×
Siemens Industry Online Support
Siemens AG
Entry type: Download Entry ID: 109474874, Entry date: 02/22/2018
(7)
Rate

Operating System Update V6 CPU412-2 PN/DP, CPU414-3 PN/DP, CPU414F-3 PN/DP, CPU416-3 PN/DP, CPU 416F-3 PN/DP

  • Entry
  • Associated product(s)
Firmware download for PN-CPU V6

Current firmware version standard CPU V6.x

CPU 412-2 PN/DP 6ES7 412-2EK06-0AB0
CPU 414-3 PN/DP 6ES7 414-3EM06-0AB0
CPU 414F-3 PN/DP 6ES7 414-3FM06-0AB0
CPU 416-3 PN/DP 6ES7 416-3ES06-0AB0
CPU 416F-3 PN/DP 6ES7 416-3FS06-0AB0

The latest firmware is available at the end of the entry.

 

General information about the firmware update

When firmware is updated, it must always be upgraded to the latest version available for the relevant MLFB. The previous versions of the firmware are only intended as a backup to enable you to downgrade to the original version, although this has never been known to be necessary.

The latest version of CPU firmware in each case is valid for all revision levels of this MLFB. The CPU will start a memory reset after a firmware update.

 

Firmware update online

You have the option of updating the CPU firmware online.

  1. Start STEP 7 and go into HW Config.
  2. Open the station containing the CPU you want to update.
  3. Select the CPU.
  4. Select the "PLC > Update Firmware" menu command. The menu command is only available if the selected CPU supports the "Update firmware" function.
  5. In the "Update firmware" dialog, select the path to the firmware update files (*.UPD) using the "Browse" button.
  6. Once you have selected a file, the information in the lower fields of the "Update firmware" dialog box shows you the file and firmware version for the corresponding modules.
  7. Click "Run". STEP 7 verifies that the selected file can be interpreted by the module, and then downloads the file to the CPU if verification is positive. If this requires changing the operating mode of the CPU, you will be prompted to do this in the relevant dialog boxes. The CPU then automatically updates the firmware.
  8. In STEP 7, verify that the CPU can start with the new firmware (by reading the CPU diagnostic buffer).
  9. Set the time when the operating system update has been successfully completed.

 

Firmware update via memory card

Requirements for creating an operating system update card:

  • S7 memory card: Flash 16 MB (order number 6ES7 952-1KS00-0AA0) or more
  • STEP 7 version V3.2 or higher (STEP 7 with the appropriate version is required to use the new functions)
  • PC with external prommer or programming device for programming the memory card

Procedure for creating an operating system update card via STEP 7

  1. Download the desired CPU file
  2. Unzip the file with a double-click on the file name
  3. Erase the memory card with the following action: "File / S7 Memory Card / Delete" in Simatic Manager.
  4. Program the firmware by selecting the following in the Simatic Manager: "PLC/Update operating system", select the destination directory and start programming by selecting the file CPU_HD.UPD and clicking "Open".

Perform the operating system update:

  1. Power OFF the power supply (PS) of the rack in which the CPU is located
  2. Insert the prepared operating system update card in the CPU
  3. Power ON the power supply of the rack in which the CPU is located
  4. The operating system is transferred from the memory card to the FLASH EPROM inside the CPU. During this time, all the display LEDs on the CPU are lit.
  5. The operating system update takes about 2 minutes and is completed when the STOP LED on the CPU flashes slowly => memory reset request from the system.
  6. Power OFF the power supply and insert the provided memory card for operation if necessary.
  7. Power ON the power supply. The CPU automatically performs a memory reset and is immediately ready for operation.
  8. Set the time when the operating system update has been successfully completed.

 

 

 

Downloads

 

Download firmware version V6.0.2 (backup –28 March 2012)

Version 6.0.2 contains the following correction:

  • Signal-level adaption for improved shutdown response of distributed I/O signals during run/stop transition

You are strongly advised to update to the latest firmware version.

Product information a5e03290570_03.pdf (93.0 KB)

Files for firmware version

 

MLFB

V6.0.2

CPU 412-2 PN/DP6ES7 412-2EK06-0AB0 4122ek06_v602.exe (6.4 MB)

CPU 414-3 PN/DP

6ES7 414-3EM06-0AB0

4143em06_v602.exe (6.4 MB)

CPU 414F-3 PN/DP

6ES7 414-3FM06-0AB0

4143fm06_v602.exe (6.4 MB)

CPU 416-3 PN/DP

6ES7 416-3ES06-0AB0

4163es06_v602.exe (6.4 MB)

CPU 416F-3 PN/DP

6ES7 416-3FS06-0AB0

4163fs06_v602.exe (6.4 MB)

 

 

 

 

Download firmware version V6.0.3 (backup – 19 July 2012)

Version 6.0.3 includes the following corrections:

  • No changes could be performed through "Module replacement during operation" with CP341. (Internal ref. AP01027309)
  • When SFC12 was used to trigger activation/deactivation of a frequent change of the state, a DEFECT with ID W#16#4550 1222 0130 0006 could occur. (Internal ref. AP01040034)
  • With open communication via Industrial Ethernet and the protocol type ISOonTCP (16#12), the DEFECT with the ID W#16#4535 0544 041C could occur with an incorrect rack/slot entry in the TSAP of the destination CPU. (Internal ref. AP01049351)
  • When the Lifelist function was executed in STEP 7 V11 (MPI/DP or DP), the DEFECT with the ID W#16#4535 0544 041C could occur. (Internal ref. AP01049351)
  • If the configured data block did not exist for the parameter record when SFC 14 was called, the DEFECT with ID W#16#4520/811d/40E8 could occur. (Internal ref. AP01156372)
  • If a read-only data block was accessed with the communication functions PUT/GET or via OCM from a partner (WinCC, OP), the DEFECT with the event ID W#16#4520 8130 40E1 could occur. (Internal ref. AP01213986)
  • When AR_SEND and SFBs for alarm generation (SFB 131-136) were used simultaneously, sometimes alarms were no longer sent to the OS (Internal ref. AP01254866)
  • If an I-device was operated on an isochronous PNIO line on the CPU, the DEFECT with ID W#16#4520 811D 2494 could occur. (Internal ref. AP01260568)
  • If S5 I/O was connected through IM463-2 and the S5 I/O was not available during CPU startup, an I/O error with event ID W#16#4548 9101 0000 1FFF could occur. (Internal ref. AP01290319)
  • When encrypted blocks were loaded, sometimes a block was rejected with the following error message: D226: A structure error occurred in a block. (Internal ref. AP01298998)
  • When using communications processors for Industrial Ethernet (CP443-1 EX20/30 or CP443-1 GX20/30), disconnections could occur with high communication loads. (Internal ref. AP01311748)
  • When SFC20 with a data block number > 16000 was called, a DEFECT with ID W#16#4520 8190 could occur. (Internal ref. AP01321691)
  • In certain cases, the following error message in STEP 7 could occur: <Trigger event occupied. Too few resources available>. Specific online functions were then no longer possible. (Internal ref. AP01360163)
  • After activating the Web server, the DEFECT with the ID W#16#4550 490E could occur in rare cases. (Internal ref. AP01033560)
  • When operating the S7-400 CPU as an I-device, the DEFECT with ID W#16#4550 4502 could occur in rare cases during the transition from STOP to RUN. (Internal ref. AP01222416)
  • When ICMP broadcast frames were used, the DEFECT with ID W#16#4535 4C44 010A could occur. (Internal ref. AP01329078)
  • When overwriting a data block with a data block of the same number and the "unlinked" attribute, the DEFECT with the ID W#16#4520 9831 could occur. (Internal ref. AP01332916)

 

Functional expansion:
The following function extension has been made for SFC109:
  • Setting of protection level 3 without password legitimization. (Mode=12). (Internal ref. AP01249186)

You are strongly advised to update to the latest firmware version.

Product information a5e03290570_04.pdf (83.7 KB)

Files for firmware version

 

MLFB

V6.0.3

CPU 412-2 PN/DP

6ES7 412-EK06-0AB0

4122ek06_v603.exe (6.3 MB)

CPU 414-3 PN/DP

6ES7 414-3EM06-0AB0

4143em06_v603.exe (6.3 MB)

CPU 414F-3 PN/DP

6ES7 414-3FM06-0AB0

4143fm06_v603.exe (6.3 MB)

CPU 416-3 PN/DP

6ES7 416-3ES06-0AB0

4163es06_v603.exe (6.3 MB)

CPU 416F-3 PN/DP

6ES7 416-3FS06-0AB0

4163fs06_v603.exe (6.3 MB)

 

 

 

 

Download firmware version V6.0.4 (backup – 27 July 2015)

New functions in version V6.0.4:

  • The CPU supports RSTP on the PN interface as of version 6.0.4

 

Version 6.0.4 contains the following general improvements:

  • Pulling and plugging a redundantly connected HART module (332-8TF01 or 331-7TF01) with more than 32 bytes was not correctly detected.
    (Internal ref.: 1008104)
  • When monitoring jump instructions (e.g. JU, JC etc., but also CC) with STEP 7 V13 (TIA Portal), sometimes the CPU went to STOP due to an opcode error.
    (Internal ref. 1216419)
  • If SFB 53 "WRREC" was executed at the diagnostic address of the CPU (e.g. 16#7FF or 32767), sometimes the CPU went into the DEFECT state.
    (Internal ref.: 1115838)
  • In rare cases, the command combination of "CC Call" followed by "L Constant" and simultaneously active clock memories could result in a change of the CPU to the DEFECT state with the ID 16#45508F30.
    (Internal ref.: 1128959)

In this version, the error behavior has been improved in the following scenarios:

  • With system functions SFC79 "SET" and SFC80 "RSET" (not relevant for PCS 7 users), an error was not signaled in case of a negative parameter N (number) when it should have been.
    (Internal ref. 551312)

  • In connection with the management of communication instances, sometimes the CPU went into the DEFECT state with the ID 16#4535 0540 041A. The following scenario was required for this:

    • The number of actually configured communication instances was close to the limit set in the CPU properties.

    • Dynamic communication instances (basic communication, AlarmS, AlarmD, etc.) were also used.

    • A buffered power on was performed.

    • Subsequently, additional communication instances were loaded above the configured limit.

(Internal ref.: 1037178)

  • If an incorrect data channel (false ID) is used for an interrupt block (e.g. 0x0003 instead of 0xEEEE), sometimes the CPU changes to the DEFECT state.
    (Internal ref.: 1129670)
  • If numerous HMI devices or OCM devices (> 16 units) were operated on the MPI/DP interface, this could cause the CPU to change to the DEFECT state when bus faults occurred.
    (Internal ref.: 1156417)

  • After extremely frequent disconnections of the communications, in very rare cases, the CPU changed to the DEFECT state with the ID 16#4535 F8EE.
    (Internal ref.: 1184338)

  • System availability has been increased by expansion of the correction mechanisms in case of temporary internal inconsistencies.
    (Internal ref. 1209364)

  • If an incorrect address (via ANY pointer or Smart ANY pointer) was used for monitoring tags by means of an operator control and monitoring system (e.g. HMI or PCS 7 OS) with one-time or cyclic reading, in rare cases the CPU changed to the DEFECT state.
    (Internal ref. 551082)

The behavior in connection with power failures on the CPU has been improved in the following scenarios:

  • Using the blocks SFB15 "PUT", SFB14 "GET", SFC 67 "X_GET" and SFC 68 "X_PUT", the communication link was not reestablished upon restart following power failure on the CPU. The connection was only re-established after another restart by switch or programming device. The behavior occurred only with a restart after a power failure on the CPU. A restart by programming device or switch operation did not lead to the described behavior.
    (Internal ref.:.555369)
  • If non-consistent data with an odd length was used in a PROFINET device, an I/O management error, event ID 16#4548 with Z1=9118, could occur on the CPU after battery-backed power on, if the start address of the user data ended with 0, 2, 4, 6 or 8.
    (Internal ref.: 828800)
  • If there were two PROFINET subsystems with different isochronous setting on a CPU (e.g. CPU-internal PN interface with isochronous mode and CP443-1 as PNIO controller without isochronous mode), sometimes the isochronous OB (OB6x) was not called after a power failure on the CPU.
    (Internal ref.: 1083407)
  • When there was a restart after a power failure on the CPU, in very rare cases while reading and writing consistent user data (SFC14 / SFC15) there was a change to the DEFECT state with the ID 16#4520 811D
    (Internal ref.: 1029946)
  • If a station or module was extended or deleted via configuration changes in runtime (CiR), in very rare cases the CPU was no longer started in RUN after a power failure on the CPU.
    (Internal ref. no. 1035629)

The following configuration-dependent improvements were introduced in version 6.0.4:

  • Time synchronization configured once on the PROFIBUS interface of the CPU could only be deactivated with a memory reset.
    (Internal ref.: 555347)
  • In a PROFINET device with isochronous modules, if the last module of the device was not operated in isochronous mode, the CPU changed to the DEFECT state with the ID 16#4520 985C when downloading to the CPU. The fault did not occur with an isochronous module as the last module of the device.

    (Internal ref.: 555355)

  • After downloading a configuration with one AG626DP encoder, the CPU changed to the DEFECT state.
    (Internal ref.: 857128)
  • If the maximum number of 64 sub-slots was configured in a PROFINET device, the CPU could go into DEFECT state or freeze during startup.
    (Internal ref.: 1321323)

  • In rare cases, simultaneously downloading or deleting of blocks via multiple PGs or engineering stations could cause the DEFECT with the ID 16#4520 823.
    (Internal ref. 933496)

The following improvements were made with regard to communication and networks:

  • When a connection was established over PROFIBUS via an FDL connection, the CPU changed to the DEFECT state with the ID 16#4550 420F, after a negative acknowledgment.
    (Internal ref. 555546)
  • The CPU did not forward a ping request from another subnet if the device part of the IP address corresponded to the broadcast address (of the local subnet), although the network part of the IP differed.
    (Internal ref.: 936065)
  • The Web server of the CPU could not be reached via a secure connection over HTTPS.
    (Internal ref.: 1132948)

  • In connection with the SINEMA Server V13, sometimes the CPU changed to the DEFECT state.
    (Internal ref.: 1138139)

  • If exactly 159 data blocks were downloaded to the CPU, the data blocks could not be accessed with an unspecified S7 connection.
    (Internal ref.: 1226165)

  • When the blocks FB65 "TCON" and FB66 "TDISCON" were used, it could occur in connection with interruptions that the connection could only be re-established after STOP/RUN transition. The mentioned blocks are used to establish and terminate connections for open IE communication.
    (Internal ref.: 554428)

  • If the "Disable" and "Enable" functions were used for messages at the same time as messages were acknowledged, sometimes the CPU no longer sent messages.
    (Internal ref. 555378)

  • In extremely rare cases, a very high communication load could result in the DEFECT state (internal system error) with the ID 16#4550 0380.
    (Internal ref.: 1003520)

Version V6.0.4 contains the following corrections with regard to system status lists

  • When reading the system status list via SFC 51 "RDSYSST" with the ID= W#16#xxB1 or W#16#xxB4 (module diagnostic data) at an address W#16#xx3C (e.g.: 60, 316, 572, … 32748), no valid data was contained in the returned data record.
    (Internal ref.: 1015025)

  • When reading the device status on a PROFINET sub-system (0x694 and 0x794 system status list) via SFC51 "RDSYSST", sometimes the device status was not displayed correctly if sub-slots without user data (e.g. a SCALANCE switch) were configured in the PROFINET device sub-slot.
    (Internal ref.: 1336667)

  • When reading the system status list (SSL) W#16#0xB1 (module diagnostics information) via SFC 51 "RDSYSST", in extremely rare cases, there was a switch to the DEFECT state when connections were interrupted.
    (Internal ref.: 736393)

You are strongly advised to update to the latest firmware version.

Product information: A5E03290570-05.pdf (33.6 KB)

Files for firmware version

 

MLFB

V6.0.4

CPU 412-2 PN/DP

6ES7 412-EK06-0AB0

4122EK06_V604.exe (6.1 MB)

CPU 414-3 PN/DP

6ES7 414-3EM06-0AB0

4143EM06_V604.exe (6.1 MB)

CPU 414F-3 PN/DP

6ES7 414-3FM06-0AB0

4143FM06_V604.exe (6.1 MB)

CPU 416-3 PN/DP

6ES7 416-3ES06-0AB0

4163ES06_V604.exe (6.1 MB)

CPU 416F-3 PN/DP

6ES7 416-3FS06-0AB0

4163FS06_V604.exe (6.1 MB)

 

 


Download firmware version V6.0.5 (backup – 02 August 2016)

Functional extensions:

  • Improvements and extensions relating to diagnostic and service data (internal ref.: 1561862).

General improvements:

  • The SNMP data has been harmonized with the other SIMATIC CPUs. This changes the content of the SNMP variables "sysContact" and “sysLocation“. These changes especially improve the interaction with the SINEMA servers (internal ref.: 1383004 and 1780963).

  • On a network-connected SINEMA server, when accessing the Web server of the CPU, the Web server may no longer react to user entries if it has been used to request the module status of individual PROFINET devices (internal ref.: 1433033).

  • When a peripheral access error occurred when updating the process image for an address which has been configured as consistent useful data, and this lead to a call of the OB85, the CPU changes to the Defective operating state (internal ref.: 1499746).

  • The monitoring of a block simultaneously with an older and a more recent STEP 7 version (STEP 7 V5.x and lower than V5) no longer results in a change to the Defective operating state. (internal ref.: 1501785).

  • Improved behavior with configured DP interface and use of a large number of connections (internal ref.: 1538212).

  • In combination with a very high TCP communication load, the defect with the ID 4535 0540 0412 0001 has been eliminated (internal ref.: 1671594).

  • In rare cases it was possible that the CPU could change to the Defective operating state (with the identifier 16#4535 0544 0414 0000) when open communication blocks (FB 63 "TSEND", FB 64 "TRCV", FB 67 "TUSEND" or FB 68 "TURCV") were called nested with the parameters RQ =0 and RQ =1. (internal ref.: 1763712 and 1786263).

  • In very rare cases, a defect may occur when compressing the memory in RUN (internal ref.: 1561172).

Improvements in the usage of PROFINET IO and PROFIBUS DP:

  • The undesirable behavior at SFC49 "LGC_GADR" (entry ID: 109736598) has been eliminated (internal ref.: 1640578).

  • The PIP has not been updated when using different process image partitions in combination with SFC27 and the CPU as an iDevice (internal ref.: 1621586).

  • In very rare cases, very fast hot swapping of PROFINET devices could lead to a stop of the CPU (internal ref.: 1690460).

You are strongly advised to update to the latest firmware version.

Product information:   PI_V605PN.pdf (109,8 KB) 

Files for firmware version:

 

MLFB

V6.0.5

CPU 412-2 PN/DP

6ES7 412-EK06-0AB0

  4122EK06_V605.exe (6,1 MB)

CPU 414-3 PN/DP

6ES7 414-3EM06-0AB0

  4143EM06_V605.exe (6,1 MB)

CPU 414F-3 PN/DP

6ES7 414-3FM06-0AB0

  4143FM06_V605.exe (6,1 MB)

CPU 416-3 PN/DP

6ES7 416-3ES06-0AB0

  4163ES06_V605.exe (6,1 MB)

CPU 416F-3 PN/DP

6ES7 416-3FS06-0AB0

  4163FS06_V605.exe (6,1 MB)



 

 


Download firmware version V6.0.6 (backup – 03 November 2017)

Functional extensions:

  • Extension of the check mechanism for blocks during download.

    (Internal ref.: 2376501) 

General improvements:

  • In rare cases, the CPU changed to the Defective operating state or remained in Stop due to brief voltage drops (few ms).
    (Internal ref.: 1443461)

  • In very rare cases with active communication (for example, monitoring of blocks) and a simultaneous voltage dip with configured restart after POWER ON, the CPU may have switched to Defective operating state after a buffered POWER ON.

    (Internal ref.: 1590430)

  • The behavior during monitoring of a block with multiple instances (multiple devices or multiple windows) has been improved. The automation system now no longer changes to the Defective operating state in very rare cases when exiting monitoring.

    (Internal ref.: 1926565)

  • An optimization of the processing times when using consistent user data (KND) was introduced. The data from consistent user data is now available more quickly.

    (Internal ref.: 1976718)

  • The  compatibility when using simulation modules for DP slaves was improved.

    (Internal ref.: 2040680)

  • In very rare cases after deleting a module with different input and output addresses followed by CiR loading of this change, the CPU may have switched to the Defective operating state.

    (Internal ref.: 2062983)

  • Avoidance of time-of-day overflow in 2036 and 2038.

    (Internal ref.: 2173707)

  • After downloading a faulty configuration and subsequently correcting it, the MAINT LED no longer remains constantly lit.

    (Internal ref.: 2425774)

Improvements for PROFINET:

  • Increased robustness for non-standard-compliant messages / message sequences of PROFINET devices.

    (Internal ref.: 2085999 and 2368969)

You are advised to update to the latest firmware version.

Product information:   A5E03290570-07.pdf (119,9 KB) 

Product information (license terms):   A5E03129664-AC.pdf (304,0 KB) 

Files for firmware version:

 

MLFB

V6.0.6

CPU 412-2 PN/DP

6ES7 412-EK06-0AB0

 Download unterliegt Exportcontrolle  4122EK06_V606.exe (6,1 MB)

CPU 414-3 PN/DP

6ES7 414-3EM06-0AB0

 Download unterliegt Exportcontrolle  4143EM06_V606.exe (6,1 MB)

CPU 414F-3 PN/DP

6ES7 414-3FM06-0AB0

 Download unterliegt Exportcontrolle  4143FM06_V606.exe (6,1 MB)

CPU 416-3 PN/DP

6ES7 416-3ES06-0AB0

 Download unterliegt Exportcontrolle  4163ES06_V606.exe (6,1 MB)

CPU 416F-3 PN/DP

6ES7 416-3FS06-0AB0

 Download unterliegt Exportcontrolle  4163FS06_V606.exe (6,1 MB)








 


Download firmware version V6.0.7 (recommended for upgrade – 22 February 2018)

General improvements:

  • The buffered startup behavior with FLASH memory cards was improved.

    (Internal ref.: 2615316)

  • In very rare cases, the CPU no longer started up following a factory reset while using FLASH memory cards.

    (Internal ref.: 2697448)

  • In very rare cases, a "fault" with the code 4550/0544/0413 occurred when using PROFINET devices in conjunction with PDM software and/or when writing a PROFINET data set with the SFB53.

    (Internal ref.: 2712617)


You are advised to update to the latest firmware version.

Product information:   PI_A5E03290570-AH.pdf (42,5 KB) 

Product information (license terms):   OSS_A5E03129664_AD.pdf (179,8 KB)

Files for firmware version:

 

MLFB

V6.0.7

SHA-256 checksum 

CPU 412-2 PN/DP

6ES7 412-EK06-0AB0

 Download unterliegt Exportcontrolle  4122EK06_V607.exe (6,1 MB)

  Registrierung notwendig  4122EK06_V607_hash.txt (1 KB) 

CPU 414-3 PN/DP

6ES7 414-3EM06-0AB0

 Download unterliegt Exportcontrolle  4143EM06_V607.exe (6,1 MB)

  Registrierung notwendig  4143EM06_V607_hash.txt (1 KB) 

CPU 414F-3 PN/DP

6ES7 414-3FM06-0AB0

 Download unterliegt Exportcontrolle  4143FM06_V607.exe (6,1 MB)

  Registrierung notwendig  4143FM06_V607_hash.txt (1 KB) 

CPU 416-3 PN/DP

6ES7 416-3ES06-0AB0

 Download unterliegt Exportcontrolle  4163ES06_V607.exe (6,1 MB)

  Registrierung notwendig  4163ES06_V607_hash.txt (1 KB) 

CPU 416F-3 PN/DP

6ES7 416-3FS06-0AB0

 Download unterliegt Exportcontrolle  4163FS06_V607.exe (6,1 MB)

  Registrierung notwendig  4163FS06_V607_hash.txt (1 KB) 










For further information on SHA-256 see Entry ID 109483101


 



Security information
In order to protect technical infrastructures, systems, machines and networks against cyber threats, it is necessary to implement – and continuously maintain – a holistic, state-of-the-art IT security concept. Siemens’ products and solutions constitute one element of such a concept. For more information about cyber security, please visit
https://www.siemens.com/cybersecurity#Ouraspiration.
Rate entry
no rating
Requests and feedback
What do you want to do?
Note: The feedback always relates to the current entry / product. Your message will be forwarded to our technical editors working in the Online Support. In a few days, you will receive a response if your feedback requires one. If we have no further questions, you will not hear from us.