Redundant Ethernet CP Connections on S7-400 with PCS 7 WinCC

Overview

Standard PCS 7 deployments rely on the S7-Redconnect software package to provide transparent, fail-over capable S7 communication. Redconnect, however, is licensed and engineered specifically for the S7-400H redundant PLC family (S7-417H/AS 410H/AS 412H/AS 414H/AS 416H). When the controller is a non-redundant S7-400 such as the S7-416-3 or S7-417-4, Redconnect cannot establish a high-availability channel and the redundant behavior must be reconstructed in the application layer.

This reference documents the field-proven pattern of using two physical Ethernet CP 443-1 communications processors in one S7-400 station, each on a separate physical network segment, with two independent S7 connections in PCS 7 NetPro and a software-based selector in WinCC that picks the "better" of the two received values based on a lifecycle (life-bit) check. The approach also applies to AS 410 single stations and S7-1500 non-H CPUs when the application demands dual-path collection but the controller itself does not support a hot-standby partner.

The procedures below assume PCS 7 V9.0 SP2 or later, STEP 7 V5.6 (or TIA Portal V17 for S7-1500), SIMATIC WinCC V7.5 SP2 or WinCC Professional V17, and CP 443-1 EX30 or CP 443-1 Advanced GX30 firmware V3.0.x or newer. Substitute module variants where appropriate.

Prerequisites

• PCS 7 engineering station with STEP 7 V5.6 and SIMATIC Logon configured.
• S7-400 CPU with two free CP slots (UR2/UR2-A rack with sufficient slots, or ET 200M with IM 460/461 for distributed CPs).
• Two CP 443-1 communications processors (recommended: 6GK7 443-1EX30-0XE0 or 6GK7 443-1GX30-0XE0 for ISO/TCP, TCP, and S7 communication). See the CP 443-1 product manual for order numbers and firmware compatibility.
• Two physically independent Ethernet networks (Layer 2/3 managed switches, distinct subnets, no shared VLAN trunk). For industrial-grade topologies, see the Advantech Industrial Ethernet Network Redundancy White Paper.
• PCS 7 AS-OS engineering license and a WinCC runtime station (OS Server / OS Client) configured in the project.
• Static IP addressing scheme documented per CP, subnet mask, and gateway.

Reference Topology

Figure 1 - Two CP 443-1 modules on independent subnets feeding a single OS server through a software-based selector.

Hardware and Network Planning

Insert both CP 443-1 modules in the S7-400 rack. Use slot rules from the S7-400 hardware manual: in a UR2 rack, CP slots 4-9 are valid; CPs must be ordered in STEP 7 HW Config so that their slot numbers do not collide with the CPU's integrated PN/IE interface (when present). For multi-rack stations using IM 460/461, each CP can reside in the expansion rack and is still treated as a local CP of the CPU.

Assign each CP a unique IP address in a separate subnet, ideally with a separate routing domain. Use two managed switches; do not bridge the two subnets at Layer 2. If the OS server only has a single NIC, a dual-NIC add-in card (Intel i350-T2 or similar) is the typical field solution. Disable Spanning Tree on edge ports or use RSTP with edge port designation so re-convergence is sub-second.

STEP 7 / PCS 7 Configuration

Step 1 - Configure the two CPs in HW Config

1. Open the PCS 7 project in SIMATIC Manager and select the AS station.
2. Open HW Config and insert the first CP 443-1. Set its IP address (e.g., 192.168.10.10), subnet mask 255.255.255.0, and assign it to Ethernet subnet "NET10".
3. Insert the second CP 443-1. Set its IP address (e.g., 192.168.20.10), subnet mask 255.255.255.0, and assign it to Ethernet subnet "NET20".
4. Save and compile the station. The S7-400 must be in STOP for the first download; subsequent online changes are supported.

Step 2 - Create two S7 connections in NetPro

1. Open NetPro (or the S7-1500 equivalent "Devices & Networks").
2. Right-click the first CP and select "Insert New Connection". Choose "S7 connection" with the OS server as the partner. Name the connection, e.g., AS01_CP1_OS01.
3. Repeat for the second CP. Name it AS01_CP2_OS01. Each connection must terminate on a different CP on the OS server (or on the same OS server via two separate WinCC channels).
4. Compile and download NetPro. Verify the connection status online - the "S7 connection" indicator turns green when established.

Step 3 - WinCC channel assignment

1. Open WinCC Explorer on the OS server.
2. Add a "SIMATIC S7 PROTOCOL SUITE" channel driver. Create two channel units:
   • S7_A1 bound to NIC1 (192.168.10.5), connection name AS01_CP1_OS01, partner IP 192.168.10.10, rack 0, slot 4.
   • S7_A2 bound to NIC2 (192.168.20.5), connection name AS01_CP2_OS01, partner IP 192.168.20.10, rack 0, slot 5.
3. For every tag, add two tag references - one through each channel. Convention: Tag_PathA and Tag_PathB in the tag management, both pointing to the same PLC address.

Application Layer: Lifecycle Bit and Selector

Hardware redundancy on the PLC side does not exist, so the OS must decide which of the two received values is "good". The standard mechanism is the lifecycle (life-bit) check. A counter or bit toggles on the PLC at a defined interval; the OS verifies that it actually changes and uses the change rate as a proxy for connection health.

Step 4 - Implement the lifecycle tag in the S7-400

Create two DBs (or one DB with two areas) and increment a counter in OB35 every 100 ms. Each CP path needs its own independent heartbeat because the lifecycle reflects the integrity of the path, not the CPU.

// OB35 - 100 ms cyclic interrupt, triggered once per S7-400 cycle
// LIFECYCLE_CP1: DB100.DBX0.0 toggled each call
// LIFECYCLE_CP2: DB100.DBX0.1 toggled each call
// HBTIMER_CP1:   DB100.DBW2   incremented each call, wraps 0..65535
// HBTIMER_CP2:   DB100.DBW4   incremented each call, wraps 0..65535

      L     DB100.DBX 0.0          // current toggle state of CP1
      XOW   W#16#0001              // flip the bit
      T     DB100.DBX 0.0

      L     DB100.DBX 0.1          // current toggle state of CP2
      XOW   W#16#0001
      T     DB100.DBX 0.1

      L     DB100.DBW 2
      +     1
      T     DB100.DBW 2

      L     DB100.DBW 4
      +     1
      T     DB100.DBW 4

Step 5 - Build the WinCC selector

The selector chooses between the two tag copies based on a quality flag and the heartbeat delta. Two implementation paths are common in PCS 7:

• C script in WinCC global script (cycle 1 s) - simple and inspectable.
• VB / C# action in WinCC Professional (V17) - same logic, better IDE.

// WinCC global C action, 1 s cycle
// Inputs:  dPV_A, dPV_B (REAL), wHB_A, wHB_B (WORD), bQ_A, bQ_B (BOOL)
// Outputs: dPV_Sel (REAL), iPathSel (INT), bQ_Sel (BOOL)

static DWORD dwLastHB_A = 0;
static DWORD dwLastHB_B = 0;

BOOL bLifeA = ((WORD)(wHB_A - dwLastHB_A) > 0);
BOOL bLifeB = ((WORD)(wHB_B - dwLastHB_B) > 0);
dwLastHB_A = wHB_A;
dwLastHB_B = wHB_B;

// priority: good quality & alive > good quality > alive > default A
if (bQ_A && bLifeA) {
    dPV_Sel = dPV_A;
    iPathSel = 1;
    bQ_Sel  = TRUE;
} else if (bQ_B && bLifeB) {
    dPV_Sel = dPV_B;
    iPathSel = 2;
    bQ_Sel  = TRUE;
} else if (bQ_A) {
    dPV_Sel = dPV_A;
    iPathSel = 1;
    bQ_Sel  = FALSE;        // stale path A
} else if (bQ_B) {
    dPV_Sel = dPV_B;
    iPathSel = 2;
    bQ_Sel  = FALSE;        // stale path B
} else {
    dPV_Sel = 0.0;
    iPathSel = 0;
    bQ_Sel  = FALSE;        // both paths dead
}
return 0;

The same block can be encapsulated in an SCL/FB on the PLC if the redundancy must live on the AS side. For a fully AS-centric design, copy the A and B tags into a third DB block of "selected" values inside the S7-400. This is preferred when downstream S7-400 slaves or third-party OPC clients also consume the data.

Structured Tag Naming Convention

Network Considerations

The two Ethernet paths must be physically independent to deliver any real redundancy gain. A single switch that hosts both VLANs without segregation still has a single point of failure at the switch itself. Use two switches, ideally fed from independent power sources, on independent cable routes.

• Enable MRP (Media Redundancy Protocol) inside each individual subnet for ring resilience; MRP delivers < 200 ms re-convergence. See the Industrial Ethernet Network Redundancy White Paper.
• Disable Spanning Tree on the OS server's edge ports or use RSTP with edge designation; otherwise a single bad cable triggers a 30-50 s outage during STP re-convergence.
• Configure SNMP traps on the switches and forward to the PCS 7 Maintenance Station so that path degradation is visible in the OS.
• For HMI/SCADA drivers that themselves support network redundancy, the PTC Kepware network redundancy documentation shows the dual-NIC driver pattern applicable to similar architectures.

Failure Mode Matrix

Performance and Bandwidth

Two independent connections double the AS-OS communication load. With PCS 7 V9.0 the typical AS-OS data block poll rate is 1 s for process values and 500 ms for alarms. Each CP can handle up to 64 simultaneous S7 connections; the OS server's two connections use two of those, leaving plenty of room. CPU load on the AS increases by approximately 1-2 % per 1 000 tags because the OB1 must service two parallel ISO-on-TCP send queues. Verify with the CPU's diagnostic buffer that OB1 run time stays well below the configured maximum cycle time (default 150 ms).

Alternative Approaches

Where a single S7-400 is insufficient to deliver the desired availability, evaluate these alternatives before assuming the software-selector pattern is the right answer:

• Upgrade to S7-400H (e.g., AS 412H or AS 416H) and use S7-Redconnect. Hardware redundancy eliminates the OS-side selector logic. Reference: S7-Redconnect configuration.
• Upgrade to S7-1500R/H with two communications processors on redundant Industrial Ethernet as documented in the S7-1500R/H configuration guide.
• Use OPC UA server-to-server redundancy at the OS level with a third-party redundancy broker. Higher complexity, but OS-independent and survives a WinCC station rebuild.
• Use the PCS 7 Maintenance Station to monitor CP fault LEDs and connection state via SNMP/syslog so that operators see a path switch, not just a value change.

Verification and Commissioning Checklist

1. Download HW Config and NetPro to the AS. Verify both CPs have the configured IP and that the SF LED is off on each.
2. Open NetPro online and confirm both S7 connections show the green "connected" indicator.
3. In WinCC Channel Diagnostics, force a re-init on Channel A and observe that Channel B continues to deliver tags. Reset Channel A and verify tags are updated again.
4. Physically disconnect the Ethernet cable from CP #1. Verify in WinCC that iPathSel flips to 2 within one poll cycle (1 s) and that PV_SEL continues to track PV_B.
5. Reconnect CP #1 and disconnect CP #2. Verify the same behavior in the opposite direction.
6. Disconnect both cables. Verify bQ_Sel becomes FALSE and that the operator screen shows the "path loss" alarm.
7. Stop the AS CPU (MRES or mode switch). Verify that the OS retains the last good value and flags it as invalid.
8. Inspect the CPU diagnostic buffer for OB1 runtime exceeded events. If present, raise the maximum cycle time or reduce the tag count per CP path.

FAQ