Reconfiguring S7-1500 and TP1200 IP Addresses with T_Config

Overview

Standardized S7-1500 / WinCC projects are typically duplicated for many end customers, each with a different plant network. Shipping every machine with hard-coded IP addresses forces the customer to either rebuild the project, open the controller's display to re-address the device, or navigate the HMI's Service and Commissioning dialog. None of these approaches is acceptable in a repeatable machine build where the commissioning engineer must apply an IP plan in minutes, often over a remote VPN link.

The Siemens PROFINET stack for S7-1500 CPUs exposes a configuration channel that lets the application program re-parameterize the CPU's PROFINET interface at runtime: the T_CONFIG instruction (sometimes spelled T_Config in older portal help). Pairing T_CONFIG on the controller with a writable connection in WinCC Professional V15.1 Update 3 allows a single HMI screen to set both the CPU and the panel IP, store the values persistently, and re-establish the HMI-to-PLC link on the new address without a TIA Portal download.

This article is field-proven on the following stack:

• STEP 7 Professional V15.1 Update 3 in TIA Portal
• WinCC Professional V15.1 Update 3
• CPU 1513-1 PN (6ES7513-1AM02-0AB0, firmware V2.6.x)
• TP1200 Comfort Panel (6AV2124-1MC01-0AX0, firmware V15.1)

The same flow applies to any S7-1500 with a PROFINET interface (CPU 1511, 1515, 1516, ET 200SP CPU, etc.) and to Comfort/Advanced panels from V14 SP1 onward.

Architectural Constraints You Must Respect

Two architectural facts dictate the design of the runtime IP-change routine. If you skip them, the panel will go black immediately after the CPU accepts the new address.

1. The HMI connection is a static project entry. When TIA Portal compiles the WinCC project, the S7 connection (or rather, the HMI connection of type S7 COMM) stores the partner IP and the connection resource (rack/slot of the CPU). WinCC does not automatically follow a live IP change on the CPU; the connection is bound to the address that was active when Runtime started.
2. The T_CONFIG instruction writes to a PROFINET data record, not to the panel. Reconfiguring the panel's own IP is a different system call (covered later). When the CPU changes its IP, the panel must be told which IP to use as the connection partner. The cleanest way is to enable Use the system IP address for switched communication for the connection in TIA Portal, which lets WinCC read the panel's current PROFINET address from its local interface and apply it to the partner parameter. If the connection was created with Use the system IP address disabled, the connection stores a static partner IP and will not follow the new CPU address.

Prerequisites

Item	Required Value / Version	Notes
TIA Portal	STEP 7 Professional V15.1 Update 3 or newer V15.1.x	V15.0 ships an older T_CONFIG interface
WinCC Professional	V15.1 Update 3 or newer V15.1.x	Required for runtime reconfigurable connections
S7-1500 CPU	CPU 1513-1 PN (or 1511/1515/1516) firmware V2.5+	T_CONFIG requires PROFINET IO controller capability
Comfort HMI	TP1200 / TP1500 / TP1900 / TP2200 firmware V15.1	Same flow works for Basic panels with reduced scope
Library	T_CONFIG from Instructions > Communication > PROFINET IO	Built-in to TIA Portal, no add-on required
IP block at design time	CPU: 192.168.0.10 / 24 (placeholder), HMI: 192.168.0.20 / 24	These are your TIA project defaults that get overwritten at runtime
Engineering station	PG/PC in the same subnet, TIA Portal installed	For initial download and HMI image transfer

System Topology

PLC Program: T_CONFIG IP-Reconfiguration Block

The T_CONFIG instruction is the S7-1500 PROFINET-configuration channel. It is found in TIA Portal under Instructions > Communication > PROFINET IO > T_CONFIG. You do not call it once; you build a small wrapper FB so that the HMI can supply the new IP, subnet, and optional router, then trigger the write on a button press.

Function Block Interface

Create FB in the Program blocks > PLC_1 > Program Blocks folder:

FB "setPlcIp" — IP reconfiguration wrapper
VAR_INPUT
  iExecute      : BOOL;            // Rising-edge trigger from HMI
  iNewIp        : DWORD;           // 192.168.0.10 → 16#C0A8000A
  iNewSubnet    : DWORD;           // 255.255.255.0  → 16#FFFFFF00
  iNewRouter    : DWORD;           // 0.0.0.0 if unused
  iInterfaceId  : HW_INTERFACE;    // PROFINET interface HW ID
END_VAR
VAR_OUTPUT
  oDone         : BOOL;
  oBusy         : BOOL;
  oError        : BOOL;
  oStatus       : WORD;            // T_CONFIG STATUS
END_VAR
VAR
  sTConfig      : T_CONFIG;        // instruction instance
  sExecuteOld   : BOOL;
  sDataRecord   : ARRAY[0..63] OF BYTE;   // IP record buffer
END_VAR

Data Record Layout for the PROFINET IP-Parameter Write

Index 0x802A is the standard PROFINET PDPortDataReal data record used to change the IP suite of the local PROFINET interface. For the S7-1500 PROFINET stack, the relevant subset is the PDInterfaceAdjust sub-record starting at byte 0 of the data buffer. The IP address is stored in network byte order (big-endian), which is why we build the DWORD with byte 0 = first octet.

Offset	Size (B)	Field	Source	Example (10.20.30.40)
0	2	BlockType	0x0001 (PDInterfaceAdjust)	0x01 0x00
2	2	BlockLength	Length of sub-record (0x003C = 60)	0x3C 0x00
4	2	BlockVersion	0x0100	0x00 0x01
6	2	Reserved	0x0000	0x00 0x00
8	1	NoOfInterfaces	0x01	0x01
9	1	SubBlockType	0x02 (PDPortDataReal)	0x02
10	2	SubBlockLength	0x0036	0x36 0x00
12	2	SubBlockVersion	0x0100	0x00 0x01
14	2	SubBlockSlotNumber	0x0000 (X1)	0x00 0x00
16	2	SubBlockSubslotNumber	0x0000	0x00 0x00
20	6	MAC address (read-only)	Local MAC	ignored on write
26	6	Padding	0x00	0x00 …
32	4	IPAddress	iNewIp (big-endian)	0x0A 0x14 0x1E 0x28
36	4	SubnetMask	iNewSubnet (big-endian)	0xFF 0xFF 0xFF 0x00
40	4	DefaultRouter	iNewRouter (big-endian)	0x0A 0x14 0x1E 0x01
44..59	16	Reserved / DNS / DHCP flags	0x00	0x00 …

ST Implementation

Use SCL (Structured Control Language) inside the FB:

// FB "setPlcIp" body — SCL
IF iExecute AND NOT sExecuteOld THEN
    sExecuteOld := TRUE;
    sDataRecord[0]  := 16#01; sDataRecord[1]  := 16#00;       // BlockType
    sDataRecord[2]  := 16#3C; sDataRecord[3]  := 16#00;       // BlockLength = 60
    sDataRecord[4]  := 16#00; sDataRecord[5]  := 16#01;       // BlockVersion
    sDataRecord[6]  := 16#00; sDataRecord[7]  := 16#00;       // Reserved
    sDataRecord[8]  := 16#01;                                 // NoOfInterfaces
    sDataRecord[9]  := 16#02;                                 // SubBlockType
    sDataRecord[10] := 16#36; sDataRecord[11] := 16#00;       // SubBlockLength
    sDataRecord[12] := 16#00; sDataRecord[13] := 16#01;       // SubBlockVersion
    sDataRecord[14] := 16#00; sDataRecord[15] := 16#00;       // Slot
    sDataRecord[16] := 16#00; sDataRecord[17] := 16#00;       // Subslot
    sDataRecord[20..25] := 0;                                  // MAC ignored
    sDataRecord[32] := DWORD_TO_BYTE(SHR(iNewIp,24) AND 16#FF);
    sDataRecord[33] := DWORD_TO_BYTE(SHR(iNewIp,16) AND 16#FF);
    sDataRecord[34] := DWORD_TO_BYTE(SHR(iNewIp, 8) AND 16#FF);
    sDataRecord[35] := DWORD_TO_BYTE(           iNewIp AND 16#FF);
    sDataRecord[36..39]  := DWORD network byte order subnet
        (mirror of bytes 32..35 from iNewSubnet);
    sDataRecord[40..43]  := DWORD network byte order router
        (mirror of bytes 32..35 from iNewRouter);
    oDone := FALSE; oError := FALSE; oStatus := 16#0000;
END_IF;
IF NOT iExecute THEN sExecuteOld := FALSE; END_IF;

sTConfig(REQ   := iExecute AND NOT sExecuteOld,
         ID    := iInterfaceId,
         LADDR := 0,
         INDEX := 16#802A,
         LEN   := 60,
         DONE  => oDone,
         BUSY  => oBusy,
         ERROR => oError,
         STATUS=> oStatus,
         RECORD:= sDataRecord);

Calling the FB in OB1

Create a tag for each parameter so the HMI can read/write them:

// OB1 — call the wrapper once per cycle
IF "Tag_HmiIpExecute" THEN
    "setPlcIp".iExecute     := TRUE;
ELSE
    "setPlcIp".iExecute     := FALSE;
END_IF;
"setPlcIp".iNewIp         := "Tag_HmiNewIp";        // DWORD
"setPlcIp".iNewSubnet     := "Tag_HmiNewSubnet";    // DWORD
"setPlcIp".iNewRouter     := "Tag_HmiNewRouter";    // DWORD
"setPlcIp".iInterfaceId   := "Local~PROFINET_Interface_1";

// Latch results for the HMI
"Tag_PlcIpDone"  := "setPlcIp".oDone;
"Tag_PlcIpBusy"  := "setPlcIp".oBusy;
"Tag_PlcIpError" := "setPlcIp".oError;
"Tag_PlcIpStatus":= "setPlcIp".oStatus;

HMI Project: Connection and Tags

Step 1 — Create the HMI Connection with System IP

1. In TIA Portal, open the TP1200 device configuration.
2. Open Connections and create a new S7 connection to the CPU 1513-1 PN.
3. In the connection properties, expand Communication path and confirm that Use the system IP address for switched communication is enabled. This is the option that makes the connection follow the panel's PROFINET address and is documented at Siemens TIA documentation.
4. Verify that the connection points to the CPU's PROFINET Interface X1 as the partner, not a fixed IP.

Step 2 — Create HMI Tags with PLC Addressing

Under HMI Tags > Default tag table create the following tags and connect them to the PLC tags created above:

HMI Tag	Data Type	PLC Tag	Access	Purpose
HMI_NewIpStr	WString[16]	—	Internal	User-entered IP string
HMI_NewIp	DWORD	Tag_HmiNewIp	Read/Write	New IP in big-endian DWORD
HMI_NewSubnet	DWORD	Tag_HmiNewSubnet	Read/Write	Subnet mask
HMI_NewRouter	DWORD	Tag_HmiNewRouter	Read/Write	Default router (0.0.0.0 if none)
HMI_IpExecute	Bool	Tag_HmiIpExecute	Read/Write	Edge-triggered start bit
HMI_IpDone	Bool	Tag_PlcIpDone	Read	FB DONE bit
HMI_IpBusy	Bool	Tag_PlcIpBusy	Read	FB BUSY bit
HMI_IpError	Bool	Tag_PlcIpError	Read	FB ERROR bit
HMI_IpStatus	Word	Tag_PlcIpStatus	Read	FB STATUS word

Step 3 — Build the HMI Screen

Create a new screen Settings_Network with the following objects:

• Five IO fields for the four IP octets and the router. Bind each octet field to a script that re-assembles the DWORD once the user leaves the field.
• One Button — Set CPU IP that sets HMI_IpExecute := TRUE for one cycle, then back to FALSE on the next scan.
• One Status bar that shows the decoded status: OK, Busy, Error 0x80C3, etc. Map the HMI_IpStatus word to a multiplex tag display.
• One Button — Restore connection that calls the WinCC system function SetConnectionMode to force the connection re-establishment after the IP change.

Step 4 — Convert IP String to Big-Endian DWORD

Use a VBScript on the IP-field Change event:

' Script: build big-endian DWORD from four IO fields
Dim o1, o2, o3, o4, ip
SmartTags("HMI_NewIpStr") = _
    SmartTags("Field_Oct1") & "." & _
    SmartTags("Field_Oct2") & "." & _
    SmartTags("Field_Oct3") & "." & _
    SmartTags("Field_Oct4")

ip = CLng(SmartTags("Field_Oct1")) * 16777216 _
   + CLng(SmartTags("Field_Oct2")) * 65536 _
   + CLng(SmartTags("Field_Oct3")) * 256 _
   + CLng(SmartTags("Field_Oct4"))
SmartTags("HMI_NewIp") = ip

HMI Self-Reconfiguration (Panel IP)

Changing the panel's own IP from the panel itself is a different system call. WinCC Professional exposes it through Control Panel > Service and Commissioning > IP Config. From a runtime screen you can launch the dialog programmatically with the system function OpenServicePage or, on newer firmware, write the panel's own IP via the system function SetPanelIP (V15.1+).

Manual Field Procedure (as confirmed in the field)

1. Open the TP1200 Control Panel on the device (Start Center > Settings > Control Panel).
2. Switch to the Service and Commissioning tab.
3. Select IP Config and press the Set connection button.
4. Press Find Online; the panel will discover available S7-1500 devices on the subnet.
5. Highlight the CPU 1513-1 PN and press OK (single click is required even if the row is already highlighted).
6. Press Save to commit the connection.

Putting the Two Halves Together

Verification

1. Online in TIA Portal, open the CPU's Online & Diagnostics > PROFINET Interface and confirm that the IP shown matches the new value sent from the HMI.
2. On the HMI, switch to the start screen and watch the diagnostic icons in the status bar. The connection should turn green within 3–5 seconds of pressing Set CPU IP.
3. From the engineering PG, ping the new IP. The PROFINET node should respond in <1 ms on a healthy switch.
4. Cycle power on the CPU. The new IP must persist; T_CONFIG writes to non-volatile storage, so the value survives a STOP/RUN transition and a power cycle.
5. Trigger a T_CONFIG write with the same IP the device already has. T_CONFIG must return DONE = TRUE, ERROR = FALSE and STATUS = 16#0000; the write is treated as a no-op by the stack.

Troubleshooting Matrix

Symptom	Likely Cause	Fix
HMI status bar shows Connection interrupted after pressing Set CPU IP	HMI connection has a static partner IP because Use the system IP address for switched communication was disabled	Edit the connection in TIA Portal, enable that checkbox, recompile, redownload the HMI image
T_CONFIG returns STATUS = 16#80C3 (resource busy)	Another T_CONFIG / WRREC job is in flight on the same interface	Serialize calls with a small state machine; only re-trigger when BUSY is FALSE
T_CONFIG returns STATUS = 16#80A1 (record length mismatch)	LEN parameter does not equal the actual buffer size (60 bytes for the IP sub-record)	Set LEN := 60 and re-compile
CPU accepts the new IP but PROFINET devices go down for 5–10 s	PROFINET controller restarts the AR when its own IP changes	Expected behavior. Use a maintenance mode screen and inform the operator
New IP is 0.0.0.0 after a CPU restart	The IP-protocol selection in the device configuration is IP address is set directly at the device rather than IP address is set in the project	Change the CPU's PROFINET interface properties in TIA Portal to Set IP address in the project and download the project; the T_CONFIG write will then be persistent
Panel cannot find the CPU in Service and Commissioning > IP Config	The new IP is in a different subnet than the panel's current IP; Find Online is broadcast-based	Temporarily set a second IP on the panel, or connect a PG directly to the CPU's X1 port with a /30 subnet
T_CONFIG STATUS = 16#DE80_B004 (PROFINET IO stack error)	Index 0x802A is not supported on the chosen interface (e.g. X2 on a CPU 1516) when the interface is in PLC mode only	Re-target the FB at the correct HW_INTERFACE; for CPU 1516-3 PN, the second PROFINET port must be configured as PN IO first

Field-Proven Caveats

• Big-endian only. S7-1500 stores DWORDs in little-endian, but the PROFINET specification requires the IP record to be big-endian. The wrapper FB above performs the byte swap explicitly — do not skip it.
• Subnet / router / DNS tripwires. Writing a router that is not reachable from the new subnet will not produce an error, but it will silently break any TCP connection (e.g. SMTP, OPC UA) that tries to leave the local network. Validate the plan before pressing Set.
• IP conflict detection. The S7-1500 PROFINET stack performs a gratuitous ARP on the new IP. If another device answers, the new IP is dropped silently and the CPU falls back to the old one. Check the diagnostic buffer for Duplicate IP address detected events.
• PG routing after the change. The TIA Portal project on the engineering PG still tries to reach the CPU at the project's old IP. After a successful T_CONFIG write, re-resolve the CPU in Online & Diagnostics > Accessible nodes to discover it at the new IP.
• Redundant S7-1500R/H systems. The PROFINET IP for the system IP is owned by the R/H system, not the individual CPU. T_CONFIG in this context writes the system IP; partner addressing on the HMI must use the system IP per the Siemens documentation referenced above.

Alternatives to Consider

Approach	Pros	Cons
T_CONFIG at runtime (this article)	No portal download; works over VPN; reusable for serial machines	Requires careful HMI connection configuration; brief PROFINET AR restart
CPU display manual edit	No code required; works on a brand-new CPU	Operator must open the display; not scriptable; no validation
TIA project variant per customer	Deterministic; full PROFINET topology download	Long commissioning; one project per customer; more memory on the TIA server
SIMATIC Automation Tool	Bulk-provisions many CPUs at once; PC-based	Not runtime; needs Windows tool and a USB or Ethernet cable
DHCP at boot	Zero configuration for the panel	Not allowed by most plant network policies; CPU does not support DHCP by default

FAQ