Siemens S7 to Softing S5-PCLink: Configuring PUT/GET Bridging

Overview: Bridging SIMATIC S5 and S7 Over Industrial Ethernet

The Softing S5-PCLink (the product line formerly marketed as S5-LAN++) is an industrial Ethernet gateway that terminates the legacy Siemens AS511 protocol on the S5 side and exposes a TCP/IP transport on the S7 side. The product lets a SIMATIC S7-300 or S7-400 controller read and write data blocks (DB), markers (M), inputs (E), outputs (A), timers (T), and counters (C) on a SIMATIC S5-90U, S5-95U, S5-115U, or S5-948U without modifying the S5 program.

This article documents the configuration path used in field deployments: a CP443-1 in an S7-400 station initiates an ISO-on-TCP connection to the gateway, and S7 communication function blocks (FB PUT / FB GET) carry payload in 64-word telegrams. The S5 is configured as the passive partner. The throughput ceiling observed in production is approximately 500 ms per poll cycle when a single PUT and a single GET fit within one telegram each.

Reference documents: Softing S5-PCLink product manual, Softing S7/S5 OPC Server datasheet, Softing Siemens connectivity overview.

System Architecture

The end-to-end topology consists of three logical nodes and two protocol transitions:

1. S7 station (active): S7-300 or S7-400 with CP343-1 / CP443-1 Industrial Ethernet CP. STEP 7 V5.x or TIA Portal configures the CP, the NetPro connection, and the PUT/GET blocks.
2. Softing S5-PCLink gateway: Industrial Ethernet on the field side, AS511 (TTY 20 mA or RS-232-C, 9600 baud) on the S5 side. The 511 protocol parameters are fixed; only IP/subnet are user-configurable via the VCOM utility.
3. S5 station (passive): Any S5 CPU that exposes a programming/AS511 port. The S5 does not require any program changes; the gateway polls/commands it as a passive participant.

Inside the S7 station, the application logic only knows the gateway's IP address, the local CP's connection ID, and the S5 memory image to manipulate. The gateway performs the byte-order and data-width conversion between S5 (16-bit word) and S7 (BYTE/WORD/DWORD) formats transparently.

Prerequisites and Component Selection

Hardware Wiring: AS511 and Industrial Ethernet

On the S5 side, plug the AS511 cable into the 15-pin PG socket of the S5 CPU and connect its DB-9 or DB-25 tail to the Softing gateway's "S5" port. Polarity of the TTY current loop matters on S5-115U and earlier; consult the S5 installation manual for the canonical pin-out before powering the system.

On the S7 side, connect the CP443-1 (or CP343-1) RJ-45 port to the same Ethernet subnet as the Softing S5-PCLink. Use managed switches only if IGMP snooping or port-priority QoS is required; the gateway itself does not impose restrictions on switch port type.

Configuring the Softing S5-PCLink with VCOM

The VCOM setup utility ships on the CD bundled with the gateway. It is a Windows-based COM-port configurator that operates against the gateway over a temporary serial session before the Ethernet port is enabled. The 511 protocol parameters (baud rate, character format, handshake) are fixed by the gateway firmware and cannot be edited.

Minimum parameter set entered in VCOM:

Save the configuration and power-cycle the gateway. Verify reachability from a maintenance PG with ping 192.168.10.50 before opening STEP 7.

S7 CP443-1 / CP343-1 Network Configuration

Open the S7 station in STEP 7 (or the device view in TIA Portal) and assign the CP an IP address on the same subnet, for example 192.168.10.10/24. Confirm the CP is operational by checking the SF/BF LEDs after download; both must be off.

For an S7-400 with CP443-1, the CP slot is fixed by the rack design (slot 4–6 typical). For an S7-300 with CP343-1, mount the CP next to the CPU and assign rack 0, slot 1 logic in hardware configuration. The CP's MAC address is printed on the front panel and must be unique on the subnet.

NetPro Connection Definition (Unknown Partner)

The Softing S5-PCLink presents itself as a non-Siemens device, so the connection in NetPro is configured as an "unspecified" partner. This bypasses the S7 partner-CPU type check and forces the CP to accept the gateway's response.

1. Open NetPro and select the CP443-1 (or CP343-1) row.
2. Right-click → Insert New Connection.
3. Connection partner: Other stations → Unspecified.
4. Connection type: ISO-on-TCP connection (RFC1006).
5. Local TSAP: any free value, e.g. 01.00.
6. Partner TSAP: must match the value entered in VCOM (e.g. 10.00).
7. Partner IP Address: enter the gateway IP (e.g. 192.168.10.50).
8. Connection ID: e.g. 1. This ID is referenced by the PUT/GET blocks.
9. Active connection establishment: enable the S7 as the active endpoint.
10. Compile and download to the S7 station.

Verify in online view that the connection status reads Established. If the status reads Not connected or cycles between Connecting and Disconnected, the TSAP pairing is wrong (see troubleshooting matrix below).

PUT/GET Programming in STEP 7

The PUT and GET blocks are pulled from the standard STEP 7 library:

• S7-300: FB15 "PUT" and FB14 "GET" from Standard Library → Communication Blocks.
• S7-400: FB15 "PUT" and FB14 "GET" from Standard Library → Communication Blocks; S7-400 can also use FB8 / FB9 (older PUT_S / GET_S variants) but FB14/15 is preferred for new code.
• TIA Portal: Instructions → Communication → S7 Communication; blocks named PUT and GET are available for S7-300/400 CP variants.

The PUT block transfers a local source area to a remote partner area. The GET block reads a remote partner area into a local destination. Both work in any S7 memory area (DB, M, I, Q), and the Softing gateway maps those areas 1:1 onto the corresponding S5 data image.

PUT Interface (FB15)

GET Interface (FB14)

Sample Call (STL, S7-400)

// One-shot trigger from a cyclic OB
// WRITE 32 words of local recipe DB into S5 DB100
      CALL  FB15,  DB300
       REQ   :=M 100.0
       ID    :=W#16#1
       DONE  :=M 110.0
       ERROR :=M 110.1
       STATUS:=MW 112
       ADDR_1:=P#DB100.DBX 0.0 WORD 32   // partner S5 DB100, words 0..31
       SD_1  :=P#DB200.DBX 0.0 WORD 32   // local S7 DB200, words 0..31

// READ 32 words of S5 markers M0..M31 into local DB201
      CALL  FB14,  DB301
       REQ   :=M 100.1
       ID    :=W#16#1
       DONE  :=M 111.0
       ERROR :=M 111.1
       STATUS:=MW 114
       ADDR_1:=P#M0.0 WORD 32            // partner S5 marker area
       RD_1  :=P#DB201.DBX 0.0 WORD 32

The Softing gateway accepts both DB targets and marker targets on the S5 side. Use P#M<byte>.0 WORD <count> for markers and P#DB<n>.DBX<b>.0 WORD <count> for data blocks. Inputs, outputs, timers, and counters are addressed similarly with P#E, P#A, P#T, P#C.

TSAP, Rack/Slot, and Addressing Rules

The TSAP is a 2-byte (or sometimes 4-byte ASCII) local port selector on each side of an ISO-on-TCP connection. For S7-to-S7 links the byte pattern is well-defined, but for third-party gateways you must use whatever convention the gateway expects. The Softing S5-PCLink accepts any TSAP on the partner side that matches the value configured in VCOM; the local S7 TSAP is free of convention because the CP is the active opener.

Two field-proven conventions work without further configuration:

• Symmetric pair: Local TSAP 01.00 and partner TSAP 01.00. The gateway is set to listen on 01.00 via VCOM. Easy to remember; works on first commissioning.
• Asymmetric pair: Local TSAP 01.00 (rack 0, slot 0 of the S7 CP), partner TSAP 11.00. The gateway listens on 11.00. Useful when multiple gateways share one CP.

Because the gateway presents itself as a single connection point, do not configure two S7 connections to the same gateway TSAP — the second connection fails to establish with STATUS = 0x000E.

Data Area Mapping: Data Blocks and Markers

Byte-order is little-endian on both sides; no swap is required. S5 data words are 16 bits and align on word boundaries; the Softing gateway does not support bit-level access. If you require single-bit manipulation, mirror the bit in a marker and rewrite the surrounding word.

Performance Characteristics and Throughput Limits

The 511 protocol imposes a hard upper bound on cycle time. Production measurements taken on a CP443-1 against an S5-115U through a S5-PCLink show:

Throughput is dominated by the serial 511 request/response delay, not by Ethernet. Adding managed switches, QoS, or higher CP firmware versions does not reduce cycle time. Plan polling intervals of 1 s or longer for closed-loop control; for non-time-critical data exchange (recipes, setpoints, diagnostics) the gateway is comfortably adequate.

Troubleshooting Matrix

Verification and Commissioning Checklist

1. VCOM parameters saved; gateway power-cycled.
2. ping from the S7 engineering station to gateway IP returns < 1 ms.
3. NetPro connection is downloaded; online status is Established.
4. One PUT into a known S5 DB returns STATUS = 0 (DONE = TRUE within 1 s).
5. One GET from a known S5 marker area returns STATUS = 0 (DONE = TRUE within 1 s).
6. Reading and writing the same S5 word produces the expected pattern (write 0xAAAA, read back 0xAAAA).
7. Continuous polling for 1 hour produces zero STATUS ≠ 0 events.
8. CP SF and BF LEDs remain off; gateway SF LED is off; S5 CPU is in RUN.

If any of the above fails, capture the CP connection diagnostic buffer (PLC → CPU Messages → Connection Diagnostics in STEP 7) and the S5-PCLink event log (VCOM → View Log) before escalating to Softing support.