Configuring S7-1500 NTP Server IP via IF_CONF_NTP User Program

Problem: NTP Server IP Cannot Be Changed From the HMI on an S7-1500

An S7-1500 CPU (for example, 6ES7 511-1AK02-0AB0, CPU 1511-1 PN) is configured in TIA Portal to perform time synchronization via NTP. The engineer wants to change the NTP server IP address at runtime from a WinCC HMI (or any VISU) without re-downloading the project. A user-program call to IF_CONF_NTP returns the existing configuration as an array, the new IP values are written into the data block, and the call is repeated — yet the CPU keeps synchronizing with the original NTP server. No error is reported, but no change takes effect either.

The root cause is rarely the IP string itself. It is almost always one of three issues: the MODE input is wrong, the data block tags are not mapped to the block's InOut variables, or the runtime write is confused with the engineering-time configuration in the CPU properties. This article documents the correct procedure using the IF_CONF_NTP function block from the SIMATIC library.

Prerequisites

• S7-1500 CPU with firmware V2.0 or higher (CPU 1511-1 PN 6ES7 511-1AK02-0AB0 firmware V2.6 or later recommended).
• TIA Portal V15.1 or higher (V16 / V17 preferred for current library revisions).
• The IF_CONF_NTP function block from the global SIMATIC library > "Time synchronization" must be available in the project.
• An NTP server reachable from the CPU's PROFINET interface. Confirm with ping from a service laptop before commissioning.
• The PLC program must have write access to CPU system data (always available; no special protection needed).
• HMI tags pointing to the same data block tags that are wired to IF_CONF_NTP must be configured with the correct length for the STRING parameters (typically 64 characters).

Why IF_CONF_NTP Appears to Do Nothing

Three common root causes are seen in the field:

1. MODE = 0: The block returns the current NTP configuration (read) but never writes. The status word shows DONE=TRUE, but no change is made.
2. MODE = 1: A full overwrite is performed. On firmware older than V2.1 this can fail silently with STATUS = 0x8080 ("Mode not supported") if a previous server is already configured.
3. HMI tag length mismatch: WinCC writes a STRING shorter than 15 characters (for example, 8 characters for a 32-bit IP). The trailing CR/LF or null terminator shifts the IP by one byte, and the CPU rejects the address with STATUS = 0x8081 ("Invalid IP format").

The Siemens support entry "How do you set the IP address of the NTP server variably via the user program of the S7-1500 CPU?" documents the correct procedure and confirms that MODE = 2 is required when modifying an existing NTP configuration in place.

IF_CONF_NTP Interface Reference

The block is found in TIA Portal under Libraries > Global libraries > SIMATIC > S7-1500 > Time synchronization > IF_CONF_NTP. The interface is documented in the TIA Portal information system and the S7-1500 system manual.

STATUS Word Decoding

Step-by-Step Implementation

Step 1 — Create the Configuration Data Block

Add a global DB (for example, DB_NTP_Config) with the following tags. The STRING length must match what the block expects; do not reduce it.

DATA_BLOCK "DB_NTP_Config"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
NON_RETAIN
   STRUCT
      Server1_IP : STRING[64];   // e.g., '192.168.10.250'
      Server2_IP : STRING[64];   // '' to disable
      Interval   : TIME;          // T#60s typical
      Mode       : UINT;          // 2 for modify
      Req        : BOOL;
      Done       : BOOL;
      Busy       : BOOL;
      Error      : BOOL;
      Status     : WORD;
   END_STRUCT;
END_DATA_BLOCK

Step 2 — Call IF_CONF_NTP in OB1 (or Cyclic OB)

Wire the InOut variables directly to the data block tags. Do not use temporary variables — the block reads the STRING header to determine the actual length.

// OB1 — cyclic call, edge-triggered on a HMI command tag
IF "HMI_Cmd_NTP_Apply" AND NOT "DB_NTP_Config".Busy THEN
   "DB_NTP_Config".Req := TRUE;
END_IF;

"IF_CONF_NTP_DB"(REQ     := "DB_NTP_Config".Req,
                 MODE    := "DB_NTP_Config".Mode,
                 SERVER_1_IP := "DB_NTP_Config".Server1_IP,
                 SERVER_2_IP := "DB_NTP_Config".Server2_IP,
                 INTERVAL := "DB_NTP_Config".Interval,
                 DONE    => "DB_NTP_Config".Done,
                 BUSY    => "DB_NTP_Config".Busy,
                 ERROR   => "DB_NTP_Config".Error,
                 STATUS  => "DB_NTP_Config".Status);

IF "DB_NTP_Config".Done OR "DB_NTP_Config".Error THEN
   "DB_NTP_Config".Req := FALSE;
END_IF;

Step 3 — Configure the HMI Tags

In WinCC (Comfort/Professional or WinCC Unified):

1. Create four HMI tags of type WString with length 64 mapped to the four server STRING tags.
2. Create an HMI tag of type UInt for Mode; set the property to read/write and limit input range to 0..2.
3. Create a TIME tag with format Time for Interval; limit to 1 s .. 86400 s (WinCC auto-converts to T#..).
4. Add an IO field with the "Apply" property driving HMI_Cmd_NTP_Apply as a momentary pushbutton (SetBitWhileKeyPressed).

Step 4 — Trigger the Apply from the VISU

Press the "Apply NTP settings" button on the HMI. HMI_Cmd_NTP_Apply goes high for one PLC cycle. The block executes with the current STRING contents. Verify on the HMI that Status displays 16#0000 within a few hundred milliseconds and Error stays FALSE.

Step 5 — Confirm the CPU Actually Uses the New Server

Open TIA Portal online > CPU > Diagnostics > Time. The active NTP server is listed under "Time-of-day synchronization > NTP server". Alternatively, read the diagnostic buffer (online > CPU > Diagnostics > Diagnostics buffer) and look for event ID 0xE505 "Time was set via NTP" — the source address in the entry confirms the server that supplied the time.

Parameter Mapping Table (PLC ↔ HMI)

Verification Checklist

• [ ] STATUS = 16#0000 after REQ edge returns to FALSE.
• [ ] DONE = TRUE for at least one PLC cycle.
• [ ] BUSY = FALSE after DONE.
• [ ] ERROR = FALSE.
• [ ] CPU online > Diagnostics > Time > NTP server shows the new IP address.
• [ ] CPU diagnostic buffer contains event "Time was set via NTP" within one interval period.
• [ ] Disconnect the old NTP server (block its port 123/UDP at the switch) and confirm time sync continues from the new server.

Troubleshooting Matrix

Edge Cases and Field-Proven Notes

No CPU restart required. The new NTP server becomes active immediately after DONE. The first successful synchronization is performed on the next interval tick.

Failover behaviour. If SERVER_1_IP is reachable, the CPU uses it exclusively. Servers 2..4 are tried in order only if the previous one stops responding. Configure at least two servers for redundancy in production cells.

STRING encoding on TIA Portal <V16. Older TIA Portal versions handle STRING differently in optimised data blocks. If the block reports STATUS=8081 on first write after download, compile the project and re-download the program — STRING headers are sometimes stale until a full recompile.

WinCC Unified vs. Comfort. WinCC Unified uses WSTRING (UTF-16). IF_CONF_NTP expects STRING (UTF-8 ASCII). Configure the HMI tag as STRING with conversion or use a script that copies WSTRING → STRING byte by byte before write.

Security note. NTP traffic is unauthenticated by default. On a machine cell with PROFINET only, isolation from the office LAN is sufficient. On converged networks, configure firewall ACLs to restrict UDP/123 to the NTP server only.

Related Configuration: Enable NTP Mode in TIA Portal

Before IF_CONF_NTP can modify anything, NTP must be enabled in the device configuration:

1. Open the CPU device view in TIA Portal.
2. Navigate to Properties > Time of day > Time synchronization.
3. Set NTP mode to "NTP server (RFC 5905)" or "Secure NTP (RFC 5905 with authentication)" if your server supports key-based authentication.
4. Enter the engineering-time NTP server IP (used as initial value before runtime modification).
5. Compile and download the project to the CPU.

The S7-1500 system manual, available on the Siemens support portal, documents the supported NTP modes and authentication keys in chapter "Time synchronization".

FAQ