Siemens Protocol Suggestion


Thread Starter

Lynn Linse

I'm starting a project to network into older Siemens equipment by serial port/protocol - specifically S5. Any suggestions of which protocol(s) will support the MOST old & new equipment. Multi-drop is NOT required - point-to-point is Ok. PC/DDE/OPC servers are irrelevant - I need to do the protocol work on a small embedded system to mount with the S5.

I've heard of things like AS511 and R3946, but am not a Siemens expert & want feedback as to what are common older protocols.

I repeat, the S7 are not in my scope yet - so PPI or MPI are not yet required.


Lynn August Linse, Snr Prod App Engr

Andreas Klein

The AS 511 protocol you can use direct with the port of the S5-PLC you can find a description on the Siemens A&D homepage. But if you connect your equipment to the PLC-port you will always have a problem if you want connect your programunit to the PLC because normally the S5-PLC has only one port. We have made the connection to the S5-PLC with a Serial card (CP524 for example) and the protocol 3964 or 3964R. You always need a serial card in the PLC but it works well and with all the S5 by the same way. A description of the 3964 protocol is written on the Siemens A&D homepage and i believe in the manuals of the CP524.

D.C. Pittendrigh

Hi All

I would be interested to know a bit more about the equipment, but if it is all S5, then there is really only a very limited set of options.

P3964 (R) is a proprietary Siemens protocol, it uses RS232 and can only do point to point officially, unofficially there is a current loop version of the card, and it is possible to have more than one unit on the link, but I have never seen it done, and you need to be an S5 hobbyist like me if you want to go this route.

AS511 is also a serial protocol, it is used for the programmer interface.

The early protocols were AS511 (AnSchaltung 511, or interface 511) and this came from the card's part number which was 6ES5 511 3AA11 or something like that, on the very first Simatic PLC's the card type was 511, and it was an interface, and the protocol was called AS511. The other serial interface could talk to other PLC's, Printers, computers and serial monitors, the interface card was a type number 6ES5 512 5AA21, or the like, the card type was specifically a 512 card, the protocol was called RK512 (Rechner Kopplung 512, or computer link 512). That's the history, The RK512 was known as a procedure, and the P3964 or P3964R was called a protocol, what it basically
did was define the byte structure of the telegrams, and define the handshaking between telegrams and reply telegrams, and define the error handling.

L1 bus is no good for moving data, it was for I/O only.

That leaves Profibus FMS which was available on the 5431 interface card, and could probably later interface to S7 , I have never done it but the theory is that it should work. (to the S7 that is)

Then there is H1 or industrial ethernet, provided you can hook all PLC's together using H1 interfaces, you will definitely be able to talk to S7 on the same bus and between S5 and S7 as well. This is probably the right way to go, but what about non-S5 equipment, do you have any? and is your stuff all modern enough to handle H1 interfaces?

Telll me more, I would love to help you, this is a part of my ancient history, of which I have rather fond recollections, in those days setting up comms links was quite challenging and I considered it to be a pet speciality of mine.

Good Luck

Donald Pittendrigh
email:[email protected]

Jerry Baucum


In the past I have implemented RK512 3964(R) if that's what you mean. This protocol is point to point serial that connects to CP-524/525 cards in the S5 series. There are plenty of got ya's along the way. There is a 20ma current loop protocol that talks directly to the programming port of the CPU, but uses absolute addresses which depends
on CPU as to where stuff really is. You might want to contact WinCC guys, they used to have RK512 3964(R) as example source for their channel development kit.

Don't know how much I can help, haven't touched Siemens in years, but will be happy to try.


Jerry M Baucum
Bullet Software
3213 Peppertree Pl.
Plano, TX 75074, USA
Tel: (972) 633-9111
Fax: (972) 633-9112
Email: [email protected]

Helmut Meissner

Hi Lynn,

you can use AS511 to communicate direkt via PG-Connector.

We use in the factories AS511 to communicate with a "master"-PLC. This is connected to the other plc´s via L1-bus. This is more programming
overhead on the plc side, but sometimes it is easier in the field to do changes in the plc than in a pc program.

I used also serial Comm-processor CP524 or CP 525 (no longer to buy by siemens) and 3964R protokoll. It is easy on the plc side (1 send all. 1 receive all command, the pc is fetching the data).

if you do not get protokoll-driver for your embedded system (i had this problem one time) it is possible to use the CP524 with a special ascii
driver and to send and receive the data in strings.

All of these are slow connection (normaly 9600 Baud).

To get faster communication (for a scada system etc.) we use Profibus-DP with the FMS protokoll-stack. But you need special drivers and a lot of
proctice in Profibus FMS.

if you have more questions you can contact me at:
[email protected]

I like the old fashion SIMATIC S5.


Helmut Meissner
Manager Softwaredepartment
Schlosser-Pfeiffer GmbH
Aarbergen, Germany
I reverse engineered the S5 protocol a few years ago when we (Westinghouse, at the time) sold a private labeled version of the S5-100U and the S5-115U. I wrote an application note and MS Assembler 6.0 program that basically allows you to scroll through memory. The big gotcha is there are no checksums used in the messages! Probably one reason Siemens didn't publish the protocol (at least at the time, maybe they do now -- like I said I did this about 10 years ago). I'll see if I can find my old archived DOS files!