Resolving S5 CP1430 TF Communication Errors on SINEC H1 Networks

1. Problem Overview

A legacy supervisory layer built around a SIMATIC S5-115U PLC equipped with a CP 1430 TF communications processor stops exchanging data with MS-DOS 6.22-based HMI/operator stations running Open Concepts PDS-SE drivers. Plant mimics freeze, log values are not refreshed, and the operator panel appears alive but disconnected. The CP 1430 is reachable through 10BASE2 thin Ethernet, yet no transport connection completes.

The most common trigger in this class of system is a silent MAC-address drift caused by replacement of the PC-side 3COM Etherlink III combo NICs (3C509) without updating the corresponding remote MAC entries inside the CP 1430 TF database. Because Fetch/Write is a non-open service in the TF protocol family, the change is invisible on the PC side and only manifests as a stuck connection at the PLC.

This reference covers:

• Interpreting the 0DFF error returned by showcfg.exe from the PDS-SE driver
• Re-establishing the Fetch/Write handshake between CP 1430 TF and the HMI PCs
• Validating the supporting FB 238/239 and FB 241-251 blocks in the CPU 945
• Mapping a forward migration path to S7-300/400 with SIMATIC NET OPC

2. System Architecture and Components

Understanding the wiring is the first step to isolating the fault. The reference architecture that produces this error pattern is summarized below.

3. CP 1430 TF Communication Stack

The CP 1430 TF implements a layered stack on top of 802.3 10BASE2:

1. Physical: AUI drop, transceiver, RG-58 coax backbone terminated with 50 Ω BNC terminators at both ends.
2. Data link: IEEE 802.3 with on-board MAC (readable via COM 1430).
3. Network: SINEC H1 addressing. CP 1430 holds up to MaximumCircuits = 32 configured connections.
4. Transport: SINEC TF (Technological Functions) offering SEND/RECEIVE and FETCH/WRITE services.
5. Application: Standard DBs and the FETCH/WRITE job interface for the CPU.

Two official reference documents drive the TF configuration:

• SINEC TF user interface — User Interface for the SINEC Technological Functions, Siemens order number 6GK1971-1AB00-0AA1, Release 02.
• SINEC H1 Triaxial Networks Manual, Siemens order number 6GK1971-1AA20-0AA1, Release 03 (used historically for the triaxial variants; consult your local Siemens distributor for current availability).

4. Root Cause: MAC-Address Drift After NIC Replacement

Fetch/Write is a connection-oriented, configured service. Both the CP 1430 TF database and the PC driver must agree on:

• Remote IP/Ethernet MAC of the peer
• Transport Service Access Point (TSAP) on each side
• Direction (initiate at CP or at PC)
• DB number and length on the PLC side

When a 3C509 NIC is replaced, the burned-in 48-bit MAC changes. The CP 1430 TF keeps the old MAC in its connection table. Because PDS-SE talks FETCH/WRITE (a non-open, vendor-fixed service), the HMI PC has no protocol-level way to advertise its new address — the connection simply times out at the transport layer.

The same symptom appears when the plant has expanded from N to N+k operator stations and the new PCs were added without re-running FD => CP on the CP. Hence the operator statement "the PCs have 6 NICs before" is a direct hint that several of the current stations no longer match the CP database.

5. Diagnostic Procedure with showcfg.exe

The Open Concepts PDS-SE v3.2 driver ships a small diagnostic utility: showcfg.exe. Run it from the DOS prompt on the HMI PC:

C:\PDS> showcfg
Buffer      = 16
Queue size  = 32
MaximumCircuits = 32
Error Occurred = 0DFF

The 0DFF code is a PDS-SE-internal value (not a Siemens SINEC code). Its meaning in this driver family is "no transport connection ready within timeout". The driver masks the underlying SINEC TF reason, so additional evidence must be collected at the CP side.

5.1 Cross-checks before touching the configuration

1. Verify the BNC T-piece and 50 Ω terminators on both ends of the 10BASE2 segment. Remove power before reseating.
2. Inspect the AUI-to-RG58 transceiver. A "heartbeat" failure (missing SQE test pulses) is interpreted by 3C509 ODI drivers as no link.
3. Boot a DOS laptop with a known-good 3C509 and a packet capture tool (e.g., ethereal-dos or a manual NDIS sniffer) and confirm 802.3 frames from the CP MAC are visible on the segment.
4. Compare the MAC of the current NIC (printed on the white label of the 3C509) against the value stored in the CP 1430 TF connection database.

6. Error Code 0DFF Analysis

The driver returns 0DFF when the open-circuit condition has been observed for at least one full polling cycle. The two most likely upstream reasons are:

7. FB and OB Configuration in CPU 945

FETCH/WRITE on the S5-115U requires a minimum set of FBs installed in the CPU 945 user memory:

The job interface FBs (FB 246-251) implement the FETCH and WRITE requests on the application side. They are not re-entrant: each station on the network needs its own job number range. The CP 1430 TF, not the CPU, performs the actual transport handshake, so changes to the FBs are required only if the PLC program has been reloaded or if the FBs were overwritten by another utility.

8. Step-by-Step Resolution

Use the following ordered procedure. Each step is a verification gate: do not advance until the gate passes.

Step 1 — Inventory current MAC addresses

1. Power each HMI PC. From DOS, run 3c5x9cfg /mac (or the equivalent utility bundled with the 3C509 driver disk).
2. Record the burned-in MAC. Save to a plain ASCII file named NICS.TXT.
3. If a 3C509 utility is not available, read the value from the white barcode sticker on the EPROM of the card.

Step 2 — Retrieve current CP 1430 TF database

1. Connect a PG with COM 1430 to the CP 1430 TF service port.
2. Select File -> Download from CP -> *FD to receive the full connection database.
3. Open the database in the COM 1430 editor and export the connection list as a CSV-style report.

Step 3 — Reconcile MAC addresses

1. Cross-check each entry in the connection list against NICS.TXT.
2. For each mismatch, note the slot row and the partner MAC that the CP still believes in.
3. Decide the source of truth: in most plant environments the CP database is canonical and the NICs are aligned to it. In a greenfield migration the inverse applies.

Step 4 — Edit and re-issue the CP configuration

1. In COM 1430, modify the Remote MAC field for each affected connection.
2. Save the database locally, then upload to the CP with File -> Send to CP -> *FD.
3. Cycle CP 1430 TF power. The module performs a self-test and reinitialises its transport connections.

Step 5 — Re-align the PDS-SE driver

1. Boot each HMI PC into DOS. The PDS-SE driver reads its configuration from a binary file in C:\PDS.
2. Run SETUP.EXE and confirm the partner MAC and TSAP values match the new CP database.
3. Save and exit; restart the HMI application.

Step 6 — Validate the CPU-side FBs

1. Connect a PG with STEP 5 to the S5-115U.
2. Use File -> Blocks to confirm FB 238, FB 239 and FB 246-251 are present in the CPU.
3. Cross-reference the FB calls inside OB 21/OB 22 (FB 238, FB 239) and OB 1 (FB 246-251).
4. If any FB is missing or overwritten, reload from the project archive.

9. Verification and Functional Testing

1. From a known-good HMI PC, run showcfg.exe again. The line Error Occurred = 0DFF must clear within one polling cycle (typically < 5 s) once the CP establishes the circuit.
2. Open the plant mimic and toggle a bit in the PLC (e.g., a marker that is mapped to the mimic). Verify that the change is reflected within one FETCH cycle.
3. Check the CP 1430 TF front panel: the TXD and RXD activity LEDs must toggle symmetrically under load.
4. Watch the CPU 945 ISTACK for any OB 24 (timeout) or OB 25 (fault) entries. None should appear during a one-hour soak test.
5. Optionally, run a third-party ping-equivalent for SINEC H1 from the PDS-SE driver prompt to confirm each of the six NICs is now reachable.

10. Migration Path to S7-300/400

The S5-115U + CP 1430 TF + DOS HMI stack is end-of-life. A planned migration to S7-300/400 with SIMATIC NET OPC will eliminate the recurring maintenance cost of repairing the SINEC H1 segment. Two official options are recommended by Siemens support for migrating Fetch/Write applications:

1. Direct replacement using SIMATIC NET OPC and Fetch/Write to S5. The PG/PC continues to talk Fetch/Write to a CP 1430 TF or to an S7-CP that emulates the role. See the application example "How do you configure S5-compatible communication to the SIMATIC S5 via Industrial Ethernet for the SIMATIC NET OPC server" in the SIMATIC NET documentation set, page 19 onward.
2. Gateway mode. Replace the CP 1430 TF with an S7 CP (e.g. CP 343-1) and use the S7-side Fetch/Write library to expose the same data. See "How do you set up a Fetch/Write connection (S5-compatible communication) to the SIMATIC S5 via Ethernet for the SIMATIC NET OPC server", page 24 onward.

For greenfield PC software, consider the Siemens Industry Online Support portal which hosts the latest migration guides, the S5-to-S7 converter utilities and the SIMATIC NET PC software V20 documentation.

11. Field-Proven Caveats and Edge Cases

• PG mode at the CP. If a programming device is connected to the CP service port and a software download is in progress, transport connections are paused. Always perform configuration changes on a maintenance window, not during production.
• Volatile memory on older CP 1430 TF. Some early modules had battery-backed but not flash-backed memory. A long power-down will erase the connection database. The current configuration must be archived on the PG after every change.
• AUI transceiver SQE. The 3C509 ODI driver does not support SQE disable explicitly. If your AUI-to-BNC transceiver emits SQE pulses by default, the link may flap. A 10BASE2 transceiver with an SQE-disable switch is preferred.
• Mixing triaxial and 10BASE2. The SINEC H1 triaxial variant is electrical-incompatible with 10BASE2. If the original 6GK1971-1AA20 triaxial manual describes the same network, do not intermate transceivers.
• CPU 945 user memory. The CPU 945 is the high-end 115U CPU. Reloading the entire FB set occupies only a few hundred bytes of user memory; no memory upgrade is required to recover the Fetch/Write handler.

12. Diagnostic Decision Matrix