps onto the AUI drop cable and presents a female RJ45 for the Ethernet segment.
2. AUI drop cable replacement — some third-party vendors supply a 15-pin D-sub to RJ45 active adapter that contains the MAU (Medium Attachment Unit) inside the RJ45 housing.

Set the transceiver to 10 Mbit/s half-duplex; the CP 1430 TF is a 10 Mbit/s Ethernet-2 device and does not negotiate. If the new segment is switched full-duplex, configure the switch port to hard-code 10/Half to match. Mixing duplex modes will produce late collisions and intermittent TF timeouts that are difficult to diagnose later.

Selecting a Replacement OPC Server

The Applicom OPC server currently provides tag addressing to InTouch 7 (Wonderware) and to IndustrialSQL via DDE. The replacement must satisfy three constraints: it must run on Windows NT 4 (or inside a Windows NT 4 VMware guest on modern server hardware), it must speak the transport the CP 1430 TF actually uses (ISO or TF), and it must present an OPC DA 1.0 or DA 2.0 interface that InTouch 7 OPC Link can browse.

Option A: Siemens NCM / SOFTNET OPC Server

Siemens' NCM (Net Configuration Manager, later branded SOFTNET) historically bundled an OPC server for S5 and S7 communication. The relevant variants for this migration are:

If the field inspection reveals ISO transport, SOFTNET-S7 Lean running on the NT 4 guest can replace the Applicom OPC server with no further hardware change on the PLC side. If the inspection reveals TF, the NCM family on the PC side will not interwork; a CP 1413 (legacy ISA) or CP 1613 (PCI) must be installed in the VMware host and bridged to the NT 4 guest via a raw-socket mapping. Because this contradicts the goal of removing all proprietary PC hardware, TF mode usually forces either a CP 1430 TCP upgrade on the PLC side or a re-programming of the S5 stations to use ISO transport instead.

Option B: Third-Party OPC DA Servers with S5 ISO Driver

Several third-party OPC servers expose S5 ISO transport directly over a stock Ethernet adapter. Notable options that explicitly support Windows NT 4 and ISO-on-Ethernet:

• KEPServerEX (Kepware) — legacy V4.x builds retain NT 4 support; the "Siemens TCP/IP Ethernet" driver may be coaxed to read ISO transport by selecting the "ISO over Ethernet" framing option. Confirm with Kepware's compatibility matrix before procurement.
• MatrikonOPC Siemens S5 OPC Server — designed for legacy S5 stations with both ISO and TF capability; check the explicit NT 4 support matrix.
• TOP Server (Software Toolbox) — legacy V3.x supports NT 4 and includes an S5 ISO driver.

Virtualizing the PCs with VMware

VMware Workstation, VMware Server (legacy), and modern VMware ESXi can all host Windows NT 4 as a guest, but several constraints apply:

• Virtual NIC driver: VMware provides an AMD Lance (pcnet) virtual NIC that Windows NT 4 recognizes with the supplied vmxnet/pcnet driver disk. Do not assign a bridged physical NIC dedicated to the CP 1430 TF segment — bridged mode injects traffic that confuses ISO retransmission logic. Use the Host-only or Custom VMnet configuration and connect the host NIC that faces the AUI transceiver into the same custom VMnet, with the NT 4 guest bridged to it.
• Time synchronization: NT 4 inside VMware drifts at roughly 1–2 seconds per hour unless the VMware Tools time-sync feature is enabled. InTouch 7 time-stamping and INSQL history are sensitive to monotonic time; install VMware Tools even for the NT 4 guest and enable periodic resync.
• USB passthrough for legacy keys: Several of the legacy applications rely on HASP USB dongles. Configure USB passthrough for the specific dongle per VM.
• VMware Tools install order: Install VMware Tools after the proprietary third-party NT 4 application. Some older installers write registry keys that VMware Tools' SVGA driver overwrites if installed first.

VMware VMnet Layout

Recommended segment layout when the Applicom card is removed:

1. Physical NIC 1 on the host — connects to the SSV104 / 10 Mbit half-duplex segment through the AUI transceiver. Bind to VMnet2.
2. Windows NT 4 Guest 1 (former Supervision PC 1) — bridged to VMnet2; IP address on the supervisory subnet (if ISO-on-TCP), static MAC cloned from the original Applicom card if required by the CP's ARP table.
3. Windows NT 4 Guest 2 (former Supervision PC 2) — same VMnet2 with a different MAC.
4. Windows NT 4 Guest 3 (former INSQL server) — VMnet2 for the data path plus VMnet3 for the corporate network if the historians need to publish externally.

For pure ISO/Ethernet-2 traffic, set the Windows NT 4 guest NIC to "bind to VMnet2" without an IP address; ISO transport does not require IP. For SOFTNET-S7 Lean, assign an IP in the supervisory subnet, configure the CP 443-1 as the partner, and define the connection in NCM/Step 7.

Procedure: Reading the .143 File in COM 1430 TF

This is the canonical sequence for the case where the customer has lost the ability to inspect the CP 1430 TF database. The procedure assumes COM 1430 TF has been installed and an attempt to open the file has produced the "INVALID ENTRY" symptom discussed earlier.

1. Verify the COM 1430 TF version. The CP 1430 TF Release 2 (0TA02) requires at minimum COM 1430 TF V5.1 SP2. Earlier builds reject the file as "INVALID ENTRY" on every parameter.
2. Open the .143 file in a hex editor. Confirm the first four bytes are the magic header: CP14 — if present, the file is a valid CP 1430 configuration. CTP1 — the file belongs to a CP 1430 TCP configuration and must be opened with the TCP tool.
3. Set the regional settings of the engineering workstation to German (Germany) or English (United States) depending on what the original station was created under. The COM 1430 TF UI is not fully Unicode; date and float separators are loaded from the regional settings of the host.
4. Launch COM 1430 TF, choose File → Open CP Configuration, select the .143 file, and choose the matching CP type (1430 TF R1 or R2).
5. Inspect the connection table under Configuration → Connections. Each row reveals the partner MAC/IP, the transport (ISO / TF), the local and remote TSAP, and the active/passive role. Export the table to .CSV for inclusion in the migration design document.
6. Inspect the variable table under Configuration → Variable Catalogue. The number of entries determines the OPC tag database size; budget 1 KB per tag for SOFTNET runtime memory.

Procedure: Configuring SOFTNET-S7 Lean on Windows NT 4

1. Install SOFTNET-S7 Lean V6.x on the NT 4 guest.
2. Configure the OPC server instance in Station Configuration Editor: select S7 Protocol Suite → TCP/IP as the active channel.
3. Add a partner entry for the CP 443-1: IP address of the S7-400 CP, Rack 0, Slot 2 (default CP 443-1 position in S7-400).
4. Add partner entries for the two CP 1430 stations only if the migration plan replaces the CP 1430 TF with CP 1430 TCP hardware; otherwise omit and document the gap.
5. Define items for each DB or process image area; use the access path DBx,BYTE y for byte-level reads and DBx,REAL y for floating-point.
6. Start the OPC server service and verify with the OPC Quick Client that tags update.
7. In InTouch 7 OPC Link, create a new OPC topic pointing to the SOFTNET server. Browse the tag namespace and link existing InTouch tag names.

Verification Procedure

Troubleshooting Matrix

Safety and Operational Constraints

The CP 1430 TF and CP 443-1 Extended operate on the same physical segment as the supervision PCs. The legacy 10 Mbit half-duplex requirement constrains the choice of switch or hub. Use only unmanaged 10/100 hubs or industrial switches with hard-coded 10/Half ports. Do not connect a 100 Mbit auto-negotiating device — the CP will drop frames silently and the SCADA layer will appear to "freeze" for 30–120 seconds while retransmissions occur.

Backup the .143 file in a versioned archive before any hardware change. The CP 1430 TF database is firmware-format-specific and cannot be regenerated from the S5 program — once lost, the only source is a backup.

VMware Workstation does not provide the same redundancy as ESXi; if the supervision PCs are critical to plant operation, plan to migrate the VMware host to ESXi with vMotion and HA before the cutover. Document the recovery path: a power-fail recovery on the NT 4 guest requires chkdsk with the /f switch on the next boot because NT 4 does not gracefully handle improper shutdowns of mounted NTFS volumes under VMware.