WinCC Flexible 2008 to Siemens S5 PLC: AS511 and RK512 Setup

Overview: Integrating WinCC Flexible 2008 with Legacy S5 Controllers

Many production lines built between the mid-1980s and late 1990s remain in service with SIMATIC S5 CPUs (S5-90U, S5-95U, S5-100U, S5-115U, S5-135U, S5-155U, S5-155H). When the operator interface (HMI) has to be replaced or extended, SIMATIC WinCC flexible 2008 remains a viable HMI/SCADA choice because the runtime supports both the SIMATIC S5 AS511 and SIMATIC S5 RK512 channel drivers out of the box. This article documents the two physical paths that connect a WinCC flexible Runtime PC to a SIMATIC S5, the protocol trade-offs (AS511, 3964R, RK512), the byte-order conversion needed between S5 and S7/PC addressing, and the verification steps that confirm a stable tag exchange.

Two viable paths exist between the PC and the S5:

1. Via the CPU programming port using the AS511 protocol over a TTY 20 mA current-loop interface, requiring an active TTY-to-RS232 converter on the PC side.
2. Via an S5 communications processor (CP544, 6ES5 544-3UB11 in the example) using RK512 (with 3964R framing) over RS232 or TTY.

Both paths are supported natively by WinCC flexible 2008 as long as the correct channel driver is selected in the project. If the application needs data to be visible from more than one PC, an OPC server or an S5-to-S7 gateway must be inserted between the S5 and the WinCC flexible Runtime.

Prerequisites

System Architecture and Path Selection

The selection between the two paths is dictated by hardware already present on the S5 and by the data volume that has to move between the controller and the HMI.

Path A: CP544 with RK512 / 3964R

A CP544 (6ES5 544-3UB11) is a communications processor that occupies one slot in the S5 central rack (CR) or expansion rack (ER). It offloads the serial protocol handling from the CPU and supports RK512 (with 3964R as the underlying transport) on either RS232 (V.24) or TTY 20 mA. RK512 allows:

• Reading and writing S5 data blocks (DB, DX) by absolute address.
• Coordinated access from multiple partners (one master, several slaves by CP number).
• Higher throughput than AS511 (up to 19200 bit/s in practice on a CP544).

Path A is recommended whenever an S5 already has a CP544 installed and wired to a SCADA system, or whenever the application reads or writes more than a handful of tags.

Path B: Programming port with AS511

Every S5 CPU exposes a programming port on the front panel (15-pin sub-D, TTY 20 mA current loop). The AS511 protocol was originally intended for STEP 5 programming but is sufficient for low-volume HMI polling. The drawback is that only one master can own the port at a time, so the same port cannot be shared between WinCC flexible Runtime and STEP 5 simultaneously.

Path B is preferred when no CP is installed, when the existing CP is reserved for another system, or when the operator station is a single PC that polls a small tag count.

Hardware Wiring

Path A — CP544 to PC (RS232)

If the CP544 variant supports an RS232 interface, the connection is a standard serial extension. Typical pin-out (refer to the CP544 manual for the exact variant):

Path B — S5 programming port to PC (TTY ↔ RS232)

The 15-pin programming port on an S5 CPU is a TTY 20 mA current-loop interface. A PC COM port is RS232 (±12 V levels). A passive level-shifter does not work; an active current-loop ↔ RS232 converter is mandatory. Typical active converters (third-party industrial products) accept the S5 15-pin plug on one side and provide a 9-pin RS232 male or female on the other, with onboard 20 mA sourcing.

The S5 side expects the following signals (refer to the CPU manual):

• Pin 1 — +20 mA transmit loop (out)
• Pin 14 — -20 mA transmit loop (return)
• Pin 2 — +20 mA receive loop (in)
• Pin 15 — -20 mA receive loop (return)
• Pin 8 — Shield / functional ground

Connect the shield at one end only (typically the converter end) to avoid ground loops.

Protocol Selection in WinCC Flexible 2008

Open the WinCC flexible ES, create or open the HMI project, and edit the Connections node under the target PC station. Add a new connection and choose the appropriate driver:

For the CP544 path, set the CP parameters using STEP 5 COM 544 / COM 115 / COM 135/155 (depending on the S5 family) so that:

• Protocol = RK512
• Interface = V.24 (RS232) or TTY, depending on the CP544 variant and the cable used
• Baud rate = 9600 or 19200 (both ends must match)
• Parity = Even (default for 3964R)
• CP number = the logical CP address the HMI will reference

Tag Address Mapping (S5 Byte Order to WinCC / S7 Byte Order)

S5 stores a 16-bit word as high byte : low byte (Motorola / big-endian), with the left byte (DL) before the right byte (DR). WinCC flexible and the S7 world store a 16-bit word as low byte : high byte (Intel / little-endian). Every word read from the S5 must therefore be byte-swapped before it is interpreted as an S7 word. The WinCC flexible driver handles this swap automatically when the tag is entered in the DBW form, but the underlying byte mapping is:

The general rule for WinCC tag entry is:

• S5 DW n ↔ WinCC DBW (2·n) in the same data block.
• S5 DL n ↔ WinCC DBB (2·n)
• S5 DR n ↔ WinCC DBB (2·n + 1)

This byte swap applies regardless of whether the path is AS511 or RK512; it is a property of the S5 storage model.

Creating a Tag in WinCC Flexible 2008

1. Open the project in WinCC flexible ES, expand Communication > Tags.
2. Double-click the connection that was created earlier (AS511 or RK512).
3. Add a tag, name (e.g. Motor_Speed), data type INT or WORD.
4. Set Address to the appropriate S5 address using the WinCC syntax, for example:
   • DB 10, DW 0 — 16-bit word from data block 10, byte-swapped automatically.
   • DB 10, DR 0 — single byte (the low byte of DW 0).
5. Select the acquisition mode (cyclic on poll, or change-driven).
6. Compile and download (or transfer) to the WinCC flexible Runtime target.

OPC Server Integration for Multiple Clients

Both AS511 and the CP544 serial port allow only a single master at a time. If two operator stations (or one HMI plus a historian) need to read the S5, an OPC DA 2.0 server that owns the serial port is required. The WinCC flexible Runtime then acts as an OPC client and reads tags from that server instead of the COM port directly.

Architecture:

SIMATIC S5 ──(TTY/RS232)──> OPC DA Server (PC #1)
                                  │
                                  ├──> WinCC flexible Runtime (PC #1 or #2)
                                  ├──> WinCC flexible Runtime (PC #3)
                                  └──> Historian / third-party SCADA

Steps to point WinCC flexible at an existing OPC server:

1. Confirm the OPC server is installed and running locally or on a remote node (DCOM configured).
2. In WinCC flexible ES, on the PC station, open OPC > OPC Connections.
3. Browse for the OPC DA 2.0 server (it will appear with its ProgID, e.g. a vendor-specific S5 server).
4. Select the items you want to expose; their addresses follow the same S5 byte-swap convention described above.
5. Compile and download.

Third-Party S5-to-S7 Gateway Alternative

When the application has to feed both a WinCC flexible Runtime and a modern S7-1200 / S7-1500 controller, a dedicated S5 gateway can be inserted between the S5 programming port and the WinCC PC. The gateway presents itself as an S7 MPI/PROFINET device on one side and an AS511 / RK512 master on the other. WinCC flexible continues to use its SIMATIC S5 AS511 or SIMATIC S5 RK512 driver without modification; the gateway handles the physical conversion. Address mapping inside the gateway follows the same S5-to-S7 byte-swap rules given above.

Commissioning and Verification

1. Power on the S5, confirm the CPU is in RUN or RUN-P (the AS511 port requires the CPU not to be in STOP-only mode on most CPU types).
2. Confirm the CP544 is in RUN with no SF (red) LED if Path A is used; the CP should have the RK512 firmware loaded and the configured CP number should be visible on the front display.
3. Start the WinCC flexible Runtime on the PC.
4. Open Tools > Tag Simulation or a small diagnostic screen that displays a known tag (e.g. DB 10, DW 0).
5. Use STEP 5 to write a recognizable pattern (e.g. DW 0 = KH 1234) into the same data block, then read it back in the HMI. The displayed value must equal 0x1234, not 0x3412 — confirming the byte-swap is correct.
6. Force the S5 to toggle a bit (e.g. D 0.0) and verify the cyclic update rate in the WinCC tag. AS511 typically polls at 1–2 Hz on a 9600 bit/s link; RK512 / 3964R can sustain faster rates up to ~10 Hz depending on block size.
7. Check the WinCC flexible Runtime event log for channel status messages. A successful connection shows periodic polling acknowledgements; a failure shows No connection to PLC or Timeout events.

Troubleshooting Matrix

Field-Proven Cautions

• WinCC flexible 2008 Service Pack levels below SP5 are not certified for Windows 10. If the operator PC has been refreshed to Windows 10, an upgrade to SP5 is mandatory; otherwise the runtime will refuse to install or will fault on launch.
• The S5 programming port and the CP544 port are mutually exclusive at any one time on the same CPU; they cannot both be addressed simultaneously by different masters in the same session.
• Always ground the cable shield on one side only (the converter or the PC chassis) to prevent ground loops that cause intermittent data corruption.
• S5 data block numbers above 255 require STEP 5 V6 or later and a CPU that supports extended DB ranges (e.g. CPU 948). Confirm the CPU firmware revision if your tags reference DB 256+.
• When migrating from an existing SCADA (InTouch, WinCC, etc.) that already polls the S5, do not open a second COM channel on the same port. Configure WinCC flexible Runtime to read from the OPC server that already owns the port, instead.

FAQ