Resolving iFIX Redundancy with Siemens S7-400H and Kepware OPC

System Architecture Overview

A SIMATIC S7-400H fault-tolerant station contains two CPU racks (Rack 0 and Rack 1) running redundant CPUs of the 41x-H series. Each rack is equipped with its own CP443-1 Industrial Ethernet communications processor. The two CPUs maintain program-synchronized state over fiber-optic sync modules, while the CP443-1 modules expose the program data to TCP/IP clients using the S7 protocol on ISO-on-TCP port 102 (RFC1006).

When an iFIX-based SCADA layer needs redundant supervision, it must hold two distinct transport paths into the H-station: one through the CP443-1 in Rack 0 and another through the CP443-1 in Rack 1. The failover challenge is that, when one CP443-1 fails, transport connections traversing it are terminated by the TCP stack. From the OPC server (KEPServerEX, formerly Kepware) and the iFIX client, the connection through that path simply registers a timeout; the application must detect it and redirect the polling to the surviving path without operator intervention or data loss.

Why Native Path Redundancy Is Not Automatic at the SCADA Level

Siemens S7-400H delivers CPU-level redundancy: the program keeps running after any single CPU or rack failure. What it does not deliver automatically is path-level redundancy between an external OPC client and the CP443-1 modules. When the CP443-1 in Rack 0 loses its network link, every active ISO-on-TCP (port 102) connection routed through it is torn down by the transport stack. From the SCADA workstation's perspective, the OPC link through that path records a timeout event; nothing about the failure is propagated up to the application layer unless the application is watching for it.

To preserve process visibility the SCADA layer must hold two independent transport connections — one to each CP443-1 IP address — and switch the active read source when one path dies. There are two routes a controls engineer can take to deliver that behavior:

• Option A — S7-REDCONNECT: Use a Siemens CP1613 or CP1623 PC module plus the SIMATIC NET S7-REDCONNECT software on the SCADA PC. The redundancy is handled inside the Siemens driver layer; the OPC server and iFIX see one logical fault-tolerant connection.
• Option B — Software redundancy via two channels: Add a second KEPServerEX device pointing to the CP443-1 of Rack 1 and detect/switch in iFIX with a VBA watchdog script. This path uses only the SCADA PC's standard NIC and requires no additional Siemens hardware.

Hardware and Software Requirements

S7-REDCONNECT and CP1613/CP1623 are part of the SIMATIC NET PC software/hardware catalogue; verify the current model and required firmware against the corresponding Siemens Industry Online Support entries before procurement, because CP1613 is older PCI hardware and the PCIe successor CP1623 is the contemporary choice on most modern SCADA PCs.

Option A — S7-REDCONNECT Configuration

This is the path of least surprise for the SCADA layer because KEPServerEX and iFIX see one S7 endpoint. The failover is carried out inside the Siemens driver.

1. Install the CP1613 or CP1623 in the SCADA PC. Mount the card in a free PCI (CP1613) or PCIe (CP1623) slot; install the SIMATIC NET device driver package that ships with the card.
2. Configure the CP in STEP 7 (or TIA Portal) under the PC station. In the PC station configuration, add the CP16x3 to slot 1 (or as required) and assign the same PROFINET IO / S7-subnet that is wired to the H-station.
3. Install the S7-REDCONNECT software on the SCADA PC. The runtime is part of SIMATIC NET and must be licensed per PC.
4. Configure redundant connections in NetPro. Open the PC station in NetPro, right-click the S7-REDCONNECT interface, and add two S7 connections—one targeting the CP443-1 in Rack 0 and one targeting the CP443-1 in Rack 1. Mark both as redundant; the wizard links them into one logical REDCONNECT endpoint.
5. Compile and download the PC station from STEP 7 to the SCADA PC using the PC station configurator (Station Configuration Editor / "Configuration Console").
6. Point KEPServerEX at the REDCONNECT channel. In the KEPServerEX Siemens TCP/IP Ethernet driver, set the device IP to the logical REDCONNECT endpoint address. The Siemens driver handles the underlying path selection.
7. Connect iFIX through OPC DA (or OPC UA) to KEPServerEX as usual — no script-based failover logic is needed.

Option B — Dual-Channel Redundancy Without CP1613/CP1623

When procurement of CP1613/CP1623 and the S7-REDCONNECT license is not an option, you can implement redundancy in the SCADA layer using a standard Ethernet NIC, two KEPServerEX devices, and a watchdog tag that allows iFIX to switch the active channel. Trade-offs versus Option A are longer switch-over time (driven by the SCADA polling cycle), bespoke switching logic, and additional engineering effort.

STEP 7 / TIA requirements

• Compile the S7-400H station and configure it as an H-station with two CPUs (Type 41x-H).
• In NetPro on the H-station side, define two separate S7 operator (OP) connections: one allowed partner to CP443-1 in Rack 0, one to CP443-1 in Rack 1. Alternatively, mark both connections as "all partners" if the SCADA PC is moved between subnets.
• Each CP443-1 needs its own Ethernet address (IP / subnet mask / router) and its own S7 connection resources. Confirm available connection resources on the CP443-1 (typically 16 maximum for ISO-on-TCP at the time of writing) and account for other clients.

KEPServerEX Configuration

Two channels and two devices are required. Each device points at the IP of one CP443-1; data tags are duplicated so iFIX can read from either.

Both devices must reference the same PLC DB/M/I addresses. Naming with a prefix (A_ / B_) keeps iFIX switching logic readable.

PLC-Side Watchdog Block

Add a 1 Hz blinking bit in OB35 (cyclic interrupt, 1000 ms) on each CPU. This gives the SCADA layer a real-time heartbeat it can interrogate independently of stale-data detection in the OPC driver.

// FB175 "S7RedundancyHeartbeat" - call in OB35 of CPU 0 and CPU 1
// Output : BOOL Q_Heartbeat  - 1 Hz pulse (50 % duty)
// Memory : BOOL M_SecondToggle

Q_Heartbeat := NOT M_SecondToggle;
M_SecondToggle := NOT M_SecondToggle;

iFIX Switching Logic

iFIX acquires KEPServerEX tags through OPC DA. Two parallel tag databases are populated, one per channel. A VBA switching routine inspects the watchdog of each channel and toggles a database tag ACTIVE_CHANNEL that drives tag substitution in graphics.

' iFIX VBA routine - place in the iFIX Background Script (cyclic)
' Reads watchdog timers for both channels and chooses the healthier one.

Dim nPrimary As Long
Dim nSecondary As Long
Dim dblStale As Double
Dim nActiveCh As Long

nPrimary   = Fix32.ReadValue("A_WDG_PRIM.A_CV")
nSecondary = Fix32.ReadValue("B_WDG_SEC.A_CV")
dblStale   = 5   ' seconds without heartbeat before switching

If (nPrimary > 0) And ((Fix32.Time - Fix32.GetLastUpdate("A_WDG_PRIM")) < dblStale) Then
    nActiveCh = 0
ElseIf (nSecondary > 0) And ((Fix32.Time - Fix32.GetLastUpdate("B_WDG_SEC")) < dblStale) Then
    nActiveCh = 1
Else
    nActiveCh = 2   ' both paths unhealthy
End If

Fix32.WriteValue "ACTIVE_CHANNEL.A_CV", CStr(nActiveCh)

' Optional logging
If nActiveCh <> Fix32.ReadValue("ACTIVE_CHANNEL_AH.A_CV") Then
    Fix32.WriteValue "ACTIVE_CHANNEL_AH.A_CV", CStr(nActiveCh)
    Fix32.Msg "Redundancy switch to channel " & CStr(nActiveCh), 48, 0
End If

In graphics, replace direct reads of process tags with a database alias that points at A_TAGNAME when ACTIVE_CHANNEL = 0 and B_TAGNAME when ACTIVE_CHANNEL = 1. iFIX database indirect tags using D point references implement this with no display-level scripting.

Verification and Commissioning Procedures

1. Baseline traffic check: From the SCADA PC, ping both CP443-1 IP addresses. Confirm both succeed under healthy conditions.
2. Force watchdog: Disable the Watchdog tag in PLC for one rack. Confirm that the OPC quality for the affected channel drops to BAD and that iFIX switches to the backup within one polling cycle.
3. Physical disconnect test: With the plant in a controlled state, remove the network patch cable from the CP443-1 in Rack 0. Verify that:
   • KEPServerEX logs the channel as disconnected.
   • The iFIX ACTIVE_CHANNEL tag transitions from 0 to 1.
   • The Watchdog_Age value rises above the 5-second threshold before the switch.
   • Operator screens continue to display data sourced from Rack 1.
4. Reverse failover test: Reconnect the Rack 0 cable. After the heartbeat is restored, iFIX should optionally fall back to the primary channel (configure this explicitly in the script; do not assume it).
5. Alarm policy check: Confirm an operator alarm is generated on every ACTIVE_CHANNEL transition with the previous and new channel number.
6. Latency check: Time the period between CP443-1 failure and iFIX-visible data continuity. For Option B, expect on the order of one iFIX polling interval (typically 1–5 s). For Option A, expect faster sub-second transition.

Troubleshooting Matrix

Maintenance and Field-Proven Caveats

• Keep two independent plant LAN paths between the SCADA PC and the H-station whenever possible. A redundant PLC pair connected via a single cable is not redundant in practice.
• Avoid poll storms: iFIX polling faster than KEPServerEX can re-attempt connection will saturate the PC. Set iFIX scan slower than the OPC connection-recovery interval (default ~5 s).
• Document the failover: Write ACTIVE_CHANNEL transitions to the iFIX Historian so root-cause analysis is possible after a controller trip. Time-stamping on every transition is essential.
• Tag prefix discipline: Naming prefixes (A_ / B_ or P_ / S_) prevent mis-pairing tags to the wrong rack and simplify the iFIX indirect-tag table.
• CPU slot rule: KEPServerEX's "slot" parameter is the slot of the CP443-1 in the S7-400 rack, not the CPU slot. Misconfigured slot is the single most common reason an S7 TCP/IP device returns data without errors but shows stale values.
• Keep a license of iFIX's SCADA redundancy option on top of this setup if full SCADA-server high availability is required (iFIX supports a primary/standby SCADA pair). See the iFIX redundancy section in the official product documentation at GE Vernova iFIX.
• Consider a parallel non-iFIX viewer during commissioning: Wireshark plus an S7 protocol filter shows which CP443-1 is responding to which ISO-on-TCP connection — invaluable when KEPServerEX logs are ambiguous.

Frequently Asked Questions