S7-400 CPU 416-3 PN/DP Ethernet Connection to SCADA via PROFINET

Overview

The SIMATIC S7-400 CPU 416-3 PN/DP (MLFB 6ES7416-3ER05-0AB0) is a high-end central processing unit that integrates three independent communication interfaces on a single module: PROFIBUS-DP, PROFINET (Industrial Ethernet), and a slot for an additional IF964-DP or similar submodule. Because the PROFINET interface is built directly into the CPU front panel, no additional Ethernet CP (Communications Processor) is required for connection to a SCADA workstation, engineering station, or HMI panel. The CPU's integrated PROFINET port is a 10/100 Mbit/s RJ-45 interface (X1P1) supporting TCP/IP, ISO-on-TCP (RFC1006), UDP, PROFINET IO, and S7 communication.

This reference documents the field-proven procedure for connecting a single PC (such as an HP Compaq 600 Pro Micro Tower running WinCC, PCS 7, or a third-party SCADA) to the CPU's PROFINET port. It also addresses the recurring field question of whether a hub, switch, or cross-over cable should be used, and what Ethernet CPs can be deployed in the S7-400 backplane if the built-in port is unavailable (damaged, occupied, or assigned to a different subnet).

CPU 416-3 PN/DP Hardware Identification

Before commissioning, verify the CPU's MLFB and firmware version. The ordering data and successor parts are documented in the Siemens Industry Online Support product tree.

The successor MLFB 6ES7416-3ES06-0AB0 is fully pin-compatible at the backplane connector level and preserves the PROFINET and PROFIBUS port assignments, so the cabling instructions below apply to both the E-series (-ER05-) and the newer ES06- hardware.

Built-in PROFINET Interface Specifications

The integrated PROFINET interface of the CPU 416-3 PN/DP occupies the left-most RJ-45 socket on the CPU front panel, labelled X1P1 (PROFINET port 1) and X1P2 (PROFINET port 2) on later ES06- variants. Key parameters:

Network Topology Options

Selection of the correct physical topology is the most common commissioning question for an S7-400 CPU 416-3 PN/DP connected to a single SCADA PC. Three topologies are valid:

Option A — Direct PC-to-CPU Connection (Recommended for One PC)

Use a standard patch cable (TIA-568A on both ends) when the PC's Ethernet NIC supports Auto-MDIX (virtually all post-2005 NICs do, including the Broadcom NIC in the HP Compaq 600 Pro Micro Tower). If the NIC does not auto-negotiate, use a crossover cable (TIA-568A on one end, TIA-568B on the other). No hub, switch, or CP module is required.

• CPU X1P1 ↔ patch/crossover cable ↔ PC RJ-45
• Maximum cable length: 100 m (Cat 5e or higher)
• Assign a fixed IP address (e.g., 192.168.0.1 / 24) to the CPU and a same-subnet address to the PC (e.g., 192.168.0.2 / 24)

Option B — SCALANCE Switch (Recommended for One or More PCs)

Use a Siemens SCALANCE XC/XB/XR series switch when:

• More than one PC needs access to the CPU (e.g., engineering station + SCADA server + thin client)
• PROFINET IO devices are also connected to the same CPU port
• Network diagnostics, port mirroring, or SNMP monitoring are required

A 10/100 unmanaged switch (e.g., SCALANCE XC206-2SFP) is sufficient when the network is exclusively used for SCADA polling. Configure VLANs and managed features only if PROFINET IO is mixed in the same switch — PROFINET requires priority tagging (VLAN 0, PCP 6) and LLDP, which unmanaged switches do not respect.

Option C — Legacy Ethernet Hub

A 10/100 Mbit/s hub (repeater) is electrically valid for a single SCADA PC because the integrated CPU port supports half-duplex 10/100 Mbit/s. However, hubs are obsolete and introduce collision-domain contention; a managed or unmanaged switch is always preferred. A hub must never be used if PROFINET IO devices share the segment, as the timing jitter of CSMA/CD collisions violates the PROFINET real-time requirements.

Ethernet CP Alternatives (When the Built-in Port Is Unavailable)

If the integrated PROFINET port is damaged, fully occupied by a PROFINET IO controller assignment, or the application requires additional isolated subnets, an Ethernet CP can be inserted in the S7-400 backplane. The supported CP modules are documented in entry 59187251 of the Siemens Industry Online Support.

The CP occupies a free slot in the S7-400 rack. Configuration is performed in HW Config (STEP 7 V5.5 / V5.6) or in the TIA Portal (V13 SP1 and higher, via GSD or HSP). The CP's MAC address is printed on the front panel and is required when the network administrator assigns a fixed IP outside of the S7 project.

IP Address Configuration Procedure (STEP 7 V5.x)

1. Open SIMATIC Manager and the S7 project containing the CPU 416-3 PN/DP hardware configuration.
2. Open HW Config and double-click the CPU 416-3 PN/DP slot. Select the PROFINET Interface tab.
3. Click Ethernet Addresses → Properties. The dialog is shown in the S7-400 CPU manual entry 23904550.
4. Click New and enter the IP address, subnet mask, and (if applicable) router address. Example values for an isolated SCADA subnet:

   IP address:    192.168.0.1
   Subnet mask:   255.255.255.0
   Router:        0.0.0.0 (none)

5. Compile and download the hardware configuration to the CPU. After the restart, the CPU's PROFINET port is reachable on the assigned IP.
6. Configure the PC's NIC with a same-subnet fixed IP (e.g., 192.168.0.2 / 255.255.255.0). Disable any other active NICs (Wi-Fi, VPN) to avoid routing conflicts.

SCADA / OPC Configuration

For a SIMATIC WinCC or PCS 7 OS, add the S7-400 station via the SIMATIC S7 PROTOCOL SUITE channel and select the TCP/IP driver. Enter the CPU's PROFINET IP address and the rack/slot (always rack 0, slot 3 for the CPU in an S7-400).

For third-party SCADA packages (Ignition, iFIX, Citect, WinCC OA), use either:

• Siemens S7 driver / libnodave / Snap7 over ISO-on-TCP (port 102), or
• OPC UA via the S7-400 OPC UA server (requires CP 443-1 with firmware supporting OPC UA, or an external edge gateway such as the SIMATIC IOT2050)

The default port 102 (ISO-on-TCP / RFC1006) is the standard S7 communication port. The PROFINET port also accepts PG/OP communication on the same port. No additional firewall opening is required if the SCADA PC and the CPU are on the same isolated subnet.

Cable and Wiring Requirements

Verification and Diagnostics

1. From the PC, open a command prompt and run ping 192.168.0.1. A reply with TTL < 64 confirms IP-level connectivity to the CPU's PROFINET port.
2. In STEP 7, select PLC → Accessible Nodes. The CPU 416-3 PN/DP should appear with its MAC address and the assigned IP. If the CPU is not visible, verify that the firewall on the PC allows ISO-on-TCP port 102 and that the PC and CPU share the same subnet.
3. Open the CPU's online diagnostic buffer (PLC → Diagnostic Buffer in SIMATIC Manager) and confirm that the PROFINET interface has reached the RUN state and that no link-down events are logged after the cable was connected.
4. Use the CPU's front-panel LED indicators: LINK (green, link up) and RX/TX (yellow, flashing on traffic). Both LEDs must be active when the SCADA is polling.
5. From the SCADA, perform a single read of a known tag (e.g., a marker in MB0) and confirm the value updates at the configured poll interval.

Troubleshooting Matrix

Field-Proven Notes

• For a single SCADA PC, the direct CPU-to-PC patch cable is the most reliable configuration. A switch adds only one extra failure point with no benefit in a one-to-one link.
• For PROFINET IO line topology and SCADA on the same physical port, use a SCALANCE switch in the line. The CPU 416-3 PN/DP supports PROFINET Conformance Class B and can act as a PROFINET IO controller while simultaneously serving PG/OP and S7 communication on the same interface.
• If the application is safety-related (F-CPU), the integrated PROFINET interface of the CPU 416-3 PN/DP is the safety bus interface; do not connect a non-safety SCADA on the same port without a SCALANCE S-series security module in front of the SCADA side.
• The HUB question is best answered in 2024+ by saying: use a switch, not a hub. Hubs are no longer manufactured in industrial grade and are not supported in any new PROFINET installation.

FAQ