Troubleshooting Siemens CP5611 MPI Connection Failures on Modern

Problem Overview

The Siemens CP5611 (SIMATIC NET, 6GK1 561-1AA0x) is a legacy PCI communications processor that provides MPI and PROFIBUS connectivity for engineering stations, HMI servers, and WinCC/SCADA hosts. When a CP5611 that has been in service for years on an older Windows NT/2000 system is transplanted into a newer PC, field reports consistently show three failure modes that look identical at first glance:

1. The card is enumerated and installed by the PCI BIOS, but the SIMATIC NET device driver stack fails to bind, or binds with reduced functionality.
2. WinCC / STEP 7 can scan the bus but only sees passive stations (OPs/TPs), never the CPUs, when "PG/PC is the only master on the bus" is checked.
3. Bus scan returns no nodes at all when that option is cleared, even though the identical cable plant, connectors, and termination were working on the previous PC.

All three symptoms usually share a single root-cause family: PCI enumeration, BIOS/UEFI resource assignment, or SIMATIC NET configuration mismatch between the legacy card and the modern chipset. This article walks through the diagnostic tree, the bus-parameter interpretation, the driver/runtime pairing, and the verified remedies that bring a transplanted CP5611 back online with WinCC V6.2.

Affected Hardware and Software Versions

MPI Bus Architecture Refresher

Before changing drivers, refresh the protocol model. MPI (Multi-Point Interface) is a token-passing, RS-485 based bus operating at 187.5 kbit/s by default. Key parameters that WinCC and STEP 7 negotiate at bus attach time:

• Highest MPI address – default 31, sometimes configured to 15 for legacy segments.
• Highest PROFIBUS address – default 126.
• Baud rate – 19.2 kbit/s, 187.5 kbit/s, 1.5 Mbit/s.
• Bus profile – DP, Standard, Universal (DP/FMS).
• Tslot, Tidle_1, Tidle_2, Tset, Ttr, Tqui – timing slots defined in EN 50170 Volume 2.

A CP5611 running in "PG/PC is the only master on the bus" mode is granted the token permanently, which is why the scan appears to succeed in finding passive listeners (OP/TP slaves that never request the token) but returns nothing when that flag is cleared: the OPs do not request the token, so the CPUs never get a chance to respond before the master times out.

Root-Cause Taxonomy

Field data clusters the failures into five reproducible categories. Walk through them in order; the first match is almost always the cause.

1. PCI Resource Mismatch on Modern Chipsets

CP5611 was designed in the late 1990s and uses legacy PCI interrupts (INTA#) plus a fixed I/O region (typically 0xD800–0xD80F or assigned by BIOS). Newer boardsets (Intel Q-/Z-series, AMD 5xx/6xx) frequently expose only PCI Express and emulate legacy resources in a constrained compatibility window. Symptoms:

• Device Manager shows CP5611 with a yellow exclamation; "Device cannot start" (Code 10) or "IRQ not assigned" (Code 22).
• SIMATIC NET "Commissioning" tool hangs at "Initialize CP".
• Bus scan returns immediately with empty list.

Fix path: enter BIOS/UEFI, set PCI Express Native Control = Disabled, enable IOMMU = Disabled, set Above 4G Decoding = Disabled, and if available enable Legacy PCI Resources. Then re-seat the card in a true 32-bit PCI slot (avoid PCIe-to-PCI bridges when possible).

2. SIMATIC NET Driver / Runtime Pairing

Each CP5611 revision ships with two binaries: an OEM driver and a SIMATIC NET wrapper. The wrapper exposes the card to STEP 7 / WinCC as CP5611(MPI), CP5611(PROFIBUS), or CP_L2_1. If the wrapper is missing, the card appears in Device Manager as "Siemens SIMATIC CP5611" but STEP 7 Accessible Nodes shows "no PG/PC interface assigned".

3. PG/PC Interface Address and Bus Profile Drift

After migration, the Set PG/PC Interface dialog often inherits the previous station's parameters from the registry under HKLM\SOFTWARE\Siemens\SINEC\DP. The most common drift items are:

• Station address changed from 0 to 1 (or vice versa) – causes a token collision with the CPU (default address 2).
• Highest station address reduced to 15 – hides the CPUs at addresses 16+.
• Bus profile flipped from "Standard" to "DP" – MPI-only OPs drop off.
• Transmission rate locked at 1.5 Mbit/s – older OPs at 187.5 kbit/s become invisible.

4. Firmware/Flash Corruption After Power Loss

CP5611 holds its firmware in flash. If the card was removed while powered (PCI hot-plug on a server chassis) or if the host was power-cycled during a SIMATIC NET update, the firmware can be left in a half-loaded state. The card enumerates, but every DS_read / DS_write call returns F000_H firmware-not-ready. Re-flashing requires SIMATIC NET "Commissioning PC" → "CP Type" → "CP5611" → "Flash" with the matching FW container (s7fw5611.bin or its successor).

5. Cable Plant / Termination Latent Fault

The new PC often introduces a different ground potential, exposing a marginal shield connection that the old PC tolerated. Verify with an ohmmeter across shield-to-ground on each connector: the reading should be < 1 Ω at one end and open at the other, with terminator resistors (typically 220 Ω) at both physical ends. CP5611 itself does not supply terminator power; terminators on PROFIBUS connectors (e.g. 6ES7 972-0BA12-0XA0) must have their termination switch in the "ON" position at the two ends only.

Step-by-Step Diagnostic Procedure

1. Confirm physical enumeration. Open Device Manager → "SIMATIC NET Communication" subtree. Verify the CP5611 appears with no error code. Capture Vendor ID 0x110A, Device ID 0x2103 (A1) or 0x2104 (A2/A3).
2. Reboot the host twice. SIMATIC NET installs sometimes defer binding until the second boot because the wrapper service (S7SVCIDX) initialises after the network stack. This matches the field observation that "we didn't change anything and it started working" – a pending install or driver rebind completed in the background.
3. Open Set PG/PC Interface. Start → SIMATIC → STEP 7 → Set PG/PC Interface. Confirm the active access point "S7ONLINE" is bound to CP5611(MPI), station address 0, transmission rate 187.5 kbit/s, highest station address 31.
4. Run Accessible Nodes test. STEP 7 → Options → Set PG/PC Interface → Diagnostics. With "Only master on the bus" cleared, perform a node scan. Expected: all OPs and CPUs appear with live green icons.
5. If only OPs are visible: drop "Highest station address" to 31, re-check "Bus profile" = Standard, and verify no duplicate address by scanning twice and diffing. Then attempt a forced bus parameter overwrite via PG/PC → Properties → MPI → "Bus Parameters" tab → click "Default" then OK.
6. If nothing is visible: open a terminal on the diagnostic DLL: S7epa.exe /cp5611 /diag. Capture the F-block status. Typical patterns:
   • F001_H – cable short or no terminator
   • F002_H – duplicate address
   • F003_H – baud rate mismatch
   • F080_H – firmware not loaded
7. Re-flash firmware if F080. Use SIMATIC NET → Commissioning PC → CP Type → CP5611 → Firmware → Load. Source file default path: C:\Program Files\Siemens\Automation\SIMATIC_NET\cp5611\s7fw5611.fw.
8. Verify in WinCC. Start WinCC Explorer → "TCP/IP" → check that the S7 channel not selected (CP5611 routes via the MPI channel). In WinCC Channel Diagnosis, set channel "MPI" → unit "S7-MPI" and watch ChannelStatus toggle from "Disconnected" to "Connected" within 5 s.
9. Tag test. Add an internal tag Heartbeat with a 1 s increment and bind it to a real CPU DB. Confirm the value updates in Graphics Designer runtime.

PG/PC Interface Parameter Map

Troubleshooting Matrix

Field-Commissioning Checklist

• [ ] Card physically seated, screw-down bracket, full PCI slot engagement.
• [ ] BIOS: Legacy PCI resources enabled, Above-4G decoding disabled, IOMMU disabled.
• [ ] SIMATIC NET version matches WinCC version (see pairing table).
• [ ] CP5611 firmware loaded, version printed on label matches S7EPA report.
• [ ] Station address = 0, highest MPI = 31, rate = 187.5 kbit/s, profile = Standard.
• [ ] STEP 7 Accessible Nodes shows all controllers with green status.
• [ ] WinCC Channel Diagnostics shows Connected within 5 s.
• [ ] Heartbeat tag updates every 1 s for at least 10 minutes uninterrupted.
• [ ] Backup of HKLM\SOFTWARE\Siemens\SINEC created for rollback.
• [ ] Spare CP5611 (6GK1 561-1AA03) on the shelf before commissioning sign-off.

When to Replace Rather Than Repair

The CP5611 A1/A2 has been discontinued for over a decade. Spare cards are increasingly counterfeit or refurbished. Replace with one of the following when the fault is hardware-side:

• CP5611 A3 (6GK1 561-1AA03) – drop-in PCI replacement, dual-stack firmware, full WinCC V6.2/V7.x support.
• CP5621 (6GK1 562-1AA02) – PCI Express x1 form factor; required if the new PC has no PCI slot. Requires SIMATIC NET 2008 or later.
• PC Adapter USB A2 (6ES7 972-0CB20-0XA0) – temporary diagnostic adapter, not recommended for permanent runtime use because it monopolises a USB IRQ.

Migration Path Beyond CP5611

For plants still on WinCC V6.2 + CP5611 + MPI, plan a structured migration:

1. Phase 1 – stabilise the existing CP5611 with the procedure above; document station addresses and bus profiles.
2. Phase 2 – introduce a CP343-1 Lean or CP443-1 on the controller side; parallel-run PROFINET and MPI.
3. Phase 3 – replace WinCC V6.2 with WinCC V7.4 SP1 or TIA Portal WinCC Professional; switch HMI connection from MPI to PROFINET.
4. Phase 4 – decommission CP5611; archive the SIMATIC NET configuration under %programdata%\Siemens\Automation\SIMATIC_NET.

Verification Procedure After Repair

1. Power-cycle the host PC.
2. Wait 60 s after Windows login to allow S7 services to bind.
3. Open STEP 7 → Accessible Nodes; confirm every CPU appears with live green icon and correct firmware version string.
4. Open WinCC Runtime; confirm all configured tags show current values, no red "connection error" icons in the process screens.
5. Leave the system in an undisturbed state for 24 h; verify no CP5611 driver reset events in %systemroot%\MEMORY.DMP or System Event Log (filter by Source S7SVCIDX).
6. Snapshot a WinCC project backup with WinCC Project Duplicator before returning the line to production.

FAQ