Relaying Safety PLC System Messages to WinCC via S7-400

A network-separated safety PLC (IPS — Instrumented Protective System) generates system messages that must be visible on a central WinCC Operator Station (OS) without violating IEC 62443 zone separation. Process values already traverse a dedicated PROFIsafe / PROFINET conduit to a control S7-400 CPU; system messages do not, because WinCC's OS-Compile step requires an engineering-grade connection directly to the message-originating CPU.

This article documents a deterministic engineering pattern that satisfies both requirements simultaneously: the IPS remains logically isolated from the OS network, and WinCC still receives IPS-derived alarms, warnings, and acknowledgments attributed to the correct plant area. The approach is widely deployed in SIMATIC PCS 7 plants where S7-400F safety controllers feed central OS stations through standard S7-400 controllers, and it is equally applicable to any third-party safety controller that exposes S7-compatible communication services.

1. Problem Context and Engineering Constraints

The standard PCS 7 message architecture assumes three tiers:

• An Engineering Station (ES) with STEP 7 / SIMATIC Manager installed, connected to every CPU at configuration time.
• An Operator Station (OS) running WinCC, connected to one or more AS controllers at runtime via S7 Communication (S7Comm over ISO-on-TCP, port 102).
• One or more Automation Stations (AS), each an S7-400 CPU with attached I/O and possibly subordinate safety controllers.

OS-Compile on the ES reads the AS hardware configuration, the S7 program symbol table, and the WinCC message configuration, then generates a runtime database. At runtime, the OS pulls alarm bits and diagnostic records from each AS via S7 Communication.

In a zoned architecture, the safety PLC (IPS) is part of a higher-criticality Safety Zone and is reachable from the ES only at configuration time (or via an air-gapped engineering workstation that is never attached to the OS network). The OS therefore has no direct S7 channel to the IPS at runtime, and the OS-Compile step cannot bind WinCC events to IPS bit tags or diagnostic events.

The pattern in this article mirrors the canonical PAS / OS relationship that PCS 7 already supports: the Automation Station (the S7-400 in this scenario) owns the message surface that WinCC reads. The IPS is treated as a subordinated data source, not a peer of the OS.

2. Reference Architecture

Three zones, two conduits:

• Zone S (Safety): IPS CPU. Typical hardware: S7-400F (CPU 416F-3 PN/DP), S7-1500F, or third-party safety PLC exposed via PROFIsafe. Engineering access is restricted to the air-gapped ES.
• Zone C (Control): Control S7-400 AS (typical CPU 416-3 PN/DP). Mirrors IPS state, owns the message surface that WinCC reads.
• Zone O (Operations): WinCC OS (WinCC V7.5 SP2 or TIA Portal WinCC Professional V18). Read-only S7 connection to Zone C.

The conduit between Zone S and Zone C is the PROFIsafe/PROFINET (or PROFIBUS DP) link. The conduit between Zone C and Zone O is the standard plant bus (PROFINET or Industrial Ethernet).

Figure 1 — Three-zone, two-conduit reference topology.

3. WinCC Message System Components

WinCC V7.x and TIA Portal WinCC both organize messages into three classes:

The OS-Compile step writes the message-to-tag binding into the WinCC Alarm Logging database (typically CCAlgLogging.MDF) and the related binary tag references into the connection list. When the IPS is unreachable at compile time, IPS-derived events are absent from this database.

The gateway S7-400 must therefore expose a tag surface that mirrors every IPS event WinCC must display. Three practical patterns cover most plants:

1. Bit mirror: One DB word per event. WinCC binds each bit to a bit-message class with custom text. Simplest to deploy; suitable for < 64 events.
2. Diagnostic mirror: The gateway runs the same diagnostic OB stack and exposes the SZL IDs that WinCC expects, so the OS-Compile maps to gateway tags instead of IPS tags. Suitable when the IPS exposes SSL via SFC51.
3. Message-record mirror: The gateway compiles a structured message record (timestamp, event ID, state, ack, slot) and WinCC consumes it via a User Archive or OPC UA subscription. Suitable when event volume exceeds the bit surface.

For most plant applications the bit-mirror pattern is sufficient. The remainder of this article focuses on it.

4. Communication Methods Between S7-400 and Source PLC

The gateway AS reads from the IPS using one of four Siemens communication primitives. Choose by data volume, latency budget, and PLC firmware.

4.1 SFB14 GET / SFB15 PUT — S7 Communication

SFB GET (SFB14) and SFB PUT (SFB15) on S7-400 read and write data from a partner CPU over an S7 connection (ISO-on-TCP, port 102). They are configured in NetPro in STEP 7 V5.5 or in Devices & Networks in TIA Portal V18.

Maximum payload per call: 462 bytes. Latency: typically 20 to 80 ms on a 100 Mbit/s plant bus, dominated by request/acknowledge turnaround. Reference: Siemens Industry Online Support — "Standard functions and standard function blocks" manual for S7-300/400.

4.2 SFB12 BSEND / SFB13 BRCV — Block-Oriented Transfer

BSEND / BRCV transfer up to 32 KB (S7-400) or 64 KB (S7-1500) per call with sequence integrity. Use them when the IPS exposes a consolidated event log or a snapshot block rather than scattered bits. BSEND fragments the payload internally, so the application code only sees one DONE per call.

4.3 SFC13 DPNRM_DG — PROFIBUS Slave Diagnostic Buffer

If the IPS is reachable as a PROFIBUS DP slave (for example, an ET200S F-module stack, a third-party safety slave, or a remote rack hosted on the S7-400 PROFIBUS interface), SFC13 reads the standardized diagnostic buffer:

Call signature:

// SCL — read PROFIBUS diagnostic buffer of slave at station address 3
ret_val := DPNRM_DG(
  CPLADDR := W#16#3FF,           // logical address of DP master interface (HW config)
  LADDR   := 3,                  // station (PROFIBUS) address
  RET_VAL := iRet,               // return value (16#0 on success)
  RECORD  := pDiagBuf,           // ANY pointer, min 6 bytes, up to 244 bytes
  SZL_ID  := W#16#0000);         // 0 for full standardized diagnostic buffer

RET_VAL on error includes the PROFIBUS standard error codes (for example, 16#80A2 resource error, 16#80B1 illegal address). Map them to operator-readable text in the gateway DB so WinCC can display the same root cause the IPS itself reports.

4.4 SFC51 RDSYSST — System Status Lists

SFC51 reads CPU-internal SZL partitions. The partitions most relevant to mirror-based messaging:

4.5 Status and Error Code Reference

5. Reading the Source PLC Diagnostic Buffer

The reading sequence is independent of the underlying primitive. The gateway S7-400 cyclically polls the IPS, mirrors the result into a shared DB, and arms a WinCC tag that the Alarm Logging evaluates.

// SCL — gateway block: cycle-time-based GET from IPS
FUNCTION_BLOCK FB_MirrorIps
VAR
  iConnId    : WORD := W#16#1;     // S7 connection ID to IPS
  tPoll      : TON;                // poll every 250 ms
  fbGet      : SFB14;
  iState     : INT;
  iRet       : INT;
  sState     : STRING[80];
END_VAR

BEGIN
  tPoll(IN := TRUE, PT := T#250MS);
  IF tPoll.Q THEN
    tPoll(IN := FALSE);
    fbGet.REQ := TRUE;
  END_IF;

  fbGet(
    REQ    := fbGet.REQ AND NOT fbGet.DONE,
    ID     := iConnId,
    ADDR_1 := P#DB100.DBX0.0 BYTE 64,   // IPS mirror DB layout
    RD_1   := P#DB200.DBX0.0 BYTE 64,   // gateway mirror DB
    DONE   => ,
    ERROR  => ,
    STATUS => iRet);

  IF fbGet.ERROR THEN
    "dbDiag".iConnStatus := 16#0001;    // connection-fault code
    "dbDiag".sConnStatus := 'IPS S7-Comm fault';
  ELSIF fbGet.DONE THEN
    "dbDiag".iConnStatus := 16#0000;
    "dbDiag".sConnStatus := 'OK';
  END_IF;
END_FUNCTION_BLOCK

Define the IPS-side mirror DB on the IPS itself (or as a coordinated contract in the gateway if the IPS is third-party). A typical 64-byte layout holds 32 event bits plus a 16-bit event timestamp and a 16-bit event counter.

5.1 Handling Connection Faults

S7 Communication may fail when the IPS is in STOP, when the PROFIsafe stack is rebuilding, or during a hot-swap. Wire every DONE-with-ERROR to a dedicated Connection fault bit in the gateway DB; WinCC binds that bit to a diagnostic message with text such as "IPS connection lost — values frozen".

When the IPS connection is down for more than three consecutive poll cycles, set a separate Stale flag and freeze the mirror DB so WinCC does not display flapping values from a half-up partner. The WinCC side can be configured with a substitution value (e.g. last-good-value or 0) per tag.

5.2 Polling Frequency and Latency Budget

The plant-bus round-trip latency is approximated by:

t_latency = 2 * t_propagation + t_partner_scan + t_ack_processing

Where t_propagation is the physical-layer propagation (negligible on 100 m links), t_partner_scan is the partner CPU's scan time (typically 5 to 50 ms), and t_ack_processing is the SFB execution overhead (typically 10 to 20 ms). On a healthy 100 Mbit/s plant bus, a single SFB GET/PUT cycle completes in 20 to 100 ms. The WinCC update cycle should be at least 2x the worst-case S7 poll to avoid aliasing. With a 250 ms poll, set WinCC acquisition to 500 ms.

6. Remapping Messages in the Gateway S7-400

The remapping step is what makes the solution behave correctly in the eyes of WinCC. Each IPS-derived event must produce a deterministic bit edge in a known DB location, with the right timestamp and acknowledgment model.

6.1 Mirror DB Layout

6.2 Edge Detection and Acknowledgment

WinCC bit-message classes trigger on the rising edge of the tag. The gateway must therefore store the previous-cycle state and emit a one-cycle pulse whenever the IPS event goes from inactive to active.

// SCL — rising-edge detection and ack handling
FUNCTION_BLOCK FB_EdgeDetect
VAR
  bLastState : BOOL;
  bPulse     : BOOL;
END_VAR

BEGIN
  bPulse := "dbMirror".bEvt_SafetyTrip_Zone1 AND NOT bLastState;
  bLastState := "dbMirror".bEvt_SafetyTrip_Zone1;

  // Acknowledge handshake: WinCC sets bAck_SafetyTrip_Zone1 = TRUE on operator ack
  // Gateway clears the source-side bit and reports back bAckOK
  IF "dbMirror".bAck_SafetyTrip_Zone1 THEN
    "dbMirror".bEvt_SafetyTrip_Zone1 := FALSE;
    "dbMirror".bAckOK_SafetyTrip_Zone1 := TRUE;
  END_IF;
END_FUNCTION_BLOCK

For acknowledgment to round-trip cleanly, mirror the operator's Ack command back to the IPS. Most third-party safety PLCs expose a dedicated Acknowledge control word that the IPS-side program can read on the next PROFIsafe cycle.

6.3 Time-of-Event Preservation

The IPS-side diagnostic buffer (read via SFC13, SFC51 SSL 0121, or the IPS's own event log) carries the time-of-event as BCD-formatted DATE_AND_TIME. Copy that value verbatim into the mirror DB rather than stamping it with the AS arrival time. Operators correlate WinCC alarm times against safety-PLC audit trails; mismatched timestamps are a common audit-finding root cause.

6.4 Ladder Logic Equivalent

For engineers who prefer LAD over SCL, the equivalent rising-edge detector is a single network using the FP (rising-edge) contact:

// LAD — Network 1: edge detect
A   "dbMirror".bEvt_SafetyTrip_Zone1
FP  "dbMirror".bLastState_Zone1    // positive edge detect
=   "dbMirror".bPulse_Zone1

// LAD — Network 2: ack handshake
A   "dbMirror".bAck_SafetyTrip_Zone1
R   "dbMirror".bEvt_SafetyTrip_Zone1   // reset event
S   "dbMirror".bAckOK_SafetyTrip_Zone1 // confirm to OS

7. WinCC Configuration Against the Gateway

7.1 Channel and Connection Setup

Configure one WinCC channel of type SIMATIC S7 Protocol Suite, with a single S7 connection to the gateway AS (Zone C). Do not add a second connection to the IPS — that is the zone policy the architecture exists to enforce.

7.2 Tag Definition

Create one WinCC internal or process tag per mirror DB bit. Use the prefix IPS_ so the operator screen tree separates them from native AS tags.

// Sample tag list (WinCC tag management export)
'IPS_SafetyTrip_Zone1'  -> DB200.DBX0.0    BOOL  Update: 500 ms
'IPS_SafetyTrip_Zone2'  -> DB200.DBX0.1    BOOL  Update: 500 ms
'IPS_AckRequired'       -> DB200.DBX0.2    BOOL  Update: 500 ms
'IPS_BypassActive'      -> DB200.DBX0.3    BOOL  Update: 500 ms
'IPS_ConnStatus'        -> DB200.DBW10.0   INT   Update: 1000 ms
'IPS_LastEventTime'     -> DB200.DBD4.0    DATE_AND_TIME

7.3 Bit-Message Configuration

In WinCC Alarm Logging, define one message class per IPS event. The minimum required fields:

Bind Status + and Ack tags so the operator can acknowledge from the WinCC message line. The Ack tag goes back to the mirror DB at dbMirror.bAck_<event>, which the gateway FB_EdgeDetect block already processes.

7.4 Diagnostic Messages from SZL Mirror

If the IPS exposes SZL IDs (rare on third-party safety PLCs, common on S7-400F), run SFC51 in the gateway on a 1-second cycle and map each meaningful SZL entry to a dedicated WinCC message. The mapping is identical to what an OS-Compile against the IPS itself would have generated, which means an existing PCS 7 message library can be reused with only the connection target changed.

8. Optional OPC UA Aggregation Path

For plants that already operate an OPC UA hub, the gateway S7-400 can publish the mirror DB as an OPC UA server using a CP443-1 OPC UA module. WinCC Professional V18 connects to OPC UA natively via the OPC UA WinCC Channel. This path consolidates all IPS-derived events behind a single encrypted endpoint and removes the S7 protocol from the OS-facing segment.

The CP443-1 OPC UA module supports OPC UA server certificates. These certificates must be issued by the OS-side trust store before the WinCC OPC UA channel will accept the endpoint. Reference: Siemens Industry Online Support — CP 443-1 OPC UA configuration manual.

9. Verification Procedure

1. Compile check. Run STEP 7 "Consistency Check" on both IPS and AS projects. Confirm zero warnings on the message-related blocks (FB_MirrorIps, FB_EdgeDetect, DB200 mirror DB).
2. OS-Compile. Run OS-Compile against the AS only. Verify in the WinCC Alarm Logging editor that every IPS_ tag has a bound message number in the 500001-500099 range.
3. Loopback test. Set dbMirror.bEvt_SafetyTrip_Zone1 := TRUE from the AS programming device. Confirm the message appears in WinCC within two polling cycles (i.e. within 1 second at the recommended 500 ms acquisition rate).
4. Acknowledge test. Acknowledge the message from the OS. Confirm dbMirror.bAck_SafetyTrip_Zone1 transitions TRUE for one cycle and the IPS-side Acknowledge register is updated on the next S7 poll.
5. Fault injection. Disconnect the plant-bus cable between AS and OS. Confirm IPS_ConnStatus transitions to fault and the IPS connection lost diagnostic message appears within 5 s. Reconnect and verify recovery without operator intervention.
6. PROFIsafe loss test. Disable the PROFIsafe slot in HW config or physically disconnect the PROFIsafe cable. Confirm WinCC displays a diagnostic message whose text matches the configured slot identifier, not a generic PROFIBUS fault.
7. Time alignment. Verify that dtEventTime uses the IPS time-of-event, not the AS arrival time, so operator-stored event logs match the safety PLC's own audit trail. Cross-check against the IPS diagnostic buffer log.
8. Stale-data test. Stop the IPS CPU. Confirm that mirror DB values freeze, the stale flag asserts, and WinCC displays the configured substitution value (typically last-good or "---invalid---").

10. Troubleshooting Matrix

11. Hardware Compatibility and Sizing

The pattern is supported on every S7-400 / S7-400F CPU with the S7 Communication services. Typical selection for a gateway AS:

Confirm firmware compatibility against the current Siemens Industry Online Support product notice for each CPU before deployment. The S7-400 series entered phase-out status; verify spare-part availability for the project's expected lifecycle.

12. Time Synchronization

Plant-wide time-of-event correlation requires all PLCs and the WinCC OS to share a common time base. Three options are common:

1. SICLOCK 1000 / 240: Siemens plant clock, distributed via Industrial Ethernet or PROFINET. Most accurate; preferred for PCS 7.
2. NTP via plant firewall: NTP packets forwarded through a SCALANCE S firewall to each CPU. Adequate for sub-second accuracy.
3. WinCC-side time stamping only: Pragmatic fallback where plant time sync is unavailable. Not recommended for safety-PLC audit correlation because the AS arrival time is what gets stamped, not the IPS event time.

Whichever option is chosen, configure the IPS to write its diagnostic-buffer entries with the synchronized plant time so the gateway DB's dtEventTime field carries the correct value when read by SFB GET.

13. Redundancy with S7-400H

For plants with a redundant AS (S7-400H), mirror the same FB_MirrorIps instance on both CPUs. The partner S7 connection is configured to the active CPU's IP; failover is handled by the S7-400H redundancy layer, which presents a virtual IP to the IPS. WinCC continues to use the same virtual IP across failover.

When the redundant AS fails over, WinCC's S7 connection may transiently report Disconnected for 1 to 3 seconds. The IPS connection lost diagnostic message will fire briefly during that window. Adjust the WinCC connection timeout to suppress the message during planned failovers, or accept the brief alarm as a useful operator-visible indicator that the redundant CPU is now active.

14. Audit Logging and Compliance Reporting

Operators and auditors expect safety-PLC events to be traceable to the original IPS-side diagnostic buffer entry. Configure WinCC Tag Logging to record every IPS-tag transition into a circular database. The minimum audit fields per event:

• Event number (WinCC message ID)
• Event time (from dtEventTime, IPS time-of-event)
• State (came / went, acknowledgment status)
• Operator (WinCC user name when acknowledged)
• Comment (free text if operator added one)

Export the Tag Logging database daily for retention. PCS 7 includes a built-in Connectivity Pack that pipes Tag Logging data to a relational database for long-term archiving; this is the standard mechanism for IEC 62443 audit-trail compliance.

15. IEC 62443 Compliance Notes

IEC 62443-3-3 defines the foundational requirements (FR) and system requirements (SR) applicable to industrial automation and control systems. The pattern in this article satisfies the following:

• FR 5.1 — Network segmentation: Three explicit zones, two explicit conduits. No direct S7 channel between Zone S and Zone O.
• SR 5.1 — Identification of zones and conduits: Documented in the system security plan; the AS is the named conduit endpoint.
• FR 4.1 — Information confidentiality: The AS-side mirror DB can be read by the OS, but the OS cannot write into Zone S. No reverse path exists.
• FR 3.4 — Software and information integrity: The AS-side program is the single point that re-publishes IPS events, so audit logging is consolidated.

Where the underlying plant bus is shared with corporate IT, terminate it at a SCALANCE S industrial security appliance configured with the S7 protocol filter enabled. The S7 protocol filter blocks unauthorized S7Comm attempts across the corporate boundary without disturbing plant-internal traffic. Reference: IEC 62443-3-3:2013 System security requirements and security levels.

For environments that must align with the older ISA-99 terminology cited in the field report, the mapping is direct: Security Level SL-1 maps to IEC 62443 SL-T 1, and the zone-and-conduit vocabulary is preserved verbatim from ISA-99 to IEC 62443-3-2.

16. Engineering Workflow and Version Control

The gateway AS program must follow the same revision discipline as any production PLC code:

1. STEP 7 / TIA Portal project for the IPS is maintained on the air-gapped ES.
2. STEP 7 / TIA Portal project for the gateway AS is maintained on the OS-network ES.
3. The mirror DB contract (offsets, types, scaling) is documented in a shared specification document, versioned with the STEP 7 project.
4. Every DB structure change in either project triggers a re-OS-Compile on the OS and a sign-off review on the AS.

For PCS 7, use the SIMATIC Manager version-cross-check feature to detect drift between ES project copies. For TIA Portal V18, use the built-in project library to lock the mirror DB structure as a master copy.

17. Migration Path from Direct IPS Connection

Brownfield plants that previously had a direct IPS-to-OS connection must migrate in this order:

1. Build the gateway AS program against the existing IPS mirror DB.
2. Configure WinCC tags against the gateway AS, leaving the original IPS tags in place but disabled.
3. Run both configurations in parallel for a defined burn-in period (typically 4 to 12 weeks).
4. Compare alarm statistics: total messages, time-to-acknowledge, spurious events.
5. Once parity is confirmed, remove the direct IPS-to-OS connection from the WinCC channel configuration.
6. Update the network architecture diagram and zone-and-conduit documentation.

18. Quick-Reference Summary

FAQ