Siemens S5 CP1430TF SSNR Parameter: KY Format Decoded

1. Overview

The SSNR (Schnittstellen-Nummer / Interface Number) is the parameter that ties a Siemens SIMATIC S5 SEND or RECEIVE block call to a specific communications processor (CP) in the rack and to a logical connection endpoint. On a system that uses a CP1430TF for Industrial Ethernet (also referred to as SINEC H1 or the predecessor to PROFINET/Industrial Ethernet on S5), the SSNR must match the value configured in COM1430 — the parameterization tool that runs on a PG/PC and downloads the connection and base address data to the CP1430TF module via its PG interface or the slot.

When an S5 programmer sees an SSNR parameter written as KY 255, 50, the high byte (255) is not a decimal interface number — it is a flag that tells the S5 CPU firmware that the actual interface number is stored indirectly in the currently opened data block (DB). This reference clarifies what the parameter means, how to decode it, how it differs from direct SSNR assignments such as KY 0, 8, and how to configure the matching base SSNR inside COM1430.

For the official Siemens cross-reference document that lists supported S5-to-S7 Industrial Ethernet coupling examples, see Communication between SIMATIC S5 and SIMATIC S7 via Industrial Ethernet (Siemens Support entry ID 47905848). For background on the CP1430TF and the SEND/RECEIVE handling blocks, refer to the SIMATIC S5-115U, S5-135U, and S5-155U manuals, which contain the same SSNR semantics across all three product lines.

2. The SSNR Parameter in S5 SEND/RECEIVE Blocks

The SSNR is the first formal operand of the standard S5 communications handling blocks:

• SEND — sends a block of data over an Ethernet/PG/CP connection.
• RECEIVE — receives a block of data over the same channel.
• FETCH and WRITE — used for the S5-to-S5 and S5-to-S7 server-style READ/WRITE coupling (RFC 1006 / TCP-based FETCH/WRITE on CP1430TF).

On the S5-115U, S5-135U, and S5-155U the relevant blocks are taken from the standard library STEP 5 / COM 1430 TF / SEND-RECEIVE package. The signature looks like:

  :JU   SEND
  SSNR : KY 0, 8          // SSNR parameter
  A-NR : KY 0, 0          // Job number (Auftrags-Nummer)
  ANZW : MW 200           // Status word (Anzeige-Wort)
  QTYP : KS DB            // Source type
  DBNR : KY 0, 50         // Source DB number
  QANF : KF +0            // Source start offset (DW)
  QLAE : KF +20           // Source length (words)

The SSNR is therefore the link between the STEP 5 program and the connection configured inside COM1430. A mismatch causes error codes such as 0x0A (interface not configured), 0x14 (interface busy), or 0x32 (partner not reachable) to be returned in the ANZW word.

3. KY Data Format in STEP 5

The KY data type is a two-byte constant in which each byte is treated as an independent unsigned value (0–255). The mnemonic comes from the German Konstante, 2 Bytes. Examples:

The high byte and the low byte are independent — the SSNR itself is conceptually a single byte in the low position, while the high byte is a flag word only.

4. Direct vs Indirect SSNR Assignment

The CPU interprets the high byte as a selector:

Indirect assignment is useful when a single program needs to address different CP interfaces at runtime (e.g., redundant CPs or different sub-nets per job), or when a library block receives the SSNR from its caller. The trade-off is one extra word of pointer indirection and the obligation to have the right DB opened (via A / AD / AX / AR) before the SEND/RECEIVE call is executed.

5. CP1430TF Module Overview

The CP1430TF (Siemens order number 6GK1 430-0AA0x, where x depends on firmware revision) is the TCP/IP-capable Industrial Ethernet CP for the S5-115U, S5-135U, and S5-155U racks. Key characteristics relevant to the SSNR:

• Plug-in module that occupies one slot in the S5 rack and is treated as an intelligent slave by the CPU.
• Each CP1430TF is assigned a base SSNR (page index) at commissioning time using COM1430.
• The CP exposes up to four logical interfaces (sub-numbers 0–3) on that base, allowing up to four independent protocol stacks (for example, separate FETCH/WRITE, SEND/RECEIVE, and ISO-on-TCP endpoints).
• The base SSNR must be divisible by 4 (see Section 8 below).

Older CP1430 (non-TF) modules only support the ISO transport layer (Layer 4 over 802.3) — they cannot speak TCP/IP directly. The TF suffix indicates Transport Frame / TCP support and is the variant typically required when bridging to a modern S7 station that uses ISO-on-TCP (RFC 1006) on an S7-CP such as CP343-1 or CP443-1.

6. COM1430 Configuration Software

COM1430 is the Windows-based (originally DOS-based) parameterization tool that runs on a Siemens PG 7xx or any PC with an MPI/PG cable to the CP1430TF's commissioning port. It writes the connection database into the CP's flash/EEPROM and is the source of truth for the SSNR values used in STEP 5.

For each CP1430TF in the project, COM1430 assigns:

• Base SSNR — the slot index of the CP within the rack. The number must be a multiple of 4.
• SSNR offset — the logical sub-channel within that CP. Offsets 0, 1, 2, 3 are valid.
• Connection list — partner IP, port, transport (TCP / ISO / UDP), job type (SEND/RECEIVE/FETCH/WRITE), and the job numbers used in the STEP 5 A-NR parameter.

The full SSNR used in the STEP 5 block call is computed as:

  SSNR = base_SSNR + offset

For example, with base SSNR 8 and offset 0 the direct SSNR is 8 (written as KY 0, 8). With base SSNR 48 and offset 2 the direct SSNR is 50 (written as KY 0, 50).

7. Decoding KY 255, 50 — Step by Step

The original program line in question is:

  SSNR : KY 255, 50

To resolve this SSNR before a SEND or RECEIVE call executes:

1. Open the relevant DB with A DB or have it open from a previous network. The same DB that the SEND/RECEIVE call uses for its data (the source DB QTYP/DBNR) is typically not the one that holds the indirect SSNR; it is whatever DB the programmer has loaded with the A DBxx instruction immediately before the call. Confirm this on the cross-reference list.
2. Read DW 50 from that open DB. The word stored at DW 50 must itself be a valid KY constant whose low byte is the real interface number — for example KY 0, 50 for direct SSNR 50, or KY 255, 12 for a chained indirect pointer.
3. Pass that resolved value to the SEND/RECEIVE block. The block then contacts the CP whose base SSNR matches.

If the offset for the new CP is 2 and the base SSNR is 48, the matching direct equivalent is KY 0, 50, and that same value must be stored in DW 50 of the open DB at runtime. This is the fastest path when modernizing legacy STEP 5 code that uses the indirect form.

8. Base SSNR Requirements — Divisible-by-4 Rule

COM1430 enforces the rule that the base SSNR of any CP1430TF must be a multiple of 4. The reason is internal: each CP occupies four consecutive SSNR slots (its base plus three sub-offsets) and the firmware indexes the CP slot table at 4-word granularity. Typical legal base values:

Assigning a base SSNR that is not a multiple of 4 will be rejected by COM1430 with error E 0x0A ("Invalid interface number") during the download, and the CP will refuse to come online.

9. SEND/RECEIVE Block Call Structure (Reference)

The ANZW must be a non-retentive flag word (in the M 200–M 255 range is conventional). After the call, the high byte contains the error code returned by the CP and the low byte contains handshake bits (e.g., bit 0 = job active, bit 1 = job complete).

10. Industrial Ethernet Coupling: S5 to S7

The most common deployment of a CP1430TF in modern plants is bridging legacy S5 controllers to current S7-300 / S7-400 stations over ISO-on-TCP (RFC 1006). The recommended Siemens reference for this scenario is the application example PDF linked in Section 1, which provides:

• S5 side: CP1430TF with TF firmware, ISO-on-TCP transport, SSNR KY 0, 0 (default CP slot) and connection entries to the S7 partner IP/port.
• S7 side: CP343-1 / CP443-1 configured as ISO-on-TCP server or client in STEP 7 (TIA Portal or classic) using connection type ISO-on-TCP connection with passive/active establishment.
• Application-level protocol: BSEND/BRCV on the S7 side paired with AG_SEND/AG_RECV — or pure SEND/RECEIVE pairs on both sides — with a defined maximum payload length (typically 240 bytes for AG_SEND to AG_RECV, up to 8192 bytes for BSEND/BRCV).
• Port number: TSAP-based addressing; the S5 side uses a TSAP of the form TCP-1.<rack>.<slot> in COM1430, e.g., TCP-1.0.0.

The SSNR on the S5 side does not appear on the wire; it is purely an S5-internal slot/handle. The transport addressing (IP, port, TSAP) is what travels on Industrial Ethernet.

11. Verification and Troubleshooting

After wiring and parameterization, verify the SSNR chain end to end with this sequence:

1. CP status check. From the PG connected to the CP1430TF's PG port, run CP1430 TF Diagnostics and confirm the module reports RUN, not STOP. A STOP indicates an invalid base SSNR or corrupted connection database.
2. SSNR sanity check. In COM1430, list the configured CPs and confirm each base SSNR is a multiple of 4 and that the effective SSNR (base + offset) matches the value in DW 50 (for indirect) or in the KY literal (for direct).
3. Connection check. From COM1430 issue a PG-FETCH or PG-WRITE test on the same connection. A successful round-trip proves the ISO-on-TCP/TCP channel before any STEP 5 logic is involved.
4. STEP 5 loop test. Add a test SEND to an unused job number pointing at a partner echo, evaluate the ANZW after one CPU scan, and confirm bit 1 (job complete) is set within the configured timeout and the high byte is 0x00.
5. Indirect SSNR dump. On the PG online view, open the DB referenced by the SSNR's low byte and inspect DW 50. If the high byte of DW 50 is not 0xFF for indirect or not 0x00 for direct, the indirect mechanism is broken.

12. FAQ