Configuring SCALANCE Layer 3 Routing for PCS7 S7-400H H-System Multi-Station Networks

Deploying a SIMATIC PCS 7 process control system across physically separated stations — Fuel Farm, Hydrant, and Receiving — with redundant S7-400H controllers and CP443-1 / CP443-1 Advanced communication processors is a common requirement in oil & gas, ESD (Emergency Shutdown), and Fire & Gas (F/G) architectures. When the customer mandates Layer 3 switching instead of the existing Layer 2 diagnostic switches, the engineering team immediately encounters a hard protocol constraint: the S7 fault-tolerant connection used by S7-400H systems cannot traverse routed IP boundaries because it is bound to ISO Transport (ISO-on-TCP is not supported for the redundant path) and ISO Transport relies on MAC addressing rather than routable Layer 3 addresses.

This technical reference documents the protocol limits, evaluates each SCALANCE routing option (static routes, VRRP, OSPF, Single-Hop Inter-VLAN-Routing, QinQ), and provides the field-proven configuration paths for keeping an S7-400H PCS 7 multi-station H-system operational after a Layer 3 migration.

1. Problem Definition: PCS 7 H-System Across Three Stations

A typical large refinery or tank-farm deployment places the OS / ES server pair at the Fuel Farm (Station 1) and remote I/O islands with H-CPUs at the Hydrant pit (Station 2) and the Receiving station (Station 3). The original Layer 2 topology used SCALANCE XC-200 or SCALANCE XB-200 switches configured in rings with HRP (High-speed Redundancy Protocol) or MRP redundancy.

The new specification requires Layer 3 switching so each station can be addressed as an independent IP subnet. This is a normal request when the customer wants to:

• Enforce per-station broadcast domains and ACL boundaries.
• Terminate a routable WAN / MPLS link between sites.
• Integrate future IOT, historian replication, or remote engineering VPNs.
• Reduce BUM (Broadcast / Unknown Unicast / Multicast) traffic across fiber links.

The Layer 3 candidate is usually a SCALANCE XR-500 (e.g., 6GK5 524-8GS00-2AC2 for the modular 24-port version) or a SCALANCE XR552-12M (6GK5 552-1GS00-2AC2) — Siemens managed switches that support static routes, OSPF, VRRP, and Single-Hop Inter-VLAN routing per SCALANCE X routing function documentation.

2. Protocol Stack: Why ISO Transport Blocks Routing

The S7-400H redundant communication uses the S7-REDCONNECT library blocks (FB450, FB451, FB452, FB453, FB454, FB455 — see the PCS 7 "Redundancy" library) on top of ISO Transport (TPKT over ISO 8073 / CLNP). The connection is established by:

1. The H-CPU in slot 0 (master) opens a connection using ISO Transport to the partner CP443-1 MAC address.
2. The H-CPU in slot 1 (standby) opens a parallel redundant connection to the same partner MAC.
3. Both connections are kept alive; one is active and the other is hot-standby.
4. On rack failure or CP443 failure, the surviving CPU's connection transitions to active within the configured max-tolerance time.

ISO Transport carries an NSAP (Network Service Access Point) address rather than an IP address as the destination identifier. The NSAP is mapped to a MAC address via the station table in the CP443-1 configuration (NetPro / HW Config). Because the MAC address only has local link significance and is rewritten by every Layer 2 device but discarded by every Layer 3 router, the connection cannot traverse a routed hop.

This is documented in the Siemens application note "S7-400H Communication — Configuration of fault-tolerant S7 connections" (entry ID 26483647) and the PCS 7 manual "PCS 7 Process Control System — Fault-Tolerant Systems".

3. SCALANCE Layer 3 Capabilities Overview

SCALANCE X managed switches from the XC-200, XB-200, XP-200, XR-500, and XM-400 families support the following Layer 3 functions, per the TIA Portal SCALANCE X routing documentation:

• Static routing — manual entries in the routing table. The standard option for small deterministic PCS 7 topologies. Configured under Layer 3 > Static Routes.
• Policy Based Routing (PBR) — packet forwarding decisions based on ACLs or DSCP values.
• VRRP / VRRPv3 — virtual router redundancy. SCALANCE XR-500 and XM-400 support up to 52 VRRPv3 virtual routers (per the XR-500 manual).
• OSPFv2 / OSPFv3 — dynamic routing. Used when the PCS 7 network is connected to a larger plant backbone.
• RIP — legacy dynamic routing, rarely used in PCS 7.
• Single-Hop Inter-VLAN-Routing — enables direct communication between two hosts on different VLANs through the switch's Layer 3 engine, available on SCALANCE XP216PoE and SCALANCE XR-500 family. See Single-Hop Inter-VLAN-Routing.

The SCALANCE X-414-3E (6GK5 414-3FC00, firmware V3.x or V4.x) is the classic Layer 3 industrial router used in PCS 7 V8.x deployments. It supports static routes, RIP, OSPF, and VRRP. Newer projects should use the SCALANCE XR-500 (modular) or SCALANCE XC-200 (Layer 2+) depending on whether full Layer 3 routing is required.

4. Architectural Alternatives to IP Routing

Four field-proven approaches satisfy the customer's "Layer 3 switches" requirement while preserving S7-400H fault-tolerant communication.

4.1 Option A — VLAN-Based Segmentation on Layer 2 Switches

Keep all three stations on a single Layer 2 broadcast domain but separate traffic using VLANs. Each station still gets its own subnet (the customer's core requirement), and SCALANCE switches enforce broadcast isolation. The S7 fault-tolerant connection sees a single Layer 2 path — exactly what ISO Transport requires.

Configuration summary:

• Fuel Farm subnet: 10.10.1.0 / 24 (VLAN 10)
• Hydrant subnet: 10.10.2.0 / 24 (VLAN 20)
• Receiving subnet: 10.10.3.0 / 24 (VLAN 30)
• Trunk ports between SCALANCE XC-200 switches carry all VLANs tagged (802.1Q).
• Default gateway is the H-CPU CP443-1 IP, not a router.

This is the most common PCS 7 H-system deployment and is supported by every PCS 7 release from V7.1 to V9.1 SP2.

4.2 Option B — VRRP with SCALANCE 414-3E or XR-500

VRRP (Virtual Router Redundancy Protocol, RFC 5798) provides a single virtual default gateway IP for the H-CPUs. Two SCALANCE Layer 3 switches act as VRRP peers; one is master, one is backup. If the master fails, the backup takes over the virtual MAC and IP within the configured advertisement interval (default 1 s, can be lowered to 100 ms).

VRRP is useful for non-redundant TCP traffic such as WinCC OPC UA, SIMATIC PDM, PCS 7 Maintenance Station, and S7 standard connections routed through the SCALANCE.

4.3 Option C — Static Routing with QinQ Redundant Channel

QinQ (802.1ad) allows stacking a service-provider VLAN tag on top of a customer VLAN tag. Two physically separate QinQ-tagged channels can provide a redundant Layer 2 tunnel across a routed backbone. This is the Siemens-recommended approach when the customer truly needs IP routing for non-S7 traffic while keeping S7 fault-tolerant communication operational.

Logical structure:

1. Two parallel Layer 2 paths between Fuel Farm and Hydrant / Receiving, each QinQ-tagged with a unique outer S-VLAN (e.g., 1001 and 1002).
2. SCALANCE XR-500 acts as the QinQ provider-edge switch at each station.
3. CP443-1 sees a single, deterministic Layer 2 path. S7 fault-tolerant connections ride the QinQ tunnel unchanged.
4. TCP / IP traffic between stations uses the routed interfaces (default gateway pointing at the SCALANCE virtual router IP).

4.4 Option D — SCALANCE S VPN Tunnel with Extended Timeouts

SCALANCE S612 / S623 / SC-600 modules create IPsec VPN tunnels between sites. The S7 fault-tolerant connection can traverse the tunnel if:

• The tunnel MTU is set to at least 1400 bytes to avoid fragmentation.
• The S7 connection's max-tolerance time is increased to at least 5 s (default 100 ms is too short for VPN round-trip latency).
• The VPN concentrator does not perform NAT on the tunnel payload (use transport mode, not tunnel mode with NAT).

This option is reserved for brown-field migrations where legacy WAN infrastructure is reused. New installations should prefer Option A or Option C.

5. SCALANCE 414-3E Static Routing Configuration

The SCALANCE static routing application note documents the procedure. Apply the equivalent on SCALANCE XR-500 / XM-400 using the WBM (Web Based Management) or CLI.

5.1 Prerequisites

• SCALANCE X-414-3E firmware V4.1 or higher (V3.x has limited Layer 3 features).
• Admin access to the WBM (default: https://).
• Defined IP plan and subnet mask per station.
• Each H-CPU has two CP443-1 Advanced modules (6GK7 443-1EX50-0XE0 or 6GK7 443-1GX30-0XE0) with unique IP addresses in the same subnet.

5.2 WBM Step-by-Step

1. Open WBM and log in as admin.
2. Navigate to Layer 3 > VLAN > VLAN Configuration. Create VLAN 10, 20, 30 with the corresponding IP interface addresses:

   VLAN 10: 10.10.1.1 / 24  (Fuel Farm router interface)
   VLAN 20: 10.10.2.1 / 24  (Hydrant router interface)
   VLAN 30: 10.10.3.1 / 24  (Receiving router interface)

3. Navigate to Layer 3 > Static Routes and add the routes. Each route has the syntax: Destination network + subnet mask + next-hop gateway + metric.

   ip route 10.10.2.0 255.255.255.0 10.10.1.2 1
   ip route 10.10.3.0 255.255.255.0 10.10.1.3 1
   ip route 0.0.0.0 0.0.0.0 10.10.1.254 1   (uplink default)

4. Enable IP routing globally under Layer 3 > General: set IP Routing to Enabled.
5. Commit configuration. The switch restarts the routing engine (does not affect Layer 2 forwarding).

5.3 CLI Verification

Use the SSH console (port 22, default credentials) and run:

show ip route
Codes: C - connected, S - static, R - RIP, O - OSPF
C    10.10.1.0 / 24   is directly connected, VLAN 10
C    10.10.2.0 / 24   is directly connected, VLAN 20
C    10.10.3.0 / 24   is directly connected, VLAN 30
S    0.0.0.0 / 0       [1/0] via 10.10.1.254, VLAN 10

For the complete WBM walkthrough see the SCALANCE Routing V1.0 PDF guide.

6. Configuring the S7-400H CP443-1 for the Target Topology

The CP443-1 / CP443-1 Advanced in an S7-400H rack (H-CPU 412-5H, 414-5H, 416-5H, 417-5H) has two connection types per NetPro partner definition: S7 connection fault-tolerant and S7 connection (standard). Only the standard S7 connection can be routed. The fault-tolerant S7 connection remains in the same IP subnet and Layer 2 broadcast domain.

6.1 NetPro / HW Config Settings

1. In SIMATIC Manager, open the H-station HW Config.
2. Double-click the CP443-1 in slot 4. Under Properties > Interface, set the IP address (e.g., 10.10.2.10) and subnet mask (255.255.255.0).
3. Set IP Router = 10.10.2.1 (the SCALANCE Layer 3 interface for that station).
4. Open NetPro and double-click the partner connection to the OS server CP1613.
5. Confirm the connection type is S7 Connection Fault-Tolerant. Do NOT change to S7 Connection unless the OS server application has been migrated to TCP.
6. Compile and download the connection configuration to the H-CPU and to the CP1613 station.

6.2 CP1613 / CP1623 Server-Side Configuration

The CP1613 (6GK1 161-3AA01) and CP1623 (6GK1 162-3AA01) are the dedicated Siemens Industrial Ethernet cards installed in the OS server. They support:

• S7 communication fault-tolerant via ISO Transport.
• S7 communication via TCP (firmware V2.x or higher on CP1623).
• PROFINET IO controller.

The CP1613 firmware version must be checked. Outdated firmware (V1.x) only supports ISO Transport. For any TCP-based route or for OPC UA server extension, upgrade to CP1623 with firmware V2.6 or higher.

Configure the CP1613 / CP1623 with the Siemens "SIMATIC NET Configuration" tool. Set the ISO station address (NSAP) and the IP address:

CP1623 Station Configuration:
  IP address: 10.10.1.20
  Subnet mask: 255.255.255.0
  ISO NSAP: 01.0491.11.FF.FF.04.0001.0001
  MAC: 08-00-06-01-00-01 (Siemens default prefix 08-00-06)

7. WinCC Communication Path with Layer 3 Switches

WinCC / PCS 7 OS communicates with the AS using the "S7 Channel" driver in WinCC Explorer. The driver establishes S7 connections to the H-CPU. Configure two connections per OS server:

1. Connection 1 — Primary: Standard S7 connection to H-CPU slot 0 (master) via TCP. Used for process data acquisition.
2. Connection 2 — Redundant: Standard S7 connection to H-CPU slot 1 (standby) via TCP. Activated on primary failure.

For routed Layer 3 traffic, configure WinCC TCP connections as follows:

WinCC S7 Channel:
  Connection name: AS01_HCPU
  Partner IP: 10.10.2.10
  Partner rack/slot: 0 / 4 (CP443-1 in slot 4)
  Connection type: TCP
  Read/write cycle: 1000 ms
  Max. number of variables: 2000

Verify reachability before commissioning:

From WinCC OS server:
ping 10.10.2.10           (CP443-1 of Hydrant H-CPU)
ping 10.10.2.11           (Second CP443-1 of Hydrant H-CPU)
tracert 10.10.2.10        (must show SCALANCE 10.10.2.1 as first hop)

8. Verification and Commissioning Checklist

After physical installation and configuration, run the following verification sequence:

1. Layer 2 verification: Confirm the S7 fault-tolerant connection is established between the OS server and the H-CPU. In NetPro, right-click the connection and select Check Connection. Status must be OK / Established. The CP443-1 diagnostic buffer must show Connection established, ISO Transport.
2. Layer 3 verification: From the OS server, ping each H-CPU's CP443-1 IP address. Verify tracert shows the SCALANCE router as the first hop.
3. Redundancy test: Disconnect the primary fiber between Fuel Farm and Hydrant. Confirm:
     a. S7 fault-tolerant connection switches to the redundant path within the configured tolerance time (typically < 100 ms).
     b. WinCC does NOT disconnect because it uses a parallel TCP connection.
     c. The CP443-1 diagnostic buffer logs Fault-tolerant switchover completed.
4. VRRP failover test (if Option B used): Power down the VRRP master SCALANCE. Confirm the backup takes over the virtual IP within the configured advertisement interval. Expect a brief WinCC interruption (~3 s). The S7 fault-tolerant connection will register a partner failure and the standby H-CPU becomes active.
5. QinQ test (if Option C used): Force the primary QinQ service-provider VLAN down. Confirm traffic shifts to the secondary QinQ tunnel without S7 H-connection interruption.
6. ESD / F&G response time: Perform a full ESD-1 / ESD-0 test from the F&G station. The end-to-end shutdown time, including SCALANCE forwarding and S7 H-system redundancy, must remain within the SIL target (typically < 1.0 s for SIL 2, < 0.5 s for SIL 3).

9. Troubleshooting Matrix

10. Field-Proven Recommendations

1. Use VLAN separation, not IP routing, for S7-400H H-system segments. It is the only architecture that keeps the S7 fault-tolerant ISO connection operational without protocol changes. Configure the SCALANCE XR-500 as the Layer 3 backbone but keep the H-CPU traffic on a dedicated Layer 2 VLAN pair.
2. Upgrade CP1613 to CP1623. CP1623 supports both ISO Transport and TCP and provides better diagnostic capability. Firmware V2.6 or higher is recommended for PCS 7 V9.0+ compatibility.
3. Document the NSAP table for every CP443-1. ISO Transport addressing is invisible in IP tools. A NSAP spreadsheet with rack / slot / MAC mapping is essential for troubleshooting. Store the file in the PCS 7 project archive.
4. Set the S7 H-connection max-tolerance time based on the worst-case path. Default 100 ms is suitable for direct fiber. For routed or VPN paths, increase to 3 s for SCALANCE-based QinQ and 5 s for SCALANCE S VPN tunnels. Never exceed the safety response time budget.
5. Run MRP or HRP on every SCALANCE ring. Layer 2 redundancy protocols recover a failed link in < 200 ms, far faster than IP routing protocols.
6. Separate ESD / F&G traffic on a dedicated VLAN with highest QoS priority. The SCALANCE XR-500 supports eight QoS queues. Mark the H-connection packets with VLAN PCP 6 (or DSCP EF / 46).
7. Document the customer's "Layer 3" requirement. Sometimes the customer only wants broadcast isolation and ACL enforcement, both achievable with VLANs on Layer 2 switches. Confirm the actual requirement before committing to a full routing architecture.

11. Relevant Siemens Part Numbers

12. Standards and Reference Documentation

The following IEC and IEEE standards govern the network architecture decisions documented above:

• IEC 62443-3-3 — Industrial communication network security, segment isolation requirements.
• IEEE 802.1Q — VLAN tagging (used for Layer 2 segmentation).
• IEEE 802.1ad — QinQ provider bridges (used for transparent Layer 2 tunnels across routed backbones).
• IEEE 802.1AX — Link aggregation (for redundant SCALANCE uplinks).
• RFC 5798 — VRRPv3 (Virtual Router Redundancy Protocol version 3).
• RFC 1006 — ISO Transport over TCP (ISO-on-TCP), not used by S7 H-connections but relevant for standard S7 connections.
• IEC 61511 — Functional safety for process industries, defines SIL targets that constrain the max-tolerance time of S7 H-connections.

For deeper protocol detail consult the Siemens manual "SIMATIC PCS 7 — Fault-Tolerant Systems" (entry ID 26483647) and "S7-400H Automation System — System Manual" (entry ID 1117747).