S7-400 to S5-155H Gateway Communication via CP 1430 TF and WinCC

S7-400 to S5-155H Gateway Communication via CP 1430 TF and WinCC V6.2: Field Reference

This field reference documents an Industrial Ethernet configuration in which a Siemens S5-155H redundant PLC operates as a gateway between an S7-400 station and a WinCC V6.2 SCADA host. The S5-155H is fitted with a CP 1430 TF (Transport Forwarding) communications processor, the S7-400 is fitted with a CP 443-1, and the SCADA node carries a CP 1613 layer-4 PCI card. All three endpoints exchange data over Industrial Ethernet using ISO Transport (RFC 1006 on top of TCP/IP, port 102) with two-byte TSAP addressing.

Three questions always come up the first time this topology is built:

1. Can a single CP 1430 TF serve both the upstream S7-400 link and the downstream WinCC link simultaneously? Yes. The CP 1430 maintains a connection database with up to 16 transport connections and keeps each connection's send queue, receive buffer, and state machine independently.
2. Does the S5-H redundancy interfere with the WinCC Layer-4 channel? It can. The WinCC V6.2 "S5 Ethernet Layer 4" channel was not always explicitly released for S5-H systems; commissioning should be coordinated with the system integrator (the legacy vendor community in this space is dominated by Indu-Sol, formerly IT4 Industries) and verified end-to-end before plant acceptance.
3. Which blocks implement the data exchange? On the S5 side, the CP 1430 SEND/RECEIVE/FETCH blocks (FB 244/245/246 family from the COM 1430 library). On the S7 side, the standard SFBs/FBs BSEND/BRCV (FB 12/13) or PUT/GET (FB 14/15) on the CP 443-1.

1. Architecture and Protocol Topology

The reference topology is a star around an Industrial Ethernet switch (10/100 Mbit/s). Each device terminates a CP that implements the same ISO Transport stack. The S5-155H is the only bidirectional element: it accepts WinCC polls on one connection and initiates FETCH requests on the S7 connection. The S7-400 and the WinCC host never talk to each other directly.

2. Prerequisites and Compatibility Matrix

Validate every line of this matrix before purchasing or building. S5 components are no longer in mainstream production; refurbished parts are the only practical source.

3. CP 1430 TF Hardware Installation

1. Slot the CP 1430 TF into a free slot in the S5-155H central rack (or expansion rack if the bus is bridged). The TF variant is functionally identical to the non-TF except for the addition of the Transport Forwarding state machine; both run the same firmware family.
2. Set the backplane slot address (DIP switch on the CP, if present). Default is fine for slot 0/3, but verify with the rack plan.
3. Connect the Industrial Ethernet cable. The CP 1430 front panel has both an ITP (twisted pair, Siemens proprietary 15-pin) connector and an AUI port for 10BASE5/10BASE2 transceivers. Use ITP for new installations.
4. Power up the S5 rack. The CP goes through a self-test (front-panel LED sequence). On completion, the STOP LED should extinguish and the RUN LED should illuminate.
5. Use STEP 5 / COM 1430 on an engineering PC connected to the CP via serial (or via an Ethernet connection if the CP supports it) to load the initial connection database.

If the S5-155H is operated as a redundant pair, install a second CP 1430 TF in the second CPU's rack slot. The S5-H firmware handles CP failover transparently to the application program; the SFBs and FBs on the active CPU drive the active CP.

4. COM 1430 Connection Database

COM 1430 is the Siemens configuration tool that compiles the connection database downloaded to the CP 1430 TF. It runs on Windows 9x/NT/2000/XP and connects to the CP either through a serial configuration port or through Ethernet for the -0TB00 variant.

For the gateway topology, define two transport connections:

TSAPs are 2-byte (hex) values. The first byte typically encodes the slot (rack/slot) and the second byte the connection index, but the encoding is project-specific. The only rule is that local TSAP and remote TSAP must be non-zero and must not collide with any other connection in the CP's database.

After configuration, download the database to the CP 1430 flash and reset the CP for the new connections to take effect. Always save a binary backup of the CP database; reconfiguring a CP 1430 from scratch is significantly more work than restoring a backup.

5. STEP 5 Send/Receive Programming on the S5-155H

The CP 1430 uses S5 function blocks from the standard Ethernet library. Block numbers can shift between COM 1430 versions; the canonical assignments on the -0TB00 firmware are:

FB 246 (FETCH) call example in STEP 5 STL — the S5 program runs every OB 1 cycle and re-arms the fetch on completion:

      A    M     0.0           ; Manual trigger (e.g. from timer OB 35)
      S    M     0.1           ; Latch request
      A    M     0.1
      AN   M     0.2           ; Not busy
      =    M     0.3           ; Edge to call
      A    M     0.3
      SPB  FB   246
NAME  :FETCH
SSNR  :KY   0, 3             ; Page 0, Job number 3 (SEND/RECEIVE)
A-NR  :KF   +1               ; Connection 1 = S7 link
DBNR  :DB   100              ; Target DB on S5 side
ANZW  :MW   200              ; Status word for this job

      A    M     0.3
      R    M     0.1           ; Clear request when called

      AN   M     0.2           ; If CP is busy, wait
      BEB

      L    MW   200
      L    W#16#0000           ; No error
      <>I
      JC   ERR                 ; Branch to error handler

The status word (ANZW) returns a job result and an extended error code in the high byte. Typical meaning:

On the S5 side, allocate a 256-byte (or larger) DB — for example DB 200 — as the round-robin cache. FETCH writes the S7 tags into this DB; the WinCC link reads from it via FB 244 (SEND-on-poll) or by exposing DB 200 to the Layer-4 channel through the CP's "Server DB" function.

6. CP 443-1 and STEP 7 HW Config / NetPro Setup

1. HW Config: Open the S7-400 station. Drag the CP 443-1 from the hardware catalog (SIMATIC 400 → CP-400 → Industrial Ethernet) onto a free slot. Double-click the CP, set the Ethernet address: MAC: 08-00-06-01-00-01, IP (if also using ISOonTCP): a project-specific value, subnet mask, and (optionally) router.
2. NetPro: Right-click the CP 443-1 → "Insert New Connection". In the connection wizard, choose partner = "S5 / CP 1430" (selectable from the dropdown if the S5 is also in the project, or use "Unspecified" and enter parameters manually). Choose connection type: ISO Transport or ISO-on-TCP. For maximum compatibility with the CP 1430 TF firmware, ISO Transport is the safer default.
3. Connection parameters: Set the local TSAP to 02.02 and the partner TSAP to 03.03. The partner MAC must match the CP 1430 TF (read from the CP's front panel sticker or COM 1430 backup). The connection ID assigned by NetPro (e.g. 1) is the handle the STEP 7 user program will use to call the SFBs.
4. Configure FETCH data area (optional but recommended): In the connection properties, the "Operating Mode" tab can mark the S7 side as a "PUT/GET/FETCH" server with a pre-defined data area. If using the simpler GET/PUT model, leave this unset and let the S5 program call FETCH explicitly.
5. Save, compile, and download HW Config and the connection configuration to the S7 CPU. The CP 443-1 will not establish the connection until the S5 CP 1430 brings up the active side (or the user program calls the SFBs).

If the S5 side is in the STEP 7 project (as a "non-S7 partner"), the NetPro properties surface the partner MAC and TSAP directly. If the S5 is a foreign station, enter the parameters manually. Always verify the partner is reachable using the online "Accessible Nodes" function in STEP 7.

7. STEP 7 ISO Transport SFB Programming on the S7-400

The S7-400 side typically does not need to run a periodic send — the S5 gateway pulls the data on its own cycle. However, the connection must be valid in NetPro and the SFBs must be present. Two implementation options are in common use:

Option A — S5 pulls with FETCH, S7 is server-only. Configure the S5-CP 443-1 connection in NetPro as a "FETCH"-capable ISO Transport connection and pre-define a FETCH data area (DB + offset + length). The S7 user program is just:

// OB 1 on S7-400 — passive server for FETCH
// No periodic SFB call required; the CP 443-1 answers FETCH
// TPDUs directly from the configured data area.

// (Optional) Update DB 100 from application process:
      CALL  FB   100           ; Application FB that fills DB 100
      IN   :="ProcessData_OK"  ; User-defined tag
      OUT  :="DB100"           ; Maps to DB 100 starting at byte 0

Option B — S7 pushes with PUT, S5 receives with FB 245. Use this when the S7 application owns the data freshness and pushes on event (e.g. on each process scan completion):

// OB 35 (cyclic 100 ms) on S7-400
      CALL  FB   14            ; PUT
      REQ   :=M     100.0      ; Trigger (e.g. from OB 35 pulse)
      ID    :=W#16#0001        ; Connection ID from NetPro
      DONE  :=M     100.1      ; Set on success
      ERROR :=M     100.2      ; Set on error
      STATUS:=MW    102        ; Status word
      ADDR_1:=P#DB100.DBX 0.0 BYTE 64   ; Source: DB 100, 64 bytes
      SD_1  :=P#DB200.DBX 0.0 BYTE 64   ; Target: S5 DB 200 (must be matched on S5)

Option C — S5 fetches, S7 still uses SFBs for local diagnostics. On the S7 side, the FETCH path is handled by the CP firmware, but the application can still call FB 21 (STATUS) or read SFC 62 (CONTROL) on the CP for local diagnostics.

8. WinCC V6.2 S5 Ethernet Layer-4 Channel Configuration

1. Hardware install. Fit the CP 1613 (or CP 1613 A2) PCI card in the WinCC station. Boot the OS, install the SIMATIC NET device driver, and verify the card appears in the SIMATIC NET configuration console ("Set PC Station" → "Modules").
2. Set the CP 1613 MAC. In the SIMATIC NET console, open the CP 1613 properties and confirm the MAC address matches the value the S5 COM 1430 configuration expects as the "remote MAC" of connection 2.
3. Open WinCC Explorer. In the Tag Management editor, right-click "Tag Management" → "Add New Driver" → select S5 Ethernet Layer 4 (display name in WinCC may be 1413 for legacy reasons; the underlying driver is the S5ETH4 for CP 1613).
4. Create the connection. Right-click the new driver entry → "New Connection". In the connection properties dialog:
   • Connection name: any, e.g. S5_155H_Gateway
   • Partner MAC: the CP 1430 TF MAC (must match COM 1430 database)
   • Local TSAP: 01.01 (matches the S5 remote TSAP for connection 2)
   • Partner TSAP: 04.04 (matches the S5 local TSAP for connection 2)
   • Mode: FETCH (read) — primary, or FETCH/WRITE if the SCADA also writes to the S5
5. Define tags. For each SCADA tag, set:
   • Data area: DB
   • DB number: e.g. 100 on the S5 (this is the DB the S5 user program exposes — typically the same DB 200 that the FETCH result lands in)
   • Offset: byte/bit offset
   • Type: BYTE, WORD, DWORD, BOOL, INT, REAL, etc.
6. Polling cycle. Set the channel's update time. For 256 bytes of process data, a 500 ms cycle is a sensible starting point; tune down only if the S5 cycle time and the CP 1430 FIFO can sustain it.
7. Activate WinCC Runtime and watch the channel diagnosis for connection state and error codes.

The Layer-4 channel's online diagnosis (right-click the connection → "Connection Status") surfaces the current state of each configured connection and any pending error codes from the CP 1613 driver.

9. S5-155H Redundancy Caveats

The S5-155H is a high-availability CPU pair. The system has two CPUs (master + standby), each with its own CP 1430 TF. The S5-H firmware synchronises the two CPUs' memory over a fibre-optic link and presents a single logical controller to the network. Several caveats apply to a gateway installation:

• CP redundancy is automatic. The S5-H firmware only allows the active CPU's CP to transmit. On failover, the standby CPU's CP takes over. Ethernet partners see a brief connection drop (typically 100–500 ms during a clean failover, longer if the active CPU crashes).
• WinCC Layer-4 channel behaviour on failover. The CP 1613 driver treats the loss of the transport connection as a transient error and re-establishes it on the next poll cycle. The exact re-connection time depends on the CP 1613 firmware, the configured retry count, and the WinCC channel's timeout. If the S5-H system uses the legacy "APRED" (Anwenderprogramm-Redundanz) or related redundancy protocol for connection state, the S5 may briefly refuse new connections during the sync interval — verify with Indu-Sol or the project documentation.
• Connection database must match on both CPs. COM 1430 must be downloaded to both CP 1430 TFs. A mismatched database is a common commissioning fault — the active CP works, the standby CP rejects the partner's reconnect.
• TSAPs must be identical on both CPs. The S5-H firmware does not translate TSAPs; both CPs must answer on the same TSAP. COM 1430 enforces this if both CPs are configured from the same project file.
• FB 244/245/246 status bits behave the same way on the active and standby CPU. The blocks always run on the active CPU. The S5-H firmware does not execute user code on the standby; the CP there is idle at the application layer even though the network port is hot.

10. Error Words, Status Codes, and Online Diagnostics

When commissioning fails, walk the three layers in order: physical link → CP status → application status word.

10.1 CP 1430 TF status and error codes

10.2 CP 443-1 diagnostic block (S7 side)

From STEP 7 online, "CP 443-1 → Diagnostics" exposes the live connection table. Each connection has a state field with values such as:

10.3 WinCC Layer-4 channel error codes

The WinCC channel logs to the WinCC diagnostic file WinCC_S5ETH4_<timestamp>.log (path: project root → \Logs). Common entries:

For layer-2 verification, the SIMATIC NET console ships a "Layer 2 Ping" tool (named L2PING) that can confirm MAC reachability without needing the full transport stack — an indispensable first step.

11. Commissioning and Verification Checklist

1. Layer 1 — physical link. All port LEDs on the switch show link. L2PING from the WinCC PC reaches the CP 1430 MAC and the CP 443-1 MAC.
2. Layer 2 — CP self-tests. CP 1430 RUN solid, no SF/BAT. CP 443-1 RUN solid, no SF/BUSF.
3. Layer 3 — connection bring-up. With WinCC Runtime running, the Layer-4 channel status changes from "Disconnected" to "Connected". From STEP 7 online, CP 443-1 connection state reads 0x0001 for the S5 link.
4. Layer 4 — FETCH round trip. Toggle a bit in the S7's source DB. Force FB 246 to run on the S5. Confirm the value appears in the S5 DB 200 within one S5 cycle. Confirm the value appears in the WinCC tag within one channel poll cycle (typically 500 ms).
5. Layer 5 — failover test (S5-H only). Initiate a CPU failover on the S5-155H. Confirm the WinCC connection re-establishes within 5 s. Confirm no data corruption in the S5 DB 200.
6. Layer 6 — load test. Run the application at full process load for 30 minutes. Monitor the CP 1430 FIFO overflow flag and the S5 cycle time. If the S5 OB 1 cycle time exceeds 32 ms while the CP 1430 FIFO is non-zero, the FBs need to be re-distributed across OB 35 / OB 40 to avoid buffer overflow.
7. Layer 7 — redundancy test (S7-side CP 443-1). If the CP 443-1 is also redundant (two CPs in the S7-400), force a CP failover on the S7 side. Confirm the S5 side retries FETCH successfully and recovers.

Document the values of every status word, ANZW, and connection state on paper at the end of the FAT. This is the baseline for any future troubleshooting; the SCADA logs will not survive a project migration.

12. Frequently Asked Questions