Migrating an S5-95U Master to an S7-300 CPU While Keeping S5-95U Slaves on SINEC L2

This reference covers the field-proven procedure for replacing a failed master S5-95U (order number 6ES5 095-8MB02) and its TP15 panel with a SIMATIC S7-300 CPU, while leaving the three remaining S5-95U slave stations untouched. The existing peer-to-peer data exchange is based on Siemens SINEC L2 / FDL (PROFIBUS Layer 2) blocks FB252 (send) and FB253 (receive). The task is to retain that wire-level protocol so that the three S5-95U slaves do not need to be re-engineered, re-flashed, or rewired.

1. Problem Context

Original configuration:

• Four 6ES5 095-8MB02 S5-95U stations on a single SINEC L2 segment.
• One station is the master and also drives a TP15 panel.
• Three stations are slaves that exchange process data with the master using FB252/FB253 on the L2 interface.
• Master S5-95U and TP15 fail beyond economical repair.

Goal: drop a SIMATIC S7-300 (with appropriate CP) into the role of master, keep the cable plant, keep the three S5-95U slaves, and have the L2 data traffic continue without rewriting the slave applications.

2. Hardware Identification: S5-95U 6ES5 095-8MB02

The 6ES5 095-8MB02 is the L2 variant of the S5-95U compact PLC. The 8MB02 suffix is significant: it identifies the second-release module with a SINEC L2 interface on board. Key facts that govern the migration:

Reference documentation: the Siemens manual "SINEC L2 Interface of the S5-95U Programmable Controller" describes the L2 services, SAPs, and block interfaces used by FB252/FB253. Treat this as the authoritative source for the slave-side behavior you must preserve.

3. Protocol Analysis: SINEC L2, FDL, and PROFIBUS Layer 2

SINEC L2 is the marketing name Siemens used for what later became standardized as PROFIBUS with the FDL services defined in EN 50170 / IEC 61158. Concretely, FB252/FB253 on the S5-95U build SDA (Send Data with Acknowledge) and SRD (Send and Request Data) frames at the FDL layer. They do not run DP-V0 cyclic I/O, they do not run DP-V1 acyclic, and they do not exchange DP diagnostics.

This matters for the S7-300 replacement because the only S7-300 CP that can run in FDL mode is the CP342-5 (or its successor CP343-5). A standard DP-only CP, or a CPU's onboard MPI/DP port set to DP master, will not interpret FB252/FB253 traffic from the slaves.

Each FDL relationship is identified by a pair of Service Access Points (SAPs). On the S5-95U, FB252/FB253 parameters include the local and remote SAP. The replacement CP342-5 on the S7-300 must use the same SAP numbers to keep the slaves happy.

4. Why CP340 Fails and CP342-5 Succeeds

It is tempting to reach for a CP340 (for example 6ES7 340-1CH02-0AE0, RS422/485) because the S5-95U's onboard L2 is also an RS-485 physical layer. Do not do this. The pinout, the bit timing, the frame format (PROFIBUS HDLC), and the link-layer state machine are completely different from any point-to-point serial protocol the CP340 can run (ASCII, 3964(R), RK512, Modbus RTU master/slave, USS).

Use the CP342-5 in the S7-300 (or its modern equivalent CP343-5 on a later ET 200S/S7-300 station) and configure it in FDL mode, not DP master. FDL is one of the protocol modes selectable in the CP's HW Config in STEP 7. The CP then exposes FDL SEND / FDL RECV services to the S7-300 program via the standard SEND/RECV interface (FC5/FC6 or the CP's own FBs).

5. Alternative Path: DP/DP Coupler (6ES5 8ME__ on the S5 Side)

If the customer wants to keep the new S7-300 in standard DP master mode and isolate the legacy L2 segment, use a DP/DP coupler. The L2-side flange variant referenced in service discussions is the 6ES5 8ME__ family. The more common S7-side flange is 6ES7 158-0AD01-0XA0. The DP/DP coupler converts DP I/O on one side to FDL on the other, with up to 244 bytes of input and 244 bytes of output transferred bidirectionally. This decouples the migration: the S7-300 can stay in standard DP master / DP slave mode, and the three S5-95U slaves keep using FB252/FB253 unchanged.

For a four-station network with the S7-300 taking the master role, the CP342-5 in FDL mode is usually the lower-cost and lower-latency choice. The DP/DP coupler makes sense when the S7-300 station is shared with additional DP slaves (ET 200, drives, third-party) and you want to keep the legacy L2 segment isolated.

6. Network Topology and Cabling

The original plant likely uses the historical Siemens purple SINEC L2 cable (6XV1 830-0AH10 or the older 6XV1 830-0xxx), which is electrically compatible with PROFIBUS DP cable. At the data rates the S5-95U typically ran (187.5 kbit/s, 500 kbit/s, occasionally 1.5 Mbit/s), the legacy cable is usually fine. Verify before power-up:

1. Shield continuity end-to-end. L2 cable shields must land at the bus connector shell at every node.
2. Characteristic impedance ~150 Ω. Measure with the segment powered off.
3. Termination at both physical ends of the segment only. On an L2 segment, set terminating resistors on the two end stations and off on the middle ones — same rule as DP.
4. No stubs. The S5-95U's 9-pin sub-D must be a bus connector with PG port, not a drop cable.
5. No L2 repeater needed for four nodes; just segment termination.

7. S5-95U Slave Side: FB252 and FB253 Configuration

On each of the three remaining slaves, FB252 and FB253 must keep their existing parameters. Document them before the cut-over so the S7-300 can be configured to match. The relevant parameters are:

For FB253 (L2-RECEIVE), the same parameters appear inverted, with a status byte that the slave's OB1 evaluates. Do not change FB252/FB253 on the slaves during migration — the S7-300 must impersonate the master that the slaves already expect.

8. S7-300 Master Side: CP342-5 in FDL Mode

Configuration steps in STEP 7 (matching the FB252/FB253 parameters captured from the slaves):

1. Insert the CP342-5 in HW Config on the S7-300 rail. The CP is order-number sensitive; use the variant intended for FDL (CP342-5 / CP343-5).
2. In the CP's properties, set the operating mode to FDL (not DP master, not DP slave).
3. Set the PROFIBUS address of the CP342-5 to the value the old master S5-95U had on the L2 segment.
4. Set the baud rate to the value the slaves run on (typically 187.5 kbit/s or 1.5 Mbit/s; check the slaves' project). Mismatched baud is the number-one cold-start failure.
5. For each of the three slaves, define an FDL connection with the remote station's PROFIBUS address and the same SAPs the slaves' FB252/FB253 use.
6. Map the data blocks: each FDL connection's send and receive buffers correspond to the QTYP/QLAE/ZTYP/ZLAE parameters the slaves send.

The S7-300 program then uses the standard SEND/RECV interface (FC5 AG_SEND / FC6 AG_RECV or the FDL-specific blocks) to drive the CP342-5. The control interface per job mirrors the FB252/FB253 paradigm (job number, status word), so the S7-300 control code is essentially a re-implementation of the original master logic on STEP 7.

// Example: cyclic FDL exchange with one S5-95U slave on the CP342-5
// Using FC5 AG_SEND / FC6 AG_RECV in OB1
// ID  = 1   (configured FDL connection ID in HW Config)
// LADDR = hardware address of CP342-5 (from HW Config)
// SEND  = P#DB100.DBX0.0 BYTE 32
// LEN   = 32
// DONE  = M100.0   // send complete
// ERROR = M100.1
// STATUS= MW102    // CP342-5 status

CALL  FC  5
      ID     := 1
      LADDR  := W#16#300
      SEND   := P#DB100.DBX0.0 BYTE 32
      LEN    := 32
      DONE   := M100.0
      ERROR  := M100.1
      STATUS := MW102;

Repeat with FC6 for receive. For each of the three slaves, allocate one ID and one pair of DBs sized to the slave's expected payload.

9. Migration Procedure: Step-by-Step

1. Document the existing network — list every S5-95U's L2 station address, baud rate, SAPs, DBs, and the FB252/FB253 job numbers. Photograph the bus connector terminations.
2. Capture the old master's program from a working backup or PG. Even if the failed master is dead, the three slaves still hold the protocol contract.
3. Order the S7-300 components: CPU 315-2 DP (or 314 + CP), one CP342-5, and the I/O modules to replicate the master S5-95U's signals.
4. Build and bench-test the S7-300 in the workshop. Configure the CP342-5 in FDL mode. Simulate the S5-95U slaves with another S7-300 running a stub FDL SEND/RECV. Verify all three logical connections cycle without error.
5. Power down the line. Isolate the L2 segment by switching off the three slaves.
6. Remove the failed master S5-95U and TP15. Note the bus cable path and termination.
7. Install the S7-300 in the same cabinet. Insert the CP342-5. Land the L2 bus cable on the CP342-5's 9-pin sub-D PROFIBUS connector.
8. Move the bus termination to the new physical end of the segment (the S7-300's CP342-5 connector if it is now at the end, otherwise the existing end node).
9. Power the segment in stages — bring up the S7-300 first, watch CP342-5 diagnostics for "bus fault" / "station not found". Then power each slave one at a time and confirm FB252/FB253 report 0 (no error).
10. Run a controlled data-exchange test for each slave. A failing slave will report the FDL connection as down; the CP342-5's diagnostics buffer gives the failing station and SAP.
11. Restore the TP15/OP15 replacement — the original TP15 is a 5" text display. Modern replacement is a Comfort Panel running a WinCC Flexible / TIA Portal project, with the variable names retained from the STEP 5 source.

10. Verification and Diagnostics

After the cut-over, run a structured verification pass:

10.1 Troubleshooting Matrix

11. Field-Proven Caveats

TP15 / OP15 replacement. The TP15 is a 5" text display that ties to the S5-95U directly via the TTY/AG port, not via L2. If the TP15 was driven by the master S5-95U (not standalone), its variables are sourced from the S5-95U's process image. The S7-300 replacement project must reproduce those variable names in a Comfort Panel (TP700 / TP900) project under TIA Portal or WinCC Flexible 2008 SP5. There is no direct TP15 → Comfort migration tool — expect a screen-by-screen port.

S5-95U firmware revisions. Some 6ES5 095-8MB02 units carry firmware that supports 32-byte payloads, some 64, and some 244. Confirm with the part-number and the MLFB suffix before assuming maximum frame length. The CP342-5 must be configured to match, not to the largest possible size.

CP342-5 vs. CP343-5. The CP343-5 is the modern ET 200S/S7-300 replacement for the CP342-5. Both can run FDL. The CP343-5 has the same S7-300-side programming interface (FC5/FC6) but a different MLFB. For long-term spares, prefer the CP343-5 if the rack and firmware allow.

SAP allocation. SAPs 0 (default) and 1..62 are free for FDL user traffic. SAP 63 is reserved for DPV1. SAP 64..65 are reserved. SAPs are configured on the CP342-5 per FDL connection, not globally. Make sure that the S7-300 master uses a SAP that does not collide with the slave's SSNR mapping.

Avoid mixing DP and FDL on the same CP342-5. A CP342-5 in FDL mode cannot simultaneously act as a DP master. If the S7-300 station also needs to serve a local DP line, add a second CP342-5 (or a CP343-5) and run FDL on one, DP on the other.