T_CONFIG Status 00700000: Resolving S7-1200 IP Change Failures

The T_CONFIG function block is the only Siemens-supplied mechanism for changing the PROFINET interface IP address, PROFINET device name, or NTP server assignment of an S7-1200 or S7-1500 CPU from inside the user program. A large share of field reports describe the same symptom: the FB is called cyclically, the EN input is green, but every output stays at its inactive value, with STATUS = 16#00700000 (often written 0x00700000), BUSY = FALSE, DONE = FALSE, ERROR = FALSE, and ERR_LOC = 16#00000000. The job never starts. This reference walks through every documented cause of that exact status pattern, the diagnostic steps that isolate it, and the verified working code that puts the FB back in service.

1. Problem Details

The reported failure has a very specific signature that distinguishes it from a normal T_CONFIG execution:

Status 16#00700000 is the WSystem "no job" sentinel. It is returned by T_CONFIG when the internal state machine has nothing to do. There are three conditions that produce it:

1. The FB has been called but REQ has never produced a rising edge.
2. A previous job finished and REQ has not been re-triggered with a new rising edge.
3. The configuration DB is malformed and the FB cannot initialize the job, so the call returns to idle before queuing anything.

The first two are user-code issues. The third is an engineering issue. All three are fixable without firmware changes.

2. T_CONFIG Function Block Reference

T_CONFIG is documented in the SIMATIC S7-1200 Programmable Controller System Manual (entry ID 109824803) and the equivalent S7-1500 system manual. It is located in the TIA Portal global libraries under Communication → PROFINET / Industrial Ethernet.

Two facts that are not obvious from the FB faceplate drive most of the failures described in the field:

• REQ is edge-evaluated. Holding REQ = TRUE does not retrigger the FB. The internal state machine requires a clean 0 → 1 transition for every job.
• The FB does not look inside the configuration DB on every scan. It reads the structure once at job start. If the structure is corrupt, the FB silently returns to idle with STATUS = 16#00700000 and never raises ERROR.

3. Affected Hardware and Firmware

Verify the firmware before chasing the FB. Open Online → Diagnostics → Module Information in TIA Portal and read the firmware from the CPU's identification tab. If the firmware is below the version in the table, T_CONFIG is not present in the runtime library and the call will return a "FB not found" compile error, not the 00700000 status described here.

4. Root Cause Analysis

Five root causes account for almost every STATUS = 16#00700000 report. The order reflects field frequency.

4.1 REQ is a level, not an edge

This is the single most common cause. The user energises REQ with a coil or a static tag, leaves it TRUE, and watches the outputs. The FB does its first-cycle handshake, sees that REQ is already TRUE, and because it is looking for a transition it does not start a job. STATUS stays at 16#00700000.

Proof: the moment a rising-edge detector is inserted ahead of REQ, the FB wakes up and the status changes to 16#007F0000 (job executing) on the first scan and then to a success or error code.

4.2 CONF_DB does not exist or has the wrong number

CONF_DB is a UINT input that names a user data block. If the number points to a DB that does not exist, that has been deleted, or that has been retagged, T_CONFIG silently returns to idle. There is no FB exception, no ERROR, and no STATUS code other than 16#00700000.

4.3 CONF_DB has a valid DB number but a malformed structure

The T_CONFIG configuration DB has a fixed layout. Two fields are mandatory and must be at the expected offsets:

• cbLength (UINT at offset 0) — total length of the configuration record in bytes.
• cbBlockId (UINT at offset 2) — block identifier, must be 16#0001 for IP change, 16#0002 for subnet mask, 16#0003 for router address, 16#0004 for PROFINET device name, 16#0005 for NTP server.

Any deviation — wrong block ID, wrong length, or wrong byte order in the IP — makes the parser reject the record and the FB stays idle. The exact byte layout is given in section 6.

4.4 INTERFACE index does not match the configured port

The INTERFACE input takes the hardware identifier of the PROFINET interface, not a port number. The typical user mistake is to write 1 or 2 as a literal. On an S7-1200 CPU the correct identifiers are 1 (X1) and 2 (X2). On an S7-1500 the identifiers are 64 (X1), 65 (X2), and so on. A wrong identifier also drops the FB back into idle.

You can read the correct value in TIA Portal under Device view → PROFINET interface → Properties → System constants → Local~PROFINET_interface_1. The value is exposed as a system constant of type HW_INTERFACE and can be passed by symbolic name rather than by literal.

4.5 "Set IP address using a different method" disables the user-program path

Under Device view → PROFINET interface → Properties → Ethernet addresses → IP protocol there is a check box labelled "Set IP address using a different method". This is the master switch that gates every out-of-band IP change. If the box is checked, T_CONFIG is rejected. Toggling the check box without recompiling does not change the running PLC behaviour; a full download is required.

5. Status Code Reference Table

The STATUS output is a 32-bit field. The high word is the function class, the low word is the sub-status. The codes below are taken from the Siemens system manual entry on T_CONFIG.

Note that 16#00700000 is the only status in this table that contains no error bit. The FB simply has nothing to report because nothing has been asked of it. That is the diagnostic signature you are chasing.

6. CONF_DB Structure Specification

The configuration data block is a standard global DB with one STRUCT element. The offsets are fixed; do not add or remove fields.

6.1 IP address change (Block ID 16#0001)

The subnet field is required even when the goal is only to change the IP, because the parser validates the entire record. A length of 10 in cbLength is acceptable when only IP + subnet are needed (the parser will pad); the safest is to include the 4-byte router block and set cbLength = 18 to match the system manual example.

6.2 SCL declaration for the IP-change record

DATA_BLOCK "cfgTConfigIp"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
VAR
   cfg : STRUCT
      cbLength   : UINT := 18;          // 18 bytes for IP + sub + router
      cbBlockId  : UINT := 16#0001;     // IP address change
      ipAddress  : ARRAY[0..3] OF BYTE := 16#C0, 16#A8, 16#00, 16#0A;
      subnetMask : ARRAY[0..3] OF BYTE := 16#FF, 16#FF, 16#FF, 16#00;
      router     : ARRAY[0..3] OF BYTE := 16#C0, 16#A8, 16#00, 16#01;
   END_STRUCT;
END_VAR
BEGIN
   cfg.cbLength  := 18;
   cfg.cbBlockId := 16#0001;
END_DATA_BLOCK

7. Edge-Triggered REQ Implementation

The simplest fix is a one-shot on REQ. The pattern below is verified on S7-1200 firmware 4.4 with TIA Portal V17.

7.1 Ladder logic (LAD)

Network 1 — one-shot on REQ
 |    |
 | [startIpChange]  — manual command (BOOL)
 |    |
 |--(P)--[M0.0  := 1]   — positive edge detector

7.2 Structured text (SCL)

// Edge memory
IF "startIpChange" AND NOT "edgeMemIpChange" THEN
   "edgeIpChange" := TRUE;     // pulse for one OB1 cycle
ELSE
   "edgeIpChange" := FALSE;
END_IF;
"edgeMemIpChange" := "startIpChange";

// T_CONFIG call
"instTConfig"(REQ        := "edgeIpChange",
              INTERFACE  := 1,                       // X1 on S7-1200
              CONF_DB    := 10,                      // DB10 = cfgTConfigIp
              DONE       => "tcDone",
              BUSY       => "tcBusy",
              ERROR      => "tcError",
              STATUS     => "tcStatus",
              ERR_LOC    => "tcErrLoc");

// Latch the result so the diagnostic page can show it
IF "instTConfig".DONE THEN
   "tcStatusLatch" := "instTConfig".STATUS;
   "tcDoneLatch"   := TRUE;
END_IF;
IF "instTConfig".ERROR THEN
   "tcStatusLatch" := "instTConfig".STATUS;
   "tcErrLocLatch" := "instTConfig".ERR_LOC;
   "tcErrorLatch"  := TRUE;
END_IF;

The same pattern works in LAD with the built-in P coil. The point is to feed REQ a single-cycle TRUE pulse, not a level. Without that, the FB sees no transition and STATUS is stuck at 16#00700000.

8. Diagnostic Procedure

Run through the steps in this order. Each step is non-destructive until step 8.

1. Open TIA Portal and go online with the CPU.
2. Open the instance DB of T_CONFIG and confirm REQ is going TRUE then FALSE within one cycle. If it is held TRUE for more than one cycle, the level/edge problem in section 4.1 is the cause.
3. Confirm INTERFACE matches the configured port. Use the system constant, not a literal, to remove this variable from the equation.
4. Confirm CONF_DB points to a DB that exists in the project. Open the project tree, expand Program blocks, and look up the DB number.
5. Open the configuration DB online and verify cbLength = 18 and cbBlockId = 16#0001 (or whichever block ID matches the operation). If cbLength is 0 or cbBlockId is 0, the DB was never initialised.
6. Verify optimised access is OFF on the configuration DB (section 6.2 note).
7. Verify the IP bytes are non-zero and not a broadcast or loopback address. 16#7F000001 (127.0.0.1) is rejected with 80C0 0300, but a zero-filled address is rejected with the silent 0070 0000 path on some firmware.
8. With the CPU still in STOP, edit the project, fix the root cause, and download. Do not change the IP while the CPU is in RUN with active PROFINET IO traffic; the change is committed to the interface and PROFINET devices will lose connection.

9. Solution Procedure

Once the diagnostic has identified the root cause, apply the targeted fix.

9.1 Fix the REQ signal (cause 4.1)

1. Insert a rising-edge detector on the boolean that drives REQ.
2. Add a status bit that latches the last DONE / ERROR, so you can see the result on the HMI after the pulse is gone.
3. Re-download and test.

9.2 Fix CONF_DB numbering (cause 4.2)

1. Recreate the configuration DB with the exact name used in CONF_DB.
2. If you renamed the DB, the symbolic reference is updated automatically, but the numeric reference (CONF_DB) keeps the old number. Re-enter the new number.

9.3 Fix the record layout (cause 4.3)

1. Open the DB and verify the field order matches section 6.1.
2. Set optimised access OFF.
3. Re-initialise the DB in the startup OB (OB100) so a fresh power-on always loads the right values.

9.4 Fix INTERFACE (cause 4.4)

1. Open Device view → PROFINET interface → Properties → System constants.
2. Copy the constant Local~PROFINET_interface_1 symbolically to the T_CONFIG INTERFACE input.
3. Delete any literal 1 or 2.

9.5 Clear the master switch (cause 4.5)

1. Uncheck Set IP address using a different method in the PROFINET interface properties.
2. Recompile and download the hardware configuration.
3. Cycle power to the CPU. The change is only active after a warm restart.

10. Verification

After applying the fix, run this sequence. Do not skip step 4; T_CONFIG can succeed at the user-program level and still fail at the network level if the new address collides.

1. Trigger REQ. Observe the status transition 16#00700000 → 16#007F0000 → 16#00000000. DONE is TRUE for one cycle.
2. Open the HMI or watch table and read the latched DONE bit and STATUS.
3. From a second engineering station, ping the new IP address. The first ping may time out because the PROFINET stack re-initialises; the second should succeed.
4. Open TIA Portal and try Online → Accessible nodes. The CPU must appear at the new address.
5. Re-establish any HMI, S7, or OPC UA connection that was using the old address and verify data is updating.
6. If the verification fails, set tcStatusLatch and the raw STATUS in the watch table and look up the value in section 5.

11. Common Configuration Mistakes

12. Advanced Topics

12.1 Changing the PROFINET device name at runtime

Use cbBlockId = 16#0004 and place the device name as a 1–240 character ASCII string after a 2-byte length prefix. The name is committed to the PROFINET stack on DONE. After the change the CPU must restart the PROFINET interface, so this is a maintenance-window operation.

12.2 Changing the NTP server

Use cbBlockId = 16#0005. The configuration record carries a 4-byte IPv4 address and an optional 1-byte poll interval in seconds. The CPU must have time synchronisation enabled in the device configuration for the change to take effect.

12.3 Sequencer for back-to-back changes

Calling T_CONFIG twice in a row on the same interface with the same REQ pulse does not work; the second call sees BUSY = TRUE from the first. The clean pattern is a small state machine with four states: idle → write_ip → wait_done → write_router → idle. Each transition uses a new rising edge on REQ.

12.4 Behaviour in S7-1500 versus S7-1200

The S7-1500 implementation of T_CONFIG accepts the same record layout and the same block IDs. The only operational difference is the INTERFACE constant: on S7-1500 the X1 port is identifier 64, not 1. A code project that is migrated from S7-1200 to S7-1500 must update INTERFACE or the FB will sit in 16#00700000 just as in the S7-1200 case.