Installing CP1430 TCP in SIMATIC S5-155U Slot Configuration Guide

1. Overview: Adding Ethernet to a Live S5-155U System

Retrofitting a SIMATIC S5-155U with a CP 1430 TCP communications processor is a common requirement when modern equipment must exchange data with an established S5 program over Industrial Ethernet. The mechanical challenge is that the central rack is usually full, while the logical challenge is that S5 has no HW Config equivalent to STEP 7 / TIA Portal — every address, every slot, and every multi-CPU relationship is determined by physical switches, the DB1 of each CPU, and any installed Coordinator card.

This reference walks through the complete mechanical and logical retrofit of a CP 1430 TCP into an S5-155U central rack whose last slot cannot accept the CP. The procedure assumes a single CPU S5-155U on STEP 5 with a Coordinator card already fitted (or to be fitted) for multi-CPU IPC flag coordination. The same logic applies to the S5-135U and S5-155U/155H families; consult the Siemens Industry Online Support portal for the specific 155U manual chapter on allowable slot populations.

2. Prerequisites

Before touching the rack, download and archive every CPU's complete project — program blocks, DB1, DB2 (if used for IPC), system data, and any EPROM contents. A corrupt DB1 is the single most common failure mode when an S5 module is moved or replaced, and a clean backup is the only safe rollback.

3. S5-155U Rack Architecture and Slot Topology

The S5-155U central rack (CR) and expansion racks (ER) follow fixed slot rules that are more rigid than S7-300/400. The CPU and Coordinator cards are restricted to specific slots, while digital and analog I/O may sit in any free slot except where the CPU occupies the row. Communication processors (CPs) and interface modules (IMs) are also restricted — they cannot occupy the slot reserved for the CPU, but they are also excluded from certain peripheral slots where their bus-master or interrupt behavior would clash with the I/O scan.

Three physical slot classes must be understood before any move:

The CP 1430 TCP draws power from the S5 backplane and uses the peripheral bus for its dual-port RAM interface to the CPU. Because the peripheral bus is scanned synchronously by the CPU cycle (OB1 cycle), the CP must be installed in a slot whose peripheral bus address is reachable by the CPU's I/O update. This is exactly the same mechanism used by every digital input card, which is why DIP switch addressing is consistent across module classes.

4. Slot Rules: Which Modules Can Be Moved Where

The S5-155U system manual chapter 4.1 contains the canonical table. The simplified rules that matter for a CP 1430 retrofit are:

• DI, DQ, AI, AQ cards can be installed in any peripheral slot of the central rack except the slot reserved for the CPU. Their P/Q byte addresses are set by DIP switch and travel with the card.
• CPs (including CP 1430), IPs (intelligent I/O such as IP 240, IP 252), and IMs (IM 304, IM 308, IM 314) are restricted to specific peripheral slots. The CP 1430 TCP is permitted in most peripheral slots of the central rack except the very last slot of certain rack variants (this is the documented limitation in the source scenario).
• The CPU itself must remain in its fixed slot. Moving the CPU is not a mechanical swap — it requires program reload and configuration validation.
• The Coordinator card (Co 135/155) is required for any multi-CPU configuration and must reside in a slot defined by the CPU manual for the specific CPU variant.

5. Identifying a Candidate Module to Relocate

To free a peripheral slot for the CP 1430 TCP, identify a module that:

1. Currently occupies a mid-peripheral slot that the CP 1430 TCP can use.
2. Is mechanically and electrically compatible with the target slot (i.e., a peripheral slot where I/O is allowed).
3. Does not have firmware or jumpers tied to slot number (rare, but some IPs use slot-encoded interrupts).

The best candidates are almost always:

• An IM 304 / IM 308 / IM 314 used for an expansion rack. If the IM leads to an expansion rack, you cannot move the IM into the CP 1430's former slot without re-routing the expansion rack topology. However, if the expansion rack is fed by a different IM (one already in the middle of the rack), moving that IM into the last slot is rarely possible either — see the slot rule above.
• A DI or DQ card with low criticality. A digital card in the last slot can almost always be moved into the freed mid-rack slot. The address travels with the DIP switches, so STEP 5 program changes are not required.
• An unused or spare slot already fitted with a blanking plate. If a blank exists mid-rack, the move becomes trivial.

6. DIP Switch Addressing: Why the Address Travels With the Card

Every S5 digital and analog I/O module carries a small DIP switch bank that selects the P (input) or Q (output) byte address. When the card is moved to a different slot, the address does not change — the CPU scans the slot, the card reports its DIP-encoded address, and the I/O image is updated at that address. This is a critical property: it means a card swap that does not alter the DIP switches produces no program change.

Typical DIP switch encodings for DI/DQ cards:

For the CP 1430 TCP, address selection is different: the CP uses a DIP switch to set its slot-related base address on the peripheral bus (so the CPU knows where to find the CP's dual-port RAM). The base address must not collide with any DI/DQ/AI/AQ address set by other cards. Typical CP 1430 DIP settings reserve a peripheral area starting at a chosen byte, conventionally placed at the high end of the address space (e.g., P/Q 252 onwards) to avoid user I/O overlap.

7. Coordinator Card and Multi-CPU IPC Flags

If the S5-155U runs a single CPU, no Coordinator is needed for I/O addressing. The Coordinator (Co) is required for multi-CPU coordination, in which case it provides the IPC (inter-CPU communication) flag area used to pass data between CPUs without going through I/O.

The Coordinator must be enabled per CPU in each CPU's DB1. The flags must be defined for the CPU that owns the CP 1430 so that it can pass data to other CPUs and vice versa. The CPU 948 manual is the authoritative reference; see also the Siemens FAQ 22535867 on CP 1430 TCP configuration for an end-to-end example.

For the CP 1430 retrofit, the practical implication is: if your rack has only one CPU, the Coordinator is not required for the CP 1430 itself — the CP exchanges data with its host CPU via the standard dual-port RAM interface. The Coordinator only becomes mandatory when the CP 1430 must pass data to a second CPU on the same rack, which then requires IPC flags to be enabled in both CPUs' DB1.

8. DB1 and Per-CPU Address Assignment

DB1 is the system data block that the S5 CPU reads at restart to determine its own I/O addresses, the Coordinator's IPC flag area (if present), and certain restart behaviors. Unlike STEP 7's HW Config, there is no centralized I/O list — every CPU owns its own DB1 and its own view of the rack.

Typical DB1 entries for a S5-155U with one CPU and a CP 1430:

DB1 (System data, do not edit online without restart)
DW0  : KC 'DB1'                ; DB identifier
DW2  : KF +0                   ; Reserved
DW4  : KF +0                   ; Coordinator base address (0 if no Co)
DW6  : KF +8                   ; IPC flag area size (bytes per CPU)
DW8  : KF +252                 ; CP 1430 base address (per DIP switch)
DW10 : KF +1                   ; Number of CPs in this CPU's view
DW12 : KF +0                   ; Reserved
DW14 : KF +0                   ; Restart mode bits
DW16 : KF +0                   ; Reserved
DW18 : KC 'CP1430'             ; Symbolic CP name for documentation only
; ... additional DW for multi-CPU if applicable

When you move cards, DB1 does not normally need editing unless the Coordinator flag area is changing. For a single-CPU retrofit, the only DB1 change is typically the documentation-only DW entry showing the CP 1430's base address; the program itself continues to run unmodified.

9. CP 1430 TCP Hardware Installation

1. Power down the rack at the PS 951/952. Do not hot-swap S5-155U modules.
2. Remove the blank or DI card from the chosen mid-slot. Note its DIP setting (photograph it).
3. Verify the slot against the manual's table — confirm CP 1430 is listed as supported in that slot.
4. Set the CP 1430 DIP switches for the peripheral base address (e.g., 252) and the slot identification. Refer to the CP 1430 manual for switch banks S1, S2, S3.
5. Insert the CP 1430 into the slot. Apply even pressure on the top and bottom latches simultaneously.
6. Tighten the front-panel screws that lock the card to the rack. Vibration on a S5-155U is a common cause of intermittent peripheral faults.
7. Connect the Ethernet cable to the CP 1430's front-panel RJ45. The CP 1430 supports 10BASE5 (AUI) on older variants and 10BASE-T on newer; verify the variant.
8. Update the rack layout sheet with new slot, DIP addresses, and CP 1430 base address.

For the swapped-out card (e.g., DI 32 moving to the last slot), confirm that the last slot accepts that card type before insertion. If the last slot is mechanically incompatible (e.g., a slot width issue or a termination issue), you cannot move the card there and must find another solution.

10. CP 1430 TCP Software Configuration (COM 1430 / NCM S5)

Once the CP 1430 is seated, configure it from a PG using COM 1430 (or NCM S5 for newer firmware). The configuration is downloaded to the CP via the S5 backplane using the CP's initialization handshake; the CP then boots with the saved parameters.

The configuration file generated by COM 1430 is a binary record loaded into the CP's flash. On boot, the CP performs a hardware self-test, initializes the Ethernet controller, and signals readiness on its front-panel LEDs (typical: LINK, RUN, STOP, FAULT). The RUN LED is the primary indicator that the loaded configuration is valid; FAULT indicates an invalid parameter or duplicate IP.

11. Connection Setup: TCP and ISO-on-TCP

For interop with a modern S7-1500 CPU or a third-party device, ISO-on-TCP (RFC 1006) on port 102 is the standard. The CP 1430 may also support raw TCP and UDP, but these require careful handling of segment boundaries — typically the application prepends a length header (P_LEN) so the receiver can reassemble. ISO-on-TCP transparently handles this.

; S5 side STL snippet - sending a 32-byte message via CP 1430
; using SEND-ALL / RECEIVE-ALL job interface
; (block numbers vary by CP 1430 firmware; consult manual)

      L   DB 100          ; application data DB
      T   IR              ; source pointer
      L   +32             ; length
      T   LW 0            ; length word
      L   KB 1            ; connection ID 1
      T   LW 2            ; connection ID word
      L   KS 'S7-CPU01'   ; destination TSAP
      T   LW 4            ; TSAP word 1
      L   KS 'ISO '       ; "ISO on TCP" tag
      T   LW 6            ; TSAP word 2

      JU  FB 244          ; SEND block (CP 1430)
      ; error handling on RET_VAL follows

For an end-to-end example of an S5-155U with CP 1430 establishing ISO-on-TCP to a S7-1500 CPU, see the Siemens application document "Communication S5-S71500". The same document shows the matching S7-1500 side connection configuration (TSAP, partner IP, active/passive role).

12. Risk Mitigation on a Live Production Line

Stopping the line is rarely permitted. The following sequence minimizes risk for a live S5-155U:

1. Pre-stage the swap with the rack powered off briefly during a scheduled mini-stop. Verify all DIP settings and slot tables offline.
2. Document the rollback: which card goes back to which slot, original DIP settings, and original DB1. Print and keep at the rack.
3. Backup every CPU project including the EPROM image if the CPU uses one. Store on the engineering PC and on a separate USB drive.
4. Add a watchdog rung that ignores the new CP's input bytes for the first 10 minutes after power-up, in case the CP is not yet initialized. This prevents nuisance faults.
5. Apply power incrementally: PS first, observe P/B LED on the CPU, then perform a warm restart (OB21 / OB22) rather than a cold restart (OB20).
6. Monitor the CPU STOP light during the first scan. If the CPU goes to STOP, the most likely cause is an address collision from the new CP 1430 DIP setting.
7. Verify peripheral bus by reading a known DI word that was moved and confirming the value matches the field.
8. Verify Ethernet by issuing a PING from a laptop on the same subnet (Industrial Ethernet hubs and unmanaged switches are typical on legacy S5 networks).
9. Run a controlled test transaction from the new S5 program block through FB 244 SEND against the partner device. Compare with the partner's receive log.

13. Verification Checklist

14. Field-Proven Caveats

• CP 1430 firmware revisions matter. Older firmware does not support RFC 1006 plus the full TSAP length used by S7-1500/1200. Always cross-check the firmware version against the application document listed in section 11.
• Industrial Ethernet hubs are still common on S5 networks. Verify the CP variant supports 10BASE-T (most do) — older CP 1430 variants may ship with AUI only.
• Coordinator conflicts: if the rack has a second CPU, the Coordinator's IPC flags must be sized in every CPU's DB1 before the CP 1430 starts sending multi-CPU traffic. Skipping this produces silent data loss on inter-CPU messages.
• DO NOT assume hot-swap. S5-155U modules, especially older CPs, are not designed for live insertion. Plan a stop.
• Archive the CP's flash configuration separately from the CPU's STEP 5 project. If the CP fails and is replaced, you can restore parameters without re-commissioning from scratch.

15. Frequently Asked Questions