CP524 to CP340 Communication: S5-115 to S7-300 Gateway Setup

Integrating a legacy Siemens S5-115U PLC (with CP524 serial module) into a modern S7-300 (with CP340 serial module) requires bridging three generations of Siemens automation technology. The CP524 only supports point-to-point serial protocols (3964R, 3964, RK512, ASCII), while the S7-300 side has both legacy CP340/CP341 serial and modern CP343-1 Ethernet options. This reference documents the deterministic 3964R/RK512 path, the configuration of both CPs, the STEP 7 function block call surface, and the field-proven alternatives when the 3964R route is impractical.

1. Hardware Identification & Compatibility Matrix

The CP340 family is firmware-loadable for ASCII only; the 3964R and RK512 protocols are embedded in the module firmware. The CP341 supports loadable drivers, which is preferred for long-term 3964R work because Siemens has issued driver updates addressing initial CP340 3964R timing edge cases. For new installations that must keep the S5 in the loop, prefer CP341 over CP340.

2. Protocol Selection: 3964R vs. RK512 vs. AS511

For the question of reading and writing Data Blocks on the S5 from a S7-300, RK512 sitting on top of 3964R is the correct layered choice. 3964R alone gives you framed but untyped text. RK512 adds the typed commands (SEND, FETCH, READ, WRITE) and the address structure (DB number + DW offset + length) that map directly onto S5 data blocks.

3. CP524 Interface & RS232 Pinout

The CP524 provides two physical ports:

• COM1 (X1): RS232C (V.24), 25-pin male D-sub, used for the RK512/3964R link to the S7-300 CP340.
• COM2 (X2): TTY 20 mA current loop, 25-pin female D-sub, typically retained for the legacy InTouch or Movicon SCADA link.

RS232C pinout on the CP524 (X1, 25-pin D-sub, male):

For a CP524-to-CP340 null-modem cable, cross TXD/RXD, RTS/CTS, and DTR/DSR, and connect signal grounds. Pin 4 (RTS) on the CP524 must be looped back to pin 5 (CTS) on the same connector or crossed with the partner's CTS, depending on handshake mode (XON/XOFF is preferred for 3964R; with RTS/CTS selected in the COM PP image, the cable must cross the handshake lines). The CP524 supports four handshakes: none, XON/XOFF, RTS/CTS, RTS/CTS+XON/XOFF.

CP524 protocol configuration parameters (COM PP / COM 525 image):

4. 3964R Protocol Deep Dive

3964R is a Siemens point-to-point protocol that wraps an arbitrary byte stream between two RS232 endpoints. The frame format is:

[STX] [DLE][STX] <DATA, 0..1024 bytes, with embedded DLE doubled> [DLE][ETX] [BCC]

Control characters:

Sender transmits STX. Receiver responds with DLE to grant the bus within the ZVZ (character delay) window. Sender then transmits the data block, escaping any embedded DLE as DLE DLE. After the final ETX and a one-character BCC (XOR of all data bytes after the start-DLE and before the end-DLE), the receiver responds with DLE (good) or NAK (bad) within the QVZ window. The CP524 automatically computes and validates the BCC; the S7 CP340 does the same when 3964R is selected in HW Config.

Three 3964R timer values control interoperability:

1. ZVZ (ZeichenVerzugsZeit, character delay time): max gap between two consecutive characters inside a block. Default 220 ms. If exceeded, the receiver aborts and emits NAK.
2. QVZ (QuittungsVerzugsZeit, acknowledge delay time): max time the sender waits for DLE after STX. Default 2 000 ms in CP524, 550 ms default in CP340. The two values must be made equal, with the longer one as the common denominator, or the partner with the shorter timer will time out before the partner with the longer one can answer.
3. BW (BlockWaitingTime): max time the receiver waits for the first character of a new block after granting the bus. Default 5 000 ms.

5. RK512 Application Layer

RK512 (released by Siemens in 1981) is the application layer that runs on top of 3964R. The CP524 on S5 and the CP340 on S7 both implement the RK512 command set:

For SCADA tag polling the READ (A2h) and WRITE (A3h) commands are typically used; they are stateless, so a single failed transaction does not desynchronize a coordination byte. The FETCH command is the classic method the InTouch/Movicon SCADA used against the CP524: the SCADA sent FETCH, the CP524 placed the requested DB words in the response buffer.

RK512 request frame layout (sender to partner):

[3964R frame payload]
Byte  0  : 0x00 (start byte, reserved)
Byte  1  : Command (0xA2 READ, 0xA3 WRITE, 0xA1 FETCH, 0xAA SEND)
Byte  2  : 0x00 (subcommand, reserved)
Byte  3  : 0x00 (status field, 0 in request)
Byte  4  : 0x00 (length high)
Byte  5  : N   (data length low, max 128 data bytes per record)
Byte  6  : DB   (target S5 data block number, 0..255)
Byte  7  : 0x00 (DX flag 0 / DX number high)
Byte  8  : DBN (data block number low or DX number low)
Byte  9  : DW   (start data word offset in DB, 0..2047)
Byte 10  : AM   (amount of data words, 0..64)
Bytes 11..(11+2*N) : data (WRITE/SEND only)

Each RK512 data record carries at most 128 data bytes (64 data words) in the original specification; multiple records can be chained in one 3964R frame, but the CP524 in older firmware (V1.x) limits a frame to 1 record. The CP340 with RK512 driver accepts the same limit. When sizing data exchanges, plan for one 64-word block per call.

6. CP524 Configuration in COM PP / COM 525

Configuration steps (Windows XP/Win7 32-bit with COM PP V5.x):

1. Connect the Siemens PG (or PC with COM PP) to the S5-115U programming port (TTY on the CPU front X2).
2. Open COM PP, select CP524 in the Module dropdown.
3. Set Slot to the physical CP524 slot in the S5 rack (typically 0..3 in the central rack CR).
4. Configure the protocol image (RK512 profile):

Module       : CP524
Slot         : 0
COM1 protocol: RK512 3964R
COM1 baud    : 9600
COM1 parity  : EVEN
COM1 data bits: 8
COM1 stop    : 1
COM1 handshake: RTS/CTS
ZVZ          : 220 ms
QVZ          : 4000 ms        (must match CP340)
BW           : 5000 ms
Coordination byte S5->S7 : EB0 (bit 0 = handshake flag)
Coordination byte S7->S5 : AB0 (bit 0 = handshake flag)
DB range     : DB1..DB255   (configurable mask; restrict to your SCADA DBs)

5. Save the image to an empty 27C256 EPROM with the PG prommer. The .S5 file is typically named CP524.ROM.
6. Power down the S5 rack, pull the CP524, insert the EPROM in socket X3 (top of module), re-insert the CP524.
7. Power up. The CP524 SF (red) and BF (yellow) LEDs should be off within 5 s of power-up; if the SF LED stays on, the EPROM checksum is wrong or the CP524 firmware is older than V3.0 and rejects the image.

7. CP340 Configuration in STEP 7 (HW Config)

In STEP 7 V5.5 / V5.6 the CP340 is configured in HW Config (or TIA Portal for newer projects):

1. Insert CP340 (6ES7 340-1AH02-0AE0) at the next free slot in the S7-300 rack. The CP340 occupies 1 slot.
2. Open the CP340 Properties dialog, Protocol tab.
3. Set Protocol = 3964R for raw 3964R use, or RK512 if STEP 7 exposes it (in some HW Config versions, RK512 is a checkbox on top of 3964R).
4. Set baud, parity, data bits, stop bits to match the CP524 exactly (9 600 / 8 / Even / 1).
5. On the Interface tab, set Handshake = RTS/CTS (matches the CP524 cable).
6. On the Parameters tab:

ZVZ (character delay)         : 220 ms
QVZ (acknowledge timeout)    : 4000 ms   (matches CP524)
BW  (block waiting time)     : 5000 ms
Max frame length              : 1024 bytes
Initial DLE / STX behavior    : Send STX on send trigger
Retries on NAK                : 3
Retries on no response        : 3
Inter-character gap inside frame: disabled (driver handles)

7. Compile and download the hardware configuration. After CPU restart, the CP340 will be in passive mode waiting for a request or for a CP/FB trigger.

8. STEP 7 Program: Sending and Receiving with FB2 / FB3

The CP340 library is shipped with STEP 7. The relevant blocks for 3964R/RK512 are:

Instance DB and call example (STL):

// Data block of S5 to be read: DB 20 starting DW 0, length 32 words (= 64 bytes)
// Result buffer: DB100 in the S7-300, 32 words from offset 0

CALL  FB7  , DB107        // P_SND_RK
      REQ   :=TRUE         // start new request
      R     :=FALSE
      LADDR  :=256          // logical I/O base address of the CP340 (from HW Config)
      R_TYP  :=B#16#02     // RK512 type: 02 = READ (no coord)
      DB     :=20           // S5 data block number 20
      DBNO   :=0            // reserved, 0 for S5
      DWNO   :=0            // start data word offset in S5 DB20
      ANZW   :=32           // amount in data words (1..64)
      QTY    :=64           // amount in bytes (2 * ANZW)
      DATA   :=P#DB100.DBX0.0 BYTE 64  // ANY pointer to S7 buffer
      LEN    :=64
      DONE   :=M100.0
      ERROR  :=M100.1
      STATUS :=MW102
      
CALL  FB8  , DB108        // P_RCV_RK
      EN_R   :=TRUE
      R      :=FALSE
      LADDR  :=256
      DATA   :=P#DB101.DBX0.0 BYTE 64
      LEN    :=64
      NDR    :=M110.0
      ERROR  :=M110.1
      STATUS :=MW112

Polling sequence: REQ rising-edge triggers an RK512 READ on the CP340. The CP340 sends the 3964R-framed RK512 READ command to the CP524, the CP524 returns the 64 bytes of DB20 from DW0..DW31, the CP340 returns them in DATA and sets NDR. On ERROR, evaluate STATUS against the CP340 status table.

8.1 CP340 status codes (subset)

9. S5-115 Side: Programmatic Read/Write of Data Blocks via CP524

The S5-115U does not need application code to handle the 3964R/RK512 frame: the CP524 firmware decodes the RK512 command and accesses the data blocks on its own. The S5 CPU only needs to expose the relevant data blocks (DB) and reserve input/output bytes for the optional coordination flags.

STEP 5 / S5-DOS program snippet (data exchange DB):

FB 100  // Custom FB: handle CP524 SF LED / coordinator polling
NAME    : CP524_HANDLER
   :U  E 0.0        // CP524 ready signal (front panel "READY" contact)
   :=A 0.0          // Mirror to output for SCADA visibility
   :U  M 100.0      // S7-300 command to read DB20 complete flag
   :S  A 0.1        // Pulse to CP524 coord byte

DB 20  // Application data exposed to S7
0:  KF +0       ; Spare
2:  KH 0000     ; Status word 1 (e.g., motor 1 running)
4:  KH 0000     ; Status word 2 (motor 2 running)
6:  KF +0       ; Counter 1
8:  KF +0       ; Counter 2
10: KC 'S5 TO S7' ; Tag string (8 bytes)
20:  KF +0
30:  KF +0

For the CP524 to access DB20 on behalf of the S7, the DB must be open in the S5 program (at least one A or JU reference). The CP524 does not need to be referenced by the CPU; it owns the bus arbitration to the backplane. The S5-115 CPU only sees the CP524 as an I/O module occupying 32 input bytes and 32 output bytes (slot-decoded). The coordination flags live in the first byte of those I/O areas.

10. Alternative Path 1: AS511 over the S5 Programming Port

If the customer cannot or will not change the CP524 EPROM, the AS511 path is feasible. AS511 runs on the S5-115U's front-panel TTY 20 mA programming port, not on the CP524. A TTY-to-RS232 converter (e.g. Siko, P&S TTY-232 or a generic Stobra 9-pin converter) is wired to the CP340 TTY variant (6ES7 340-1CH02-0AE0).

AS511 frame format (simplified):

[0x00] [0x01] [0x49] [CMD] [DB# hi] [DB# lo] [DW# hi] [DW# lo] [LEN] [data...] [BCC]

CMD byte 0x49 = READ, 0x48 = WRITE, 0x12 = STATUS, 0x16 = STOP, 0x18 = START. Max 32 words (64 bytes) per request. Baud is fixed at 9 600 bit/s, even parity, 8 data bits, 1 stop bit. AS511 is not documented in any open Siemens manual; it is reverse-engineered and supported only by third-party drivers (e.g., LibNoDave for S5 supports AS511). On the S7-300 side, the CP340 TTY variant must be loaded with a generic ASCII driver (no 3964R) and a custom FB/FC must encode/decode the AS511 frame because Siemens does not ship an AS511 driver for the CP340.

11. Alternative Path 2: S7-300 as a Communication Gateway

Use case: a Movicon or WinCC SCADA needs to poll data from the S5-115, and the SCADA has no native AS511/3964R/RK512 driver. The S7-300 with CP340 acts as a protocol converter between RK512 on the S5 side and PROFINET/S7 on the SCADA side.

Configuration of the S7-300 as gateway:

1. The S7-300 CPU 315-2 PN/DP (or CPU 314 + CP343-1) runs an OB1 cycle that calls FB7 P_SND_RK and FB8 P_RCV_RK in a 100 ms OB35 cyclic interrupt. The S5 DBs are mirrored into DB100 on the S7-300.
2. The S7-300 exposes DB100 to the SCADA over S7 Comm (PUT/GET) or, with a CP343-1 Lean, over PROFINET to a WinCC RT / Movicon RT that has the Siemens S7 Comm driver.
3. SCADA polling rate can be 50–500 ms depending on the S5-115 CPU scan time. Do not poll faster than 50 ms: the RK512 transaction round-trip on a CP524 is 30–80 ms at 9 600 bit/s with a 64-byte block.

12. Alternative Path 3: Ethernet Gateways

When the customer is willing to invest in new hardware, two industrial Ethernet gateway families solve the problem without any RK512 work.

12.1 IBH Softec IBH Link S5 (AS511 to Ethernet)

The IBH Link S5 is a DIN-rail module that connects to the S5-115 programming port (TTY 20 mA) and exposes the S5 data blocks as Ethernet/TCP using IBH's S5Comm protocol. The companion IBH Link S7-300/PN connects to the S7-300 MPI/PROFINET port and bridges to the IBH Link S5 over Ethernet, presenting each S5 data block as a transparent S7 DB on the S7-300 side. Pros: no EPROM burning, no 3964R timing risk, RS232 cable distance replaced with 100 m Ethernet. Cons: new hardware cost, two IBH boxes.

12.2 Digi One SP IA (Serial Tunneling)

The Digi One SP IA industrial device server connects an RS232 or TTY device to Ethernet, presenting it as a virtual COM port or raw TCP socket. Digi's serial-tunnel application guide explains how to pair two Digi One SP units to extend a serial cable over Ethernet, which solves the physical distance problem (server room to PLC) without changing the protocol. The customer's Movicon SCADA sees a virtual COM port that is the S5-115's programming port, unchanged. This is the right answer when the SCADA has a working AS511 driver and the customer only needs to extend the cable distance.

13. Wiring & Cable Fabrication

For the 3964R/RK512 path the cable is a null-modem RS232 cable between CP524 COM1 (25-pin male) and CP340 (15-pin male). The CP340 is supplied with a 6ES7 340-1AH02-0AE0 wiring label that documents the 15-pin pinout.

Use shielded cable, shield connected to chassis ground (Pin 1 of the CP340) at one end only (CP340 end). Maximum cable length at 9 600 bit/s is 15 m per EIA-232; for longer runs drop to 4 800 bit/s and use a serial extender or switch to the IBH Softec Ethernet gateway.

14. Commissioning Procedure

1. Bench test the cable. Use a break-out box or oscilloscope on TXD/RXD. Short TXD to RXD at one end; echo test verifies the physical layer.
2. Verify CP524 EPROM. With the S5 in STOP, the CP524 SF LED must be off. If SF is on, EPROM is bad or the slot is wrong.
3. Verify CP340 in HW Config. From STEP 7 online, right-click the CP340, select Module Information. The Diagnostic tab must show No fault; Operating mode = RUN; Interface = RS232; baud = 9600.
4. Loopback test from S7-300. Insert a wire from CP340 TXD (pin 5) to CP340 RXD (pin 6) at the CP340 connector. Call FB2 P_SND_300 with 16 bytes of known data. The matching FB3 P_RCV_300 call must return the same 16 bytes. This validates the CP340 in isolation before the CP524 is even involved.
5. Remove the loopback, plug in the CP524 cable. Power the S5 rack.
6. Online RK512 test from STEP 7. Use the RK512 test tool (in the CP340 library examples directory, file RK512_TST.EXE) or write a short FC that calls FB7 P_SND_RK to read DB20 DW0..DW31. Expected response: STATUS = 0000h, DONE = TRUE, DB100 populated with 64 bytes of S5 data.
7. Document the timing. Time the round trip from REQ = TRUE to NDR = TRUE in the OB1 cycle counter. Expect 30–80 ms at 9 600 bit/s with a 64-byte block. If > 200 ms, suspect QVZ mismatch or electrical noise.
8. Hand off to SCADA only after the loopback test, the bench test, and the on-line RK512 test all pass with STATUS = 0000h for 1 hour continuous polling.

15. Verification Matrix

16. Troubleshooting Matrix

17. Long-Term Migration Considerations

The S5-115U and CP524 were declared discontinued by Siemens in 2007 and have been out of active support since 2014. Spare-part availability is now limited to the second-hand market. When designing a new SCADA integration, plan a 3–5 year migration to a S7-1500 + ET200SP architecture, with the S7-300 (or an IBH Link S5) as a bridging gateway that can be decommissioned when the S5 is finally retired. The 3964R/RK512 link described in this document is an integration band-aid, not a long-term architecture.

For new SCADA projects that must connect to a S5-115, the recommended hierarchy is:

1. First choice: IBH Link S5 + IBH Link S7-300/PN. PROFINET, no EPROM work, IBH support contract available.
2. Second choice: CP524 + CP340 with 3964R/RK512 (this document). Free if hardware is in stock, but no Siemens support, fragile to electrical noise.
3. Third choice: Two Digi One SP IA units as serial-tunnel. Solves distance only; does not solve the protocol problem.
4. Last resort: Custom AS511 driver on CP340 TTY variant. Brittle, undocumented, not Siemens-supported.