Resolving S7-400H CPU 414H TP177A MPI Failover Connection Loss

When a SIMATIC TP177A touch panel is wired directly to the MPI port of a single CPU in an S7-400H (CPU 414-4H) redundant station, the HMI will fail to automatically re-establish communication after the connected CPU is power-cycled and brought back online. The connection is only restored after a physical restart of the panel itself. This article documents the architectural cause of the failure and the two field-proven recovery paths: a dual-MPI connection with an H-status function block that follows the active master, and a migration to Industrial Ethernet through a CP 443-1 module.

1. Problem Overview

The reported fault is reproducible and follows this exact sequence on a stock S7-400H station:

1. TP177A is configured with a single MPI connection to CPU(0) at MPI address 2 (CPU 414-4H default).
2. CPU(0) is the active master, CPU(1) is in standby with MPI address 3.
3. Operator power-cycles CPU(0). CPU(1) takes over as master within 100 ms (typical RUN-Redundant handover).
4. The TP177A loses its partner, scans the bus, and reports Connection failed: Partner not reachable.
5. Operator restarts CPU(0). It rejoins the H-system, the H sync link re-establishes, and CPU(0) returns as standby.
6. TP177A remains in Connection failed state. The panel does not retry the original connection.
7. Only a warm restart of the TP177A (power-off/power-on) re-initialises the CFB (Communication Function Block) stack and reconnects to CPU(0).

The fault presents identically whether the operator switches CPU(0) first or CPU(1) first. As soon as the panel has logged onto a partner, it does not retry that partner automatically after a hard outage. A soft H-system link-up (e.g., a brief disruption without power-down) is sometimes handled by the WinCC Flexible runtime, but a hard stop of the master is not.

2. S7-400H Redundancy Architecture

The SIMATIC S7-400H (High Availability) is a fault-tolerant PLC station built from two identical CPUs of the same type (CPU 412H, 414H, 416H, 417H) mounted in a synchronised pair. The two subsystems communicate over fibre-optic sync modules and sync cables, with a maximum sync distance of 10 km on the longest S7-400H configurations.

Both CPUs share the same STEP 7 project and the same process image. From the outside, the H-system is a single logical PLC. The two MPI ports, however, are physically two interfaces on two different CPUs. A standard S7 connection in NetPro is bound to one physical partner (CPU 0 or CPU 1) - it does not float.

During a master change, the new master (say CPU(1)) inherits all active S7 connections that the old master (CPU(0)) held. This is handled at the H-system layer via the S7 connection redundancy function, but only for S7 connections that are configured in the STEP 7 project. WinCC Flexible runtime connections are not S7 connections in the STEP 7 sense - they are HMI connections defined in the panel project, and they do not participate in the H-system's connection hand-over.

3. MPI Network Constraints in H-Systems

MPI is a token-passing RS-485 network limited to 187.5 kbps in the standard S7-400H topology. PROFIBUS DP runs up to 12 Mbps on the same physical layer but uses a different protocol. The TP177A supports both MPI and PROFIBUS DP on its single 9-pin Sub-D interface, with the protocol selected in the panel configuration.

Three constraints apply specifically to H-systems:

• Single-master-per-segment rule: The H-system and the HMI cannot both be configured as bus master if they share the same RS-485 segment. The TP177A acts as a passive listener; it never holds the token. This is normally correct, but it means the HMI cannot initiate reconnection logic at the bus level - it can only retry at the application layer.
• Address uniqueness: The H-system occupies two MPI addresses (2 and 3). A third device on the bus (the TP177A) typically takes address 1 (master) or 4 (slave). The panel must have a unique address that does not clash with the standby CPU.
• No native HMI failover in WinCC Flexible 2004-2008: The HMI driver for S7-300/400 (channel unit "SIMATIC S7 MPI/PROFIBUS") supports a single connection partner. WinCC Flexible does not expose a "primary / secondary" or "any partner" field for MPI connections. The partner address is hard-coded at compile time.

4. TP177A Communication Model

The SIMATIC TP177A is a 6-inch STN touch panel with 256 colours, a 4 MB user memory, and a single RS-485 interface for MPI/PROFIBUS DP. It runs WinCC Flexible 2004 SP1 or higher. The HMI connection is configured under Communication > Connections in WinCC Flexible, with the following relevant parameters:

The Only master on bus option in WinCC Flexible is a legacy field. When set to Yes, the panel attempts to act as the active bus master if it cannot reach its partner. This is wrong for an S7-400H configuration: both CPUs already master the segment, and enabling the option causes the panel to fight the token. Leave this at No.

5. Root Cause Analysis: Why the HMI Loses Its Partner

The root cause is a combination of three factors. Each must be addressed for the panel to recover cleanly after a CPU outage.

5.1 Hard-coded connection partner

WinCC Flexible stores a single S7 connection partner address in the panel project. At runtime, the panel opens one S7 connection to that partner. If the partner disappears, the panel cycles through the configured retry time and watchdog time, then drops the connection into the Connection failed state. The runtime does not search for a substitute partner - it does not know that the configured partner has a "twin" at address 3.

5.2 H-system connection handover is invisible to WinCC

When CPU(0) is lost, the H-system migrates the active S7 connections to CPU(1). This is transparent to STEP 7 applications but not to WinCC Flexible, which uses its own S7 driver, not the H-system's connection table. The HMI driver sees only one CPU at one address. It cannot detect that CPU(1) now holds the same process image.

5.3 Bring-up race after CPU power-up

When CPU(0) is powered back on, the panel is in Connection failed state. The panel's CFB (Communication Function Block) stack has already abandoned the socket. There is no periodic retry that would catch the moment CPU(0) returns. Only a fresh initialisation of the CFB stack (i.e., a panel warm start) re-issues the S7 connection request and connects to CPU(0) - which is now in standby and is a valid S7 partner.

6. Prerequisites for Resolution

Before reconfiguring, verify the following:

• STEP 7 V5.5 or V5.6 with S7-H optional package installed. The S7-H optional package is required for H-system configuration in HW Config.
• WinCC Flexible 2008 SP2 or later for the TP177A project. Earlier SPs do not support the required connection parameters cleanly.
• Both CPUs are configured as an H-system in HW Config (CPU Properties > H-CPU tab).
• The MPI addresses of CPU(0) and CPU(1) are 2 and 3 respectively (default). If you have changed them, note the new values - the panel configuration must match.
• You can connect to both CPUs online from STEP 7 (PG on the MPI bus, or via Ethernet routing through CP 443-1).
• You have a copy of the S7-H optional package FB FB 1001 "H_STATUS" (or your plant's equivalent H-status evaluation block). See S7-400H CPU 414-4H manual for the block interface.

7. Configuration Method 1 - Dual MPI Connection with H-Status FB

This method keeps the TP177A on MPI but gives the panel two S7 connections, one to each CPU. A status byte from the H-system tells the panel which CPU is the active master. The panel area pointer or a tag swap function selects the appropriate connection at runtime.

7.1 STEP 7: Define both S7 connections

Open NetPro and define two S7 connections from the TP177A station to the H-system:

1. Insert an S7 connection from the HMI station to CPU(0). Partner MPI address = 2, local MPI address = 1. Note the connection ID (e.g., 1).
2. Insert a second S7 connection from the HMI station to CPU(1). Partner MPI address = 3, local MPI address = 1. Note the connection ID (e.g., 2).
3. Compile and download NetPro to both CPUs and to the HMI station.

7.2 STEP 7: Implement the H-Status FB

Insert the H_STATUS function block into the cyclic OB1 of the H-system program. The block returns the active master and the status of each CPU.

// OB1 cyclic interrupt / OB1 (cycle)
CALL "H_STATUS", DB100
    H_SYSTEM := "DB_H_STATUS".H_SYSTEM_DATA   // 16-byte area
    MASTER    := MW120   // 0 = CPU0 master, 1 = CPU1 master
    STATE_C0  := MB122   // 0=STOP, 1=RUN, 2=STARTUP, 3=HOLD, 4=LINK-UP, 5=UPDATE, 6=DEFECT
    STATE_C1  := MB123   // Same encoding as STATE_C0
    SYNC_OK   := M124.0  // 1 = sync link up
    MASTER_OK := M124.1  // 1 = at least one CPU in RUN
    ERROR     := MW126
    STATUS    := MW128
    RET_VAL   := MW130

// Latch the master ID into a process tag the panel can read
// L "DB_HMI".MASTER_ID   // byte tag, mirrored to the HMI
L     MW120
T     "DB_HMI".MASTER_ID   // 0 or 1

7.3 WinCC Flexible: Configure both connections

Open the TP177A project in WinCC Flexible and create two connections under Communication > Connections:

Mark one connection as the primary. In the project, point every tag and area pointer to the primary connection. The secondary connection is used only to read the MASTER_ID tag and a status mirror.

7.4 WinCC Flexible: Tag-based connection failover

Use a VBScript in the runtime scheduler to swap the active connection when the master changes:

' HMI Scheduler script, 1-second cycle
Dim iMaster, sConn
iMaster = SmartTags("MASTER_ID")

If iMaster = 0 Then
    sConn = "S7_H_CPU0"
ElseIf iMaster = 1 Then
    sConn = "S7_H_CPU1"
End If

' Rebind the area pointer or trigger a reconnect
' (WinCC Flexible 2008 supports HmiRuntime.SysFct.SetActiveConnection)
HmiRuntime.SysFct.SetActiveConnection sConn

7.5 Performance: MPI cycle

At 187.5 kbps, an MPI round-trip for a 32-byte read takes approximately 12 ms. With the TP177A reading roughly 80 tags at 1 s cycle time, the bus is loaded to about 1 percent. There is no performance penalty for the dual-connection method.

8. Configuration Method 2 - Ethernet Migration via CP 443-1

If the H-system has at least one CP 443-1 (6GK7 443-1EX11 or higher), the cleanest solution is to move the TP177A to Industrial Ethernet. The TP177A itself does not have an Ethernet port, but it can be connected to a SCALANCE X switch via an RS-485-to-Ethernet gateway, or replaced with a TP177B (which has Ethernet). For new installations, the recommended path is to upgrade the HMI to a Comfort Panel or a Basic Panel with Ethernet.

8.1 H-system IP addresses

The CP 443-1 is bound to the H-system, not to a single CPU. Both CPUs share the same IP address and the same MAC address (in standby mode, the standby CPU holds the IP down). The H-system firmware handles the IP handover transparently for S7 connections defined in NetPro.

8.2 Why Ethernet solves the fault

On Industrial Ethernet, the TP177A's connection target is the CP 443-1 module's IP address. The CP 443-1 is part of the H-system; the active CPU owns the IP. When CPU(0) is lost, the IP migrates to CPU(1) within 200-400 ms. The HMI's TCP connection drops for a brief moment, but the panel's TCP/IP stack (and the WinCC Flexible driver) implements a transparent reconnect - the partner IP is the same, and the connection re-establishes automatically when CPU(1) takes over the IP.

This is the same mechanism that the PG programming interface uses to "follow" the active master, and it is the recommended path for all S7-400H stations with WinCC Flexible HMIs.

8.3 Y-Link consideration

Some plant designs attempt to use a PROFIBUS Y-Link (6GK1 506-0AM00 or 6ES7 972-0AC80) to merge the two redundant PROFIBUS segments into a single PROFIBUS network for downstream I/O. The Y-Link itself is a Y-shaped bus coupler for PROFIBUS DP/PA on the I/O side, not for HMI connections. In a typical TP177A installation, the Y-Link will not establish an S7 connection to the H-system because the Y-Link does not terminate an S7 connection - it forwards PROFIBUS I/O traffic. Attempting to route the TP177A's S7 connection through a Y-Link is not supported and will not recover after a failover.

9. Bus Termination, Cable, and Physical Layer Checks

Before assuming the failure is purely architectural, rule out physical-layer faults. An MPI bus with marginal termination will exhibit the same "connection lost, no reconnect" symptom, and the TP177A will appear to be the culprit.

9.1 Termination resistors

Every MPI/DP segment must be terminated at both ends with 220 ohm resistors, with the 390 ohm pull-up/pull-down also fitted. The TP177A's 9-pin Sub-D connector has a built-in switch for the 220 ohm termination. On the CPU, the MPI connector on the bottom-front of the 414-4H has a slide switch marked "ON/OFF".

If the two CPUs are mounted side-by-side in a UR2 rack with the TP177A on a stub, terminate the two outermost devices only. If the H-station is at the end of a long bus with the TP177A in the middle, terminate the H-station and the far-end device (not the TP177A).

9.2 Cable specifications

Use PROFIBUS cable (6XV1 830-0AH10) for the MPI bus, even though the protocol is MPI. The cable is identical - the protocol is selected by firmware. Maximum segment length at 187.5 kbps is 1000 m. Drop lines (stub cables) to the TP177A should be kept under 0.3 m if possible; long stubs reflect the signal and corrupt frames during failover (when the bus takes a couple of hundred milliseconds to resync after the master change).

9.3 Baud rate

All devices on an MPI segment must run at the same baud rate. The CPU 414-4H defaults to 187.5 kbps. The TP177A's baud rate is set in the panel configuration under Communication > Connection > Parameters. Mismatches show up as an immediate connection failure on the very first handshake, not as a post-failover fault - but check the setting anyway.

9.4 Master-on-bus property

In WinCC Flexible 2008, the connection property "This HMI device is the only master on the bus" must be set to No for any S7-400H installation. Setting it to Yes causes the panel to attempt to acquire the token when the configured partner is unreachable, which collides with the H-system's token-holding behaviour and prevents reconnection.

10. Verification Procedure

After applying either Method 1 or Method 2, run the following verification sequence to confirm the fix:

1. Baseline state: Both CPUs in RUN-Redundant. TP177A shows process values. Open WinCC Flexible Runtime, verify tag update is active.
2. Master change CPU0 to CPU1: In STEP 7, select CPU(0) in HW Config and trigger Operating Mode > Stop (this is a controlled STOP, not a power-down). Observe:
   • CPU(1) becomes master within 200-300 ms. The "H" LED on CPU(0) goes off, the "H" LED on CPU(1) stays on.
   • TP177A loses the connection for 1-2 s (acceptable), then reconnects via the H-status-driven switch.
   • All process tags continue to update. The MASTER_ID tag on the panel reads 1.
3. Power-down of master CPU1: Pull the power connector on CPU(1). The H-system continues on CPU(0) without interruption. TP177A must reconnect automatically.
4. Restore the failed CPU: Re-apply power to CPU(1). It starts in STOP, runs LINK-UP, then UPDATE, then RUN-Redundant. TP177A must remain connected throughout this sequence, with MASTER_ID transitioning from 0 to 1 when CPU(1) becomes the active master.
5. Cold start of TP177A: Power-cycle the TP177A. It should reconnect to whichever CPU is currently master within 30 s.
6. Disconnect both CPUs: Pull both CPUs. The TP177A enters Connection failed. Restore both CPUs. The TP177A must reconnect without intervention.

Record the time-to-reconnect at each step. A correctly configured dual-connection / H-status system should reconnect in under 5 s for any single-CPU outage.

11. Troubleshooting Matrix

12. Long-Term Recommendations

For new installations on S7-400H stations, follow these guidelines to avoid the fault class entirely:

• Use Ethernet, not MPI, for new HMIs. The TP177A is end-of-life; replace it with a Basic Panel 2nd Generation (KTP700 Basic, KTP900 Basic, KTP1200 Basic) or a Comfort Panel. Both have Ethernet and connect directly to the CP 443-1's IP.
• Avoid direct MPI wiring to one half of the H-station. Even with the dual-connection method, the panel is single-attached to a single RS-485 segment. If the segment is lost (cable cut, connector failure), the panel goes down regardless of CPU state.
• Document the MASTER_ID tag in the tag list so that future engineers understand the topology.
• Train operators to power-cycle the HMI as a last-resort step, not as the primary recovery action. An H-system should fail over transparently to the human-machine interface.
• Keep the H-system on a supported firmware version. CPU 414-4H firmware V4.5 and V5.3 are the most common in service. S7-400H V5.3 is the last version with full support. See the S7-400H product notification for the support lifecycle.