Siemens S5 SCADA Selection: AS511 Protocol, Drivers, and Setup

Overview: Connecting a Siemens S5 to a Modern SCADA

The Siemens SIMATIC S5 family (S5-90U, S5-95U, S5-100U, S5-115U, S5-135U, S5-155U) remains in service across thousands of plants installed between 1980 and the late 1990s. Most of these systems require a SCADA layer for visualization, trending, and alarm handling. Selecting the right SCADA package for an S5 controller depends on three technical variables: the physical interface available on the CPU, the SCADA driver's supported protocol, and the tag/address translation model the SCADA uses to map PLC memory (DB, MW, I, Q, F) into its internal database.

For new installations, building a SCADA in Visual Basic or C++ is generally avoided because industrial-grade SCADA packages provide certified drivers, redundant communication, hot-standby, historical archiving to SQL/Oracle, and certified security (role-based access, audit trail). These are non-trivial to reproduce in-house. The discussion below covers the practical drivers and the configuration of two representative SCADA packages (Winlog Lite and Movicon) against the S5's native AS511 protocol.

Siemens S5 Communication Architecture

The S5 exposes its process image over several physical interfaces depending on the CPU family and option modules installed. When selecting a SCADA driver, you must confirm the physical port and protocol, not the CPU model number alone.

For a low-cost modern retrofit, the most common path is the CPU's built-in TTY/PG port running AS511. This is a 20 mA current loop interface and requires either a current-loop-to-USB converter (S5-TTY-USB) or a legacy PC with a native serial port plus a TTY-to-RS232 adapter (Siemens 6ES5 734-1BD20 or equivalent third-party unit). USB-to-TTY converters based on FTDI chipsets are the field-proven choice; the legacy Siemens PC-TTY adapter is increasingly rare.

AS511 Protocol Technical Details

AS511 is Siemens' proprietary serial protocol used by the STEP 5 programming software to read/write the S5's memory and diagnostic data. It is also the most accessible SCADA protocol for the S5 because it requires no special hardware beyond the CPU's PG port. The protocol runs over a 20 mA current loop at 9600 baud, half-duplex, using a Siemens-specific frame structure.

Frame Structure

An AS511 frame contains:

1. STX (0x02) — start of text
2. Command byte — read, write, start, stop, status, password, etc.
3. Block/address — DB number, DW number, byte/bit
4. Data — payload (up to 64 bytes per telegram)
5. BCC — block check character (XOR of preceding bytes)
6. ETX (0x03) — end of text, followed by a parity byte

Common command codes:

Timing Constraints

AS511 was designed for STEP 5 programming, not continuous polling. Critical timing parameters for SCADA integration:

• Inter-character timeout: 220 ms — pause that indicates end of a telegram
• Block turnaround time: 1500 ms — recommended minimum between requests to avoid CPU STOP on some firmware revisions
• Maximum read length: 64 data bytes per request (32 words)

SCADA Software Comparison for S5 Connectivity

The selection of a SCADA package should consider the number of I/O tags, licensing model, and the maturity of the S5/AS511 driver. The table below lists commonly deployed SCADA packages that maintain S5 support as of recent vendor releases.

For a small standalone application (one S5, < 50 tags, no redundancy), Winlog Lite is the most economical entry point. For an industrial plant with a long lifecycle expectation and IEC 62443 cybersecurity requirements, Movicon or Zenon is preferred.

Winlog Lite Configuration for Siemens S5

Winlog Lite is a free SCADA package from Codeem that includes a built-in AS511 driver. It is well suited to simple, single-CPU S5 retrofits with up to 32 internal tags.

Prerequisites

• Winlog Lite installed on a Windows 10/11 PC (32-bit application, runs in 64-bit compatibility)
• USB-to-TTY current-loop adapter (e.g., S5-USB-Adapter based on FTDI FT232)
• Siemens S5 in RUN with the PG port active (no programming software currently connected)

Step-by-Step: Adding an S5 Device

1. Launch Winlog Lite and create a new project.
2. Open the Configuration → Devices tree and right-click to add a Generic Device.
3. Set the communication port to the COM port assigned to the TTY-USB adapter (verify in Windows Device Manager; typical values COM3-COM7).
4. Set the baud rate to 9600, parity to even, 8 data bits, 1 stop bit.
5. Select the driver Siemens S5 AS511 from the driver list.
6. Define the PLC type (e.g., S5-95U) and the DB/DW addresses to be polled.
7. Create Tag entries mapping each SCADA tag to the PLC address:

TagName       | S5 Address   | Type   | Polling (ms)
--------------|--------------|--------|--------------
TEMP_REACTOR  | DB10.DW0     | REAL   | 1000
PUMP_RUN      | DB10.DBX2.0  | BOOL   | 500
VALVE_POS     | DB10.DW4     | INT    | 1000
ALARM_BITS    | DB10.DBW6    | WORD   | 1000

8. Build the HMI screens using the Winlog template library.
9. Save the project and run the Gateway service in the background.
10. Click Run to start live data acquisition.

Verification

Trigger a value change in the S5 STEP 5 program (e.g., write a value to DB10.DW0 with the PG) and confirm the SCADA tag updates within one poll interval. The Winlog Diagnostic window displays a green status indicator and a counter of successful transactions.

Movicon Configuration for Siemens S5

Movicon (Progea) is the more capable industrial SCADA, supporting redundancy, web clients, and OPC. The configuration steps differ from Winlog.

Step-by-Step: S5 AS511 Link

1. Install Movicon.NEXT and license the appropriate I/O tag count.
2. Open the Studio environment and create a new project.
3. From the Communication Drivers catalog, add Siemens S5 AS511.
4. Configure the COM port, baud rate (9600), and parity to match the S5 PG port.
5. Define Stations for each S5 CPU (Station 0 by default for a single S5).
6. Create Tags and bind them to driver addresses using the Movicon variable editor:

Variable       | Station | Driver Address    | Type    | Scan (ms)
---------------|---------|-------------------|---------|----------
TankLevel      | 0       | DB20.DBD0 (REAL)  | REAL    | 1000
HeaterEnable   | 0       | DB20.DBX4.0       | BOOL    | 500
RecipeStep     | 0       | DB20.DBW6         | INT     | 1000
ProductionCnt  | 0       | MW100             | INT     | 2000

7. Use the Movicon Real-Time DB for trending and the Historical DB for SQL/Oracle archiving.
8. Build screens with the Movicon symbol library.
9. Run the project in Runtime mode.

Tag and Address Mapping Reference

The translation between STEP 5 syntax and SCADA tag addresses is a frequent source of errors. Use this mapping table as a cross-check during commissioning.

Hardware Wiring: TTY Current-Loop to USB

The Siemens PG port is a 25-pin Sub-D with 20 mA current loop signaling, not RS-232. The wiring below shows the standard pinout and the corresponding connections to a USB-TTY adapter.

The current loop must be active on at least one side. Some S5 CPU models (e.g., S5-115U with later firmware) provide an internally powered loop; older S5-90U/95U/100U CPUs require the SCADA adapter to be the active source. Configure jumper/switch on the USB-TTY adapter per its manual before connecting.

Troubleshooting Matrix

Verification and Commissioning Checklist

1. Confirm CPU model and physical interface (PG port vs. CP module).
2. Verify cable and current-loop polarity with a loopback test.
3. Start the SCADA in offline mode and load the project.
4. Place the CPU in RUN with at least one operational program.
5. Switch the SCADA to online; confirm green status on the device.
6. Force a value from STEP 5 and verify the SCADA tag updates within the poll period.
7. Trigger a defined alarm condition in the S5 and confirm the SCADA generates the alarm with timestamp.
8. Test loss of communication: unplug the cable and confirm the SCADA flags the tag as "Bad Quality" within the configured timeout (typically 3× poll period).
9. Reconnect and confirm the SCADA resumes communication automatically.
10. Record a baseline of the S5 CPU scan time before and after SCADA polling to detect CPU overloading.

Migration Considerations: From S5 Direct to Bridge-Based Architectures

As S5 spare parts and the supporting PC hardware age, plant owners often migrate the SCADA link to a bridge architecture:

This pattern keeps the S5 in place for I/O and logic while isolating the SCADA from the legacy serial protocol. The bridge runs on a hardened industrial PC (e.g., Siemens IPC227, Advantech UNO) with redundant power and a watchdog. Migration adds resilience but introduces a single point of failure: the bridge PC. Always deploy a second PC in standby or use a hardware redundancy solution such as Movicon's Power Redundancy license.

Cybersecurity Considerations

AS511 has no authentication and no encryption. Treat the PG port as a single-tenant, physically secured interface:

• Do not connect the SCADA PC directly to a corporate network.
• Place the SCADA PC in a Level-3 Purdue zone behind a firewall.
• Disable unused USB and serial ports on the SCADA host.
• If remote access is required, use a VPN or a jump host with MFA.
• For modernized plants, retire the direct AS511 link and use a Siemens CP 1430 (ISO-on-TCP) gateway, which is harder to impersonate from outside the cabinet.

Cost and Licensing Notes

For a 1-S5, 50-tag visualization project, Winlog Lite delivers a complete solution at zero software cost; the only expense is the USB-TTY adapter and a Windows PC. For 500+ tags or plant-wide rollouts, Movicon and Zenon are the typical choices.