Overview
The Siemens CP 524 and CP 525 are communication processors for the SIMATIC S5 family, typically deployed for point-to-point serial links, ASCII/3964(R) protocols, and operator interface tasks. Because both modules are now long-discontinued, the only practical backup strategy is a bit-true copy of the on-board EPROM (or external memory submodule) using an EPROM programmer and the original COM 525 development environment, supplemented by STEP 5 for source preservation.
This reference documents the cable types required to read/write the EPROM, the software environment for COM 525, the practical compatibility limits of the toolchain under modern Windows, and the recommended archive workflow that avoids corrupting the live CP 524 firmware image.
System Identification
Before any backup procedure, confirm the exact variant you are handling. Both CP 524 and CP 525 share the COM 525 software front-end, but they differ in firmware, EPROM layout, and front connector assignments.
| Order Number (MLFB) | Module | Firmware Storage | Typical Role |
|---|---|---|---|
| 6ES5 524-3UA13 / -3UA15 | CP 524 | On-board EPROM, optional memory submodule | Serial comms, ASCII, 3964(R) |
| 6ES5 525-3UA13 / -3UA15 | CP 525 | On-board EPROM, optional memory submodule | Serial comms with extended protocols |
| 6ES5 430-4UA13 / similar | CP 5430 TF | Firmware submodule | SINEC H1 / PROFIBUS / TF (Technological Functions) |
The CP 5430 TF in particular is often confused with a general-purpose comms module: its TF suffix denotes Technological Functions (e.g., axis positioning, cam control) on top of the SINEC transport layer. Knowing which module you have prevents you from reading the wrong EPROM with the wrong programmer adapter.
Backup Strategy: Why EPROM, Not Hard Disk
The CP 524/525 firmware and configuration blocks (KD/KS/KB system data blocks) are designed to be loaded into a UV-erasable EPROM (typically 27C256 / 27C512, depending on revision). The COM 525 development package writes the merged result into an EPROM that is then either:
- Plugged directly into the CP's memory submodule socket, or
- Burned into a separate plug-in submodule and inserted in place of the original.
A file-level backup on a PC only preserves the source code (.ST, .S5D) — it does not capture the final compiled image with the live protocol stacks, character tables, and CP-internal block layout. To recover a bricked CP, you need the EPROM image, which is why a PROM programmer is part of the required toolchain, not optional.
Required Hardware Toolchain
| Item | Purpose | Typical Siemens/Equivalent Part |
|---|---|---|
| PG (Programming Device) | Runs STEP 5 + COM 525 | PG 720, PG 740, PG 760, or any PC with STEP 5 v7.x |
| PG-to-CP serial cable | Online / commissioning link | 6ES5 734-2BD20 (TTY), 6ES5 734-1BD20 (RS-232), per CP manual pinout |
| EPROM programmer | Read/write 27Cxxx devices | Siemens PG 675 / PG 685 with EPROM adapter, or any third-party programmer supporting 27C256/27C512 in Siemens pinout |
| UV eraser | Clear EPROMs for reuse | Any commercial EPROM eraser, ~30 min cycle |
| Spare EPROM submodule | Working drop-in replacement | 6ES5 376-0AA23 (32 KB) or matching submodule |
The PG-to-CP cable is not the same as the EPROM programmer cable. The PG cable connects to the CP's front serial port and operates at protocol level (online programming). The EPROM programmer connects to the chip itself after physical extraction. Both are required for a complete backup.
Cable Pinouts (Per COM 525 Manual)
The COM 525 Programming Package manual (Volume 1/2) documents every supported cable variant with full pinouts and Siemens order numbers. The three primary cable families are:
1. PG ↔ CP 524/525 Online Cable (TTY, 15-pin)
| PG End (15-pin D-sub) | Signal | CP End (15-pin D-sub) | Notes |
|---|---|---|---|
| 1 | Shield | 1 | Chassis ground |
| 2 | TxD+ | 9 | TTY transmit, crossed |
| 9 | RxD+ | 2 | TTY receive, crossed |
| 4 | +20 mA loop in | 11 | Current loop source |
| 11 | +20 mA loop out | 4 | Current loop return |
2. PG ↔ CP 524/525 Online Cable (RS-232, 25-pin to 15-pin)
| PG End (25-pin D-sub) | Signal | CP End (15-pin D-sub) | Notes |
|---|---|---|---|
| 2 | TxD | 2 | RS-232 transmit |
| 3 | RxD | 9 | RS-232 receive |
| 7 | GND | 1 / 8 | Common ground |
| 4 / 5 | RTS / CTS | Jumpered at CP end | Handshake loopback |
| 6 / 20 | DSR / DTR | Jumpered at CP end | Handshake loopback |
3. CP 524/525 ↔ External Device Cable (per application)
This cable is application-specific. COM 525 manuals list standard cables for printers (COM1, COM2 with XON/XOFF), operator panels, and barcode readers. Always cross-check the protocol mode (ASCII transparent vs. 3964R) — 3964R requires additional handshake wiring that ASCII transparent does not.
6ES5 524-3UA15 vs. -3UA13) before selecting a cable. Using an RS-232 cable on a TTY-only port will not damage the CP but will produce zero communication.
COM 525 Software Environment
COM 525 is the dedicated configuration and online tool for CP 524 and CP 525. It is a STEP 5 add-on package and cannot run as a standalone executable — it depends on the STEP 5 framework (DOS, Windows 3.1, or STEP 5 for Windows) for its runtime environment.
Compatibility Matrix
| STEP 5 Version | Host OS | COM 525 Compatibility | Notes |
|---|---|---|---|
| STEP 5 v6.x (DOS) | MS-DOS / Windows 3.1 | Fully supported, original target | Reference platform per Siemens manual |
| STEP 5 v7.23 | Windows XP SP2 | Reported as starting and menus usable, online-to-CP not verified by community users | Use a dedicated XP SP2 image with PG-only access |
| STEP 5 v7.23 | Windows 7 32-bit | Mixed reports; runs in compatibility mode | Disable UAC, install as Administrator, use legacy VDM if available |
| STEP 5 for Windows (newer) | Windows 10/11 64-bit | Not officially supported | Run inside a Windows XP Mode VM or DOSBox-x for archive reading only — not for online programming |
Installation Order
- Install STEP 5 first (v6.x or v7.23).
- Insert the COM 525 diskettes and run the installer from within STEP 5.
- Verify the
COM525.INIis created in the STEP 5 project directory. - Add the COM 525 paths to
STEP5.INIunder[packages]. - Restart the STEP 5 Manager; the COM 525 package appears under Packages.
Windows XP SP2 — Practical Field Notes
The field report contains conflicting claims: one user reports STEP 5 v7.23 starts and COM 525 menus are reachable on Windows XP SP2, while another flatly states "COM 525 will not run on WinXP." The likely truth is in between — the program launches and configuration files can be edited offline, but the DOS-extender memory model and direct port I/O to the PG serial port may fail on real hardware. Treat XP SP2 as archive-only unless you have verified online CP communication on the same image.
Backup Procedure (Step-by-Step)
Phase 1 — Source Preservation (PC-Side)
- Connect PG to the CP 524 front serial port using the correct cable per the COM 525 manual.
- Start STEP 5 + COM 525 on the PG.
- Open Online → PLC → Read Out All Blocks to pull FB, PB, SB, OB, DB, and the COM 525 system data blocks (KD/KS/KB).
- Save the project as
S5BACKUP.S5Don two independent media. - From the COM 525 menu, export the CP-specific Communication Configuration to a printable PDF / PRT file and archive it.
Phase 2 — EPROM Image Capture
- Power down the S5 rack. Wait at least 30 seconds for capacitor discharge.
- Remove the CP 524 from the rack. Place it on an ESD-safe mat.
- Locate the EPROM submodule (or on-board EPROM socket, depending on revision).
- Extract the EPROM using a proper PLCC/DIP extraction tool — never pry with a screwdriver.
- Place the EPROM in the programmer. Read the device at the correct voltage (Vpp = 12.5 V for 27C256, 12.75 V for 27C512; Vcc = 5 V).
- Save the binary as
CP524_._ .bin - Compute a SHA-256 checksum and record it in the backup log.
- UV-erase a verified blank EPROM. Program it from the
.binand verify byte-for-byte. - Insert the spare EPROM into a clean submodule housing. Label with date and source CP serial.
Phase 3 — Verification
- Insert the spare EPROM into a known-good donor CP 524 (or the original, if you can power it in a test rack).
- Power the rack. Observe the CP's status LEDs — normal sequence is
STOP → RUNwith theCOMLED indicating the configured interface state. - Run Online → PLC → Compare Blocks in COM 525 against the
S5BACKUP.S5Dfile. Result must be identical. - From a terminal on the CP's serial line, send a test message and confirm the configured protocol (e.g., 3964R handshake completes with
STX/ACK/ETX). - Document the SHA-256 of the verified spare EPROM in the plant's asset register.
Troubleshooting Matrix
| Symptom | Likely Cause | Corrective Action |
|---|---|---|
| COM 525 refuses to start under Windows XP SP2 | DOS extender cannot allocate low memory | Boot XP in Safe Mode; disable background services; verify with empty CONFIG.SYS emulation |
| Online read returns "Timeout" | Wrong cable (TTY vs. RS-232) or CP revision mismatch | Verify CP MLFB; rebuild cable per COM 525 manual Volume 1 |
| EPROM programmer reports device mismatch | Wrong device ID selected | Identify chip markings; use 27C256 or 27C512 as appropriate |
| Spare EPROM boots CP into STOP / blinking | Checksum error in EPROM image | Re-read original EPROM; verify checksum; reburn spare with verify-on-write enabled |
| Blocks differ after compare | Online read captured only working DBs, not FBs/PBs in EPROM | Use the EPROM image as authoritative source; the .S5D file alone is incomplete |
| COM LED stays dark after EPROM swap | CP hardware fault, not EPROM | Try EPROM in a second CP; replace CP board |
| COM 525 hangs at "Initialize Interface" | Serial port IRQ conflict under Windows | Use a dedicated PCI serial card with legacy ISA IRQ; avoid USB adapters for online use |
Edge Cases and Field-Proven Caveats
- Submodule vs. on-board EPROM: Some CP 524 revisions integrate the EPROM directly on the PCB. There is no submodule to swap — you must desolder or use an in-circuit programmer. Confirm before ordering spares.
- CP 5430 TF confusion: The TF suffix means Technological Functions, not "transport format." Do not use the COM 525 manual for the CP 5430 TF — it requires a different toolchain (COM 5430 TF / SINEC).
- Battery-backed RAM blocks: DBs in the CP's internal RAM (battery-backed) are not captured by EPROM backup. Document and manually export these separately, otherwise runtime data such as message counts or positioning tables will be lost.
- Checksum regions: The CP's EPROM layout includes a Siemens-specific checksum at the end of the image. Do not edit the binary; let the programmer regenerate it. Manual edits cause boot failures.
- Archive media: EPROMs lose data over decades. Re-read verified spares every 5 years and reburn if needed.
Commissioning Verification Checklist
- Source project
.S5Darchived on at least two independent media. - Configuration printout archived (paper + scanned PDF).
- Original EPROM image
.binarchived with SHA-256. - Spare EPROM programmed and byte-verified.
- Spare EPROM verified in a donor CP with identical online block compare.
- End-to-end protocol test message sent and acknowledged.
- Asset register updated with backup location, media ID, and SHA-256.
What cable do I need to backup a Siemens CP 524?
You need two cables: a PG-to-CP online cable (TTY 15-pin or RS-232 25-pin to 15-pin, order numbers 6ES5 734-2BD20 / -1BD20 depending on CP revision) for reading blocks via COM 525, and an EPROM programmer with a Siemens-compatible adapter to read the on-board or submodule EPROM (27C256 or 27C512). Full pinouts are in the COM 525 Programming Package manual Volume 1/2.
Does COM 525 run on Windows XP SP2?
STEP 5 v7.23 is the last version compatible with Windows XP SP2. Field reports conflict on full COM 525 functionality — the menus launch and offline editing works, but online communication with a real CP 524/525 has not been independently verified. Treat XP SP2 as archive-only and prove online behavior on a bench CP before relying on it for a live system backup.
Can I back up a CP 524 with just the .S5D source file?
No. The .S5D source preserves blocks but not the final compiled EPROM image with protocol stacks and CP-specific configuration. You must also capture the EPROM binary (or program a spare EPROM from the COM 525 build output) to have a true drop-in replacement.
What is the difference between CP 524, CP 525, and CP 5430 TF?
CP 524 and CP 525 are serial communication processors (ASCII, 3964R) configured with COM 525. CP 5430 TF is a SINEC/technological-functions module (axis positioning, cam control) and uses a different toolchain — COM 525 does not apply to it.
How often should I re-verify stored EPROM spares?
Re-read and checksum-verify EPROM spares every 5 years. UV-EPROMs lose charge over time, and an unchecked spare that boots a failed CP is a poor surprise. Document each verification with date, operator, and SHA-256 in the asset register.