An update of previously delivered SIMATIC S7-1500 controllers and ET 200 CPUs to the CPU firmware V3.1 is possible for the following modules:

Modules in the SIMATIC S7-1500 Advanced Controller product range:

CPU type	Article number	Firmware download
Compact
CPU 1511C-1 PN	6ES7511-1CL03-0AB0*	is delivered with FW 3.1
CPU 1512C-1 PN	6ES7512-1CM03-0AB0*	is delivered with FW 3.1
Standard
CPU 1511-1 PN	6ES7511-1AL03-0AB0	78301349
CPU 1513-1 PN	6ES7513-1AM03-0AB0	78065246
CPU 1515-2 PN	6ES7515-2AN03-0AB0	92273069
CPU 1516-3 PN/DP	6ES7516-3AP03-0AB0	78066881
CPU 1517-3 PN/DP	6ES7517-3AP00-0AB0	106655787
CPU 1518-4 PN/DP	6ES7518-4AP00-0AB0	92272759
CPU 1518-4 PN/DP MFP	6ES7518-4AX00-1AB0	109761490
Fail-safe
CPU 1511F-1 PN	6ES7511-1FL03-0AB0	109476729
CPU 1513F-1 PN	6ES7513-1FM03-0AB0	109476732
CPU 1515F-2 PN	6ES7515-2FN03-0AB0	106656661
CPU 1516F-3 PN/DP	6ES7516-3FP03-0AB0	92274475
CPU 1517F-3 PN/DP	6ES7517-3FP00-0AB0 6ES7517-3FP01-0AB0	106655938 is delivered with FW 3.1
CPU 1518F-4 PN/DP	6ES7518-4FP00-0AB0	92274064
CPU 1518F-4 PN/DP MFP	6ES7518-4FX00-1AB0	109761495
Technology
CPU 1511T-1 PN	6ES7511-1TL03-0AB0	109742566
CPU 1515T-2 PN	6ES7515-2TN03-0AB0	109742567
CPU 1516T-3 PN/DP	6ES7516-3TN00-0AB0	109757418
CPU 1517T-3 PN/DP	6ES7517-3TP00-0AB0	109742571
CPU 1518T-4 PN/DP	6ES7518-4TP00-0AB0	109805658
CPU 1511TF-1 PN	6ES7511-1UL03-0AB0	109752626
CPU 1515TF-2 PN	6ES7515-2UN03-0AB0	109752627
CPU 1516TF-3 PN/DP	6ES7516-3UN00-0AB0	109757419
CPU 1517TF-3 PN/DP	6ES7517-3UP00-0AB0	109742573
CPU 1518TF-4 PN/DP	6ES7518-4UP00-0AB0	109805659
Redundant
CPU 1513R-1 PN	6ES7513-1RM03-0AB0**	109766300
CPU 1515R-2 PN	6ES7515-2RN03-0AB0**	109766318
CPU 1517H-3 PN	6ES7517-3HP00-0AB0**	109766415
CPU 1518HF-4 PN	6ES7518-4JP00-0AB0**	109805656

*planned for April 2024

**planned for January 2024

After the firmware update, the user program, the hardware parameter assignments, recipes and archives on the memory card and the data declared to be “retentive” remain stored on the CPU.

Compatibility between SIMATIC S7-1500 CPU firmware and display firmware: 

A SIMATIC S7-1500 CPU with a firmware version V3.1 can be operated with a display with a firmware version ≤ V2.9. This holds good for the CPUs 1516T-3 PN/DP,1516TF-3 PN/DP, all 1517 and 1518 CPUs.

Cases where spare parts come into the picture:  

The STEP 7 project need not be changed if a CPU ≤ 1516 with a firmware version ≥ V2.0 and ≤ V3.0 is replaced with a CPU with firmware version V3.1. Upgrading the STEP 7 software is not required.

The STEP 7 project does not need to be changed if a 1516T-3 PN/DP, 1516TF-3 PN/DP or ≥ 1517 CPU with firmware version ≤ V3.0 is replaced with a CPU with firmware version V3.1. Upgrading the STEP 7 software is not required.

Configuration of a CPU with firmware V3.1 in TIA Portal versions < V19:  

CPUs with firmware version V3.1 can also be used with TIA Portal versions < V19. The procedure to be applied for configuration with TIA Portal versions in which the current firmware cannot be selected is described in the following entry:  109744163 

New properties of the CPUs with firmware V3.1: 

To use the new functionalities, the system must be configured in TIA Portal from STEP 7 Professional V19 or higher: 109820993 

In addition to the existing product properties, a SIMATIC S7-1500 CPU or an ET 200 CPU offers the following additional functionalities with Firmware Version 3.1: 

New hardware and configuration limits:

• Innovated S7-1500 Compact and ET 200pro CPUs
  • 2 compact S7-1500 CPUs 1511C-1 PN and 1512C-1 PN
  • 2 standard and 2 fail-safe ET 200pro CPUs 1513pro (F)-2 PN and 1516pro (F)-2 PN
  • Upto 100% more program memory and data memory
  • Performance improvement depending on CPU and STEP 7 project by a factor of up to 2
  • Enhanced communication performance (2nd Core)
  • Completely redesigned display implementation à no separate FW needed
• New article number (6ES7517-3FP01-0AB0) for the 1517F-3 PN/DP CPU as a fully compatible successor of the current 1517F-3 PN/DP CPU (6ES7517-3FP00-0AB0)
• OPC UA server – increased configuration limits:
  The maximum possible number of nodes in the server interface has been increased to 50,000 for the S7-1518 CPUs. The actual possible configuration limit is dependent on various interface factors (including type and content of objects).
• The total number of configured alarm instances can be loaded while the CPU is in RUN mode
  • CPU 1510SP to 1513: 5,000
  • CPU 1514SP to 1518: 10,000
• The CPU-internal memory for text lists has been increased to 10 MB for the 1517 and 1518 CPUs
• The maximum possible number of tags/attributes for subscriptions has been increased to 50,000 for the 1518 CPUs.
• Display
  • Information on the service life of the SIMATIC memory card used
    • “0%” to “100%” (0% – new memory card, 100% – guaranteed service life reached)
    • “Unknown”: The service life of the memory card could not be read
• The ET 200SP CPUs support BusAdapters with FO and SCRJ FO connectors.

New functions with firmware V3.1 for S7-1500 Compact and ET 200pro CPUs:

• A simple configuration option is now available for the SNMP service. For new configurations, this is disabled by default in the sense of “security-by-default”. There may be certain functional limitations with automatic topology detection if both devices have deactivated SNMP.
• The web server certificate for HTTPS communication can now also be managed via the OPC UA GDS mechanism, without a separate download of the hardware configuration.
• New functions for general file handling and, in particular, for log file handling via the Web API (as support for the automation of workflows)
  • Backup & restore (including failsafe)
  • Files on the card, user files, recipes, datalogs
• Read Web API time (read out system time, read out time settings)
• OPC UA server – Reading of the diagnostic status of the server’s own address space
• The OPC UA server’s own namespace can be accessed using the OPC UA instruction for reading (“OPC_UA_ReadList”). This enables you to read out the statuses of the OPC UA server and those of the connections of OPC UA clients, of the session and the subscription and then react to them in the user program. In this way, connection problems, for example, can be quickly detected and plant availability increased.
• OPC UA Server – Time stamping the source time of nodes
  By using the OPC UA instruction for writing (“OPC_UA_WriteList”) it is possible to change both the “source timestamp” and the status code of an OPC UA tag (node). From V18 or higher, this makes it possible to distinguish between the “source” and “server” time.
• OPC UA server – Increase of the quantity structures
  The possible number of nodes in the server interface has been increased to 15,000 for the small PLCs and 30,000 for the medium PLCs. The maximum possible number of subscriptions per session has also been increased to 50. And the recommendation for monitored values for a subscription was increased to a maximum of 4,000 (at a 1 s sampling and transmission rate).

New functions with firmware V3.1 for fail-safe ET 200pro CPUs:

• F-consistent Fast Commissioning Download (from FW 3.0 or higher)
  • Together with TIA (Totally Integrated Automation) Portal V18, Consistent Commissioning Download (Consistent Compile) is now also available to the user in addition to the “Fast Commissioning Download” (Fast Compile) introduced with V17.
  • This enables the user with activated Fast Commissioning to perform a consistent compile and download of the fail-safe user program to the F-CPU in RUN mode.
  • In addition, the Consistent Compile in TIA Portal extends the possible customizations of the user program (e.g. adding timer blocks etc.) in Fast Commissioning Mode.
  • This offers greater flexibility during commissioning or when adapting the safety program, while at the same time reducing commissioning time.
  • Finally, the F-CPU is transferred to activated safety mode by a Stop-RUN transition.

New functions with firmware version V3.1 for all S7-1500 and ET 200 CPUs:

• Local user management:
  Uniform and improved management of users as well as their roles and CPU function rights. The new function rights relate to the PG/HMI communication (engineering accesses), web server and OPC UA. The previous local user configuration for the web server and OPC UA server is integrated in the new user management.
• PLC Security Logging:
  The syslog functionality newly integrated in the CPUs allows improved tracking and monitoring of critical CPU changes and operations. In the event of security-relevant events, such as user logins, configuration changes and operating state changes, messages are generated in a separate message memory. The configurable forwarding to external syslog/SIEM systems enables integration into existing security monitoring systems.
• New instruction “Random” – Random number generator:
  You can use the “Random” instruction to generate a 32-bit random number. The instruction is executed synchronously.
• Implementation of PROFINET Security Class 1:
  To fulfill the requirements for PROFINET Security Class 1, STEP 7 provides extended configuration options for the SNMP and DCP protocols as of V19.
  Customer benefits: Additional protection of communication within PROFINET networks
• Timeout handling during data exchange:
  In the event of high network loads, timeouts may occur during data record communication with PROFINET IO devices. Previously, the PROFINET IO communication was terminated by the CPU in this case. As of STEP 7 V19 and FW version V3.1, the behavior of the respective PROFINET interface can be configured.
• Trace functionality of the CPU:
  • Live monitoring for the long-term trace:
    • Display and analysis of values directly in the diagram during the recording
    • Use of superimposed measurements for the long-term trace
    • Synchronizing time bases
  • Long-term project trace:
    • Simultaneous signal recording of various S7-1500 CPUs. The CPUs must be configured in a network.
• New modes for FC 804 RT_INFO “Read Runtime Statistics”
  Additional modes for restarting the CPU cycle time measurements have been added to the FC 804 RT_INFO block:
  • Mode 40 “Restart measurement of all OB statistics”
  • Mode 41 “Restart measurement of given OB”
  • Mode 42 “Restart measurement of maximum cycle runtime”
  • Mode 43 “Restart measurement of minimum cycle runtime”
  • Mode 44 “Restart measurement of minimum and maximum cycle runtime”
    

New functions with firmware V3.1 for S7-1500 and ET 200 CPUs (not R/H CPUs):

• New “SHA2” instruction – Cryptographic hash function:
  The asynchronous “SHA2” instruction enables an integrity check of data in order, for example, to check whether data were corrupted or a data range in a data block was changed during data transmission. A hash value is calculated for this.
  Versions SHA-224, SHA-256, SHA-384 and SHA-512 are supported.
• Profiling (available for CPUs ≤ 1516 (excluded 1516T/TF CPU)):
  With the new Web API method PlcProgram.DownloadProfilingData, detailed runtime data on the user program in the CPU is downloaded. This data can be evaluated and graphically displayed with third-party tools such as “Chrome Tracing” to analyze the program flow.
  The data is helpful for the following tasks:
  • Runtime optimization of the user program
  • Error diagnostics
  • Evaluation of the performance reserve of the automation system
  • Quality assurance of the application
• Project-internal Shared Device/Shared I-Device:
  From STEP7 V19 and higher, a shared device/shared I-device can be created together with a maximum of two IO controllers in a project. Previously, the second IO controller necessarily required its own project. 

New functions with firmware V3.1 for S7-1500R/H CPUs:

• Support of OPC UA server
  As of firmware version V3.1, the S7-1500R/H redundant system supports data exchange as an OPC UA server based on the redundancy concept of the OPC UA Specification.
• Central CP modules and system power supplies supported
  CP 1543-1 communications processors can now also be used in the S7-1500R/H redundant system to extend the Ethernet communications interfaces. The redundant configuration of CPs (for each R/H CPU) increases the availability of the redundant system for communication tasks.
  Use of the active backplane bus enables reaction-free removal and insertion of the CP 1543-1 while in RUN-Redundant system state.
  The option to use system power supplies (PS) in the S7-1500R/H redundant system is also added.
• Support for IE/PB LINK HA
  The IE/PB LINK HA connects PROFINET IO and PROFIBUS DP as a gateway. The IE/PB-LINK HA thus enables access to all DP devices connected to the lower-level PROFIBUS network. In the S7-1500R/H redundant system, the IE/PB-LINK HA is integrated into the PROFINET ring as an S2 device and thus enables bumpless connection of the PROFIBUS nodes at a switchover.
• Access via Web API
  From firmware version V3.1 or higher, the S7-1500R/H redundant system supports the Webserver API. The CPU offers a web-based API (Web API) as an interface for reading and writing CPU data. You will find an overview of the mechanisms and methods supported by the R/H CPUs in the Web server Function Manual.
• Extension of the OB83 events
  With OB 83 (pull/plug interrupt OB), additional events are reported for the S7-1500R/H redundant system
• Data logging
  The new firmware version of the S7-1500R/H redundant system supports the data logging function. With data logging, you can save process values from the user program to a file – the data log. The data logs are saved on the SIMATIC Memory Card in CSV format and stored in the “DataLogs” directory.
• User Files
  The following instructions are supported in the S7-1500R/H system for editing user files:
  FileReadC / FileWriteC / FileDelete
• Extensions of RH_CTRL-instruction
  The RH_CTRL instruction has been extended to include two additional modes for controlling the operating state and SYNCUP.
• Support of Long Term Trace
  The “Long-term Trace” function for long-term recording of signal sequences is now also available for the S7-1500R/H redundant controllers.
• Secure Open User Communication
  Open User Communication (OUC) can now also take place in secure form (Secure OUC) in the S7-1500R/H system.

New motion control functions with firmware V3.1 for S7-1500(F)CPUs:

• Axis control panel – Setting of absolute encoder
  The axis control panel offers new operating modes for absolute encoder adjustment absolute and absolute encoder adjustment relative.
• Axis control panel – Display and adjustment of the speed override
  The axis control panel contains two new control elements for setting the velocity override. A slider replaces the control elements for starting and stopping the axis movement.
• Measuring gearbox for positioning axis and synchronous axis technology objects
  A measuring gearbox is available for encoders of the positioning axis and synchronous axis technology objects.
• Torque precontrol
  From firmware version V3.1 or higher, a torque precontrol can be configured for faster, more precise execution of motion sequences, which reduces the following error in acceleration phases. The CPU calculates the required torque precontrol from the axis acceleration, the configured motor and load inertias and the mechanical gear ratio.
• Configurable Response to TO alarms
  For technology alarms with reaction “Remove enable”, coast down (OFF2) and Stop with ramp-function generator (OFF1) can be configured as reactions to TO alarms in addition to the standard deceleration ramp (OFF3).
• Virtual axis
  The axis is operated with improved runtime behavior in virtual mode. The setpoints are applied as the actual encoder value with a delay of one application cycle clock. One additional application cycle clock later, the transfer to the actual value of the axis takes place, similar to a real axis. Other configurations do not affect the calculation of the actual values. The new mode replaces the previous behavior of the virtual axis.
• Using a measurement input for several axes (listening measuring input)
  When measured values are acquired using Timer DI or SINAMICS (central measuring input), actual positions can be determined on multiple axes.
• Cyclic measurement via SINAMICS (central measuring input)
  With central measuring inputs, the times of signal changes can be determined precisely and then transferred to the controller using telegram 39x. The measurements can now be continued cyclically, taking into account time constraints, until they are ended by a command.

New motion control functions with firmware V3.1 for S7-1500T(F)CPUs:

• Fast reading of the following value from a cyclic cam
  With the motion control instruction “MC_GetCamFollowingValueCyclic”, the following value defined for a leading value of the same application cycle can be read cyclically from a cyclic cam. In so doing, a scaling and an offset of the cyclic cam can be specified without changing the cyclic cam technology object.
• Extension of the function for reading the following value from a cyclic cam
  The motion control instruction “MC_GetCamFollowingValue” has been extended to include parameters for specifying a scaling and an offset of the cyclic cam. The cyclic cam technology object is not changed in the process.
• Extension of the function for reading the leading value from a cyclic cam
  The motion control instruction “MC_GetCamLeadingValue” has been extended to include parameters for specifying a scaling and an offset of the cyclic cam. The cyclic cam technology object is not changed in the process. In addition, you can specify an approach direction to the sought leading value.
  

TO Kinematics (S7-1500T)

• Conveyor tracking – Blending behavior
  Blending is possible for the following motions:
  • From a motion job in the tracked OCS to a motion job that desynchronizes the TCP.
  • From a motion job that synchronizes the TCP with the tracked OCS to the subsequent motion job in the tracked OCS
  • To blend the intermediate point in the WCS during a motion from a tracked OCS to another tracked OCS, you can also issue the job for synchronization during desynchronization, not earlier, “TrackingState” = 4.
• To maintain compatibility with technology version ≤ V7.0, configure the motion transition at the following job with “BufferMode” = 1.
  The current motion job is then not blended.
• Conveyor Tracking – Dynamic response adaptation
  Dynamic adaptation (for motion jobs) can be activated in all phases of conveyor tracking. To adhere to the dynamic limits of the kinematics and the kinematics axes after changes of the conveyor dynamics and the work area, the dynamic reserve “<TO>.Conveyor.DynamicReserve” has been introduced.
  

TO Interpreter (S7-1500T)

With the SIMATIC Motion Interpreter of the S7-1500T CPU, motion jobs for individual axes and kinematics with up to 6 interpolating axes can be created. The Interpreter executes a series of serial instructions. With the SIMATIC Motion Interpreter, the Interpreter program and the cyclic user program of the CPU for controlling and operating the machine are separate from each other. This allows you to implement the technological production process of a machine with the Interpreter program without affecting the programmed PLC logic of the machine. The Interpreter program is programmed using the new Motion Control Language (MCL). The Interpreter program can be fully simulated and validated without the use of a CPU.

• Three new technology objects are available: TO_Interpreter, TO_InterpreterProgram, TO_InterpreterMapping
• Motion Control Language
  A variety of technological tasks can be created textually for the Interpreter in the Interpreter language Motion Control Language (MCL):
  • Support of SCL language constructs and data types
  • Logic operations, operations with tags and mathematical functions
  • Adaptation of the language to the interpretative processing by the Interpreter
  • Sequential programming in an Interpreter program
  • Enabling, disabling and homing of the axes
  • Simple programming of motion jobs on individual axes
  • Activation/deactivation of force and torque limiting and fixed stop detection
  • Simple programming of complex motion jobs on kinematics, e.g. for a pick-and-place cycle
  • Linear, circular and synchronous “point-to-point” movements with absolute and relative position specification
  • Definition of tool and object coordinate systems
  • Definition, activation and deactivation of workspace zones and kinematics zones.
  • Setting of modal parameters, e.g. dynamic parameters