S5 to S7 Migration: Lauer PCS900 HMI Memory Mapping Reference

David Krause19 min read
HMI ProgrammingSiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Overview: The SIMATIC S5 + Lauer PCS900 to S7 Migration Challenge

Many European machine builders installed Lauer PCS900 operator panels on top of Siemens SIMATIC S5 PLCs between the late 1980s and the early 2000s. The PCS900 was a compact, rugged operator terminal with 20 freely labelable function keys, 40 indicator LEDs (a green and a yellow LED per key), and a numeric/alphanumeric LC display. It connected to the S5 via PROFIBUS-DP using the Lauer PCSpro configuration software, and was treated as a DP slave on the S5 side.

When the S5 is replaced with a SIMATIC S7-300, S7-400, S7-1200, or S7-1500, two problems surface at the same time:

  1. The S5 program must be re-hosted on the S7 CPU. The original S5 STL or LAD cannot run on S7 directly; you must either use the Siemens S5 to S7 converter (migration tool in the STEP 5 / STEP 7 / TIA Portal family), rewrite from the documentation, or rebuild from scratch.
  2. The HMI tag database must be re-mapped. The PCS900 did not use symbolic tags — it exchanged raw bit/byte/word values with the S5 over a fixed System Data area that PCSpro allocated inside the S5 memory. If you do not extract that mapping before the S5 is decommissioned, you cannot rebuild the operator panel without disassembling the machine's I/O behavior.
Critical rule: the original PCSpro project file is the single source of truth for the F-key to PLC-bit relationship, the LED to PLC-bit relationship, and the process-value to PLC-word relationship. Capture and archive the .pcs or .ppr file before powering down the S5/PCS900 line for the last time.

2. PCS900 Hardware Architecture and I/O Model

The PCS900 panel is documented in the original Lauer manual (publication P991_e) and the PCSpro configuration manual. The relevant facts for migration are:

Feature Specification Migration impact
Function keys 20 freely assignable keys, labeled F01 to F20, foil-inscribed by the integrator Each key emits one bit to the PLC; total 20 input bits required from PLC perspective
LEDs 40 LEDs (green + yellow per key) Each LED is driven by one bit from the PLC; total 40 output bits to the panel
LED modes ON, DARK, FLASHING, INVERS FLASHING Two bits per LED are typically allocated (state + flash attribute) or one bit per mode in PCSpro
Process values Display of integer/BCD values; entry of setpoints Each value consumes one word (16-bit) in the System Data area in each direction
Soft-key actions Situation-related soft-keys overlaid on screen Dynamic key assignment is configured in PCSpro and stored in additional PLC words
Communication PROFIBUS-DP slave (RS-485) PCSpro downloads a GSD; PLC must configure the panel as a DP slave
Configuration port Serial (RS-232) on the panel, accessed via PCSpro software Required to upload the project for archiving

The PCS900 is purely a passive I/O terminal over PROFIBUS-DP. There are no symbolic tags. Every key, every LED, and every value is a fixed offset inside a contiguous data block that PCSpro allocates inside the S5 flag (Merker) area, the S5 peripheral I/O area, or an S5 data block. The integrator chooses the start address during PCSpro commissioning; PCSpro then tells you the resulting offsets.

3. PCSpro Configuration Software and the System Data Area

PCSpro is the Lauer Windows configuration tool used to:

  • Inscribe the F-key labels (printed to foil or rendered on the LC).
  • Define the LED text and behavior.
  • Allocate the System Data area in the PLC.
  • Compile the PROFIBUS-DP slave configuration and GSD.

The System Data area is the single block of PLC memory that the PCSpro project exchanges with the panel. Inside it you will find three logical sub-areas:

Sub-area Direction Typical width Content
Status area (key image) PLC ← Panel 20 bits + padding = typically 3 to 4 bytes State of F01 to F20 (1 = key currently pressed/latched)
Control area (LED image) PLC → Panel 40 bits + padding = typically 5 to 8 bytes State of green/yellow LED for each of the 20 keys
Process value area Bidirectional 2 × N words, where N = number of values displayed or entered Display values (panel reads from PLC) and entry values (panel writes to PLC)

The exact start address and bit packing is not standardized. Each PCSpro project specifies:

  • Base area type: Merker (M / F), Data Block (DB), or Peripheral (P).
  • Base address: e.g. MW 100, DB 50 DBW 20, or PQW 64.
  • Bit offset within the first byte, if the base area does not start on a byte boundary.
Important: the user's question "is the memory address fixed, or freely configurable like a modern Siemens HMI?" — for the PCS900, the base area type and start address are configured by the integrator in PCSpro, and once written to the panel and downloaded to the S5 they remain fixed for the lifetime of the project. They are not fixed by Lauer at the factory. Therefore you must read them from the PCSpro project, not assume a default.

4. SIMATIC S5 Memory Model Relevant to PCS900 Mapping

The PCS900 almost always exchanges data through the S5 Merker (flag) area or an S5 data block. The S5 memory model you need to recognize in the original documentation is:

  • PY / PW
  • S5 operand Meaning Typical size on S5-115U / 135U / 155U Format examples
    I / IB / IW Process image input (bit/byte/word) IB 0 to IB 127 I 0.0, IB 0, IW 0
    Q / QB / QW Process image output QB 0 to QB 127 Q 0.0, QB 0, QW 0
    F / M (Merkers) Internal flags M 0.0 to M 255.7 on most S5 CPUs M 0.1, M 100.7, MW 50, MB 12
    S / RS Retentive flags (S5-115U and higher) S 0.0 to S 32.7 typical S 0.0, RS 0
    D / DW / DR / DD Data words (left byte / right byte / word / double word) DB 2 to DB 255 (DB 0 and DB 1 are reserved) DB 50 DW 20, DB 50 DBW 20
    T Timers T 0 to T 255 T 5
    C Counters C 0 to C 255 C 12
    Peripheral I/O byte / word PY 0 to PY 127 (135U) / PY 0 to PY 255 PY 64, PW 64

    The example in the source question — "M0.1 connect with start button" — refers to Merker 0.1, i.e. bit 1 of byte 0 of the flag area. This is the most common location for the PCS900 status bits because the S5 CPU update of the flag area happens at OB1 cycle boundary and the panel sees a stable image.

    5. PCS900 System Data Area Layout in the PLC

    Below is a typical (illustrative) layout that an integrator might have configured in PCSpro. Use this as a template; the real layout is whatever is documented in the original PCSpro printout.

    PCSpro symbol Direction S5 address (example) Meaning
    F01 status PLC ← Panel M 0.0 State of function key 01
    F02 status PLC ← Panel M 0.1 State of function key 02
    F03 status PLC ← Panel M 0.2 State of function key 03
    F04 to F08 status PLC ← Panel M 0.3 to M 0.7 State of function keys 04 to 08
    F09 to F16 status PLC ← Panel M 1.0 to M 1.7 State of function keys 09 to 16
    F17 to F20 status PLC ← Panel M 2.0 to M 2.3 State of function keys 17 to 20
    LED F01 green PLC → Panel M 10.0 Green LED for key 01
    LED F01 yellow PLC → Panel M 10.1 Yellow LED for key 01
    LED F02 green PLC → Panel M 10.2 Green LED for key 02
    LED F02 yellow PLC → Panel M 10.3 Yellow LED for key 02
    ... ... ... ...
    LED F20 yellow PLC → Panel M 14.7 Yellow LED for key 20
    Display value 1 (analog) PLC → Panel MW 100 Process value shown on screen 1 (16-bit integer)
    Display value 2 PLC → Panel MW 102 Process value shown on screen 2
    Display value N PLC → Panel MW 100 + 2*(N-1) ...
    Entry value 1 (setpoint) PLC ← Panel MW 200 Operator-entered setpoint 1
    Entry value 2 PLC ← Panel MW 202 Operator-entered setpoint 2
    Pitfall: PCSpro allows the integrator to pack the LED bits more densely or more loosely. Some projects use 1 bit per LED (mode is configured by another PLC word). Some use 2 bits per LED (state + flash). Some use 4 bits (mode selector). Never assume the bit map from the table above; read the PCSpro printout.

    6. Extracting the Existing PCSpro Project

    Before the S5 is decommissioned, perform the following archive procedure.

    1. Locate the original PCSpro installation media and license. PCSpro runs on Windows (XP / 7 / 10 with compatibility mode) and requires a parallel-port or USB-to-serial dongle for some panel variants.
    2. Connect the configuration PC to the PCS900 service port using the original Lauer RS-232 programming cable (sub-D 9-pin). The service port is on the rear of the panel.
    3. Launch PCSpro and select Upload project from panel. PCSpro reads back the full configuration including the System Data area specification.
    4. Export the System Data area as a printed report. Use File → Print project documentation. The printout contains every F-key to bit assignment and every value to word assignment in plain text.
    5. Save the project file with a versioned name, e.g. PCS900_MachineLine3_Rev04.pcs. Store it in the machine's engineering archive alongside the S5 program floppy / EPROM image.
    6. Photograph the panel front showing the foil inscriptions on the function keys. This gives you the human-readable meaning of each F-key (e.g. F03 = "Start", F04 = "Stop", F11 = "Acknowledge fault").
    If the panel has died and you cannot upload: you may still recover by reading the S5 program source (LIST or INAW STL) and grepping for the M / DB addresses that are written or read in the same OB1 / OB21 / OB22 blocks as the PROFIBUS I/O handling. This is a last resort and is significantly slower than reading the PCSpro printout.

    7. Mapping PCS900 Tags to SIMATIC S7 Addresses

    After you have the PCSpro printout, the migration to S7 follows this transformation table.

    S5 operand in PCSpro S7 equivalent (S7-300/400) S7-1200/1500 equivalent Notes
    M x.y (flag bit) M x.y (Merkers; same name) %M x.y or tag in M memory Direct mapping if address is in range; otherwise remap to a DB bit
    MB x (flag byte) MB x %MB x Direct mapping
    MW x (flag word) MW x %MW x Watch byte order: S5 is big-endian for words, S7 is little-endian within a word (byte swapped inside MW). If you mirror a 16-bit value into an S7 MW, swap the two bytes on the S5 side or use a DB and explicit SWAP / TAW
    DB n DBW x DBn.DBW x "MyDB".Static.x as Word Direct mapping; both S5 and S7 use 16-bit words at the same offset
    I x.y / IB x I x.y / IB x %I x.y / %IB x Direct mapping if PROFIBUS master I/O area is preserved
    Q x.y / QB x Q x.y / QB x %Q x.y / %QB x Direct mapping if PROFIBUS master I/O area is preserved
    PY x / PW x (peripheral) Direct peripheral access no longer recommended; use process image or PIW/PQW Use process image Re-map into PIW / PQW or into I / Q of the PROFIBUS slave slot

    7.1 Byte-swap and word-order rules

    S5 stores a 16-bit word with the high byte at the lower address. S7 also stores a 16-bit word with the high byte at the lower address. This part is the same. The confusion arises when you read an S5 MW and then re-create the same logical value in S7. If the PCSpro printout says "Process value 1 is at MW 100, 16-bit integer, big-endian word", the S7 equivalent is "MW 100, INT, big-endian word" — direct copy.

    Where the byte order changes is when the PCSpro packs two values inside one word, e.g. low byte = status nibble, high byte = value. In that case the PCSpro printout shows two byte addresses that you must rebuild explicitly on the S7 side.

    7.2 Symbol table reconstruction

    Create a STEP 7 / TIA Portal symbol table that mirrors the PCSpro assignment. Example fragment for the table above:

    // Symbol table excerpt (STEP 7 / TIA Portal)
    HMI_F01       BIT   M0.0     // PCS900 key F01 status
    HMI_F02       BIT   M0.1     // PCS900 key F02 status
    HMI_F03       BIT   M0.2     // PCS900 key F03 status (Start)
    HMI_LED01_G   BIT   M10.0    // PCS900 LED F01 green
    HMI_LED01_Y   BIT   M10.1    // PCS900 LED F01 yellow
    HMI_Disp1     INT   MW100    // PCS900 display value 1
    HMI_Disp2     INT   MW102    // PCS900 display value 2
    HMI_Set1      INT   MW200    // PCS900 entry value 1
    HMI_Set2      INT   MW202    // PCS900 entry value 2
    

    This symbol table becomes the tag interface you then bind to the new Siemens HMI in WinCC (TIA Portal) or to a third-party HMI.

    8. Selecting and Configuring a Replacement HMI

    The PCS900 is end-of-life. Modern replacements fall into three categories.

    Option Connection Pros Cons
    Siemens SIMATIC Comfort Panel (TP / MTP) PROFINET (native) or PROFIBUS with bus adapter Native TIA Portal integration; symbol table reuse; same Merker / DB tag model Different front cutout dimensions; new foil / overlay required
    Siemens SIMATIC Basic Panel (KTP) PROFINET Low cost; WinCC Basic configuration No PROFIBUS; limited number of tags; smaller display
    PC-based WinCC Runtime PROFINET / PROFIBUS / OPC UA Largest screen possible; soft-keys as needed Higher hardware cost; industrial PC required
    Keep PCS900 and replace only the PLC PROFIBUS-DP (with CP342-5 on S7-300 or CM/CP on S7-1200/1500) Zero HMI rewiring; preserves operator muscle memory Spare PCS900 panels are scarce; PCSpro is end-of-life

    If you keep the PCS900, you must keep the original PROFIBUS slave GSD and configure the S7 as DP master. For an S7-300, use CP 342-5 or the integrated DP port of the CPU 31x-2 DP. For an S7-1200, add CM 1243-5. For an S7-1500, use CM 1542-5. The DP master config is loaded into the S7 using STEP 7 HW Config or TIA Portal device configuration. The I/O area assigned to the PCS900 slot becomes the new home of the System Data area — for example, the PCS900 might occupy input bytes 0 to 7 and output bytes 0 to 7, so the panel's status bits land in IB 0 and the LED control bits live in QB 0.

    9. Step-by-Step Migration Workflow

    1. Archive the existing project. Upload the PCSpro project, print the System Data report, photograph the front foil, archive the S5 program (LIST / INAW STL on floppy, EPROM dump, or STEP 5 archive).
    2. Convert or rewrite the S5 program to S7. Use the Siemens S5 → S7 converter for a first-pass translation, then manually clean up any unsupported instructions. Address all S5 absolute accesses against the new S7 tag names.
    3. Decide HMI replacement strategy. Either keep the PCS900 (replace only the PLC) or fit a new Siemens panel.
    4. If keeping the PCS900: configure the S7 as DP master; install the PCS900 GSD in TIA Portal; map the panel's input/output bytes to the addresses the PCSpro project allocated. Mirror the original Merker assignments into the S7 Merker area or into a dedicated DB so that the rest of the S7 program can stay unchanged.
    5. If replacing the panel: create the symbol table from section 7.2; build the WinCC / TIA Portal screen layout matching the original 20-key philosophy; bind each F-key tag to the original S5/S7 Merker or DB bit. Render the foil or label the new keys with the same inscriptions.
    6. Compile and download the S7 program and the HMI configuration. If using TIA Portal, compile as a single project so the HMI tag table binds at compile time.
    7. Run an off-line simulation. Use PLCSIM (S7-300/400) or PLCSIM Advanced (S7-1500) and the WinCC Runtime simulator to verify that every F-key toggles its expected bit and every LED responds.
    8. Power down the S5 line. Replace the CPU and any affected I/O. Power up the S7 and the HMI.
    9. Run the on-line commissioning checklist. See section 10.

    10. Verification and Commissioning Procedure

    After the swap, perform the following checks before returning the line to production.

    # Check Method Pass criterion
    1 PROFIBUS / PROFINET link to panel Read diagnostic buffer on the S7; read PCS900 / panel diagnostic LEDs No diagnostic interrupt; green "BUS" LED on panel
    2 F-key electrical path Monitor HMI_F01 in VAT table while pressing F01 on the panel Bit toggles 0 → 1 → 0 as key is pressed and released
    3 LED electrical path Force HMI_LED03_G = 1 in VAT; observe the green LED on the panel Green LED on F03 lights
    4 Display value path Force HMI_Disp1 = 12345 in VAT; read the panel screen Screen shows 12345 in the correct field
    5 Entry value path Enter 6789 in the panel's setpoint field; read HMI_Set1 in VAT Word shows decimal 6789 (or hex 0x1A85)
    6 Byte order sanity Write MW100 = 16#1234; read panel display Panel shows 4660 (decimal of 0x1234) — if reversed, you have a byte-swap bug
    7 Watchdog and PROFINET / PROFIBUS timeout Pull the bus connector; check S7 goes to stop or to OB82 / OB86 handler as expected PLC enters configured error state and panel shows "no connection"
    8 Operator acceptance Have the operator press each key in turn and confirm the LED / process response matches the original All 20 keys behave identically to the pre-migration baseline

    11. Troubleshooting Matrix

    Symptom Likely cause Fix
    All keys appear dead; panel reports "no PLC\ PROFIBUS / PROFINET cable fault; GSD mismatch; wrong slot in HW Config Verify GSD version matches PCSpro project; check baud rate (default 1.5 Mbit/s for PCS900); re-terminate bus with 220 Ω at both ends
    Keys work but LEDs do not light Bit polarity inverted; PCSpro project used inverted logic; byte-swap on the output word Compare bit numbering between PCSpro printout and S7 symbol table; ensure the byte address handed to the PCS900 output area starts on a byte boundary
    Display shows garbage or wrong value Byte-swap; wrong data type (BCD vs INT); wrong word offset Re-read PCSpro printout; check whether PCSpro was set for BCD or INT for that value; in S7, declare the tag as INT (or WORD) accordingly
    Setpoint entered on panel is off by factor of 10 or 256 Decimal / hex mismatch; scaling in PCSpro vs scaling in PLC Inspect the linear scaling block in the S5 source and replicate it in S7; PCSpro does not do scaling, the PLC does
    Some F-keys do nothing, others work Bit offset mismatch; PCSpro project was re-saved after initial install Compare current PCSpro printout against archived printout; re-upload project from the panel
    S7-1200/1500 cannot talk to PROFIBUS PCS900 CPU does not have a PROFIBUS interface; missing CM/CP Install CM 1243-5 (S7-1200) or CM 1542-5 (S7-1500); older S7-1200 firmware < V4 does not support CM 1243-5 as DP master
    PCSpro no longer installs on a modern Windows PC Software end-of-life; missing LPT dongle driver Run PCSpro in Windows XP Mode / virtual machine; use a USB-to-serial adapter (FTDI-based, e.g. ATEN UC-232A) with the legacy COM port redirected
    Replacement panel does not match operator workflow Key labels were guessed instead of read from the original foil Re-photograph the original panel front; transcribe the foil text exactly; do not invent key labels

    12. Related S5 / S7 Migration Notes

    • STEP 5 program conversion to STEP 7 is supported by the Siemens S5 to S7 converter for STL / LAD / CSF. Not every FB and not every FB parameter block is convertible. Plan to rewrite the process-specific FBs by hand.
    • PROFIBUS-DP master configuration in TIA Portal lives under Device configuration → Properties → PROFIBUS interface → Operating mode → DP master. The PCS900 GSD must be installed first via Options → Manage device description files (GSD).
    • Symbolic versus absolute addressing in S7: take the opportunity of the migration to introduce a symbol table. The PCS900 was absolute-only; S7 can be either. Future-proof the next migration by storing every panel-related tag in a dedicated DB (e.g. DB 900 "HMI_Interface") instead of scattering bits through the Merker area.
    • Retain the original PCSpro printout in the machine documentation folder for the lifetime of the equipment. If a future technician re-uses the machine as a spare-parts donor, the HMI mapping is part of the asset value.

    How do I find the memory address that connects the Lauer PCS900 HMI to my S5 PLC?

    The mapping is not fixed by the manufacturer. Open the original PCSpro project (upload it from the panel if you no longer have the file), and look at the System Data area report. PCSpro prints the exact Merker (M / F), Data Block (DB), or Peripheral (P) addresses used for the F-key status bits, the LED control bits, and the process value words. Without that report there is no reliable way to recover the mapping.

    Is the PCS900 key-to-PLC address configurable, or is it hard-coded at the factory?

    It is configurable. The integrator chooses the base area type and start address inside PCSpro at commissioning time. Once downloaded, the mapping is fixed for the life of the project but is not a factory default — you must read it from the PCSpro project file or from the panel upload.

    Can I keep the PCS900 panel and only replace the S5 with an S7?

    Yes. Keep the PCS900 as a PROFIBUS-DP slave and configure the S7-300 / S7-400 / S7-1200 / S7-1500 as the DP master using the appropriate CP (CP 342-5, CM 1243-5, or CM 1542-5). Install the original PCS900 GSD, allocate input/output bytes to the panel slot, and mirror the original Merker / DB layout into the S7 so that the rest of your S5-converted logic keeps working unchanged.

    How do I upload the PCSpro project from a working PCS900 panel?

    Connect the original Lauer RS-232 service cable (sub-D 9-pin) from the panel's service port to a PC running PCSpro, launch the software, and choose "Upload project from panel". Save the resulting .pcs file and print the System Data report immediately, before powering down the S5 line for the last time.

    What replaces the PCS900 if I want a modern Siemens HMI?

    A SIMATIC Comfort Panel (TP or MTP series) configured in TIA Portal with WinCC is the direct replacement. The same Merker or DB tag names used in the S7 symbol table bind one-to-one to the new HMI tags. Plan for a new front cutout and a fresh foil or label insert, because the physical dimensions and key count of the PCS900 do not match any current Siemens panel exactly.

    My S5 flag was M 0.1 for "Start". How do I move that to S7?

    If M 0.1 is within the S7 Merker area (it is, on every S7-300/400/1200/1500 CPU), the S7 equivalent is also M 0.1. Declare it as HMI_F03 BIT M0.2 in the STEP 7 / TIA Portal symbol table (the original M 0.1 example from the source becomes whatever bit the PCSpro project assigned to F03). Verify with a VAT table that pressing the key toggles the bit, and that writing the bit from the PLC turns on the expected LED.

    Back to blog