Resolving S7-400 CPU 416-3 PN/DP Ethernet Upload Failures

1. Problem Overview and Symptoms

An engineer trying to retrieve an existing automation project from a Siemens SIMATIC S7-400 station equipped with a CPU 416-3 PN/DP using STEP 7 V5.4 SP5 over Ethernet can hit one of three failure modes. None of them are catastrophic and every one of them has a deterministic recovery path that does not require erasing the CPU.

The failure modes observed in the field collapse into the following categories:

1. Silent Layer 2/3 — no node discovery. The "Edit Ethernet Node → Browse" dialog returns zero reachable nodes even though the PG link LED is lit. Common causes are the wrong PG/PC interface assignment and broadcast filtering on a managed switch.
2. Node visible but Upload Station to PG aborts. The CPU appears in the online dialog with rack/slot and IP, but the upload stalls or fails with a transport fault. Common causes are subnet overlap, firewall TCP/102 drop, or access protection on the CPU.
3. Connection opens but read fails. STEP 7 negotiates ISO-on-TCP, opens the connection, then fails mid-stream. Common causes are exhausted connection resources, password re-prompt, or firmware incompatibility on the CPU.

Resolving the upload requires a layered approach: solve L1 (link LED) → L3 (ping) → S7 transport (TCP 102 / ISO-on-TCP) → application (STEP 7 upload). This guide walks through each layer in order.

2. CPU 416-3 PN/DP Hardware Interface Reference

The "416-3 PN/DP" naming follows the Siemens interface-count convention. The "3" means the CPU exposes three physically separate fieldbus interfaces. The "PN/DP" suffix tells you that interface 2 is PROFINET and interface 3 is PROFIBUS DP.

The two X2 ports form an integrated 2-port Ethernet switch — both ports are equivalent. Connecting to X2 P1 or X2 P2 brings up the same IP, and the integrated switch enables line topologies with PROFINET devices daisy-chained behind the CPU.

Common MLFB part numbers (Siemens ordering data, 6ES7 family) and the maximum firmware each MLFB ships with. STEP 7 V5.4 SP5 supports the older firmware revisions natively; newer firmware revisions may need updated STEP 7 Hotfixes.

If the firmware revision on the actual CPU exceeds V7.x, install STEP 7 V5.5 SP4 or later on a separate PG, or apply the relevant Hotfix to V5.4 SP5. Mixing a newer CPU with old STEP 7 V5.4 SP5 manifests as "Unknown module type" during HW Config online read or as a 33:4940 (resource) error during upload.

Confirm the firmware revision in front of the CPU under Settings → Module Information → Firmware Version, or by selecting the CPU in PLC → Accessible Nodes after the PG/PC interface is set up (see Section 4). Reference data is published on Siemens Industry Online Support.

3. Prerequisites and Network Requirements

Stack the following prerequisites before configuring STEP 7.

• STEP 7 V5.4 SP5 installed and activated; verify via Start → SIMATIC → Information → "About". The build number typically has SP5 baked into the binary (e.g., V5.4.5.6).
• Ethernet adapter on the PG/PC: onboard NIC or certified USB-to-Ethernet (e.g., Siemens CP 5711, USB 3.0 Ethernet). Avoid virtual adapters; they confuse S7ONLINE.
• Patch cable (Cat 5e or higher) up to 100 m. With direct PG↔CPU and modern 10/100 Mbit/s interfaces, either straight-through or crossover works thanks to MDI/MDIX auto-crossover.
• Admin rights on the PG/PC to allow firewall changes and STEP 7 service starts.
• CPU power — confirm the green DC 5V LED on the front is steady; red SF/BF LEDs blink during boot and clear within 30-60 s.
• Subnet plan — keep the PG/PC on the same /24 subnet as the CPU before any upload. The default for non-routed S7-400 PROFINET setups is 192.168.0.x / 255.255.255.0.

Confirm the IP picture before launching STEP 7:

CPU 416-3 PN/DP target IP : 192.168.0.1
CPU subnet mask           : 255.255.255.0
PG/PC Ethernet adapter IP : 192.168.0.10
PG/PC subnet mask         : 255.255.255.0

4. STEP 7 V5.4 SP5 PG/PC Interface Configuration

The S7ONLINE access point selects which physical adapter STEP 7 uses for both Browse and Upload. Mis-binding the access point is the single most common cause of "Cannot find node" errors at this stage.

1. Close SIMATIC Manager if open.
2. Open Start → SIMATIC → STEP 7 → Set PG/PC Interface. Alternatively run SetPgPcInterface.exe from %ProgramFiles%\Siemens\Automation\SIMATIC Manager\S7BIN.
3. From the "Application Access Point" dropdown select S7ONLINE (STEP 7) → TCP/IP → [your NIC]. Replace [your NIC] with the physical Ethernet NIC name (e.g., "Intel I219-V Gigabit Network Connection"). Do not bind to a virtual/TAP adapter.
4. Click Properties. Under the "TCP/IP" tab confirm Windows-managed DNS is disabled for the access point (otherwise the access point may try to register with DNS and slow discovery).
5. Under the "Ethernet Address" or "Network" tab set the link speed to "Auto" (the default). Do not force 100 Mbit/full-duplex unless the CPU side is forced to match.
6. Click OK on both dialogs. Restart SIMATIC Manager to load the new binding.

The S7ONLINE access point may coexist with other entries (e.g., S7ONLINE (DCP)) used by different tools. Editing S7ONLINE (STEP 7) does not affect them; verify all points that list your NIC share the right one.

5. Online Node Discovery and IP Recovery

Discover the CPU through DCP and ensure the IP is correct before attempting an upload.

5.1 Browse the segment

1. Open a fresh STEP 7 project (File → New → Project).
2. Open SIMATIC Manager; in the menu select PLC → Edit Ethernet Nodes.
3. In the dialog, click Browse. A list of reachable PROFINET nodes populates after a few seconds. Each node displays its MAC address and current IP. If the CPU shows IP = 0.0.0.0, it has never been assigned an IP.
4. Compare the MAC printed on the CPU front (under the lower door) against each entry in the list to confirm the right device.

5.2 Assign an IP if missing

1. Select the node in the list.
2. Enter the desired IP (192.168.0.1), subnet mask (255.255.255.0), and gateway (0.0.0.0 for direct connection).
3. Click Assign IP Configuration. STEP 7 writes the IP through a DCP-Set request. The CPU stores the IP in non-volatile memory after the next store-to-flash cycle, which happens on STOP→RUN transition or power cycle.

5.3 Read the IP from the CPU display

The CPU 416-3 PN/DP includes a 2-line x 16-character LC display and a 4-direction rocker switch under the front door.

1. Unlock the lower door. Press the rocker downward to enter the menu.
2. Drill into Settings → Address → PN-IO.
3. Read IP, SnMask, and Router.
4. To set a new IP from the display: navigate to Settings → Address → PN-IO → Set IP; enter each of the four octets separated by dot; confirm with OK. Persist the change with Settings → Save on firmware revisions that do not auto-persist.

For broader communication-function background, see the Siemens documentation on Instructions for Communication Tasks S7-300/S7-400/S7-1500 (TIA Portal V21 reference; concepts apply equivalently to STEP 7 V5.x).

6. Upload Station to PG — Step-by-Step Procedure

1. Open (or create) a STEP 7 project to receive the uploaded data. A new empty project is fine — STEP 7 will fill it from the CPU's SDO data.
2. Menu: PLC → Upload Station to PG.
3. In the dialog "Upload to Project":
   • Choose the target directory (e.g., D:\PLC_Backups\S7400_Rack0).
   • Set the project name.
4. Click OK.
5. In the next dialog Select Node Address:
   • Click View. STEP 7 broadcasts an online search through the S7ONLINE adapter for reachable CPUs. Found CPUs appear with rack, slot, and assigned IP.
   • If the target is not visible, fill in the address fields manually:
     • Rack: 0
     • Slot: 3
     • Or enter the IP directly in the "Address" field if Browse was filtered out by a router.
   • Confirm with OK.
6. STEP 7 reads system data, block containers (OB, FB, FC, DB), HW Config, and the optional symbol/comment source. The status bar in SIMATIC Manager reports percentage progress.
7. On completion, the reconstructed S7 program opens under the offline project tree. Save the project with File → Save As to confirm persistence.

If the upload errors out, capture the message format. Common ones include:

• "Online: Connection to partner not established" → ping the IP first; Section 8.
• "Error 33:4711" or "33:4940" → CPU access protection active; consult the access list under HW Config.
• "The station address is invalid" → wrong rack/slot; CPU slot 3 in rack 0 is the default; Section 7.

7. Rack and Slot Mapping Reference

S7-400 online functions always address the CPU via rack and slot. The CPU is fixed at rack 0, slot 3 in the central configuration, regardless of how many sub-racks are installed.

For multi-rack UR1 configurations, only the central rack hosts the CPU. PG connections always target rack 0 / slot 3 even when HMIs or remote IO are connected to the CPU. ET200 PROFINET device slots are addressed differently — by PROFINET device name and slot within the IO device — but PG-to-CPU traffic still goes through rack 0 / slot 3.

If you operate a CP 443-1 in slot 6 to extend Ethernet capability on a different VLAN, the CP itself has its own IP, but PG-to-CPU functions still address rack 0 / slot 3 (and may be routed through the CP if needed).

8. Layer-3 and Transport Layer Diagnostics

8.1 Ping the PLC

ping 192.168.0.1 -t

Expect a reply under 2 ms on a direct cable. If Request timed out:

• Check both link LEDs (green on PC port and CPU X2 P1 or P2).
• Try a different patch cable.
• Confirm Windows subnet mask (ncpa.cpl → properties → IPv4).
• Disable Windows Firewall temporarily; if ping recovers, add a firewall rule to allow TCP 102 inbound and outbound.
• Clear stale ARP with arp -d *.

8.2 Verify TCP 102 is open

Test-NetConnection -ComputerName 192.168.0.1 -Port 102

Expected result: TcpTestSucceeded : True. A False result on a successful ping confirms a firewall or routing block on TCP 102.

8.3 Port map

8.4 TSAP pairing

The S7-400 has up to 16 PG connection resources (varies by firmware). Upload Station to PG opens one; subsequent download or monitor opens another. If the Online → Connections list reports zero free connections, restart the CPU or close other PG/OP sessions, then retry.

9. Common Root Causes and Corrective Actions Matrix

10. Verification After Upload

1. Open the reconstructed project; switch to the Online view in SIMATIC Manager.
2. Menu: Online → Online Partners. The CPU should appear at rack 0 / slot 3 with its assigned IP.
3. Menu: Online → Go Online. STEP 7 opens the live session and refreshes blocks.
4. Menu: Online → Compare with Offline. Identify deltas — offset blocks usually indicate the active CPU has been edited since the last offline save.
5. Open PLC → Diagnostic Buffer. Read the most recent entries; many upload failures leave a trace here.
6. Sanity-check online blocks with Online → Monitor/Modify. A simple I32 tag read confirms end-to-end connectivity.
7. Document the CPU firmware revision under PLC → Module Information — record this to prevent future compatibility issues.

11. Diagnostic Decision Flowchart

12. Frequently Asked Questions (FAQ)