Connecting SIMATIC S5 to OPC Server via Sena LS100: Reference Guide

1. Overview: The SIMATIC S5 Integration Challenge

The SIMATIC S5 family (S5-90U, S5-95U, S5-100U, S5-115U, S5-135U, S5-155U) ships with no native OPC DA or OPC UA interface. STEP5 programs are typically loaded and debugged through the PG port using the AS511 serial protocol, or via the CP1430 / CP143 module using SINEC H1 on Industrial Ethernet with the RK512 transport layer. When a modern SCADA, HMI, or IIoT gateway must read or write S5 data, a bridging component is required between the legacy field protocol and the OPC client application.

Three architectural patterns are field-proven for this problem:

1. Serial-to-Ethernet tunnel + third-party OPC server - exemplified by the Sena LS100 providing a virtual COM port to a vendor OPC server such as Softing S7/S5 OPC Server.
2. Native Ethernet-to-Ethernet bridge - IBH Link UA from IBHsoftec, which terminates AS511 / MPI / PROFIBUS on the controller side and exposes OPC UA on the network side.
3. Vendor-native S5-compatible communication - Siemens CP1613 with SIMATIC NET OPC Server in S5-compatible mode over Industrial Ethernet.

This reference covers the first architecture in depth, explains why the Softing OPC Server does not interoperate transparently with a generic serial device server, and documents the migration paths that avoid the constraint entirely.

2. S5 Communication Protocol Architecture

Before selecting an adaptor, identify the protocol layer exposed by the S5 CPU. Mixing layers is the most frequent commissioning error.

The AS511 protocol uses 8 data bits, 1 stop bit, even parity, and a 9600 bit/s default rate. It is a request/response protocol with a 4-byte header (job number, coordination flags, parameter count, data count) and a trailing block-check character. The PG port cannot be multi-dropped; only one master can hold the bus. This constraint forces the use of a single OPC server instance per CPU when using the serial path.

S5 Address Map for OPC Tag Authoring

The following S5 storage areas must be mapped into OPC item names:

• I (Inputs) - process image, byte-addressable, range IB 0 - IB 127 on most CPUs
• Q (Outputs) - process image, QB 0 - QB 127
• F (Flags / Merkers) - internal scratch memory, FW 0 - FW 255
• D (Data Blocks) - DB 2 - DB 255, each up to 8192 words (DW), with associated DL, DR, DD formats
• T (Timers) - T 0 - T 255, 16-bit down-counter running at a configured base
• C (Counters) - C 0 - C 255, 16-bit up-counter

3. Sena LS100 Serial Device Server: Hardware and Protocol Support

The Sena LS100 is a single-port industrial serial device server that converts RS-232/422/485 to 10/100Base-TX Ethernet. It provides four operating modes:

• TCP Server - LS100 listens on a configured port; client initiates connection.
• TCP Client - LS100 connects outbound to a configured remote endpoint.
• UDP - stateless, useful for broadcast polling.
• Virtual COM - LS100 partners with a Windows VCOM driver that creates a kernel COM port on the host PC; traffic is tunneled to the LS100 transparently.

The Sena LS100 has no awareness of AS511, RK512, MPI, or PROFIBUS. It is a transparent byte-stream tunnel. Any protocol semantics must be implemented by the host application or OPC server.

4. Virtual COM Port Architecture with the Sena LS100

When the LS100 is configured in Virtual COM mode and the Sena VCOM driver is installed on the OPC server host, a Windows COM port (e.g., COM17) appears in Device Manager. The driver intercepts read/write calls at the Win32 level and forwards them to the LS100 over TCP port 7000 (default, configurable). At the LS100, bytes are pushed out the serial port to the S5 CPU.

This arrangement works perfectly for PG traffic - STEP5 V7 and PG-95 connect to the virtual COM port and program the S5 as if a direct serial cable were attached. The S5 responds to programming requests, and the user can read/write variables interactively.

The arrangement does not work for most OPC servers because:

1. The OPC server expects a vendor-supplied adaptor API (DLL, IOCtl, or OPC custom interface) - not a generic COM port.
2. Licensing is typically bound to the vendor adaptor hardware serial number.
3. The OPC server initiates proprietary sessions on connection; a transparent VCOM does not satisfy this handshake.

5. OPC Server Options for SIMATIC S5

6. Softing S7/S5 OPC Server: Configuration and Compatibility Boundaries

The Softing S7/S5 OPC Server (current edition 2015-02 / "1502") supports the SIMATIC S5 only through Softing-supplied adaptors. Configuring a third-party serial device server as the underlying transport fails because:

• The server registers Softing adaptor COM-objects at startup; missing objects abort the connection pool.
• The S5 device DLL (s5mm.dll) calls SLBINIT on a Softing-provided handle, not on a raw file handle.
• Even with the COM-port emulation flag set in older versions, the licensing DLL (sfck50.dll) requires a Softing hardware dongle or activation key tied to the adaptor serial number.

If Softing is mandated by plant standard, the supported alternatives are:

• Insert a Softing PROFIBUS master card in the OPC server PC and bridge the S5 PROFIBUS-DP slave data through a Softing PROFIBUS-OPC gateway.
• Use a Softing-approved Ethernet-to-S5 gateway (limited catalog - confirm with Softing).

7. Alternative 1: IBH Link UA for OPC UA Integration

The IBH Link UA is a small DIN-rail gateway with an Ethernet uplink and an AS511 / MPI / PROFIBUS downlink. It terminates the legacy protocol internally and exposes an OPC UA server endpoint. For S5, the default address space maps as follows:

Byte order is big-endian (Motorola), matching STEP5 native word storage. The IBH Link UA Discovery URL is opc.tcp://<ip>:48020. Browsing this endpoint with any OPC UA client (UaExpert, Siemens OPC Scout V10) reveals the configured CPU nodes without further plug-ins.

8. Alternative 2: Siemens CP1613 with S5-Compatible Communication

Siemens documents the S5-compatible communication path for migrating S5 HMI traffic onto the same Industrial Ethernet as S7 nodes. The reference application is in Siemens Entry ID 16667875. The configuration sequence:

1. Install a CP1613 (PCI) or CP1623 (PCIe) Industrial Ethernet card in the OPC server PC.
2. Install SIMATIC NET PC software v6.4 or later (current at the time of this reference is SIMATIC NET V18). Select the SIMATIC NET OPC Server and S7/S5 Communication components.
3. Configure the CP1613 in the PC Station with SIMATIC NET Configuration Console; assign an IP address on the same subnet as the S5 CP1430/CP143.
4. Open Station Configuration Editor and add the OPC Server as a v6.4 application slot. Index 3 is typical for OPC DA.
5. Launch SIMATIC NET Commissioning; create a new connection of type S5 - Communication. Set TSAP to 01.01 for the local side and the remote TSAP configured on the S5 CP1430 (typically 01.01).
6. Define the read/write area using the S5 absolute address: DB 10 DW 0, length 100 words, transport type Job mode.
7. Export the PC Station configuration and download to the CP1613. Restart the OPC Server service.

9. S5 Data Address Mapping for OPC Tag Configuration

When authoring OPC items, the canonical formats are:

// Generic AS511 OPC item syntax (vendor-specific)
S5:[CPU]"DB10"DW0    // 16-bit word, big-endian
S5:[CPU]"DB10"DD4    // 32-bit double word
S5:[CPU]"M"FW0       // flag word
S5:[CPU]"I"IB0       // input byte
S5:[CPU]"Q"QB0       // output byte
S5:[CPU]"T"T5        // timer word
S5:[CPU]"C"C7        // counter word

Word values are stored in big-endian (high byte at low address) on all S5 CPUs. OPC clients that read a 16-bit tag will receive the high byte first. Bit access uses DB10.DX0.0 (data bit) or M.X0.0 (flag bit).

S5 STEP5 Program Considerations

• Data blocks must be opened with C DB 10 before access; an unopened DB returns 0 or triggers an OB23/OB24 error in the CPU.
• Word boundaries in DW access are natural; DX (bit) access must align with the byte boundary (DX 0.0 through DX 0.7, then DX 1.0).
• Timers run at the timebase defined in OB1 (10 ms, 100 ms, 1 s, 10 s) - confirm in the STEP5 program before exposing T values to SCADA logic.

10. Configuration Procedure: Sena LS100 + AS511 OPC Server

This procedure applies when a third-party OPC server with a generic AS511-over-COM driver is available (e.g., KEPware). For Softing or SIMATIC NET, jump to Sections 7 or 8.

10.1 Prerequisites

• Sena LS100 with firmware 1.4+ (verify via web UI).
• OPC server host running Windows 10/11 or Windows Server 2016+.
• Sena VCOM driver v5.20 or later.
• OPC server with AS511-over-COM driver license.
• Null-modem or straight-through serial cable appropriate for the S5 PG port (S5-95U uses straight-through DB15-to-DB9; S5-115U/135U/155U PG ports vary - consult the CPU manual).

10.2 LS100 Network and Serial Configuration

1. Connect a PC to the LS100 Ethernet port. Default IP is 192.168.16.1/24; set the PC to 192.168.16.100.
2. Browse to http://192.168.16.1; log in with default credentials admin/admin.
3. Network > IP Configuration: assign a static IP on the plant network, e.g., 192.168.10.50/24, gateway 192.168.10.1.
4. Serial > Port Settings: set Baud = 9600, Data Bits = 8, Parity = Even, Stop Bits = 1, Flow Control = None. Match exactly to S5 AS511 defaults.
5. Operation Mode: select VCOM. Note the TCP port (default 7000).
6. Firewall: confirm UDP/TCP 7000 is permitted between the OPC server host and 192.168.10.50.

10.3 Windows VCOM Driver Installation

1. Run the Sena VCOM installer. Reboot if prompted.
2. Launch Sena VCOM Manager; click Add.
3. Enter Remote Host 192.168.10.50, Port 7000, Description S5_PG_LS100.
4. Assign an unused COM port number, e.g., COM17.
5. Click Apply. The new COM17 appears in Device Manager under Ports (COM & LPT).

10.4 Verification Round-Trip

1. Install STEP5 V7.x on the OPC server host (or a dedicated engineering PC).
2. Launch PG-95 or STEP5 > File > Online > Set PG Interface; select COM17 at 9600/8E1.
3. Attempt a Status read of the S5 CPU. A successful response confirms the LS100 + VCOM + S5 AS511 path is operational.
4. Read a known tag (e.g., DB10 DW0) and confirm the value matches the PLC program.

10.5 OPC Server Tag Authoring

1. In the OPC server configuration tool, create a new Channel of type S5/AS511 over Serial.
2. Select COM17 at 9600/8E1.
3. Create a Device named after the CPU, e.g., S5_95U_Station1.
4. Add tags using the syntax from Section 9. Example for a 16-bit flag word: S5_95U_Station1.M.FW0.
5. Set the default update rate to 500 ms; lower to 100 ms only for control-critical loops to avoid AS511 bus contention.
6. Save and start the OPC DA server. Browse with an OPC DA client (e.g., Matrikon OPC Explorer) to confirm tags read.

11. Troubleshooting Matrix

12. Verification and Commissioning

After commissioning, perform the following acceptance checks:

1. Round-trip latency: read DB10.DW0 from the OPC client; record time stamp on both client and S5. AS511 over VCOM should achieve 50-200 ms per tag at 9600 bit/s.
2. Sustained read: read 50 tags in a polling loop for 30 minutes; verify no timeouts and no CRC errors in LS100 logs.
3. Write integrity: from the OPC client, write FW200 = 1234; verify on the S5 with PG that the value is stored.
4. Failover check: disconnect the OPC server host from the LS100; confirm the OPC server logs a disconnection event within the configured deadband (default 10 s).
5. Concurrent OPC and STEP5: keep STEP5 connected in monitor mode while OPC is running; verify neither blocks the other for more than the AS511 retry timeout (1 s typical).

13. Migration Recommendation

14. Specifications Summary