Configuring WinCC Redundancy Alarms on S7-400H Connection Loss

Overview

When operating a SIMATIC WinCC station against a fault-tolerant S7-400H automation system, the HMI application must distinguish between two failure modes that look identical to a basic S7 driver: a complete loss of the partner (for example the PLC is powered down) and a partial loss where one of two redundant paths has failed while the other remains healthy. WinCC's S7 HMI channel automatically fails over to the standby connection in the second case, so the operator screen stays live, but no alarm is raised unless the redundancy framework is explicitly configured. This article describes the three practical methods available in WinCC to generate an alarm when one half of a fault-tolerant S7 connection drops, in a stack of two CP1623 network cards, a SCALANCE X208 managed switch, and an S7-400H station with two CP443-1 modules.

Each method monitors a different layer of the stack and produces a different alarm shape. Engineers in the field typically combine all three for full diagnostic coverage: a software lifebeat for process correctness, REDRT system messages for network-card-level detection, and a SCALANCE digital input for the physical layer.

System Architecture and Component Roles

The reference topology consists of four logical partners on the plant network:

• WinCC RT Professional server (or WinCC V7.x station) with two CP1623 PCIe network cards. The CP1623 (Siemens catalog number 6GK1162-3AA00) is a PROFINET/S7-capable PCIe card that appears in the Windows network stack as a deterministic PROFINET interface. Each card is bound to one logical subnet.
• SCALANCE X208 (6GK5208 series) managed Industrial Ethernet switch. The X208 is an 8-port managed switch with one fault-signaling contact and one selector for the redundancy mode (HRP ring or transparent).
• S7-400H station with two CP443-1 communication modules (typical catalog 6GK7443-1EX30-0XE0) seated in the H-CPU's rack. Each CP443-1 owns one PROFINET interface on the plant network.
• STEP 7 / TIA Portal project defining the S7 connection as fault-tolerant S7 connection (S7-Kommunikation fehlertolerant) so that the HMI channel uses four TCP connections, two per network path.

Total logical S7 connections: 4 (2 per CP1623, 2 per CP443-1). When any one cable is unplugged, two of the four TCP connections drop while the remaining two keep the HMI live. This is exactly the condition the operator must be alerted to.

Prerequisites

Before configuring the alarm, verify the following:

• WinCC RT Professional V16 or later (or WinCC V7.4 SP1 with the Redundancy option installed) on the HMI server.
• Siemens license key for the WinCC Redundancy option (in WinCC V7.x the option package is installed separately; in TIA Portal it is bundled with the RT Professional license).
• CP1623 drivers installed and visible in the SIMATIC IPC Configuration Center or SIMATIC NET PC software. The two PROFINET interfaces must appear as separate Windows adapters (for example PROFINET IO (CP1623) #1 and ... #2).
• SCALANCE X208 configured with the fault-signaling contact assigned to a digital output. If HRP ring is in use, one X208 must be the redundancy manager.
• STEP 7 (TIA Portal) V16 or STEP 7 V5.6 with the S7-400H option installed, and the S7 connection configured as H connection with the attribute Establish S7 connection as fault-tolerant enabled.
• Engineering access to the WinCC project online and to the S7-400H CPU (online via Ethernet or MPI/Profibus).

Understanding Fault-Tolerant S7 Connections in WinCC

When WinCC opens an S7 HMI connection with the S7 fault tolerant attribute set, the driver establishes two independent partner connections per network card. A WinCC station with two CP1623 cards therefore opens four logical S7 connections to the S7-400H, all four of which carry the same data. WinCC's S7 HMI channel continuously monitors the keep-alive frames on each of the four connections; if one connection is broken, the driver silently switches the tag reads and writes to the surviving path.

From the application side, the tag is read with the same quality. The cost of this transparency is that a partial failure is invisible to the operator by default: only a complete loss (all four paths failed) is reported as a Connection failure system message. Operators and maintenance personnel usually want to know when the system is operating on degraded redundancy, so that they can replace the cable or switch before the second path also fails.

Three independent detection mechanisms address this requirement. Each monitors a different layer of the stack and produces a different alarm shape; combining them is the only way to be sure no failure mode goes silent.

Method 1 — Lifebeat (Life-Bit) Monitoring on the HMI Tag

Lifebeat monitoring is the most fundamental approach. A boolean tag in the S7-400H toggles at a fixed interval; the WinCC tag associated with that bit is configured with a lifebeat timeout. If WinCC does not see the bit transition within the configured window, it raises a system message and changes the tag's quality code to bad.

PLC side: implement the heartbeat

The cleanest implementation uses a clock bit generated by the cyclic interrupt OB. Add the following SCL code to OB35 (default 100 ms cycle) of the AS 400H program:

// SCL example for OB35 on S7-400H
// Heartbeat in DB100.DBX0.0 toggled every 100 ms

VAR
    Heartbeat : BOOL;   // shared with HMI
END_VAR

BEGIN
    Heartbeat := NOT Heartbeat;
END_CODE

Place the bit in a data block shared with the HMI, for example DB100.DBX0.0 with the symbolic name HMI_Heartbeat. In STEP 7, set the OB35 cycle time to 100 ms; the bit flips at 5 Hz, producing a 200 ms period. WinCC will see a transition every 100 ms.

For a more diagnostic-rich heartbeat, combine the bit with a sequence counter in a data block:

// SCL in OB35 of S7-400H
// Increments a DWORD on every transition; WinCC checks for monotonic increase

VAR
    Heartbeat  : BOOL;
    HeartCnt   : DWORD;  // HMI: DB100.DBD2
END_VAR

BEGIN
    Heartbeat := NOT Heartbeat;
    IF Heartbeat THEN
        HeartCnt := HeartCnt + 1;
    END_IF;
END_CODE

The counter allows WinCC to detect a stuck-bit failure that the boolean toggle alone would not catch.

WinCC side: configure lifebeat on the tag

Open the WinCC project in TIA Portal (or WinCC Explorer for V7.x), navigate to HMI Tags, select the imported HMI_Heartbeat tag, and open the properties window. In the Lifebeat tab, configure the following parameters:

With the parameters above, WinCC expects the bit to transition at least once every 1.5 s. The OB35 cycle of 100 ms gives 15 transitions per timeout window, so normal operation easily passes.

Method 2 — WinCC Redundancy System Messages (REDRT)

WinCC RT Professional includes a built-in redundancy framework that supervises the network adapters assigned to the WinCC partner connection. The framework emits REDRT system messages whenever a network card loses its link or fails to reach the partner, regardless of whether the S7 driver has already failed over. This is the cleanest software-only solution for the scenario described above.

System messages of interest

The following messages are documented in the TIA Portal help for WinCC Redundancy RT Professional. The list is extracted from System messages — WinCC Redundancy RT Professional:

Each REDRT message can be wired into the message system, the alarm logging, and the event API of WinCC Professional. The MAC address parameter (@2%s@) lets the message name the exact CP1623 that failed, which is the diagnostic granularity the user requested.

Configuration steps in TIA Portal

1. Open the WinCC RT Professional device in the project tree and double-click Connections.
2. Select the HMI connection to the S7-400H and open its properties.
3. In Redundancy › Network adapter 1, choose the PROFINET interface of CP1623 #1 (the Windows adapter name as shown in IPC Configuration Center).
4. In Network adapter 2, choose the PROFINET interface of CP1623 #2.
5. Enable Use redundancy for this connection.
6. Compile and download the WinCC configuration to the runtime server.
7. Open the WinCC RT Professional alarm control on the runtime image and confirm that messages 1012350 / 1012351 appear in the message configuration; if they are not visible, right-click the message classes and add System, Redundancy to the visible set.

Forwarding REDRT messages to the operator

REDRT messages are stored in the internal message log by default. To make them visible on an HMI screen, drag the WinCC Alarm Control onto a screen and add a column for the MAC address. To escalate to the SCADA control room, add a Horn or Bit-messaging tag in the message routing; the message number 1012350 can be used directly as the trigger condition for a relay output or an SMS gateway in the alarm processing pipeline.

Method 3 — Hardware Detection via SCALANCE X208

The SCALANCE X208 has a built-in fault-signaling contact that opens when the device detects a loss of redundancy on its ring ports. The contact is wired to a digital input on the HMI server (or on the PLC) and the resulting tag drives the alarm. This is the only method that detects a single cable unplug event with hardware-level certainty, independent of the S7 driver state.

Wiring the fault contact

The X208 fault contact is on the 4-pin terminal block labeled F-Signal (pin 1: NO, pin 2: COM, pin 3: NC, pin 4: not used). Wire pin 1 and pin 2 to a 24 V DC source and to a digital input module on the S7-400H or on the HMI server's local I/O. In the SCALANCE Web-Based Management (WBM), navigate to Information › Redundancy and confirm that the fault contact is configured to Trigger on ring redundancy loss.

Detecting the per-cable fault (advanced)

The X208 reports only the loss of ring redundancy, not which individual cable failed. To detect the per-cable status, use one X208 per cable (a non-ring topology) or move to a SCALANCE XC-200 series switch that supports per-port link monitoring and exposes the link state over SNMP or PROFINET. For the 1-to-1 cable layout (CP1623 #1 to CP443 #1 on its own switch, CP1623 #2 to CP443 #2 on a second switch), each X208 fault contact gives unambiguous detection of the corresponding cable.

For the SCALANCE X-200 family, refer to the operating instructions and the PROFINET diagnostics manual on the Siemens Industry Online Support portal.

Step-by-Step: Configuring the Connection-Loss Alarm in WinCC

The recommended approach combines Methods 1 and 2 in TIA Portal. Method 3 is added whenever the SCALANCE fault contact is wired to the S7-400H or to a local input on the HMI server.

Step 1 — Define the S7 connection as fault-tolerant

1. In the TIA Portal project, open Devices & Networks and select the S7-400H station.
2. Open the HMI connection to the WinCC station. In the properties, set Connection type to HMI connection and tick Establish S7 connection as fault-tolerant.
3. Compile and download the hardware configuration. STEP 7 will create two S7 connections per network path inside the H-CPU, for a total of four.

Step 2 — Bind the HMI connection to the two CP1623 adapters

1. Open the WinCC device in TIA Portal and open the connection's Properties.
2. Under Interface › Network adapter 1, pick the first CP1623 PROFINET interface.
3. Under Interface › Network adapter 2, pick the second CP1623 PROFINET interface.
4. Ensure Use redundancy is enabled.

Step 3 — Create the diagnostic tag

1. Add a new HMI tag, for example HMI_Redundancy_OK, with the S7 address M 100.0 of the S7-400H.
2. Map M 100.0 in the S7 program: set the bit true when all four S7 connections are healthy, false when one or more are lost. Use the standard S7 status word of the H-CPU (the H-system H-Status byte in the system data) to derive the bit.
3. In the tag properties, enable lifebeat with a 1.5 s timeout as described in Method 1.

Step 4 — Wire the alarm

1. Open HMI Alarms and add a new Discrete alarm.
2. Trigger tag: HMI_Redundancy_OK.
3. Trigger condition: On falling edge (i.e., when the bit transitions from 1 to 0).
4. Alarm text: S7-400H redundant connection lost — check cables and SCALANCE switches.
5. Class: assign to a class with a high priority, for example Errors with state Active, requires acknowledgement.
6. Add a second discrete alarm for the On rising edge condition to clear the message when redundancy is restored.

Step 5 — Make the alarm visible

1. Add a WinCC Alarm Control on a process screen.
2. Filter to the message class and number assigned in step 4.
3. Add a column for the alarm time and the trigger tag value.
4. For audible escalation, add the WinCC Sound module to play a WAV file when the alarm class is triggered.

Step 6 — Optional: integrate the SCALANCE fault contact

1. Wire the X208 F-Signal contact to a digital input on the S7-400H (e.g., I 0.0 of the ET 200M remote I/O).
2. Create an S7 tag SCALANCE_Fault bound to I 0.0.
3. Add a second discrete alarm in WinCC with the trigger SCALANCE_Fault = 1 and the text SCALANCE ring redundancy lost.
4. In the alarm class configuration, escalate this alarm to a higher priority than the HMI tag alarm, because the SCALANCE fault indicates a hardware-level event.

Verification and Commissioning

After configuration, perform the following tests on the live system. Document each test result in the commissioning report.

Test 1 — Unplug the primary cable

1. Identify the Ethernet cable from CP1623 #1 to the SCALANCE.
2. Pull the connector from the SCALANCE side. Watch the HMI screen.
3. Expected: the S7-400H redundant connection lost alarm appears within 3 s. REDRT 1012350 is raised by the redundancy framework; the lifebeat tag drops after its 1.5 s window if both primary connections drop.
4. Push the connector back. Expect the message to clear within 3 s (REDRT 1012351).

Test 2 — Unplug the secondary cable

Repeat Test 1 with the secondary cable. The result is identical because the redundancy framework is symmetric across both CP1623 adapters.

Test 3 — Power off the standby CP443-1

1. Open the H-CPU's rack access in STEP 7 (or trigger a rack failure on the standby).
2. Confirm that the HMI stays online and the diagnostic tag is unchanged. The S7 HMI channel will fail over to the active CP443-1.
3. Confirm that no alarm is raised because the redundancy is still functional (one CP443 and two CP1623 are enough to maintain the redundant S7 connection).

Test 4 — Pull both cables simultaneously

1. Pull both cables within one second.
2. Expected: the HMI screen freezes, the tags show bad quality, and WinCC emits a Connection failure alarm of the S7 driver, in addition to two REDRT 1012350 messages (one per MAC).

Test 5 — License and audit verification

1. Open WinCC RT Professional on the engineering station and view Diagnostics › Redundancy. Confirm that both network adapters are listed with OK status.
2. Pull the license dongle. The Use redundancy option degrades to a single path and a warning is logged. This is intentional behaviour and confirms that the alarm path is being driven by the licensed redundancy framework.

Test 6 — Simulate a CPU stop on the S7-400H

1. Place the H-CPU in STOP from STEP 7 online.
2. Confirm that the lifebeat tag goes bad within 1.5 s (OB35 no longer runs).
3. Confirm that REDRT does not fire because the network adapters still have link. This is the expected behaviour: the two mechanisms are complementary, not redundant.

Troubleshooting Matrix

Notes on S7-400H-Specific Behaviour

When the S7-400H is in RUN-redundant mode, both CPUs run the same logic and the system data block H_Status reports the redundancy state. Tag M 100.0 (used in the example) can also be derived from the system status list (SSL) of the H-CPU. In the STEP 7 standard library, the FB H_STATUS provides a clean read of the H-system state including the failure of any rack or CPU. If you do not want to use the H-CPU system data, an alternative is to read the connection state of the S7 connections directly via the S7 function C_STATUS or via the SZL 0x132 (communication status).

When the S7-400H performs a link-up switchover (a CPU master change), the S7 connections remain intact on the new master; the S7 HMI channel does not see a disconnect. The REDRT framework, however, will briefly report a Partner not reachable condition for the duration of the link-up. To avoid a spurious alarm, set the REDRT debounce time to 2 s in the redundancy properties.

The MAC addresses of the CP1623 adapters can be read directly from Windows with ipconfig /all and pasted into the SCALANCE WBM access control list. The REDRT message text will show the same MAC, which is useful for cross-referencing the alarm with the physical switch port that the cable is plugged into.

License and Engineering Tools

The WinCC Redundancy option is licensed per WinCC server. The license file SSF is stored in the Common Configuration directory of the WinCC project and is loaded at runtime startup. A missing or expired license degrades the redundancy framework to a single path and logs a License missing message in the WinCC diagnostic viewer; the HMI continues to run but the REDRT messages are not emitted.

For the S7-400H side, no additional license is required to use the fault-tolerant S7 connection; it is part of the standard S7-400H communication firmware. The CP443-1 firmware must be at V3.x or later to support the S7 fault-tolerant connection extension.

For engineering access, the recommended tool stack is TIA Portal V17 or later (for new projects) or STEP 7 V5.6 SP2 with WinCC V7.5 SP2 (for legacy systems). The TIA Portal cloud documentation at docs.tia.siemens.cloud is the canonical reference for the REDRT system messages in the V20 release.

FAQ