Siemens TI 505 PLC Reference: STR Syntax and CTI Hardware

Overview of the Siemens TI 505 Platform

The Siemens TI 505 family is a 16-bit modular PLC platform that originated as the Texas Instruments 505 series. Siemens took over the product line from Texas Instruments and continued to produce the platform through the early 2000s before formally discontinuing active development. The platform is found today in metalcasting foundries, automotive trim-and-final assembly, water and wastewater plants, and material-handling lines that were commissioned between the late 1980s and the early 2000s. Many of these systems remain in service because the application code is mature, the installed base is large, and third-party vendors such as Control Technology Inc. (CTI) continue to manufacture compatible I/O modules, CPUs, and backplanes.

Understanding the 505's columnar source structure, the separation between RLL (Relay Ladder Logic) and the compiled instruction set, the .SRC/.BIN source file convention, and the typical Profibus / RS-232 / Ethernet network topology is essential for anyone maintaining, troubleshooting, or migrating these systems. This reference covers program structure, network topology, CTI replacement hardware, Profibus integration with Rexroth drives, thermal-analysis applications in iron foundries, and the practical migration paths to modern controllers such as SIMATIC S7-1500, Allen-Bradley ControlLogix, and ABB AC500 V3.

The canonical Siemens 505 hardware manual is Siemens 505 User Manual (505-8204-2); engineers should keep a local copy of this document for offline reference, because the original Siemens support site has progressively removed legacy product pages.

Processor, Memory, and Backplane Architecture

The 505 family includes a wide range of CPU classes, with the higher-numbered classes adding memory, scan performance, floating-point math, drum sequencers, PID blocks, and high-speed counter support. The processor scan follows a deterministic top-to-bottom ladder evaluation, with discrete I/O serviced in the first portion of the scan and special function routines (SFRs) executed in the second portion. Battery-backed SRAM cartridges hold the loaded program and retain V-memory across power cycles.

Note: The values above are derived from the historical 505 product catalog. Engineers must verify against the specific CPU's user manual and the CTI 2500-CPU3 replacement datasheet before designing a replacement strategy, as Siemens has formally discontinued the family and CTI is the only fully warrantied source of new spares.

The 505 chassis is a passive backplane that accepts 16-bit modules in fixed slot positions. The CPU occupies slot 0; I/O modules are addressed positionally by slot. A typical 505 plant uses 8-slot or 16-slot bases daisy-chained via a 505-RBC remote base controller to extend I/O to field cabinets several hundred feet from the CPU.

Programming Language Structure: STR, RLL, and the Columnar Source

The 505 program file is a fixed-width text source. The TISOFT, APT, or 505 Workbench programming environment parses each line positionally. Field engineers who work on these systems daily treat the source file as if it were punched-card FORTRAN, with explicit column rules that the editor preserves but that the compiler does not require.

• Columns 1–5: Line number. Any character other than a digit in column 1 marks the line as a comment.
• Columns 6–17: Instruction mnemonic and operand. This is the only region the compiler reads.
• Columns 18–80: Free-form comment. Anything past column 17 is ignored by the compiler but preserved in the .SRC archive.

Every ladder rung must begin with a STR (Store), STRN (Store Not), STRM (Store Memory), or one of the immediate-I/O variants (STRX / STRXN) for forcing direct I/O reads. The store is the leftmost contact of the rung; the rung terminates with an OUT, OUTM, OUTP, or a special output instruction. Subroutines (SBR/SBRT) and program files (SG subroutine call, JUMP/LABEL) provide structured control flow that allows programs far larger than the visible RLL footprint.

00100  STR    X1           ; START PUSHBUTTON - L1 LINE 1
00101  AND    X2           ; OIL PRESSURE PERMISSIVE
00102  OR    M100          ; LATCH FROM OUTPUT
00103  ANDN   X3           ; E-STOP
00104  ANDN   C100         ; FAULT BIT FROM ALARM WORD
00105  OUT   M100          ; RUN LATCH
00106  OUT   Y1            ; CONTACTOR TO PUMP
00110  STR   M100          ; RUN LATCH CONTINUED
00111  TMR   T1  300       ; 30-SEC LUBE PRELUBE TIMER
00112  PD    T1            ; POWER DEVICE STAGE 1
00113  ANDN  T1            ; TIMER NOT DONE
00114  OUT   Y2            ; INLET VALVE
00115  STR   T1
00116  PID   LOOP1  PV=AI1 SP=V100 KP=KP1 KI=KI1   ; INLET TEMP LOOP

The "compiler" referenced in field conversations is the offline build step performed by TISOFT or APT. After the program is edited, the build step regenerates the binary image (.BIN or .OBJ) and renumbers the line columns to a canonical 100-step increment. Field-engineering convention is to leave gaps (e.g., 00100, 00110, 00120, 00130) so that future insertions do not force global renumbering.

Common instruction mnemonics in a 505 program include: STR/STRN/AND/ANDN/OR/ORN/OUT/OUTM/TMR/TON/TOF/CNT/UDC/MOV/ADD/SUB/MUL/DIV/EQ/GT/LT/NE/GE/LE/DRUM/DRUM2/PID/SFR/IF/ELSE/ENDIF/LOOP/ENDLOOP. The mnemonic is always followed by operands separated by spaces. V-memory is referenced as Vnnnn, discrete input as Xnnn, discrete output as Ynnn, control relay as Mnnn, timer as Tnnn, counter as Cnnn.

Source File Management: .SRC Files and Live Copies

Legacy 505 installations typically archive the editable program as a .SRC text file on a network drive. The .SRC file is the human-readable source that engineers modify; the .BIN/.OBJ file is the executable that is downloaded to the CPU. A typical plant will maintain the following three artifacts:

• Source archive (.SRC): The version-controlled, comment-rich text program. This is the file that engineers edit and that version control (PVCS, SourceSafe, Git) tracks.
• Compiled image (.BIN or .OBJ): The downloaded executable. This is what the CPU executes.
• Live copy: A snapshot of the .BIN currently running in each CPU. The live copy is uploaded periodically and compared against the source archive to detect drift caused by field hot-edits or temporary logic patches.

Best practice in 505 plants is to perform a full upload-and-compare cycle at the end of every shift, then commit any drift to the source archive. The on-line editor allows "live changes" to the running program; these live changes are local to the CPU until a matching offline source edit is made and the next compile/download cycle is performed. If a downloaded image and the .SRC file diverge, troubleshooting becomes a forensic exercise of comparing the .BIN to the latest .SRC commit.

Laptop programming terminals are uncommon in mature 505 plants. Most programming is performed from a fixed engineering workstation connected via Ethernet/fiber to the plant network. The workstation runs TISOFT or APT and uses the Siemens TIWAY or H1-Ethernet protocol adapter (e.g., 505-CP2572, 505-EFM, or third-party NetEnforcer) to talk to the CPU. The CTI 2500-EP Ethernet adapter is the most common modern replacement for the original Siemens 505-CP2572, providing a TCP/IP path to the legacy TIWAY or HMI-serial protocol stack on the CPU side.

Hardware: Siemens Originals vs CTI Replacements

A 505 chassis accepts 16-bit I/O modules on a passive backplane. The original Siemens catalog included the following module families:

• Discrete input modules: 24 VDC, 120 VAC, 240 VAC, and TTL/HTL variants (e.g., 505-4208, 505-4216, 505-4316, 505-4408, 505-4416, 505-4608, 505-4616, 505-4808 families).
• Discrete output modules: Relay (505-5416, 505-5516, 505-5608), 24 VDC sourcing (505-6208, 505-6216, 505-6308, 505-6316), 120/240 VAC triac (505-7008, 505-7016, 505-7108, 505-7116).
• Analog input modules: 4–20 mA / 0–10 V, 8-channel or 16-channel (505-7012, 505-7013, 505-7014).
• Analog output modules: 4–20 mA / 0–10 V (505-7018, 505-7019).
• Specialty modules: High-speed counters, thermocouple, RTD, and serial communication modules (e.g., 505-CP1434, 505-CP2572, 505-CP5434 Profibus master).

CTI manufactures form-fit-function replacements for nearly all of these modules. The CTI 2500P series (e.g., 2500P-8AI, 2500P-16DI, 2500P-16DO, 2500P-4AO) plugs directly into a 505 chassis and presents an identical I/O map to the CPU, allowing drop-in replacement of failed Siemens modules without reprogramming. CTI also offers a 505-CPU replacement (2500-CPU3) and a 505-CP2572-compatible Ethernet adapter (2500-EP), which gives older 505 systems a path to modern network infrastructure.

Network Architecture and Profibus Integration

A multi-plant 505 deployment typically segregates the network into three layers:

1. Field level: Profibus DP (RS-485, 9.6 kbps to 12 Mbps) to variable-frequency drives (e.g., Rexroth IndraDrive, Bosch Rexroth DKC, SEW-Eurodrive Movitrac), absolute and incremental encoders (Heidenhain, SICK, Hengstler), and distributed I/O blocks (Siemens ET200, CTI 2500-DP).
2. Control level: TIWAY or H1-Ethernet (the original Siemens/Allen-Bradley hybrid from the 1990s) between the 505 CPU and engineering workstations. Modern retrofit plants use the CTI 2500-EP Ethernet module to bridge the 505 chassis to TCP/IP Ethernet while preserving the legacy TIWAY protocol semantics on the CPU side.
3. Supervisory level: Ethernet/fiber between the engineering workstation, HMI panels (Siemens OP/TP series, Pro-face GP, Red Lion G3, Maple Systems), and the plant historian. The supervisory network is typically 100 Mbps / 1 Gbps TCP/IP over fiber between buildings, with copper Ethernet drops to individual machines.

Serial (RS-232 / RS-422 / RS-485) is still common at the 505 level. Many legacy HMIs communicate via RS-232 to the CPU's serial port at 9600/19200/38400 baud using the Siemens "Point-to-Point" or "Siemens HMI" protocol. The CTI 2500-EP exposes this serial traffic as TCP/IP sockets (typically port 1505 or 5000), allowing a modern HMI such as a PanelView Plus or CP600 to connect via Ethernet while using the same protocol stack.

ADAM-4000 and ADAM-6000 modules (Advantech) are a common economical path to add isolated serial-to-Ethernet or analog-to-Ethernet gateways in a 505 plant. ADAM-4520/4522 provide RS-232↔RS-485 conversion; ADAM-6017 provides 8-channel analog input over Ethernet. These are not 505-native modules, but they are commonly used in conjunction with a CTI 2500-EP to bring 3rd-party sensor data into the 505 scan.

Profibus and Rexroth Drive Mapping

Many metalcasting and material-handling lines use Bosch Rexroth IndraDrive (DKC, HCS, FCS) or older Rexroth DKC02 / DKC03 servo drives on Profibus DP. The 505 communicates with these drives via a 505-CP5434 (or CTI 2500-DP) Profibus master module configured with a GSD file for the specific drive firmware revision. Common GSD file references include Rex0F0E.GSD (DRIVECOM profile 4) and Rex0611.GSD (IndraDrive profile) for IndraDrive, and Rex-13B6.GSD for DKC02.

When the 505 CPU is connected to a Profibus master module, the drive's process data is mapped to 16-bit words in the CPU's V-memory (typically V400–V499 or V700–V799, depending on chassis slot and configuration). The control word (STW) is written from the CPU and the status word (ZSW) is read back; actual values (e.g., actual speed scaled at 0x4000 = rated speed, or actual torque scaled at 0x4000 = rated torque) are read from PZD2/PZD3.

When the drive reports a Profibus fault (e.g., F8070 "Communication error to master"), the CPU receives ZSW bit 3 (fault present) and ZSW bit 10 (control requested). A typical fault recovery sequence in RLL is to clear the control word, wait for ZSW bit 10 to fall, then re-issue the control word. A watchdog timer in the SFR block is recommended to prevent the CPU from driving a disabled drive indefinitely.

RS-232 HMI and Serial Communication

Legacy HMIs from Siemens (OP7, OP17, OP25, OP27, OP37, TP27, TP37) communicate with the 505 CPU over RS-232 using the "Siemens HMI ASCII" protocol (also called the "505 HMI" or "HMI Server" protocol). Default settings are 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. The CPU's serial port (typically port 1 on the CPU faceplate) must be configured to "HMI" mode in the CPU configuration (CFG) block.

For plants that want to keep the 505 logic intact but replace aging HMI panels, a common retrofit is to install a Red Lion G3 or Maple Systems HMI and connect it to the CPU via the CTI 2500-EP Ethernet-to-serial gateway. The Red Lion protocol driver "Siemens 505 HMI" (or Crimson 3.0's "S505 Port" driver) speaks the same binary protocol over TCP as the legacy serial panel, so the CPU's HMI configuration does not need to change.

; CPU serial port configuration (from the CFG block of the source)
PORT 1: MODE=HMI  BAUD=9600  PARITY=N  STOP=1  DATA=8
PORT 2: MODE=TIWAY BAUD=38400 PARITY=N  STOP=1  DATA=8

Plants that need a modern HMI but cannot install a CTI 2500-EP can also deploy a Red Lion G306 or G310 with a serial-only connection to the CPU's port 1. The 505 HMI protocol uses a request/response model where the HMI polls the CPU for V-memory and discrete I/O; the CPU replies with the current values. Tags are mapped to V-memory addresses in the HMI project. The 505 CPU does not push; all data movement is HMI-initiated.

Field Application: Iron Foundry Thermal Analysis

A canonical 505 deployment is the thermal analysis of molten iron in a metalcasting foundry. The process uses a single-use refractory sample cup (also called a "thermal analysis cup" or "cooling curve cup") into which a Type-K or Type-R thermocouple is embedded. Molten iron at approximately 2,500 °F (1,371 °C) is poured into the cup; the PLC samples the thermocouple at typically 10 Hz and plots a cooling curve. The inflection points of the curve correspond to phase transitions in the iron and yield the carbon equivalent (CE), the carbon content (C%), the silicon content (Si%), and (with strontium-bearing inoculants) the eutectic modification level.

The 505 application code typically performs the following sequence:

1. Detects the pour (rising edge of an analog input above 2,200 °F or a digital "pour complete" signal from the operator station).
2. Starts a high-speed sample loop using a 505-CP1434 high-speed counter module or the CPU's built-in high-speed analog input, sampling 10–100 Hz for 180–300 seconds.
3. Stores the samples in a circular buffer in V-memory (e.g., V2000–V4999, providing 3,000 samples per cup at 10 Hz over 300 s).
4. Computes first and second derivatives of the temperature curve (using SUB and DIV instructions) to find the liquidus arrest (TL) and the eutectic arrest (TE).
5. Compares the derived CE / C% / Si% against a recipe table for the alloy being poured (e.g., 65-45-12 ductile iron, 80-55-06 ductile iron, gray iron Class 30).
6. Generates a pass/fail signal to the HMI and writes the result to the plant historian.
7. Asserts a fault if the operator does not draw a sample within the scheduled interval (per the metallurgical quality-control schedule).

The standard cup geometry, pour volume, and cooling-curve acceptance criteria are documented in publicly available foundry-quality-control procedures; engineers should consult the current edition of the AFS (American Foundry Society) Casting Defect Handbook and the cup supplier's certificate of conformance for the lot being used. The cup is consumed in the test; once the iron has cooled below 1,200 °F, the refractory sand is mechanically crumbled and the metal slug is sent to the lab for chemical verification.

Migration to Modern PLC Platforms

When a 505 plant decides to migrate, three common destinations are:

• Siemens S7-1500 / TIA Portal: Maintains the Siemens ecosystem. Most 505 source code translates cleanly to SCL (Structured Control Language) once the columnar rules are unwound. TIA Portal V17+ includes an "S5/S7 import" wizard that handles some legacy constructs, but 505-specific extensions (drum instructions, PID block format) require manual rewrite.
• Allen-Bradley ControlLogix / Studio 5000: Common in North American plants that have a Rockwell standard. The 505 RLL translates to Ladder Diagram (LD) or Structured Text (ST) with manual tag-map work.
• ABB AC500 V3 with Automation Builder 2.9.x: Targets plants that want IEC 61131-3 compliance and a strong motion integration story. The AC500 V3 platform accepts a 505 program as plain Structured Text after columnar formatting is removed; the Automation Builder environment is documented in the ABB online help for Automation Builder 2.9.0, AC500 V3, and CP600 panels.

Migration pitfalls to plan for:

1. Tag naming. 505 uses X/Y/C/V/M/T/CNT for I/O and memory. Modern controllers use tag databases. The mapping must be documented in a tag cross-reference that survives personnel turnover.
2. I/O map. The 505 chassis I/O map is positional (slot 1, slot 2, etc.) and many plants have undocumented hot-fixes (e.g., a module moved from slot 7 to slot 11). Do a full I/O audit before designing the migration target.
3. Source archive. The .SRC file is the single source of truth. If a migration is being planned, freeze the .SRC archive and produce a final compiled .BIN from the frozen source. Verify both before decommissioning the CPU.
4. Communication protocols. The TIWAY / HMI serial protocols are not supported on modern controllers. Plan for new HMIs, new gateways, and re-commissioning of all fieldbus devices.
5. Code that lives only on the CPU. Live edits in the running CPU that were never committed back to .SRC are the #1 cause of migration surprises. A full upload-and-compare cycle is mandatory.
6. Power and grounding. 505 plants often share 480 V grounded-leg delta distribution with the induction furnace. The new controller's power supply (typically 24 VDC) must be conditioned against the same transients that the legacy CPU tolerated. An isolation transformer and a 480 V → 120 V control transformer on a dedicated circuit are recommended.

For plants that have decided to keep the 505 for the foreseeable future but want to extend it (e.g., add a new machine, add Ethernet, add an HMI in a new location), a CTI 2500-EP Ethernet adapter plus a modern HMI is the lowest-risk path. The legacy code is untouched; the new hardware rides on the side.

Diagnostics and Troubleshooting Matrix

Specifications, Spare-Parts Strategy, and Field Cautions

Plants that have decided to keep 505 running should adopt the following spare-parts and lifecycle strategy:

1. Identify the 10 most failure-prone modules in their installed base (typically 24 VDC sourcing inputs, 120 VAC triac outputs, 4–20 mA analog inputs, and the CPU's lithium battery).
2. Stock at least one of each as a cold spare, sourced from CTI (preferred) or a vetted secondary-market supplier (last resort, with a 30-day bench burn-in before trusting the part).
3. Pre-stage a complete "swing" CPU with the latest frozen .BIN loaded, ready to swap in.
4. Document the CPU battery replacement schedule (5-year interval) and never let a CPU run more than 7 years on the original battery.
5. Plan a budget for the eventual migration, because the CTI supply chain is also aging.

Automation Direct CLICK and DL-series PLCs are sometimes considered as a 505 replacement for small machines or for training new technicians. The CLICK series is programmed with CLICK software (free download, see the CLICK free software help page), and the DL05/DL06 are programmed with DirectSOFT 5. These are independent platforms; they do not accept 505 .SRC files. They are useful for training and for building replacement sub-machines that will eventually be lifted into the migrated control architecture.

Field-proven cautions for engineers working on live 505 systems:

• Never trust a 505 program that is not backed by a .SRC archive in version control. If the .SRC is gone, the only "source of truth" is whatever the running CPU has, and that is a forensic problem.
• Never hot-swap a CPU while a Profibus master is in RUN; the slaves will fault and the line will stop with a different alarm pattern than the one that prompted the swap.
• Never assume that "live edit" and "offline edit" are equivalent. A live edit that worked for a 4-hour shift is not the same as a tested offline edit. Document the difference.
• Never mix 120 VAC and 24 VDC wiring in the same cable tray. The 505 I/O terminals are unforgiving of transients.
• Always replace the lithium battery during a planned outage, not during a fault. Cold-swap a fresh CPU and return the suspect CPU to the shop for battery replacement and verification.
• Never write a 505 program without using the 100-step line-numbering convention (00100, 00110, 00120...). This is what allows later insertions to avoid global renumbering.