Integrating Siemens S7 with Allen-Bradley SLC 500 over Ethernet

Overview

Two Ethernet-capable PLCs do not automatically talk to each other. The Siemens S7 family and the Allen-Bradley SLC 500 share the same physical layer (IEEE 802.3) and the same transport (TCP/IP), but their session, presentation, and application layers are not compatible. Siemens S7 controllers default to S7 Communication (a Siemens-proprietary protocol that runs over ISO Transport / RFC 1006, port 102) and (on the newer S7-1200/1500 lines) OPC UA. Allen-Bradley SLC 500 Ethernet modules speak EtherNet/IP — CIP over TCP/UDP, port 44818 for explicit (class 3) messaging and UDP port 2222 for implicit I/O. Bridging them requires either a PC-based OPC server pair, a purpose-built protocol gateway (ProSoft, HMS Anybus, Molex SST), or a custom S7/CIP client. This reference documents the protocol stacks, the required hardware catalog numbers and firmware revisions, the configuration procedure for each approach, the realistic scan times, and the field-proven pitfalls when connecting a legacy SLC 500 to a modern or legacy S7 CPU.

Protocol Stack Comparison

The mismatch is at layers 5-7. Layer 1-4 will pass traffic between the two PLCs without issue; what is missing is a translator that can issue a CIP Read on one side and an S7 Read on the other.

SLC 500 Ethernet Hardware

The SLC 500 (1746 chassis, 1747 CPU) does not have built-in Ethernet on most catalog numbers. Ethernet is added with a sidecar or rack-resident module:

Critical firmware requirements for MSG over EtherNet/IP on the SLC 500:

• SLC 5/05 CPU firmware ≥ OS501 (FRN 5.01). Earlier OS levels cannot issue CIP Generic over the 1747-EN2T.
• 1747-EN2T firmware ≥ 4.005 for CIP Generic support; ≥ 5.001 for CIP Tag (symbolic) messages.
• RSLogix 500 ≥ v9.0 with the matching AOP (Add-On Profile) for the EN2T revision.

S7 Ethernet Hardware

For all S7 CPUs you must enable remote partner access:

1. TIA Portal → CPU Properties → Protection & Security → tick Permit access with PUT/GET communication from remote partner.
2. Define a DB with the shared data (e.g., DB100 with 20 INTs).
3. Confirm the CPU's Connection Resources (S7-300/400 have a hard limit, typically 16-32).

Connection Architecture Options

Three architectures are used in production. The decision tree is:

Option A — OPC Server Pair on a PC

Classic three-tier architecture:

1. Server A (S7 side): SIMATIC NET PC Software (≥ V13 SP2) provides an OPC DA and OPC UA server. It speaks S7 Communication with the S7 CPU on TCP port 102.
2. Server B (SLC 500 side): RSLinx Classic, RSLinx OEM, or RSLinx Gateway provides an OPC DA server. It speaks EtherNet/IP with the 1747-EN2T on TCP/UDP 44818.
3. Bridge (client): Any OPC DA 2.05/3.0 or OPC UA client (KEPware, Matrikon OPC, Cogent DataHub, WinCC, Ignition, iFIX) reads tags from both servers and writes them back to the other. The tag namespace is unified inside the client.

Typical configuration on the SLC 500 side in RSLinx:

Driver: EtherNet/IP Driver
  AGS path: 192.168.0.10, 1747-EN2T/A, 1, 0
  Update interval: 100 ms (default 1000 ms; reduce to 100 ms for process control)

Typical SIMATIC NET PC station configuration:

PC station index: 1
  S7-300 station: rack 0, slot 2
  Connection: ISO-on-TCP, TSAP local 03.00, TSAP remote 03.01
  Update rate: 200 ms

Realistic scan time: 250-1000 ms per direction with OPC DA polling at 200-500 ms. The PC and the OPC client are a single point of failure and require disciplined Windows patching, antivirus exclusions, and NIC power management disabled.

Option B — ProSoft Protocol Gateway

ProSoft Technology is the de-facto industrial bridge vendor for the SLC 500 era. The ProLinx and the newer PLX32 platforms are the relevant product lines:

The 1747-EN2T acts as EtherNet/IP scanner and consumes a fixed-size input/output assembly from the gateway. The gateway, in turn, maps that assembly to S7 data blocks. Configuration is performed with ProSoft Configuration Builder (PCB).

ProSoft side (PCB):

Module: PLX32-EIP-SIE
  EtherNet/IP side:
    Mode: Scanner
    Connection 1: 192.168.0.10, Assembly 100 (20 words in, 20 words out)
    RPI: 50 ms
  S7 side:
    Connection: ISO-on-TCP, TSAP 03.01
    DB: DB100, byte offset 0, length 40

RSLogix 500 ladder snippet (SLC 500 reading from S7):

Rung 1
  MSG  Instruction
    Type: CIP Generic
    Service: 0x4C (Read Data)
    Target path: 192.168.0.20, 1, 0, N7:0
    Local destination: N7:0 (length 20 words)
    Trigger: Continuous, scan-time priority

RSLogix 500 ladder snippet (SLC 500 writing to S7):

Rung 1
  MSG  Instruction
    Type: CIP Generic
    Service: 0x4D (Write Data)
    Target path: 192.168.0.20, 1, 0, ST14:0
    Source: N7:100 (length 20 words)
    Trigger: One-shot on input transition

Realistic scan time: 50-150 ms per direction with ProSoft ProLinx polling; 20-50 ms with CIP RPI 10-20 ms and event-driven triggers. Determinism is medium-to-high and adequate for slow PID (≤10 Hz).

Option C — Custom Application (libnodave / EIPScanner)

For high-volume or non-standard data, a Windows or Linux service can use libnodave (open-source S7 Communication) and a CIP library such as EIPScanner to do the translation directly without OPC or a gateway. This works for high data rates but requires:

• S7 connection parameters: rack/slot, TSAP, partner IP.
• CIP forward-open request with the correct service code and route path.
• Robust socket error handling on both sides — both protocols drop sockets on network blips and require explicit reconnection.

Avoid this approach for production unless the volume of data exceeds OPC capacity (typically 5000+ tags updated < 100 ms) and you have a clear test plan. It is, however, the cheapest path for prototypes.

Performance and Timing

For PID loops faster than 10 Hz update, the only acceptable paths are ProSoft with RPI 10-20 ms, native S7 PUT/GET (if the SLC 500 side supports it on the bridge), or a custom application with the PID executed on the faster of the two CPUs.

Configuration Procedure (ProSoft Reference Path)

Prerequisites

• SLC 5/05 CPU FW ≥ OS501 with 1747-EN2T FW ≥ 5.001.
• S7 CPU FW per table above with PUT/GET access enabled.
• ProSoft PLX31-EIP-SIE or PLX32-EIP-SIE gateway.
• ProSoft Configuration Builder (PCB) latest version.
• RSLogix 500 ≥ v9.0 with the matching 1747-EN2T AOP.
• TIA Portal (or STEP 7) for S7 side.

Step-by-Step

1. Assign static IPs to all four devices (SLC + EN2T, S7 CPU, ProSoft, engineering PC). Avoid DHCP.
2. In PCB, add the gateway. Configure the EtherNet/IP scanner side with the SLC's IP and define the input/output assembly (e.g., 20 INTs each direction).
3. Configure the S7 side: ISO-on-TCP connection, local TSAP 03.00, remote TSAP 03.01, target DB100, byte offset 0, length 40 bytes.
4. Download the configuration to the gateway. Verify with PCB's Diagnostics window that the EtherNet/IP connection is Open and the S7 connection is Established.
5. In RSLogix 500, add the 1747-EN2T to the I/O tree with the same assembly sizes. The status bits indicate connection health.
6. Add a CIP Generic MSG with service 0x4C (Read) and a CIP Generic MSG with service 0x4D (Write). Trigger the read on a slow timer (e.g., 100 ms), the write on a one-shot.
7. In TIA Portal, monitor DB100. The values should mirror the SLC 500 tags N7:0..N7:19.

Configuration Procedure (OPC Reference Path)

1. Install RSLinx Classic on the engineering PC. Add an EtherNet/IP driver. Browse to 192.168.0.10, 1747-EN2T/A, 1, 0. Confirm the SLC chassis is visible in RSWho.
2. Install SIMATIC NET PC Software. Run Station Configuration Editor and add an S7-300 station. Set the connection to ISO-on-TCP, local TSAP 03.00, remote TSAP 03.01.
3. Install an OPC DA or UA client (e.g., KEPware, Ignition, Matrikon OPC Explorer). Add both servers.
4. Create a tag mapping: SLC.N7:0 ↔ S7.DB100.DBW0, SLC.N7:1 ↔ S7.DB100.DBW2, etc. Set the update rate to 200 ms.
5. Confirm bidirectional flow with a tag-write from the OPC client and observing the destination PLC tag.
6. Configure the OPC client as a Windows service (or run as a service via srvany/NSSM) so it auto-starts.

Verification

1. Layer 1-3 check: ping the SLC 500 (EN2T), the S7 CPU, and the gateway from the engineering PC. All must respond < 1 ms on a quiet LAN.
2. Server-side check: RSLinx RSWho shows the SLC 500 chassis. SIMATIC NET station configurator shows the S7 CPU Online with a green check.
3. Bridge-side check: OPC client shows both servers with non-zero tag values. ProSoft PCB Diagnostics shows connections Open and Established.
4. End-to-end check: Write a value from the SLC 500 (or change a process variable) and confirm the corresponding S7 DB byte updates within the expected scan time. Repeat in the opposite direction.
5. Soak test: Run for 24-72 hours. Monitor the gateway's connection counter and the OPC client's quality codes. Look for "Bad" or "Uncertain" flags.
6. Failover test: Cycle power on the bridge PC, gateway, and one PLC at a time. Verify auto-reconnect within 30 seconds.

Troubleshooting Matrix

Selection Guidance

Safety and Operating Constraints

• Do not route safety-rated signals (CIP Safety, PROFIsafe) over an OPC or generic protocol bridge. Use the native safety network and a safety-rated gateway if cross-vendor safety is required.
• Segment the bridge network with a firewall or VLAN. Both EtherNet/IP and S7 Communication have known unauthenticated read/write vulnerabilities on legacy firmware.
• Disable unused services on the gateway (HTTP, FTP, Telnet) and require a strong admin password.
• Use a dedicated NIC or VLAN for the bridge PC. Do not share the engineering network.

Key Standards and References

• ODVA CIP Networks Library, Volume 1 (Common Industrial Protocol) and Volume 2 (EtherNet/IP Adaptation of CIP).
• OPC Foundation: OPC UA Specification Parts 1-14 (IEC 62541).
• IEC 61158 (fieldbus) and IEC 61784 (profile sets) for CP/CP classification.
• Siemens SIMATIC NET S7 Programming Interface manual and the S7-1200/1500 Communication Function Manuals.
• Rockwell Automation 1747-EN2T User Manual (1747-UM013) and 1747-EN2T Installation Instructions (1747-IN010).

FAQ