Resolving WinCC S7-400 Error 4116 L4_CONN_REJECT Connection

Problem Overview

When a WinCC Station (WinCC Explorer, WinCC Runtime, or a PCS 7 OS Server) is configured to communicate with a SIMATIC S7-400 CPU through a CP1613 Industrial Ethernet card, the HMI may compile and download successfully yet fail to acquire process data at runtime. All picture tabs in Graphics Designer appear greyed out, tag statuses return quality code bad, and the WinCC channel diagnostics log reports the S7 channel DLL error 4116 hex (0x1014) with the symbolic name L4_CONN_REJECT.

This condition is typically observed in PCS 7 plants with redundant OS Servers where one partner server continues to operate normally while the newly compiled or rebuilt server cannot establish its S7 connection. Because the plant is in production, the redundant partner cannot be stopped for parallel testing, which raises the cost of the failure and demands an online, non-disruptive recovery path.

Error 4116 hex (L4_CONN_REJECT) Decoded

Error 4116 belongs to the S7 communication layer (L4) error class emitted by the S7DOS / SAPI-S7 transport. The REJECT suffix means the Active Station (AS = S7-400) explicitly denied the Open Connection Request sent by the HMI. It is a transport-level rejection, not a network timeout or a TCP RST. The AS received the connection request, looked up its own connection resource table, and returned a CCO (Connect Confirm) with a negative result.

Root Cause Analysis

Per Siemens S7-400 communication specifications, a L4_CONN_REJECT is raised when the AS evaluates the incoming TPDU and refuses to associate the local resource. The four operational reasons that surface in real plants are:

1. Rack / Slot mismatch. For S7-400, the AS is identified inside NetPro by its Rack and Slot. If the WinCC connection (or the underlying "S7 Connection" property page) targets a Rack/Slot that does not match the physical position of the CPU in the actual rack — or a logical slot used by a separate CP — the AS rejects the setup. The CPU slot on S7-400 is typically 3 for the first CPU and 13 for an expansion rack, but always verify against HW Config.
2. Maximum number of AS connections reached. Each S7-400 CPU has a fixed max connection resources figure (e.g. 16 for CPU 412-2, 32 for CPU 414-3, 64 for CPU 416-3, 96 for CPU 417-4). When this is exhausted by other OS Servers, ES stations, S7 routes, or open user TCP connections, the next connect attempt receives L4_CONN_REJECT.
3. Connection data not downloaded to the AS. NetPro in the ES holds the AS-side connection endpoints. If the ES is online-compiled to a different S7 project or the NetPro data was never fully downloaded, the AS has no matching configured connection and rejects the request.
4. CPU is in STOP, HOLD, or DEFECT at the moment WinCC attempts the connect, or the connection DB has been overwritten by user program. After a STOP-RUN transition, the AS drops all active S7 connections, and the very first reconnect may be rejected if the HMI is still holding a stale context.

Diagnostic Procedure

Perform the following checks in order. Each step is non-invasive and can be executed while the redundant partner server remains in production.

Step 1 – Confirm basic IP reachability

1. From the OS Server, open a command prompt and execute ping <CPU IP address> and ping <CP1613 IP address> if a separate CP is in use.
2. Execute arp -a and confirm that the resolved MAC address matches the Siemens CP1613 OUI prefix 08-00-06.
3. Open cmd and run telnet <CPU IP> 102. A S7-400 CPU exposes the ISO-on-TCP / RFC1006 port at TCP/102. A successful TCP handshake is a strong indicator that the S7 transport is reachable at the network layer.

Step 2 – Read the WinCC channel diagnostic file

1. Open the WinCC Explorer on the affected server.
2. Right-click Tag Management → SIMATIC S7 PROTOCOL SUITE → TCP/IP and select System Parameter.
3. On the Unit tab, enable Create diagnostic file and set the cycle to 1 s, then restart the WinCC runtime service.
4. Open the generated S7ONLINE.LOG file. Locate any entry containing the substring 4116 or CONN_REJECT and record the timestamp and the affected connection name.

Step 3 – Verify the S7 connection in NetPro

1. Open SIMATIC Manager and load the ES project.
2. Open NetPro and select the S7-400 station.
3. Right-click each S7 Connection bound to WinCC and select Object Properties. Record the Rack and Slot values shown in the General tab. On S7-400 these must reference the CPU's physical slot (typically 3 in rack 0, 3 in rack 1).
4. Open HW Config on the S7-400, expand Rack 0, and confirm the CPU slot number. Mismatch between NetPro and HW Config is the single most common cause of 4116 in WinCC-to-S7-400 deployments.

Step 4 – Verify the WinCC-side connection parameters

1. In WinCC Explorer, expand Tag Management → SIMATIC S7 PROTOCOL SUITE.
2. Select the channel unit used (e.g. TCP/IP) and double-click the Connection entry.
3. In the Connection Properties dialog, verify the following fields:

Solution: Correcting NetPro and Downloading Connection Data

The corrective action that resolves 4116 in the majority of PCS 7 / WinCC-to-S7-400 deployments is to redownload the connection data — not the full PLC program — from NetPro. This is non-disruptive and does not require a STOP of the CPU.

1. In SIMATIC Manager, open NetPro.
2. Select the S7-400 station in the network view.
3. From the menu choose PLC → Download to Current Project → Connections and Gateways (or in newer PCS 7 versions, PLC → Download to Target System → Connections).
4. Confirm the dialog. The download writes the configured S7 connection endpoints and the resource table into the AS.
5. After the download, force a reconnect from WinCC by stopping and restarting the WinCC Runtime service, or by toggling the connection in Tag Management using Connection → Activate.

Once the connection establishes, the diagnostic file will switch from CONN_REJECT to CONN_ESTABLISHED, runtime screens will repaint, and tag quality will return to good.

Solution: Adjusting Rack and Slot in HW Config

If Step 3 of the diagnostic identified a slot mismatch, correct it as follows:

1. Open HW Config for the S7-400 station.
2. Double-click the CPU (e.g. CPU 414-3 PN/DP, 6ES7 414-3EM07-0AB0) and open the Properties dialog.
3. Record the Rack and Slot from the General tab. The default CPU slot for an S7-400 is 3 in rack 0.
4. Open NetPro, select the S7 connection used by the OS server, and on the General tab of Object Properties set the Rack and Slot to the same values.
5. Download only the connection data as described in the previous section.

Solution: Freeing Connection Resources on the AS

If the S7-400 has hit its connection resource limit, the WinCC connect request will be rejected. Verify and free resources with this sequence:

1. Open SIMATIC Manager → S7-400 → HW Config.
2. Double-click the CPU and select the Communication tab. The dialog displays the number of configured and available connection resources, split between PG/OP, S7, and Other.
3. Compare the count to the CPU-specific maximum (CPU 412-2: 16, CPU 414-3: 32, CPU 416-3: 64, CPU 417-4: 96). Resource shortage is a real-world cause of 4116 in plants that have grown over time.
4. Reduce redundant or unused S7 connections, or move to a CPU class with a higher resource count.

CP1613 Specific Checks

The CP1613 (6GK1 161-3AA01) is a PCI/PCIe Industrial Ethernet card used as the WinCC / PCS 7 OS side communication processor. The following checks are mandatory after any hardware replacement:

1. Open Station Configuration Editor (Start → SIMATIC → Station Configuration Editor) and confirm the CP1613 is assigned to Index 1 with the correct Computer Name matching the WinCC project.
2. In the WinCC project, open Computer → Properties and verify that the Computer Name matches the Windows hostname. A mismatch is reported as a separate warning in the channel diagnostic and is often present alongside 4116.
3. Verify the CP1613 firmware. Siemens released maintenance firmware updates; a mismatched or corrupted firmware on a freshly replaced card can also produce connection rejections because the ISO stack may fail to negotiate.
4. Confirm that the S7ONLINE access point is bound to the CP1613 and not to a soft channel. In Set PG/PC Interface, set the access point S7ONLINE (STEP7) → CP1613 → ISO Ind. Ethernet.

PCS 7 Redundant Server Considerations

PCS 7 plants typically run two OS Servers in a redundant pair, with the standby server holding its own S7 connections to the AS. The total number of S7 connections on the AS is the sum of both servers' connections. If the production server is running on a CPU that is already close to its connection limit, the new standby server's connection request will be rejected. The corrective action is one of:

• Increase the connection resource count on the CPU by upgrading to a higher-class CPU (e.g. from CPU 414-3 to 416-3).
• Reduce the number of WinCC connections per OS server by consolidating tag groups.
• Stagger the reconnect attempt: the standby server should wait until the production server has fully released its connection resources during a controlled failover.

Do not stop the redundant partner while the plant is in production unless you are explicitly performing a planned failover. The proper test sequence is to verify the connection in NetPro on the ES, download the connection data, and force the WinCC service to reconnect without touching the partner server.

Raw Data Mode Pitfall

If the WinCC channel is configured to send and receive raw data blocks (the Send/Receive raw data checkbox under the connection properties), the S7 connection is used in raw mode rather than as a named connection. In raw mode the AS still has to allocate a connection resource, and the Rack/Slot values used by WinCC must match NetPro. A common error is to enable raw data on a connection that NetPro has not provisioned. The AS responds with L4_CONN_REJECT. To recover:

1. Open Tag Management → SIMATIC S7 PROTOCOL SUITE → connection → Properties.
2. Clear the Send/Receive raw data checkbox unless the project explicitly uses raw S7-API communication.
3. Recompile the OS server and restart the WinCC runtime.

Modern Reference: WinCC Unified to S7-300/400 (RT Unified)

Newer WinCC Unified projects communicate with SIMATIC S7-300/400 using the SIMATIC S7-300/400 (RT Unified) channel. The connection parameters, Rack/Slot semantics, and maximum connection counts are documented in the official TIA Portal help. The connection path is configured under Devices & Networks → Networks view → Connections, and the HMI side requires the HMI device to be assigned as an HMI operator panel within the same project. The reference documentation is published at the Siemens docs portal: Communication with SIMATIC S7-300/400 (RT Unified). For classic WinCC (V7.x) and PCS 7 V8/V9, the S7 PROTOCOL SUITE remains the supported channel, and the diagnostic flow in this article applies unchanged.

Verification Checklist

1. Open WinCC Channel Diagnosis and confirm the S7 connection state is connected.
2. Open Graphics Designer and place a process tag (e.g. an MD or DBW from the PCS 7 master data library). The value must update without "####".
3. Open the Alarm Control and confirm that PCS 7 message frames are received from the AS.
4. In the S7ONLINE.LOG file, confirm the absence of any new 4116 / L4_CONN_REJECT entries over a 5-minute observation window.
5. On the S7-400, open CPU → Operator Panel → Message Buffer and verify that no S7 communication diagnostic events have been raised.

Preventive Recommendations

• Always perform a NetPro Connections and Gateways download whenever the OS Server computer name, the CP1613 hardware, or the CPU's HW Config is changed. A full PLC download is rarely required and adds risk.
• Document the CPU's connection resource budget in the PCS 7 project header. Track every OS server, ES station, S7 route, and open TCP communication against the CPU's maximum.
• Keep the CP1613 firmware and the SIMATIC NET PC software on a common, vendor-supported version. Version mismatches between the SIMATIC NET installation and the CP1613 firmware have historically produced intermittent 4116 errors after a hardware swap.
• Maintain a single source of truth for the Rack/Slot values. Encode them in the ES project, the WinCC project, and the plant documentation. Any deviation is a future 4116.

FAQ