Auditing and Locating Node IP Addresses Across PCS 7 Plant and Terminal Buses

Auditing and locating IP addresses across a SIMATIC PCS 7 architecture—including the Engineering Station (ES), redundant OS Servers, and OS Clients—can be performed rapidly without interrupting plant operations using three primary engineering utilities: Simatic Shell, the SIMATIC Manager "Edit Ethernet Node" browser, and Windows network configuration tools. In PCS 7, stations participate in two separate network tiers: the Plant Bus (AS-to-OS communication, often running ISO protocol or TCP/IP on industrial communication processors like CP 1623) and the Terminal Bus (ES-to-OS-to-Client communication, running TCP/IP over commercial NICs). Querying Simatic Shell properties displays the active Terminal Bus adapter IP, while "Edit Ethernet Node" broadcasts layer-2 DCP discovery frames to inventory all reachable MAC and IP addresses.

PCS 7 Network Segmentation: Plant Bus vs Terminal Bus

In a standard SIMATIC PCS 7 distributed control system, network communications are divided into two strictly isolated subnets to ensure determinism and security:

Terminal Bus: Interconnects the Engineering Station (ES), redundant OS Servers, OS Clients, BATCH Servers, Route Control Servers, and Process Historian. It operates exclusively on IPv4 TCP/IP using standard commercial network adapters (Intel/Broadcom NICs).
Plant Bus: Interconnects the S7-400 / CPU 410 controllers with the OS Servers and ES. It operates over Industrial Ethernet using dedicated communications processors (such as CP 1623 6GK1162-3AA00 or CP 1628 6GK1162-8AA00) utilizing either the ISO protocol (MAC-based, non-routable) or ISO-on-TCP (TCP/IP port 102).

When preparing plant configuration drawings, network diagrams, or procurement schedules, engineers must capture the IP addresses of both tiers separately.

Method 1: Identifying Terminal Bus IPs via Simatic Shell

Simatic Shell is the core communication middleware that manages cross-station discovery and synchronization between WinCC computers. It provides the fastest method to audit all operational station IPs on the Terminal Bus:

On any running ES, OS Server, or OS Client, open Windows Explorer.
In the navigation tree, locate and expand This PC -> Simatic Shell.
Simatic Shell queries the local subnet and lists all detected PCS 7 computer nodes.
Right-click on any listed computer node (e.g., OS_SRV_PRI, OS_SRV_STB, ES_STATION, or CLIENT_01) and select Properties.
The Properties window immediately displays the computer's active IP address on the Terminal Bus, its network name, and its WinCC station status.
To inspect the local station's network adapter binding, right-click Simatic Shell, select Settings, and review the selected network card and assigned IP address.

Method 2: Network-Wide Discovery via Edit Ethernet Node

When network nodes are powered on but station names or IP bindings are unknown, SIMATIC Manager provides a layer-2 discovery mechanism based on the Discovery and basic Configuration Protocol (DCP):

Discovery ToolTarget Network TierProtocol UsedReachable Node TypesOperational ImpactSimatic ShellTerminal BusNetBIOS / RPC / MulticastWindows PCs running WinCC (ES, OS, Clients)Zero (Passive query)Edit Ethernet NodePlant Bus or Terminal BusLayer 2 DCP (MAC Broadcast)S7 CPUs, CPs, SCALANCE switches, ET 200 IMs, PCsMinimal broadcast overheadNetPro Network ConfigOffline Engineering DatabaseS7 Project DatabaseAll engineered nodes configured in Step 7None (Offline review)Windows PowerShell / CLILocal HostGet-NetIPAddress / ipconfigLocal physical and virtual network adaptersZero

To execute DCP discovery via SIMATIC Manager:
1. Open SIMATIC Manager and set Options -> Set PG/PC Interface to the target network card (e.g., Intel Gigabit Network Connection.Auto for Terminal Bus, or CP1623.ISO / TCP for Plant Bus).
2. Navigate to PLC -> Edit Ethernet Node....
3. Under the 'Ethernet node' section, click Browse....
4. SIMATIC Manager broadcasts a DCP discovery request across the subnet. Within seconds, a dialog appears enumerating every connected node, displaying its MAC Address, current IP Address, Subnet Mask, and configured Device Name.

Method 3: NetPro and Hardware Configuration Auditing

If physical access to the running network is unavailable, all planned and engineered IP addresses can be retrieved directly from the offline PCS 7 project database:

Open the Multiproject in SIMATIC Manager.
Open NetPro from the toolbar.
In NetPro, select the Industrial Ethernet subnet lines representing the Plant Bus and Terminal Bus.
Review the network tables at the bottom of the screen; NetPro displays every configured PC station (WinCC Application, ES), controller CP, and network switch alongside their statically assigned IP addresses and subnet masks.
In Hardware Configuration for each PC station, double-click the IE General or CP network adapter and open Properties -> Parameters to view the assigned static IP.

Verification

To verify that the documented IP addresses match live network assignments:
1. Open a Windows Command Prompt on the Engineering Station.
2. Execute ping <IP_Address> for each audited OS Server and OS Client on the Terminal Bus; confirm four successful reply packets with round-trip latencies below 5 ms.
3. On redundant OS servers, verify that the primary and standby servers resolve each other's Terminal Bus IPs identically in the Windows hosts file located at C:\Windows\System32\drivers\etc\hosts.
4. Run arp -a in the command prompt to cross-check IP-to-MAC address mappings against Hardware Configuration records.

Limitations and Operational Precautions

Never use the 'Assign IP Configuration' button inside the 'Edit Ethernet Node' dialog on an active, running PCS 7 network unless explicitly commissioning a replacement component. Modifying an IP address on a live OS Server or controller CP breaks active S7 connections and disrupts redundant synchronization. Always confirm that all PCS 7 servers and clients utilize static IP addressing; DHCP (Dynamic Host Configuration Protocol) is not supported on PCS 7 Terminal and Plant Buses.

Engineer FAQ

Can PCS 7 OS servers and clients obtain IP addresses dynamically via DHCP?

No. Siemens strictly requires static IP addressing for all OS Servers, OS Clients, Engineering Stations, and automation controllers. Dynamic DHCP address changes cause immediate disconnection of WinCC communication channels.

Why does Simatic Shell not show other computers on the Terminal Bus?

Simatic Shell relies on multicast messaging and the correct network card binding. In Simatic Shell -> Settings, ensure that the network adapter assigned to the Terminal Bus is selected, and verify that Windows Firewall allows Simatic Shell communication ports.

Does the Plant Bus always require IP addresses?

Not always. If the Plant Bus utilizes the Industrial Ethernet ISO protocol on CP 1623/1628 cards, communication is based purely on MAC addresses, requiring no IP addresses on the plant bus tier.