Resolving S7-400 CP 443-1 IT to Mitsubishi A1SH Ethernet Setup

David Krause12 min read
S7-400SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Problem Overview

A common integration challenge is establishing Ethernet communication between a Siemens SIMATIC S7-400 station and a Mitsubishi MELSEC-A1SH station, where the Mitsubishi side is already operational but the Siemens side fails to establish the link. The typical hardware involved in the described configuration is:

  • Siemens S7-400 rack: PS 407 4A power supply, CPU 414-2 (6ES7414-2XG03-0AB0, firmware V3.13), and CP 443-1 IT (6GK7443-1GX11-0XE0) on slot 4.
  • Mitsubishi A1SH station: MELSEC-A1SH CPU with an A1SJ71E71-B5-S3 Ethernet interface module.

The root cause of "Siemens side does not work" with the Mitsubishi side already talking is almost always one of the following:

  1. Wrong transport protocol selected (ISO-on-TCP/TCP/UDP) in STEP 7 NetPro.
  2. Partner declared as S7 station rather than unspecified connection.
  3. Mismatched port, TSAP, or IP address between the CP 443-1 IT and the A1SJ71E71-B5-S3.
  4. CPU 414-2 V3.13 operating mode restrictions (CPU 414-2 is a non-`F` variant without `PN` in the part number; it requires the CP for Ethernet routing).
  5. Missing SEND/RECV blocks in the S7-400 user program to drive the configured connection.

This article walks through the full configuration and commissioning sequence for the S7-400 side, the matching A1SJ71E71-B5-S3 setup, and the diagnostics required to bring the link up.

2. Hardware Identification

Module Order Number Function Notes
SIMATIC S7-400 PS 407 4A 6ES7407-0DA02-0AA0 (typical) Power supply, 4 A Slots 1 only
SIMATIC S7-400 CPU 414-2 6ES7414-2XG03-0AB0 CPU, firmware V3.13 Work memory 0.7 MB code / 0.7 MB data; MPI/DP only on-board. CP 443-1 required for Ethernet.
SIMATIC S7-400 CP 443-1 IT 6GK7443-1GX11-0XE0 Ethernet CP, IT variant 2-port switch (10/100 Mbps), 64 total connections, ISO/TCP/UDP/S7/IT
MELSEC-A1SH CPU A1SHCPU MELSEC-A series CPU Older A-series, programming via GX Developer
MELSEC Ethernet module A1SJ71E71-B5-S3 10BASE-T/10BASE5/10BASE2 Ethernet with Web function MC protocol (1E/3E), TCP/UDP, FTP/HTTP

Verify the order numbers by reading the front-panel label of each module and cross-checking the SIMATIC S7-400 module manuals on the Siemens Industry Online Support portal: support.industry.siemens.com. The CPU 414-2 part number 6ES7414-2XG03-0AB0 is the third-generation (XG03) variant; firmware V3.13 supports standard S7 communication and CP routing.

3. Protocol Compatibility Analysis

Siemens S7-400 CP 443-1 IT and Mitsubishi A1SJ71E71-B5-S3 do not share a native application-layer protocol. The decision tree is therefore protocol-architecture-specific:

Siemens Transport Mitsubishi Native Direct Compatibility Required Approach
S7 protocol (port 102, S7 connection) None No Not applicable; do not configure as S7 connection
ISO-on-TCP (RFC 1006, port 102) None No Raw transport with SEND/RECV; Mitsubishi implements only TCP and UDP, not RFC 1006 framing
TCP native (port configurable) MC protocol 1E/3E over TCP (default port 5000, configurable 1024–65535) Yes at transport layer Open TCP connection on both sides; implement MC-protocol client on S7-400 OR raw data exchange
UDP (port configurable) MC protocol over UDP (1E/3E) Yes at transport layer Datagram-based exchange with MC framing; higher complexity

Recommended path: configure a TCP connection with an unspecified partner on the S7-400 side, open a passive (server) or active (client) socket on the A1SJ71E71-B5-S3, and exchange either raw data or MC-protocol frames from the S7-400 user program. For deterministic monitoring of the partner, use the Siemens AG_SEND / AG_RECV function blocks (FB 5 / FB 6 on S7-400) — see STEP 7 V5.x library "SIMATIC_NET_CP".

4. CP 443-1 IT Network Configuration (HW Config)

  1. Open the S7-400 station in SIMATIC Manager with STEP 7 V5.5 or V5.6 (CPU 414-2 XG03 is supported by STEP 7 V5.4 SPx and later).
  2. Open HW Config and confirm the CP 443-1 IT (6GK7443-1GX11-0XE0) is inserted in the rack at the slot specified in the actual hardware (the user has it on slot 4).
  3. Double-click the CP to open Properties — Ethernet Interface.
  4. Set the IP address (e.g., 192.168.0.10), Subnet mask (255.255.255.0), and optionally the Router address if the partner is on another subnet.
  5. Switch to the Options tab of the CP and verify the firmware version reported matches the actual module (the CP 443-1 IT 6GK7443-1GX11-0XE0 ships with various firmware levels; consult the SIMATIC NET CP 443-1 IT Operating Instructions entry for the firmware-to-feature matrix).
  6. Ensure that "Use CP as router for S7 communication" is enabled only if you need PG/OP routing through this CP; for raw TCP it is not required.

Compile and download the hardware configuration to the S7-400. Confirm the CP's SF LED is off and the LINK/RX/TX LEDs reflect cable activity.

Note: The CP 443-1 IT (6GK7443-1GX11-0XE0) is end-of-life and replaced by CP 443-1 (6GK7443-1EX30-0XE0) and CP 443-1 Advanced (6GK7443-1GX30-0XE0). The older "GX11" IT variant still supports all four transports (S7, ISO-on-TCP, TCP, UDP) referenced in the Weintek S7-400 Ethernet Connection Guide.

5. CP 443-1 IT Connection Configuration (NetPro)

  1. In SIMATIC Manager, double-click NetPro to open the network view.
  2. Select the CP 443-1 IT in the S7-400 station. Right-click the connection row at the bottom of the editor and choose Insert New Connection.
  3. In the connection wizard, set the Partner to "Unspecified" (this is the critical step that most users miss — selecting an S7-300/400 partner generates a S7 connection that the A1SJ71E71 cannot respond to).
  4. Choose the Type as TCP connection. (If you require ISO-on-TCP and the Mitsubishi side truly speaks RFC 1006 — most A1SJ71E71 firmware does not — pick ISO-on-TCP connection instead; otherwise remain on TCP.)
  5. Click Apply, then open the connection properties to verify and document the parameters listed in the table below.
  6. Download the connection configuration to the S7-400. The CP stores it in its connection database; the configured ID and LADDR must be referenced from the user program.
NetPro Parameter Value (example) Meaning
Local ID 1 Connection identifier used by AG_SEND / AG_RECV
Partner IP address 192.168.0.20 IP of the A1SJ71E71-B5-S3
Partner Port 5000 TCP port the A1SJ71E71 has opened for MC protocol
Active connection establishment Enabled (S7-400 = active) S7-400 opens the TCP socket; recommended for client role
Operating mode Full duplex / TCP Transport characteristics
Local Port 0 (auto-assigned) Leave at 0 unless a fixed local port is required

The configured ID is shown in the lower pane of NetPro. The LADDR (logical base address) is taken from the CP's hardware address — typically W#16#03FF for the first CP 443-1 in the S7-400. Confirm the value by reading the CP's diagnostic buffer in STEP 7 (PLC → Module Information → Diagnostic Buffer).

6. Mitsubishi A1SJ71E71-B5-S3 Configuration (GX Developer)

  1. Open the A1SH project in GX Developer (or migrate to GX Works 2/3 — the A1SH is supported as a "transitional" target in GX Works 2).
  2. In Parameters → Network Parameters → Ethernet / MELSECNET set:
GX Developer Field Value
Network type Ethernet
Starting I/O No. 0000 (matches slot)
Network No. 1
Group No. 0
Station No. 1
IP address 192.168.0.20
Subnet mask 255.255.255.0
Default gateway 0.0.0.0 (or router if used)
  1. Switch to Open Settings (or Connection Settings) and configure one open for the S7-400 partner:
Field Value
Protocol TCP
Open type MC Protocol (Unpassive or Fullpassive — keep socket open)
Port No. 5000 (decimal)
Fixed buffer / Random access buffer Random access buffer, length 1024 bytes
Pairing open Disable
Existence confirmation Enable keep-alive
  1. Write the parameters to the A1SH CPU and reset the A1SJ71E71-B5-S3. The module's RDY LED should be steady green within a few seconds after restart.
  2. Confirm the port is listening using a Windows PC and telnet 192.168.0.20 5000; the connection should remain open until either side closes it.

For reference, the operating manual of the A1SJ71E71-B5-S3 (IB-66820 or later revision) is available on the Mitsubishi Electric FA Global Site: mitsubishielectric.com/fa/ (search the e-Manual for SH-080008 or "A1SJ71E71").

7. Programming the S7-400 (SEND/RECV FBs)

Once the connection exists in NetPro, the user program must drive it. Use the FBs from the STEP 7 standard library SIMATIC_NET_CP:

  • FB 5 AG_SEND — sends a data block over a configured TCP/ISO connection.
  • FB 6 AG_RECV — receives a data block from the same connection.

Example call in STL (or import into a LAD/FBD block):

// Call once per cycle to receive
CALL FB 6, DB 6
   ID       := 1                  // connection ID from NetPro
   LADDR    := W#16#03FF          // logical address of CP 443-1 IT
   RECV     := P#DB100.DBX0.0 BYTE 200  // receive area, 200 bytes
   NDR      := M 100.0            // new data received (1 cycle pulse)
   ERROR    := M 100.1            // error bit
   STATUS   := MW 102             // extended status/diagnostics
   LEN      := MW 104             // actual bytes received
;

// Trigger a send from FC 12 (cyclic or event-driven)
CALL FB 5, DB 5
   ID       := 1
   LADDR    := W#16#03FF
   SEND     := P#DB110.DBX0.0 BYTE 200  // send area, 200 bytes
   LEN      := 200                 // bytes to transmit
   DONE     := M 110.0
   ERROR    := M 110.1
   STATUS   := MW 112
;

For multi-block payloads larger than the configured buffer, the LEN parameter must equal the total number of bytes; AG_SEND/AG_RECV handle fragmentation internally up to the CP's maximum PDU size (typically 8192 bytes for ISO-on-TCP, up to 64 KB for TCP, see CP 443-1 manual for limits).

8. Status Codes & Diagnostics

STATUS (W#16#...) Meaning Corrective Action
0000 Job complete without error —
7000 No job active Initial state after restart
7001 First call after start of job Normal during handshake
7002 Intermediate call, job still active Continue calling FB cyclically
80A0 Negative acknowledgment from partner (RST received) Check whether A1SJ71E71 has the matching open and port 5000 is open
80A1 Connection aborted (RST or partner timeout) Check keep-alive on A1SJ71E71; verify IP/port; check network path
80A2 SEND/RECV job rejected by CP Connection not fully established; check CP diagnostic buffer
80A3 Data length error LEN > max PDU or > CP buffer; reduce LEN or split the transfer
80B0 No free resources on CP Reduce the number of concurrent connections (max 64 on the CP 443-1 IT)
8085 LADDR/ID does not match a configured connection Verify LADDR and ID match the values from NetPro and the diagnostic buffer

For deeper diagnostics, read the CP's diagnostic buffer from STEP 7 (PLC → Module Information → Diagnostic Buffer → "Open"). The CP 443-1 IT (6GK7443-1GX11-0XE0) records connection states with text strings such as "Connection to partner x.x.x.x:port established" or "Connection terminated because of partner reset". If the buffer shows "no partner reachable" the issue is at the IP/routing layer; if it shows "connection aborted" the issue is at the A1SJ71E71 side.

9. Verification & Testing

  1. Link check: Verify the Ethernet link LEDs on both the CP 443-1 IT and the A1SJ71E71-B5-S3 are lit for the connected port. The CP's LINK LED and the Mitsubishi's COM.ERR LED must both be off.
  2. Ping test: From a PG/PC on the same subnet, ping 192.168.0.20 (A1SJ71E71) and ping 192.168.0.10 (CP 443-1 IT). If ping fails, the issue is purely Layer 3 — fix the IP/subnet/gateway first.
  3. TCP socket test: With the A1SJ71E71 in MC-protocol Unpassive mode, connect using telnet 192.168.0.20 5000. The connection should remain open; type a few hex bytes and observe the A1SJ71E71's RDY LED for activity.
  4. STEP 7 monitor: In NetPro, right-click the S7-400 CP and choose Connection Status (online). The configured TCP connection to the unspecified partner should show Established.
  5. FB monitoring: In online mode, watch the STATUS output of AG_SEND / AG_RECV. STATUS = W#16#0000 (DONE/NDR = 1) indicates a successful transmission/reception cycle.
  6. Loopback test: For first commissioning, configure the A1SJ71E71 to echo received bytes back to the sender (A1SJ71E71 has a built-in echo back / test function accessible through GX Developer → Diagnostics → Test). Use the S7-400 user program to send 16 bytes and compare them with the received buffer.

10. Troubleshooting Matrix

Symptom Likely Cause Action
CP 443-1 IT SF LED lit Configuration not downloaded, or wrong CP order number in HW Config Re-download HW Config; verify MLFB matches 6GK7443-1GX11-0XE0
Ping works, FB5/FB6 STATUS = W#16#80A1 A1SJ71E71 port not open, or wrong port Verify "Open Settings" in GX Developer; ensure Unpassive or Fullpassive for the S7-400 IP
Ping works, FB5/FB6 STATUS = W#16#80A0 Partner is sending RST; possible MC-protocol rejection If implementing MC, check sub-header and device range; otherwise switch to raw TCP and bypass MC framing
Connection toggles Established / Aborted every few minutes Keep-alive mismatch, firewall, or CPU 414-2 OB1 scan time too long Enable keep-alive on A1SJ71E71; ensure OB1 cycle < 1 s; shorten A1SJ71E71's existence confirmation interval
NetPro shows partner in red S7-connection selected instead of TCP with unspecified partner Re-create the connection as TCP + Unspecified
CPU 414-2 SF lit after parameter assignment CPU does not have routing rights for the CP Use CPU 414-2 firmware V3.x (your V3.13 supports this); check that the CP is assigned to the CPU in HW Config

11. Cross-Reference: Where to Find Official Documentation

Which transport protocol should I select in NetPro for an A1SJ71E71-B5-S3?

Use a TCP connection with an unspecified partner. Do not use "S7 connection" or "ISO-on-TCP connection" because the A1SJ71E71-B5-S3 does not implement S7 protocol or RFC 1006 framing. ISO-on-TCP is rejected by the Mitsubishi side even if you match the port number.

What port number should I open on the A1SJ71E71-B5-S3?

The default MC protocol port is 5000 (decimal), but you may use any free port in the range 1024–65535. Configure the same value on both the A1SJ71E71's Open Settings and the S7-400's NetPro Partner Port.

Why does the CP 443-1 IT report STATUS = W#16#80A0 (negative acknowledgment) right after establishment?

W#16#80A0 means the partner is sending an RST or refusing data. On the A1SJ71E71-B5-S3 this typically happens if the open is configured for a fullpassive (client) role but the S7-400 is also active, or if MC-protocol framing is rejected. Configure the A1SJ71E71 open as Unpassive (server) for an active S7-400 client, and ensure the data length matches the buffer size declared in the A1SJ71E71's open settings.

Do I need to use the FB 5 / FB 6 function blocks, or can I use Open Communication (OC) functions?

For the CP 443-1 IT, the simplest path is FB 5 AG_SEND and FB 6 AG_RECV from the SIMATIC_NET_CP library. The newer Open User Communication blocks (FB 100s, "TSEND/TRCV") are supported on CP 443-1 IT only for connections that the CPU establishes directly — when routing through the CP, AG_SEND/AG_RECV is still the recommended interface.

Can the CPU 414-2 (6ES7414-2XG03-0AB0) reach the A1SJ71E71-B5-S3 without a CP?

No. The CPU 414-2 XG03 has MPI/PROFIBUS-DP on-board only; the Ethernet port labeled "PROFINET" on later CPUs is not present on this variant. You must use the CP 443-1 IT (or CP 443-1 / CP 443-1 Advanced) in the S7-400 rack to carry the Ethernet traffic.

Back to blog