Migrating S5 to S7-400 with Legacy SINEC H1 HMI: Gateway Methods

Overview: The S5-to-S7 Migration with a Legacy SINEC H1 SCADA

Revamping a SIMATIC S5-based automation cell to a SIMATIC S7-400 CPU normally means an Ethernet infrastructure upgrade. The complication in this scenario is that the operator HMI—Genesys from Iconics running on DOS—still speaks the legacy Siemens SINEC H1 transport layer. SINEC H1 is not a transport protocol that the S7-400 line natively implements on any of its CPs in current firmware. Engineers who attempt a direct S7-400 <-> old-HMI link will find that the HMI's Sinec H1 driver cannot complete a connection establishment handshake to a CP 443-1, regardless of the active ISO-on-TCP or S7 communication services on the S7 side.

This article documents three production-proven strategies for closing the protocol gap and a fourth (full HMI replacement) for context. Each path is evaluated against cabling, downtime, programming effort, and lifecycle risk. Hardware part numbers, firmware prerequisites, and the configuration steps required in STEP 7 / TIA Portal are given for the SIMATIC S7-400 CPU 416-3 PN/DP and CP 443-1 variants most often encountered during S5 revamps.

SINEC H1 Protocol Background

SINEC H1 was Siemens' first industrial Ethernet stack, standardized in the 1980s for SIMATIC S5 PLCs. It uses IEEE 802.3 10BASE5/10BASE2/10BASE-T physical layers with the ISO/IEC 8073 Transport Class 4 (TP4) on top of the ISO/IEC 8802-2 LLC layer. Connection establishment uses the well-known TSAP (Transport Service Access Point) format TTTT.SSSS—for example 01.01 for the S5 CP 1430 default slot, 02.01 for a second CP.

Key technical properties:

• Bit rate: 10 Mbps (half-duplex, CSMA/CD)
• Transport: ISO TP4, connection-oriented, with class 4 retransmission
• Addressing: TSAP pairs negotiated at OPEN; no DNS, no DHCP
• Application layer: S5 protocol (AS 511-over-Ethernet variants) or Siemens PG/OP protocol
• Cable: Originally 10BASE5 (yellow "vampire tap") coax, later 10BASE2 BNC and ITP (Industrial Twisted Pair)

Because the S5 firmware builds the ISO transport stack on an 8-bit 8051-class coprocessor (CP 1430 uses the Intel 80186 + Siemens SAB 82532 HDLC controller), the on-the-wire encoding is byte-for-byte compatible with the S7-300/400 CP 343-1/CP 443-1 ISO transport only at the LLC layer. The S7 side, however, will refuse the S5 application header unless the higher-level protocol is also matched. S7-400 CPs (firmware 2.x and later) implement the ISO-on-TCP (RFC 1006) variant, which is not the same wire format as raw ISO TP4 used by SINEC H1.

Hardware Inventory: S5, S7, and What Stays in the Rack

Three Viable Migration Paths

Option A — S5 Bridge: Detailed Procedure

This is the lowest-risk path and is the one most field engineers in the field report converged on. The S5 continues to be the SINEC H1 peer for the old HMI; the S7-400 communicates with the S5 only over PROFIBUS-DP (or a point-to-point serial link if a CP 340 is in the S5 rack). The S5 program is reduced to a "shadow DB" of mirrored tags.

Step 1: Inventory S5 I/O and Tag DBs

Using STEP 5 (or the archived S5 backup) extract the DB layout that the Genesys HMI reads. Genesys polls the S5 by reading data block ranges via the CP 1430 FETCH/WRITE service. Typical fetched DBs are DB 100 (process image, integer) and DB 101 (flags, bit-packed). Record:

• DB number and offset range (e.g., DB100 DW0..DW254)
• Data type per word (BYTE, INT, BOOL packed)
• Polling rate (HMI side: scan_time_ms)

Step 2: Configure PROFIBUS-DP Between S7-400 and S5

Add the S5 as a DP Slave on the S7-400's PROFIBUS line. The S5 needs an IM 308-C (6ES5 308-3UC11) or a CP 5431 (6GK1 543-1AA01) in the S5 rack. In the S7 hardware config (HW Config in STEP 7 V5.5, or Device Configuration in TIA Portal V16+):

1. Insert a DP master system on the S7 CPU's PROFIBUS interface (X2).
2. Drag a "S5-95/DP" or generic "DP Slave / I-Slave" entry onto the bus.
3. Define at least 32 bytes of input and 32 bytes of output per slot. For mirrored tag DBs above 64 bytes, use multiple slots.
4. Set the DP address of the IM 308-C to a free value (typical 3, with master = 2). Use the IM 308-C DIP switches to match.

Step 3: Mirror Tags in the S5 Program

In the S5 program, create a flag transfer block: every cycle, write the HMI-fetched DB range into the IM 308-C's I/O area, and read the IM 308-C inputs back into a second DB that the S7 can read by FETCH. The simplest implementation is to put the IM 308-C's input/output range on top of a 1:1 DB mapping:

// S5 STL, simplified
L DW 0   // first 16 bits of HMI DB100
T FW 200 // copy to flag area accessible to IM 308-C I/O
L KB 0   // status
T AB 0   // output byte 0 to IM 308-C

Step 4: Configure CP 1430 to Talk to the HMI

The CP 1430's COM 1430 configuration utility runs on a PG attached to the S5. The TSAP and IP pairing for the HMI must match what the old DOS HMI expects. Common values:

• CP 1430 own TSAP: 01.01 (default for first CP in rack)
• HMI TSAP: 02.01 (Genesys default server TSAP)
• Bus address: 1 (S5 side) / 2 (HMI side), no IP address—SINEC H1 is MAC-based

Activate the S5 transport layer service: PG/OP services on and FETCH/WRITE passive. The HMI will then poll the S5 exactly as before.

Step 5: S7-400 Reads/Writes via PROFIBUS

In the S7 program, use PUT/GET SFBs or simple I/O access (PIW/PQW) on the configured DP slave slots. The mirrored DBs above are now just process image references:

// S7 SCL (S7-300/400, TIA Portal)
"TagFromHMI_DB".HmiTemperature := PIW 256; // first input word from IM 308-C
"TagFromHMI_DB".HmiPressure    := PIW 258;
"HmiCommandDB".HmiStartReq     := PQB 256; // first output to IM 308-C

Option B — Third-Party SINEC H1 Gateway

When the S5 must be removed entirely, an industrial gateway that emulates the S5 side of SINEC H1 is the next-best option. Devices in this category include the INSEVIS NetLink PRO Compact (configured for S5 mode), the Softing S5-LAN->Modbus/TCP converter, and the Helmholz NETLink. The gateway terminates the SINEC H1 connection on one side and exposes a Modbus TCP or S7 server on the other side that the S7-400 polls.

Device Configuration Pattern

1. Install the vendor's PC configuration tool (e.g., INSEVIS "S5-LAN Configurator").
2. Define the S5 data block mirror: DB number, start offset, length, variable list. Example: DB100, offset 0, length 256 bytes, variables Temp1 INT, Press2 INT, Flags BYTE[16].
3. Set the SINEC H1 parameters: own TSAP, remote (HMI) TSAP, transport class = 4, fetch/write enabled.
4. Set the TCP/IP side: IP address, subnet mask, gateway IP, Modbus TCP port 502 (default) or S7 connection to a CP 443-1.
5. Map each S5 variable to a Modbus register: e.g., Temp1 -> 40001 (Holding Reg 0), Press2 -> 40002, Flags -> 00001..00016 (Coils 0..15).

S7-400 Side: Read Modbus TCP via CP 443-1

The S7-400 does not have a Modbus TCP master included. Options are:

• ET 200S Modbus/PN gateway in PROFINET (the gateway is then a PN device to the S7-400, and a Modbus master to the third-party gateway).
• Custom S7 program that opens a TCP connection via the CP 443-1 (FB TCP_CONNECT from the standard library) and parses Modbus frames in user code.
• PN/Modbus gateway from Helmholz, Phoenix Contact, or HMS Anybus X-gateway, which appears as a PROFINET device to the S7 and a Modbus master to the converter.

S7-400 Side: Read via S7 Connection (preferred)

Some gateways expose an S7 client or server interface directly. For an S7-400 CP 443-1, the S7 server role is configured under "S7 connections" with TSAP and connection ID. In TIA Portal this is at Properties > CP 443-1 > S7 connections > New. Set partner IP to the gateway's address; set local and partner TSAPs. The S7-400 program then uses PUT and GET (SFB14/15) to read the gateway's virtual DB.

Option C — Replacing the Legacy HMI

If the S5 is gone and the budget supports it, replacing Genesys with a current SIMATIC HMI is the cleanest outcome. The HMI/PC replacement candidates are:

• WinCC Unified on a SIMATIC IPC (TIA Portal V16+).
• WinCC Professional on a Panel or PC runtime (TIA Portal).
• SINUMERIK PCU / SIMATIC HMI Unified Comfort Panels for machine-level operator panels.

Tag migration: use the Genesys import utility if available, or build a CSV/Excel mapping of the S5 DB offsets to the new HMI tag DB, then import the CSV as the tag list.

STEP 7 / TIA Portal Side: Connecting CP 443-1

For paths B and C, the S7-400 must be configured for Ethernet. The CP 443-1 (any 6GK7443-1EXxx variant) is set up in the device configuration. Key parameters:

• IP address: static, in the same subnet as the HMI gateway. Example: 192.168.10.40/24.
• MAC address: factory default on the label, do not change unless using a managed switch with port security.
• S7 connection: used for PUT/GET; the local TSAP is auto-assigned but should be set explicitly to 01.01 for legacy compatibility.
• ISO-on-TCP: not required for gateway paths but should remain active for diagnostic PG access.
• PROFINET interface: integrated in the CPU 41x-3 PN/DP; the CP 443-1 is only needed if you require a second interface or older ISO services.

Verification & Acceptance Test

1. Physical layer: link LEDs on CP 443-1 and gateway, port statistics on managed SCALANCE show 0 errors, 0 CRC.
2. Transport layer (SINEC H1): from a PG with COM 1430, Trace the HMI connection. Both open and fetch packets should appear with TSAP pair matching the configuration.
3. Transport layer (TCP): from a PG, ping the gateway IP. Then run the S7 connection diagnostic in TIA Portal: Online > Accessible nodes.
4. Application layer: a controlled test where the S7 writes a value to the HMI-displayed variable (e.g., set bit 0 in DB100, byte 0) and the operator confirms the HMI updates within the configured scan time. Reverse: operator enters a setpoint on the HMI, S7 reads the new value via PUT/GET.
5. Failure mode: disconnect the S7 for 30 s. The HMI should continue to show last good values (Genesys retries). Re-connect; the system should re-establish without manual intervention.

Troubleshooting Matrix

Lifecycle and Spare-Parts Note

SIMATIC S5 entered End of Life on October 1, 2017. Spare-parts supply is contractually guaranteed only for premium support contracts; new CP 1430 modules are no longer manufactured. If Option A is chosen, record the manufacturer's date code on every CP 1430 and plan a follow-up phase to move to a gateway or HMI replacement. Keep at least one bench-tested spare CP 1430 in the plant's electronics shop, as lead time for refurbished units is 6–12 weeks.

Document References (Official Siemens Manuals)

• SIMATIC S7-400 S7-400 Automation System, System Manual
• CP 443-1 Lean, CP 443-1, CP 443-1 Advanced Manual
• S5-135U/155U System Manual (CP 143, CP 1430)
• Sinec H1 Network Manual (Industrial Ethernet)
• SIMATIC NET - SCALANCE X-100 Product Information
• SIMATIC S7-400 to S5-95F DP Slave Configuration