Detecting PROFINET Interruption Zones in WinCC 7.2 with S7-400 PLCs

Engineers running a Siemens Distributed Control System (DCS) made up of multiple S7-400 CPUs on PROFINET, supervised from one or more WinCC 7.2 Operator Stations (OS), frequently need a single graphic that visualizes the interruption zone of the plant: that is, the exact pair of CPUs whose S7 or PROFINET connection has failed. The goal is a PDL picture where every healthy CPU-to-CPU line is drawn in green, and any line whose underlying connection has dropped flashes red in runtime until the fault is cleared. This reference walks through the complete implementation: S7 channel configuration, diagnostic tag mapping, PROFINET IO status acquisition, PDL picture construction, and the VBScript that drives the color animation.

1. Problem Definition

A typical plant topology comprises 6 S7-400 automation stations (AS), 1 Engineering Station (ES), and 4 Operator Stations (OS). Every AS exchanges data with its neighbors through S7 connections over PROFINET, and each OS reads data from every AS through a redundant S7 connection pair. The control room needs a single overview picture that shows:

• The 6 AS rectangles laid out geographically (or rack-by-rack).
• Lines between AS pairs that represent the S7 connections.
• One consolidated line per OS to each AS representing the OS-AS connection.
• A green color when the connection is established and quality code = Good.
• A flashing red color when the connection is interrupted, time-out, or quality is Bad.

The challenge is that the WinCC picture only knows the connection state if a tag is configured to expose it. Out of the box, WinCC 7.2 does not provide a per-connection Boolean "Connected/Disconnected" tag. The connection state must be derived either from the AS using system function blocks, or from the OS side by reading the S7 channel's internal connection status, or by evaluating quality codes on cyclic tags.

2. Architecture and Topology

2.1 Logical connection map

Each AS is a PN-IO controller. AS-to-AS communication is implemented as S7 connections using the BSEND/BRCV (SFB12/13) or PUT/GET (SFB14/15) family over the ISO-on-TCP transport. A connection name (e.g., "AS_1_to_AS_3") and a local/remote TSAP pair are configured in NetPro. The OS connections are separate S7 connections; they do not share the AS-AS link state. The interruption zone must therefore be evaluated at the OS side by polling the status of each S7 channel instance.

3. Prerequisites

• WinCC 7.2 Update Rollup 1 or later (tested with WinCC 7.2 SP2 HF3) installed on each OS server and client.
• STEP 7 V5.5 SP4 or TIA Portal V13 SP1 Update 4 for the AS project.
• S7-400 CPU firmware V6.0.4 or higher (PN-IO stack ≥ V6.0) to expose the diagnostic records referenced below.
• S7 Protocol Suite channel license on each OS (WinCC Option).
• Read access to the following S7-400 system data areas from WinCC (password/firewall permitting):
  • SZL W#16#0x0121 (PROFINET IO status, partial list).
  • SZL W#16#0x0131 (PROFINET diagnostics, port and station status).
  • Diagnostic buffer of the CPU (read via SFB51 / SFC51).
• OPC UA or named-connection access enabled in the OS firewall for redundant OS pairs.
• VBScript execution rights enabled in the OS runtime user administrator.

4. WinCC 7.2 S7 Channel Configuration

1. Open WinCC Explorer on the OS server and expand Tag Management → SIMATIC S7 PROTOCOL SUITE → PROFInet.
2. Right-click PROFInet → New Connection. For each AS, create one logical connection with a unique name (e.g., AS_1, AS_2, …, AS_6).
3. Set the Connection Properties:
   • IP Address: PROFINET interface of the S7-400 CPU (e.g., 192.168.10.11 for AS-1).
   • Rack/Slot: 0 / 3 (CPU 414/416 in rack 0, slot 3 is typical for PN-IO).
   • Connection Type: S7 Connection (TCP/IP) with ISO-on-TCP, port 102.
   • Cycle: 1 s (recommended for diagnostics; faster than 500 ms wastes CPU resources).
4. For each OS-to-AS connection, repeat the steps above. Redundancy is implemented by adding a second logical connection to a standby AS or a second physical interface of the same AS and selecting Connection Redundancy in the channel properties.

4.1 Channel diagnostic variables

Once the connections are saved, the channel automatically exposes the system tag @@ConnectionState. This tag is a hidden DWORD that reports the raw S7 channel state. The mapping is:

Although WinCC 7.2 documents the existence of @ConnectionState, it is not user-readable by default. To make it accessible to VBScript, add a derived Boolean tag AS_1_OK using the Tag Simulation wizard or expose it manually by following the procedure in section 5.

5. Detecting S7 Connection State at the OS

Two robust methods are commonly combined. Use both, and treat the OS-side state as the primary trigger, with the AS-side heartbeat as a secondary confirmation.

5.1 Method A — Quality Code evaluation on a heartbeat tag

Configure one Boolean tag per AS, e.g., AS_1_Heartbeat, on a 1 s cycle. The AS program toggles this bit in OB1 every cycle, and WinCC evaluates the tag's Quality Code property on every update. In VBScript, HMIRuntime.Tags("AS_1_Heartbeat").Quality returns an integer. The values are:

This is the lightest method, since it does not require additional blocks on the CPU side. A stale heartbeat read in WinCC reveals a failed S7 connection almost immediately, because the Quality Code flips to Q_BAD after the configured time-out (default 4 s for an S7 channel, tunable in Connection Properties → Time-out).

5.2 Method B — CPU-side status word via SFC51 / SFB52

For higher fidelity, especially to identify a single failed port while the rest of the network is healthy, expose the CPU diagnostics. In the S7-400 program:

1. Create DB DB_WinCC_Diag with the following structure:

   DATA_BLOCK DB_WinCC_Diag
   STRUCT
     AS_Quality  : DWORD;     // 0 = OK, <>0 = error code
     PN_Status   : WORD;      // SZL W#16#0131 low word
     PN_Stations : WORD;      // number of reachable PN stations
     OB86_Count  : DWORD;     // OB86 invocations since last power-on
     OB82_Count  : DWORD;     // OB82 invocations
     Last_Error  : DWORD;     // last diagnostic event ID
     Heartbeat   : BOOL;      // toggled every OB1 cycle
   END_STRUCT;
   END_DATA_BLOCK

2. Call SFC51 "RDSYSST" with SZL ID W#16#0131 to read PROFINET IO status into the DB on every OB82 / OB86 / OB85 entry, and once at startup.
3. Call SFB52 "RDREC" to read the IO device diagnostic record index 0xE00C on demand.

WinCC reads the entire DB on a 500 ms cycle. The combination of the heartbeat bit, the OB86 counter, and the SZL W#16#0131 word is more than enough to pinpoint the interruption zone.

6. PROFINET IO Diagnostics

PROFINET provides its own diagnostic model. Each PN-IO device advertises its state in standard records:

The single most useful field for the interruption zone is the NEStationStatus byte from record 0x800C. Its bits indicate:

• Bit 0 — Station failure (entire device is gone).
• Bit 1 — Reserved.
• Bit 2 — Reserved.
• Bit 3 — Line break on port 1 / port 2 (only for copper).
• Bit 4 — Reserved.
• Bit 5 — Reserved.
• Bit 6 — Reserved.
• Bit 7 — Reserved.

By mapping NEStationStatus into a per-station word in DB_WinCC_Diag, the OS can identify whether an AS is reachable, partially reachable (one port down), or fully disconnected.

7. Configuring Diagnostic Tags in WinCC

The tag set required to drive the network overview picture is summarized in the following table. All tags are read-only from the OS; they live in the AS-side DB DB_WinCC_Diag, except where noted.

7.1 Creating a derived Boolean tag for quality

1. In Tag Management, right-click the parent of AS_1_HB and choose New Tag….
2. Name it AS_1_OK, datatype Binary Tag.
3. On the Select dialog, pick Internal Tag and use VBScript to bind it dynamically, or use the Tag Simulation feature with a custom expression (@[email protected] <> 0x80) returning 0/1.
4. Alternatively, drive AS_1_OK from a C-script that polls HMIRuntime.Tags("AS_1_HB").Read().Quality every second. This is the most reliable method when the simulation wizard is not expressive enough.

8. Building the Network Picture in Graphics Designer

1. Open Graphics Designer on the OS server and create a new picture, e.g., NetOverview.Pdl.
2. Insert six rectangles representing the AS CPUs. Name them Rect_AS_1 … Rect_AS_6 in the Object Properties → Name field.
3. For every AS-AS connection, draw a line object. Name the lines Line_AS1_AS2, Line_AS2_AS3, etc. Only draw the connections that physically exist in NetPro.
4. For every OS-AS connection, draw a dashed line. Name them Line_OS1_AS1, Line_OS1_AS2, …, Line_OS4_AS6.
5. On each line, configure the Dynamic Dialog for the Line Color property. Bind it to AS_n_OK / OS_k_to_AS_n_OK:
   • Value = 0 → Red
   • Value = 1 → Green

The Dynamic Dialog returns a Boolean only, so the line is either red or green. To get a flashing effect, use VBScript instead (next section).

9. Implementing the Flashing Animation with VBScript

The animation is driven by a single VBScript action configured on a 500 ms timer in the picture. The script toggles the line color between two reds while the connection is bad, and locks it to green while the connection is good.

9.1 Picture-level script (Global Script or Picture Event)

Open the picture's Event for Open Picture and add the following VBScript to register a 500 ms cycle. (In WinCC 7.2, picture-internal timers are created through the Scheduler wizard in Global Scripts, or you can attach a VBScript to a 500 ms configured Action that runs while the picture is open. The example below uses a Timer Event on a hidden Static Text object whose Output/Input → Event → Timer is fired every 500 ms.)

Sub NetOverview_Timer(Obj)
    Dim sLines, sLine, iPhase, oObj, oTag, bOK

    sLines = Array( _
        "Line_AS1_AS2", "Line_AS1_AS3", "Line_AS2_AS3", _
        "Line_AS2_AS4", "Line_AS3_AS5", "Line_AS4_AS5", _
        "Line_AS5_AS6", "Line_AS4_AS6" _
    )

    ' Counter 0/1 toggles on each timer event to produce the flash.
    iPhase = (iPhase + 1) Mod 2

    For Each sLine In sLines
        Set oObj = ScreenItems(sLine)
        ' Tag name is "AS_a_OK" / "AS_b_OK" — derive from line name.
        oTag = HMIRuntime.Tags(SplitName(sLine))
        oTag.Read
        bOK = (oTag.Value = 1) And (oTag.Quality <> 128)

        If bOK Then
            oObj.LineColor = RGB(0, 200, 0)        ' Solid green
        Else
            If iPhase = 0 Then
                oObj.LineColor = RGB(255, 0, 0)    ' Bright red
            Else
                oObj.LineColor = RGB(120, 0, 0)    ' Dim red
            End If
        End If
    Next
End Sub

Function SplitName(sLine)
    Dim a, p, t1, t2
    a = Split(Replace(sLine, "Line_", ""), "_")
    t1 = "AS_" & a(0) & "_OK"
    t2 = "AS_" & a(1) & "_OK"
    SplitName = t1  ' use the source AS for the link state
End Function

9.2 Alternative: per-line direct tag binding

If you prefer a no-script approach, the Line Color property of each line can be bound to a Direct Tag Connection of datatype WORD where bit 0 is green, bit 1 is red. The application controls the bit pattern in the AS, and WinCC applies a discrete mapping (bit pattern → color). Use a custom C-script function block FC_PN_Status in the AS to compute the bit pattern from the heartbeat, the SZL status, and the OB86 counter.

9.3 Line thickness and width as additional cues

For operators sitting far from the monitor, color alone is not enough. Bind the Line Width property of each line to a tag whose value doubles from 2 px to 4 px when the connection is bad, and from 2 px to 6 px when the connection has been bad for more than 30 s. This is implemented by a separate VBScript action with a 1 s cycle that reads the same AS_n_OK tags.

10. Step-by-Step Implementation

1. Build the diagnostic DB in STEP 7 as described in §5.2 and download to every AS.
2. Configure the WinCC S7 Protocol Suite channel with one connection per AS (§4).
3. Create the tag set from §7 in WinCC Tag Management. Verify the Quality Code of AS_1_HB with the online tag diagnostics — a wrong rack/slot typically produces Quality Code 0x80 with a value of 0.
4. Open Graphics Designer and construct the network picture (§8).
5. Add the 500 ms timer action to drive the flash (§9).
6. Save the picture and run WinCC Runtime in simulation mode. Click Connection → Diagnosis in the S7 channel to manually toggle a connection into Stop state and verify the line color change.
7. Restore the connection and verify the line returns to green within the configured time-out window (default 4 s, recommend 6 s for PROFINET).

11. Verification

12. Troubleshooting Matrix

13. Field-Proven Caveats

• Quality Code 0x40 (substitute value active) is silently treated as Good by most operators. Add an explicit Line Width multiplier when Quality Code ≠ 0 to surface the substitute state visually.
• The S7-400 PN-IO stack reports a port failure up to 60 s after the physical link drops. Do not trust a 1 s heartbeat for fast port-flap detection; rely on the OB86 event timestamp.
• If the OS uses WinCC redundancy (Server 1 + Server 2), the channel quality may differ between the two servers when the active server has not yet reconnected. Use the redundant server's heartbeat tag for the picture only after both servers report the connection healthy.
• WinCC 7.2's Graphics Designer has a known bug where dynamic Line Color bindings silently fail if the picture is opened from Process Tag Logging and not from the main menu. Re-open the picture from Graphics → Open to recover.
• Operators typically want the picture to open automatically on every alarm. Use Alarm Logging → Function Trigger on message number 50011-50019 to call OpenScreen("NetOverview.Pdl", "Popup") whenever a connection error is raised.

14. Summary

The "interruption zone" in a WinCC 7.2 + S7-400 PROFINET DCS is best detected by combining a low-cost OS-side Quality Code check on a CPU heartbeat tag with a richer AS-side diagnostic record that mirrors the PROFINET SZL W#16#0131 and the OB86 invocation count. The Picture Designer is then a thin layer that binds the Line Color property to those tags, with a small VBScript timer driving the red flash. The pattern is portable to WinCC 7.3, 7.4, and 7.5 with no source change beyond the picture file, and it scales to dozens of AS-AS links without flooding the operator with pop-ups because the picture is a single overview rather than per-link screens.

15. FAQ