Modifying the IP Address on a Siemens CPU 414-3PN/DP from the Program

The Siemens CPU 414-3PN/DP (MLFB 6ES7414-3PN/DP) combines an integrated PROFINET interface (X1 P1/P2, two-port switch) with a PROFIBUS-DP master (X2) and a plug-in interface submodule (IF slot) on the S7-400 rack. It is one of the workhorse mid-range controllers used in process and discrete automation where the plant network IP plan is decided late, where redundant IP failover is needed, or where the controller must be commissioned with a temporary IP and switched to a production IP by the application code without a re-download of the hardware configuration.

This reference covers the field-proven procedure for changing the PROFINET IP from inside the STEP 7 V5.x user program using the standard block FB55 "IP_CONFIG", including the mandatory hardware-configuration enable, the LADDR/HW-ID lookup, the UDT structure of the configuration data, the manual restart requirement, and the verification checks that confirm the new address is active.

1. Prerequisites

1. Firmware: CPU 414-3PN/DP, firmware V6.0 or higher is recommended. IP_CONFIG support has been in the S7-400 PROFINET CPUs since the first PN variants; if you have a very early V3.x PN firmware, upgrade to the latest service pack available in the Siemens Online Support entry for this MLFB.
2. Software: STEP 7 V5.5 + SP2 or V5.6 with the installed Standard Library "Communication Blocks". The block FB55 is shipped in the standard library and is not a customer library block.
3. Hardware configuration flag: The PROFINET interface must have "Set IP address using the program" enabled in HW Config. Without this flag the FB55 call is rejected with STATUS = 0x80A3 ("Set IP address is not permitted via program").
4. Access path: Online access to the target station via TCP/IP (initial commissioning IP, e.g. the factory default 0.0.0.0 / DHCP, or the current IP) or via the PROFIBUS DP interface. The new IP will not become active until the next restart, so a backup path (MPI/DP) is recommended when changing the address.
5. Restart mechanism: The CPU must perform a STOP -> RUN transition (manual restart, OB100) to commit the new IP. Programmatic re-IP without restart stores the value but does not make the interface accept frames on the new subnet.

2. Enabling "Set IP Address Using the Program" in HW Config

This is the step most engineers miss on the first attempt. The PROFINET interface object in HW Config ships with the IP assignment channel locked to the project download. The application has to be given an explicit write permit before FB55 will accept a write request.

1. Open the S7-400 station in SIMATIC Manager > HW Config.
2. Double-click CPU 414-3PN/DP > PN-IO (X1) (the PROFINET interface object, not the DO module).
3. In the Properties dialog, open the Parameters tab. The IP address and subnet mask fields display the currently compiled address.
4. Click the ... button next to the IP address to open the IP Address Parameters dialog (same dialog reached from the TIA Portal for cross-platform reference: see the Siemens TIA Portal: "Configuring an IP address for a CPU in your project" documentation - the underlying checkbox semantic is identical, although the S7-400 dialog is in classic STEP 7).
5. Activate the checkbox "Set IP address using the program" (German: IP-Adresseinstellung über Programm).
6. Confirm with OK, save and recompile (Station > Save and Compile), then download the hardware configuration to the CPU.

3. Reading the LADDR / Hardware Identifier of the PROFINET Interface

FB55 needs the diagnostic address (Hardware Identifier) of the integrated PROFINET interface, not the IP address. There are two reliable ways to read it:

1. From HW Config: Open the Properties of the PROFINET interface object. The diagnostic address is shown in the hex format (typical values: 0x0001, 0x0002, or higher in stations that also have CP443-1 modules). In STEP 7 V5.x it is shown in decimal - the value 1 corresponds to W#16#1 in the LADDR input of FB55.
2. From the System Data: With the station online, use PLC > Monitor/Modify on the system data; the diagnostic addresses of the IO devices under the PN-IO master are listed. The PN-IO master itself is at the lowest address and is the correct target for FB55.

Record the value in a project constant, e.g. PN_INTERFACE_LADDR := W#16#1. The CPU 414-3PN/DP normally assigns 0x0001 to the integrated PN-IO, but never hard-code without checking: addresses can shift if a CP443-1 has been inserted with a lower diagnostic address.

4. FB55 IP_CONFIG - Interface Definition

FB55 lives in Standard Library > Communication Blocks > CP 300/400 (it is shared between S7-300 and S7-400). The block is multi-instance capable and the instance DB is generated automatically when the FB is called for the first time from a project block.

5. Building the Configuration Data (UDT60 / IP_CONFIG_DATA)

FB55 expects a pointer to a structured data area that lists the interface(s) to be written and the new parameter values. On S7-400 the structure layout is:

STRUCT
  IF_COUNT   : BYTE;        // number of interface blocks (use 1 for a single PN-IO)
  RESERVED_1 : BYTE;
  IF_VIRT    : ARRAY[1..4] OF BYTE;  // virtual interface index (1 = X1 PN-IO)
  IF_LEN     : ARRAY[1..4] OF BYTE;  // sub-record length
  SUBIF      : ARRAY[1..4] OF BYTE;
  IP_ADDR    : ARRAY[1..4] OF DWORD; // new IPv4 (network byte order)
  SUBNET     : ARRAY[1..4] OF DWORD;
  ROUTER     : ARRAY[1..4] OF DWORD;
  VENDOR_ID  : ARRAY[1..4] OF DWORD;
END_STRUCT

The address bytes are stored network byte order (big-endian). For an IP of 192.168.10.42 the DWORD is 16#C0A80A2A. Subnet mask of 255.255.255.0 is 16#FFFFFF00. The default router of 0.0.0.0 is 16#00000000.

A practical way to author the data block is to create a global DB, e.g. DB100 "PN_IP_CFG" with the structure above. The block can then be filled in OB1 with symbolic moves and passed to FB55 by symbolic pointer.

6. Calling FB55 from OB1 / OB100 - Reference Code

The user program is normally written in STL, LAD, or FBD. The pattern below shows the canonical SCL version because it is the most readable. STL equivalents are provided inline.

// Trigger source: rising edge when the operator enters a new IP, e.g. from HMI tag "ip_change_trigger"
// Hold trigger until DONE / ERROR fires.
IF "ip_change_trigger" AND NOT "ip_change_latch" THEN
    "ip_change_latch" := TRUE;
    // Build the configuration record
    "PN_IP_CFG".IF_COUNT := 1;                    // 1 interface to write
    "PN_IP_CFG".IF_VIRT[1] := 1;                  // virtual interface index 1 = X1 PN-IO
    "PN_IP_CFG".IF_LEN[1]  := 24;                 // sub-record length in bytes
    "PN_IP_CFG".SUBIF[1]   := 0;
    "PN_IP_CFG".IP_ADDR[1] := "new_ip_dword";     // DWORD from HMI, network byte order
    "PN_IP_CFG".SUBNET[1]  := "new_subnet_dword"; // 255.255.255.0 => 16#FFFFFF00
    "PN_IP_CFG".ROUTER[1]  := "new_router_dword"; // 0.0.0.0 if no router
    "PN_IP_CFG".VENDOR_ID[1] := 16#002A;          // Siemens vendor ID 0x002A
END_IF;

IF "ip_change_latch" THEN
    "ip_config_instance"(REQ := "ip_change_latch",
                         LADDR := W#16#1,
                         CONF := "PN_IP_CFG",
                         DONE => "ip_change_done",
                         BUSY => "ip_change_busy",
                         ERROR => "ip_change_error",
                         STATUS => "ip_change_status",
                         ERR_LOC => "ip_change_errloc");
END_IF;

// Clear the latch when the call returns
IF "ip_change_done" OR "ip_change_error" THEN
    "ip_change_latch" := FALSE;
END_IF;

STL equivalent of the call line (paste into OB1 in STL view):

CALL "ip_config_instance" , DB202      // instance DB generated by FB55
REQ    := "ip_change_latch"
LADDR  := W#16#1
CONF   := "PN_IP_CFG"
DONE   := "ip_change_done"
BUSY   := "ip_change_busy"
ERROR  := "ip_change_error"
STATUS := "ip_change_status"
ERR_LOC:= "ip_change_errloc"
NOP 0

Inside the instance DB the multi-instance / single-instance footprint is the same, because FB55 has no STAT declarations beyond the standard instance footprint. With STEP 7 V5.x the call generates the instance DB automatically on first compilation; in SCL you receive the warning "Multi-instance capability" if the FB is not declared as a multi-instance under a parent FB - that warning is informational and can be ignored for this use case.

7. Manual Restart and IP Activation

The new IP is staged in the CPU's interface record but the integrated PN-IO switch only tears down and renegotiates the link on a STOP -> RUN transition. The pattern is:

1. FB55 returns DONE = TRUE, STATUS = 0x0000.
2. The application writes a status flag to the HMI ("New IP staged - cycle CPU").
3. The operator uses the mode selector on the CPU (or PG command PLC > Operating Mode > STOP, then PLC > Warm Restart) to force a restart.
4. On the restart, the new IP is applied. The PROFINET IO devices may remain in AR (Application Relationship) - link stays up because the port is still on the same physical switch port.
5. If the new IP is on a different subnet, the ARP cache of the network switch must age out, otherwise the operator's PC retains the stale ARP entry. A power cycle of the adjacent managed switch is sometimes the only reliable way to clear the cache in industrial cabinets.

Placing the FB55 call in OB100 (warm restart) instead of OB1 is a common alternative: the operator changes the IP via HMI, the new value is stored in a retentive flag word, then on the next power-up OB100 writes it. This avoids the explicit STOP/RUN step, but the IP is still not active until the restart completes - it is just driven by the power-up sequence instead of the mode switch.

8. Verification Procedure

After the restart, the new IP must be confirmed end-to-end. Engineers tend to ping from the engineering station and stop there; on a managed industrial network that is not enough.

1. PG online path: In SIMATIC Manager, Options > Set PG/PC Interface > TCP/IP. Open PLC > Edit Ethernet Nodes > Browse. The new IP must be visible against the CPU MAC. This is the same dialog the S7-400 community uses for the offline path; it is the cleanest online verification because it uses the S7 discovery protocol (DCP) rather than ICMP.
2. ICMP from the engineering PC: ping <new_ip> -w 1000. Verify the response time is in line with previous readings (typically < 5 ms on a directly connected industrial switch).
3. Online diagnostics: PLC > Diagnostics/Settings > Operating Mode. The PROFINET interface diagnostic page shows the active IPv4, subnet mask, and default router in decoded form.
4. PROFINET IO check: Open the online view of the PROFINET IO system. All IO devices that share the same logical network must be in state "Connected" - a wrong subnet mask on the CPU breaks AR establishment with the IO devices even if PC-to-CPU ping works.
5. Application check: Monitor the PUT/GET, TCP, ISO-on-TCP, or PROFINET blocks in the user program. Open the connection diagnostics from the connected partner and verify the active partner IP.

9. Alternative Methods - Comparison

10. IP_Config_v4 Variant on Newer S7-400 Firmware

On S7-400 PN CPUs with firmware V6.0.4 and higher, a second block FB55 "IP_CONFIG" v4 layout is exposed. It accepts up to 4 interface entries in a single call (handy when the same CPU also drives a CP443-1) and adds a record for the DNS server. The call signature is identical to the classic FB55, only the CONF structure is extended. If you need to set DNS, define the structure with an additional DNS[1..4] OF DWORD field and pass the v4 pointer to FB55.

The Siemens function manual S7-400 Automation System - CPU Specifications lists the supported firmware versions and the differences in the IP_CONFIG data layout. Download path (no direct link - the Siemens support entry is dynamic): Siemens Industry Online Support, search MLFB 6ES7414-3PN/DP.

11. Troubleshooting Matrix

12. Safety and Audit Considerations

• Lock the operator HMI behind a privilege level. A runtime IP change must not be triggered by an unauthenticated user. Add a password-protected HMI screen for IP modification, and audit the change in the operator action log.
• Persist the new IP in a recipe / data record. Use a recipe (e.g. HMI recipe view) so the change is reproducible after a memory reset or CPU replacement. The recipe element is the four IP octets, the four subnet octets, and the four router octets.
• Document the change in the network plan. The IP plan in the plant documentation must be updated as part of the change-management workflow. Otherwise the next commissioning engineer will overwrite the runtime change with the static IP from HW Config.
• Watch the PROFINET diagnostic alarms. The IO devices generate a station-down alarm on the AR break during the restart. Suppress or route the alarm so it does not trigger an unwanted plant shut-down.
• Verify the new IP from two sources. Ping alone is not enough. Use Edit Ethernet Nodes (DCP) and an ISO-on-TCP connection test in addition to ICMP.

13. Cross-Reference: External Devices that Read the CPU IP

Third-party HMI panels and OPC servers often read the IP of the S7-400 through the Siemens Ethernet protocol driver. The Pro-face GP-Pro EX manual for the SIMATIC S7 Ethernet driver (the reference platform is the CPU 414-3PN/DP) describes the IP-Address field that must be filled in on the device driver: Pro-face GP-Pro EX - SIMATIC S7 Ethernet driver manual. The driver expects the same IPv4 tuple that FB55 writes. The C-more / Automation Direct KB article referenced earlier also shows the IP parameter on the same Siemens protocol: Automation Direct C-more S7 Ethernet ISO/TCP help. These documents are useful when you must confirm the IP that the third-party panel will use to connect after the runtime change.

14. Putting It All Together - Field-Proven Sequence

1. Verify the HW Config flag "Set IP address using the program" is set; download HW Config.
2. Create a data block (e.g. DB100 "PN_IP_CFG") with the IP_CONFIG structure. Pre-load default values matching the commissioning IP.
3. Add FB55 from Standard Library to your project. Call it from OB1 (HMI-driven) or OB100 (power-up-driven). Capture DONE, ERROR, STATUS, and ERR_LOC into tags exposed to the HMI.
4. Implement the HMI recipe for IP, subnet, router. Wire the recipe values into the configuration DB. The HMI must convert dotted-decimal text into DWORD (network byte order) before writing.
5. On the HMI, the operator changes the value, presses "Apply", the FB55 call returns DONE = TRUE, and the HMI prompts the operator to perform a STOP -> RUN. The HMI sends the command via a privileged button or a direct PG command.
6. After the restart, the HMI re-establishes its connection on the new IP. Verify with DCP browse, ICMP, and the live connection diagnostic.
7. Update the network plan and the audit log.