Replacing a Siemens S5 CP1430 with an S7-1500 While Preserving the Windows NT 4.0 Paper-Roll Tracking Application

Paper-roll conveyors that were originally built around a SIMATIC S5-115U/S5-135U/S5-155U PLC are still in service, and the supervisory tracking application often runs on an industrial PC (IPC) under Windows NT 4.0 Workstation. The IPC talks to the S5 through an Ethernet CP 1430 (or the TCP-enabled variant CP 1430 TCP) using the Siemens ISO-on-TCP transport, defined in RFC 1006. When the S5 is replaced with a SIMATIC S7-1500, two questions immediately surface: is the wire format identical so that the same Ethernet packets can be decoded, and can the existing tracking program (for which the source code is usually unavailable) keep running unmodified?

This reference gives an engineer-to-engineer walkthrough of the protocol, the configuration parameters, the S5 and S7-1500 program blocks, and the PC-side constraints. It consolidates the official Siemens application note "Ethernet Communication (ISO on TCP) between SIMATIC S5 and S7-1500" (Entry ID 109482475, v11) with field-proven migration practice.

1. Migration Scenario Overview

The classic topology that has to be replaced looks like this:

The protocol on the wire does not change. ISO-on-TCP (RFC 1006) is the same transport whether the partner is an S5 with a CP 1430 TCP or an S7-1500 with its integrated PROFINET interface. The migration therefore splits into three independent work packages:

1. PLC migration – replace the S5 with an S7-1500, recreate the S5 application logic, and replace the CP 1430 SEND/RECEIVE blocks (FB 244 / FB 245) with the S7-1500 TCON / TSEND / TRCV instructions.
2. Wire-format migration – keep ISO-on-TCP as the transport. The byte stream seen by the IPC's CP 1613 / S7-1613 driver is identical, so the existing PC program still receives and sends the same payloads.
3. IPC migration – Windows NT 4.0 is out of mainstream support. Plan a parallel path (virtualization, a modern replacement IPC, or a passive bridge) before the S5 is powered off.

2. CP 1430 Protocol Stack and ISO-on-TCP Fundamentals

The CP 1430 family sits in the S5 backplane and implements an Ethernet layer 2/3/4 stack with the Siemens-proprietary transport profile. When the firmware variant supporting TCP/IP is used, the transport profile used to talk to a PC application is ISO Transport over TCP, also called ISO-on-TCP, ISO 8073 class 4 over RFC 1006, or in S7 parlance, connection type 12 (B#16#0C).

RFC 1006 defines a thin TPKT header (4 bytes: version=3, reserved=0, 16-bit length) that wraps a standard ISO 8073 transport PDU. The first octet of the TPDU contains the credit (DT-credit) and TPDU number, and the variable part carries TPDU parameters — most importantly the calling-TSAP and called-TSAP. Those TSAPs are what the S5 COM 1430 parameter assignment screen and the S7-1500 TCON connection description must match.

Because the wire format is byte-identical, the Ethernet packets sent by an S7-1500 PROFINET interface running an ISO-on-TCP connection are indistinguishable on the wire from those sent by a CP 1430 TCP. That is the property that lets the existing PC application survive the migration.

3. Prerequisites and Risk Assessment

Before pulling cables, walk through the following preconditions. Each item is a real, observed source of late-stage project pain on paper-mill conveyor retrofits.

4. S5 Side: CP 1430 Configuration Retention

The Siemens application note 109482475 describes two viable S5 roles. In the recommended role, the S5 is the active partner and opens the ISO-on-TCP connection toward the S7-1500. This keeps the S5 application code untouched (no new FB 244 / FB 245 calls) — only the COM 1430 connection database is updated with the S7-1500's IP address and TSAP.

Typical COM 1430 connection parameters to capture and re-issue:

The CP 1430 firmware's SEND/RECEIVE handling blocks fetch the data to/from the data area defined by the S5 application's FB 244 / FB 245 call. The S5 STEP 5 program does not need to be modified if the S5 is kept as the active partner and the new connection database is downloaded via COM 1430 / COM 1430 TCP.

5. S7-1500 Side: TCON / TSEND / TRCV Configuration

The S7-1500 uses the Open User Communication (OUC) instruction set on the integrated PROFINET interface. The three instructions of interest are TCON (establish ISO-on-TCP connection), TSEND (transmit), and TRCV (receive). For connection type ISO-on-TCP, TCON uses a connection description pointed to by the CONNECT parameter — in TIA Portal V17 and later this is configured as a structured TCON_Configured / TCON_IP_V4 tag.

Equivalent parameters between the S5 COM 1430 and the S7-1500 TCON_IP_V4 connection description:

Sample SCL body of the connection-setup block in TIA Portal V18 for an S7-1516-3 PN/DP, configured as the passive partner for the S5:

// FB "IsoOnTcp_S7"
#iState := 0;  // state machine
CASE #iState OF
  0: // wait for start
      IF #bStart THEN
        #iState := 10;
      END_IF;

 10: // establish connection
      "TCON_DB".REQ := TRUE;
      "TCON_DB".ID   := 1;                  // connection ID
      "TCON_DB".CONNECT := "connIsoOnTcp";  // TCON_IP_V4 tag
      "TCON"(REQ := "TCON_DB".REQ,
             ID  := "TCON_DB".ID,
             CONNECT := "TCON_DB".CONNECT,
             DONE=>"TCON_DB".DONE,
             BUSY=>"TCON_DB".BUSY,
             ERROR=>"TCON_DB".ERR,
             STATUS=>"TCON_DB".STATUS);
      IF "TCON_DB".DONE THEN
        "TCON_DB".REQ := FALSE;
        #iState := 20;
      ELSIF "TCON_DB".ERR THEN
        #iState := 90;                      // error path
      END_IF;

 20: // send roll metadata
      "TSEND_DB".REQ := #bSendTrig;
      "TSEND_DB".ID  := 1;
      "TSEND_DB".LEN := UINT#32;
      "TSEND_DB".DATA := "rollMeta".outArea;
      "TSEND"(REQ := "TSEND_DB".REQ,
              ID  := "TSEND_DB".ID,
              LEN := "TSEND_DB".LEN,
              DATA := "TSEND_DB".DATA,
              DONE=>"TSEND_DB".DONE,
              BUSY=>"TSEND_DB".BUSY,
              ERROR=>"TSEND_DB".ERR,
              STATUS=>"TSEND_DB".STATUS);

 30: // receive commands from PC
      "TRCV_DB".EN_R := TRUE;
      "TRCV_DB".ID   := 1;
      "TRCV_DB".LEN  := 0;                  // accept any length up to ADHOC
      "TRCV"(EN_R := "TRCV_DB".EN_R,
             ID   := "TRCV_DB".ID,
             LEN  := "TRCV_DB".LEN,
             DATA := "TRCV_DB".DATA,
             NDR  =>"TRCV_DB".NDR,
             BUSY =>"TRCV_DB".BUSY,
             ERROR=>"TRCV_DB".ERR,
             STATUS=>"TRCV_DB".STATUS,
             RCVD_LEN=>"TRCV_DB".RCVD_LEN);

 90: // error / watchdog
      #wFault := TRUE;
      #iState := 0;
END_CASE;

For the S7-1500 to behave exactly like a CP 1430, two configuration decisions are mandatory:

1. Connection type 12 (B#16#0C) must be set. Connection type 11 (TCP) will not accept a CP 1430 ISO Transport partner; connection type 1 (S7 communication) will not carry the same payload layout.
2. Active/passive roles must mirror the legacy direction. If the S5 was active, the S7-1500 must be passive. If the S5 was passive (the PC was active), the S7-1500 must be active.

For a phased migration where the S5 is kept initially as the active partner, the S7-1500 is configured passive, and the S5 opens the connection to the S7-1500 IP. This is the architecture in the Siemens application note 109482475.

6. Connection Parameter Mapping (TSAP, Port, IP)

The single most common cutover fault is TSAP mismatch. Below is the mapping matrix to use when copying parameters from the S5 COM 1430 database to the S7-1500 TCON_IP_V4 tag and to the PC driver configuration.

TSAPs are two arbitrary bytes (0x00…0xFF) with the strong convention that the first byte is the transport selector (often the rack/slot in S5) and the second byte is the connection number. In TIA Portal, enter them as a byte array remote_tsap := B#16#01, B#16#01 or as a STRING tagged TSAP_01.01 — the firmware accepts both representations.

7. Windows NT 4.0 Tracking Program Considerations

The Windows NT 4.0 IPC is the fragile element of this migration. NT 4.0 Workstation reached end of support in 2004 and is no longer patched for new CPU instruction sets (no PAE/NX-aware kernel), USB stacks, or modern network drivers. A typical paper-mill tracking PC from that era uses a Siemens SIMATIC NET PC package — S7-1613, S7-1413, or the early SAPI-S7 transport DLL — coupled to a CP 1613 or CP 1413 Ethernet card.

Three survival strategies are common in the field, in order of preference:

For the bridge scenario, verify that the virtual NIC presented to NT 4.0 supports the SIMATIC NET transport that the vendor's program calls. The CP 1613 ISO transport DLLs in SIMATIC NET PC Software versions 6.x and 7.x have been observed to load inside a Windows 2000/XP compatibility layer under VirtualBox bridged networking, but they will not install on NT 4.0 itself once the original installation media is lost. Strategy C sidesteps that by terminating the legacy protocol at the gateway.

8. PC Driver and Application Interface Options

The PC application is typically built against one of these interfaces. Identifying the right one dictates what the S7-1500 must emulate.

For the common case where the IPC uses a Siemens S7-1613 driver and the application reads/writes DB 100 starting at byte 0, the S7-1500 must:

1. Re-create DB 100 with the same byte layout (roll ID, position, weight, scan time, etc.).
2. Expose it through an ISO-on-TCP connection whose TSAPs match the CP 1430 configuration that the S7-1613 driver was originally pointed at.
3. Accept BSEND/BRCV-style fetch requests that the driver issues. The S7-1500 TSEND/TRCV pair behaves identically from the wire's point of view.

9. Step-by-Step Migration Procedure

The sequence below assumes a phased cutover in which the S7-1500 is commissioned on the bench, the S5 + CP 1430 remains in production, and a single Ethernet cutover is performed at the end.

1. Capture the S5 baseline. Document the COM 1430 connection database (export to *.dat), print the S5 program structure (which DBs are accessed by FB 244/245), and capture a Wireshark trace of one full roll-scan cycle to record the exact ISO-on-TCP payload.
2. Build the S7-1500 program. Translate the S5 STEP 5 logic into SCL / LAD / FBD in TIA Portal V18 (or the project-standard version). Re-create the consumed data blocks (e.g. DB 100) with the same byte layout that the PC driver expects.
3. Configure the ISO-on-TCP connection. In Devices & Networks, add a new ISO-on-TCP connection on the S7-1500 PROFINET interface. Set the Connection type to ISO-on-TCP, assign a unique Local TSAP (e.g. 01.01), and enter the Remote TSAP (the IPC's TSAP, e.g. 02.02). Leave Remote address blank for the bench phase; it will be set to the IPC's IP after the cutover.
4. Implement TCON / TSEND / TRCV. Use the SCL template in Section 5. Allocate a connection ID (e.g. 1) and an instance DB per instruction. TCON goes into the startup OB (OB100) so the connection is established on warm restart.
5. Bench-test with a loopback PC. Connect the S7-1500 to a Windows engineering station running the same SIMATIC NET PC Software version that the IPC uses. Use the SIMATIC NET Connection Diagnostics tool to verify the ISO-on-TCP connection establishes, and use a small RFC 1006 client (e.g. tsap-test from the Siemens example collection) to send/receive the same payload length as the original roll-scan data.
6. Mirror the S5 as an active partner for the bench test. Keep the S5 + CP 1430 in the cubicle, change the COM 1430 remote IP to the bench S7-1500's IP, and confirm that the S5 opens the ISO-on-TCP connection to the S7-1500 and the roll-scan data is visible in the S7-1500 TRCV instance DB.
7. Cut over the PC side. Reconfigure the IPC's CP 1613 / driver from the old S5 IP to the new S7-1500 IP. If the IPC is being replaced (Strategy A), perform the same reconfiguration on the new IPC. If the IPC is being virtualized (Strategy B), reconfigure the bridged NIC and re-install the SIMATIC NET transport in the guest.
8. Validate end-to-end. Run three full roll cycles through the conveyor and confirm the tracking application prints the correct roll ID, position, and weight. Compare the S7-1500 TRCV payload against the Wireshark capture from step 1.
9. Decommission the S5 + CP 1430 only after step 8 is signed off. The CP 1430 is end-of-life; spare units should be kept in the warehouse for legacy spares in other cells.

10. Verification, Commissioning, and Troubleshooting

Commissioning checks at cutover:

Common faults and remedies observed on paper-mill retrofits:

11. Frequently Asked Questions