Migrating 3964R/RK512 Serial from S5-115 to S7-1500 PtP

Migrating 3964R/RK512 Serial from S5-115 (CP525) to TIA Portal S7-1500 PtP

1. Problem Statement

A legacy installation uses a SIMATIC S5-115 (CPU 945) with a CP 525 communications processor to exchange process data with a third-party "black box" controller. The link uses the Siemens 3964R transport on top of which the higher-level RK512 computer-link protocol carries a Siemens-internal header plus user data. The S5 application issues SEND/FETCH instructions to the CP525, which encapsulates:

• A 4-byte RK512 header (source/destination CPU number, data-block number, byte offset, length, and command ID for SEND/FETCH/IDENT).
• An optional data field whose interpretation (setpoint, actual value, error code) is signaled by the header itself.

The PLC must be replaced with a S7-1500 running in TIA Portal while the black box remains unchanged. The migration is constrained because RK512 is not natively supported on S7-1500 PtP modules — only 3964(R), ASCII freeport, USS, Modbus RTU, and Modbus TCP are available out of the box.

2. Legacy Architecture: S5-115 + CP525

The CP525 is an intelligent serial CP for the S5-115U / S5-135U / S5-155U range, programmed in COM525 (also called COM package 525). It executes the RK512/3964R protocol autonomously, exposing only the SEND/FETCH primitives to the S5 CPU over the backplane.

The RK512 command word is sent in two halves to avoid a 10 02 sequence inside the header itself:

3. Why RK512 Is Not Available on S7-1500

The RK512 computer-link protocol was historically supported on:

• S5 / CP525, CP526, CP527 via COM525 firmware blocks.
• S7-300 / S7-400 with CP340 / CP341 / CP440 / CP441 using the "RK512" function block (FB 8 / SFB 8 family). This is documented in the Siemens manual "Point-to-Point Communication with CP340/CP341/CP440/CP441" (entry ID 1117397 in the Siemens Support Online).

Siemens discontinued RK512 as a selectable protocol starting with the S7-1500 PtP modules. The TIA Portal "PtP" configuration dialogue lists only:

There is no built-in RK512 function block on S7-1500. Sending "Can Siemens provide similar blocks to handle RK512 communication on their S7-1500 PtP communication processor?" therefore resolves to: No, Siemens does not provide an RK512 block for S7-1500. The 3964(R) layer is the only Siemens transport available; RK512 must be either abandoned, emulated in user code, or off-loaded to a converter.

4. S7-1500 PtP Hardware Selection

For an S7-1500 station the PtP function is delivered by communication modules (CM) that plug into the left side of the CPU or by ET 200SP stations. The current catalog (Siemens Online Support, Industry Mall) contains:

* Older version; replaced by the BA series. Firmware ≥ V2.1 recommended for stable 3964R behavior with high baud rates.

5. Migration Paths

There are four practical paths. The choice depends on whether the black box is renegotiable and whether the user is willing to write a custom FB.

Path A — Drop RK512, keep only 3964R + payload

Re-specify the wire format with the black-box supplier: replace the RK512 header with an agreed-upon compact header (length + type field). Both sides send a 3964R telegram whose data field is the new header plus payload. The TIA Portal blocks SND_3964 and RCV_3964 (from the "PtP" library) handle 3964R framing automatically; the application program only has to compose the payload.

Path B — Emulate RK512 on top of ASCII freeport

If the black box cannot be changed, configure the S7-1500 PtP module for ASCII freeport and implement the RK512 send/receive state machine in an SCL function block. The transport layer is then the raw 3964R-style framing (DLE/STX, BCC, DLE/ETX) and the application layer is the RK512 header. Useful building blocks:

• Generate BCC over the header + data area with CRC-8 (or simple XOR BCC matching the CP525).
• Stuffer logic: insert DLE (10h) before any 10h, 02h, or 03h inside the frame (and reverse at receive).
• State machine: IDLE → WAIT_STX → READ_HEADER → READ_DATA → BCC → ACK/NAK → IDLE.

Path C — Use a protocol converter / gateway

Insert a third-party converter that speaks RK512 on the field side and a Siemens-native or open protocol on the S7-1500 side. Typical suppliers:

• Helmholz (e.g., RK512 / 3964R to Modbus TCP or PROFINET gateways).
• ProSoft Technology (RLXIB-3964R or similar).
• Softing / IXXAT / Intesis / Woodhead (various 3964R bridges).

The S7-1500 then talks Modbus TCP (S7-1500 native) or PROFINET to the gateway, dramatically reducing engineering effort. Verify that the converter implements the complete RK512 SEND/FETCH state machine, including FETCH (read) — many low-cost gateways only implement SEND (write) and ignore the partner's reply.

Path D — Retain an S7-300 CP341/CP441 as a gateway

Keep one S7-300 station with a CP341 (6ES7341-1xH02-0AE0) or CP441-2 (6ES7441-2AA05-0AE0) that still supports the RK512 FB, and connect the S7-1500 to the S7-300 via PROFINET or PROFIBUS using PN/PN couplers or PN/DP. The S7-300 runs the RK512 partner to the black box; the S7-1500 reads/writes that data via PUT/GET or BSEND/BRCV. This is a common brownfield compromise when the black box cannot be touched.

6. Path A Implementation: 3964R-Only Configuration in TIA Portal

Prerequisites:

1. TIA Portal V17 or later (V18 / V19 recommended for current CM PtP firmware).
2. S7-1500 CPU with free left-side slot (or ET 200SP with free BaseUnit).
3. CM PtP module (MLFB 6ES7540-1AB01-0AA0 or 6ES7540-1AD01-0AA0).
4. Signed firmware update file if updating module firmware.
5. Agreement with the black-box supplier on the new wire format.

Step 1 — Hardware configuration:

1. Open the device configuration of the S7-1500 station.
2. Drag the CM PtP module to the slot next to the CPU.
3. In the module properties, open "Port configuration" and select "3964(R)".
4. Set baud rate, parity, and flow control to match the black box (default CP525 setting: 9600 bit/s, 8 data bits, even parity, 1 stop bit).
5. Set RK512 option off — not present, do not enable.

Step 2 — Insert and call send/receive blocks:

1. In the program blocks, add the "PtP_Send_3964" (FB / system block — TIA names: SND_3964) and "PtP_Receive_3964" (RCV_3964) blocks from the "PtP" library.
2. Instantiate a static instance DB for each call.
3. Wire the hardware identifier of the CM PtP module to the HW_ID input.
4. Provide a POKE area of sufficient size (max 1024 bytes per 3964R telegram).

SCL — send example
instSND_3964(SND := "TriggerSend",
            LADDR := "Local~CM_PtP_3964".HardwareIdentifier,
            LEN := "iPayloadLen",
            DATA := P#DB_Tx.TxBuf,
            DONE => "stSendDone",
            ERROR => "bSendErr",
            STATUS => "wSendStatus");

Step 3 — Sequence with the black box:

1. Pre-pend a 2-byte length and a 1-byte message type (replacing the 8-byte RK512 header) in your Tx buffer.
2. Send via SND_3964; the module automatically handles 10 02 / 10 03 framing and BCC.
3. For inbound data, RCV_3964 places the payload in the Rx buffer; the application parses length + type and dispatches accordingly.

7. Verification

After commissioning the new link, run the following checks:

1. Link-layer loopback: short TX↔RX on the S7-1500 side and verify SND_3964 / RCV_3964 complete with STATUS = 0000h.
2. Bit-error test: enable a long run of 0x55 transmit patterns via ASCII freeport for at least 10 minutes and confirm zero BCC errors.
3. Sequence test: trigger a known SEND telegram and confirm the black box returns an ACK within the configured acknowledgment timeout (default 1000 ms).
4. Long payload: send the maximum payload (256 bytes for RK512-equivalent systems, 1024 bytes for unrestricted 3964R) and confirm framing is preserved.
5. Latency: measure round-trip time end-to-end; document it for the SCADA/HMI which may depend on cycle time.
6. Cold-restart: power-cycle the S7-1500 with the black box powered; verify auto-reconnect succeeds without manual intervention.

8. Troubleshooting Matrix

9. Engineering Notes for Path B (ASCII freeport RK512 emulation)

If RK512 framing must be preserved exactly, the SCL pseudocode below shows the core state machine. The 3964R-style bytes are inserted by the module driver when the protocol is set to "ASCII freeport with 3964R wrapper" — note that the latter is still 3964(R) and not raw ASCII; for full control switch to ASCII without 3964R wrapper and manage the framing manually.

SCL — RK512 SEND skeleton (Path B, ASCII freeport)
CASE eState OF
  eIdle:
    IF bTriggerSEND THEN
      Buf[0] := 10; Buf[1] := 02;            // DLE, STX
      Buf[2] := BYTE#16#01;                  // RK512 command low = SEND
      Buf[3] := BYTE#16#00;                  // RK512 command high
      Buf[4] := bSrcCPU;                     // source CPU (0)
      Buf[5] := bDstCPU;                     // destination CPU (1)
      Buf[6] := bDstDB;                      // destination DB
      Buf[7] := bOffsetHi; Buf[8] := bOffsetLo;
      Buf[9] := bLenHi; Buf[10] := bLenLo;
      // DLE-stuff data into Buf[11..]
      iTxLen := DLE_Stuff(pData := iData, iLen := iLen, pDst := Buf, iDstMax := 1024);
      Buf[iTxLen+11] := CalcBCC(Buf := Buf[2..iTxLen+10]);
      Buf[iTxLen+12] := 10; Buf[iTxLen+13] := 03; // DLE, ETX
      instSND_ASCII(SND := TRUE, DATA := Buf, LEN := iTxLen+14);
      eState := eWaitAck;
    END_IF;
  eWaitAck:
    IF instRCV_ASCII.NDR THEN
      // expect 10 02 10 30 10 03 (DLE STX DLE '0' DLE ETX) = ACK
      eState := eIdle;
    END_IF;
END_CASE;

10. Practical Recommendation

For most revamping projects, Path A (3964R-only with renegotiated wire format) is the lowest-risk and lowest-effort route. The black-box supplier is contacted once, a 2- or 4-byte replacement header is agreed, and the S7-1500 is configured in 30 minutes. Path B should be reserved for cases where the black-box supplier is unavailable or uncooperative. Path C (protocol converter) is fastest but adds hardware, supply voltage, and an additional failure point; use it when in-house RK512 expertise is limited. Path D (S7-300 gateway) is the most Siemens-idiomatic fallback and preserves any existing S7-300 rack — it is the recommended "safe choice" for brownfield plants where downtime must be minimized.

11. FAQ