Resolving WinCC V7.2 OS Server Redundancy Errors on S7-400H

1. Problem Statement

A commissioned redundant Operator Station (OS) system running SIMATIC WinCC V7.2 on Windows Server 2008 R2 paired with a SIMATIC S7-400H (AS) shows recurring server redundancy alarms. The alarms surface periodically in the WinCC Alarm Logging view and on the redundant server message line, with or without runtime interruption. The behavior persists after multiple restart attempts of both OS servers, but in the documented case the underlying cause was an unseated network cable on Server 1. Once reseated, the alarm did not return over a multi-week monitoring window.

This article consolidates the diagnostic logic, configuration checks, and corrective actions required to isolate and eliminate recurring redundancy events on a WinCC V7.2 redundant pair. It applies to PCS 7 V8.0/V8.1 installations as well as standalone WinCC V7.2 redundancy projects. The methodology also covers S7-400H systems using the SIMATIC S7 Protocol Suite for the AS-OS channel.

2. Affected System Architecture

The reported topology is a classic PCS 7 redundant OS configuration. The relevant components and their roles are summarized in the table below.

Two separate Ethernet segments are typically present:

• Terminal bus — used by WinCC clients/servers, ES, and the redundant OS pair to exchange redundancy state, archive updates, and user administration.
• Plant bus — used by the S7-400H AS to publish process values, alarms, and diagnostics up to the OS pair via the SIMATIC S7 Protocol Suite.

On a redundant OS pair, the terminal bus network adapter on each server is the one referenced inside the SIMATIC Shell redundancy entry. Selecting the wrong adapter (for example, a backup NIC, a Hyper-V virtual switch, or a VLAN-tagged management port) is one of the most common misconfigurations and can produce exactly the symptom described in the source case.

3. Symptom Classification and Event Log Entries

Redundancy errors in WinCC V7.2 surface in three distinct locations. Always cross-reference all three before changing configuration.

3.1 WinCC Alarm Logging

Recurring messages typically include WinCC redundancy event IDs that indicate the partner server is unreachable, archive synchronization is broken, or the master has changed state involuntarily. Look for:

• "Redundancy: Partner server not reachable"
• "Redundancy: Archive synchronization lost"
• "Redundancy: Master/Standby switchover executed"
• "Connection failure to automation system"

3.2 Windows Event Viewer

Under Windows Logs > System and Applications and Services Logs, look for:

• TCP/IP event ID 4227 (TCP/IP connection attempt failed)
• DHCP client 1001 (lease lost)
• e100e / I219 / iSCSI NIC link state flap events

3.3 WinCC SysLog / Diagnose Files

WinCC writes WinCC_Sys_<Server>.log, WinCC_<Server>.log, and the SIMATIC_S7_Protocol_Suite_<NN>.log. These three log families together cover redundancy state, AS connection state, and channel-level diagnostic data. The SIMATIC_S7_Protocol_Suite_<NN>.log is the first file to open when an AS connection drop is suspected, and it is the one explicitly requested in the field report.

4. Diagnostic Methodology

Use the following ordered checklist. Each step is non-destructive and may be performed on a live system with only brief redundancy partner loss. Stop only when the cause is identified.

1. Verify physical layer on both servers. Re-seat the terminal bus and plant bus cables. Confirm the RJ45 latch is fully engaged. Inspect for kinks, bent pins, or crushed strain reliefs. Replace any cable that does not click firmly.
2. Verify switch port state. From the managed switch, confirm both ports are up/up, that link speed/duplex match the NIC (typically 1 Gbit/s full duplex for industrial PCs), and that no err-disable, STP blocking, or broadcast storm control has disabled the port.
3. Disable NIC power management. In Windows Device Manager → NIC → Properties → Power Management, uncheck Allow the computer to turn off this device to save power. This is the single most common cause of intermittent link loss on Server 2008 R2 with Intel I350/I219 NICs.
4. Confirm SIMATIC Shell entry. On each OS server, open SIMATIC Shell, expand Redundancy, and verify the partner server is listed, that the terminal bus adapter is bound to the correct NIC, and that the entry is listed first (priority order).
5. Check @RM_MASTER internal tag. On each server, in WinCC Explorer → Tag Management → Internal Tags, locate @RM_MASTER. One server should read 1 (master), the other 0 (standby). If both read 0, both servers believe they are standby — an indication of a lost partner connection.
6. Validate ES runtime status. Ensure WinCC Runtime has not been started on the ES. An accidental runtime start on the ES will disturb the redundancy state, because the ES will appear as a third client and may race for master role on certain configurations.
7. Capture SIMATIC S7 Protocol Suite logs. From the ES, open the SIMATIC S7 Protocol Suite channel diagnostics for both AS connections and export the SIMATIC_S7_Protocol_Suite_01 log from each server.
8. Check PCS 7 OS Project Editor. In the OS project editor, confirm that Redundant is enabled and that the partner server name and IP resolve in both directions.

5. Root Cause Analysis: Network Cabling

In the documented case, the root cause was identified on Server 1. One of the network cables (the terminal bus cable) was not properly inserted. Once reseated, the redundancy alarms stopped.

This is consistent with the failure mode the SIMATIC Shell is designed to detect: when the terminal bus link drops, the partner server's redundancy heartbeat times out, the master transitions the local server to standby, and upon link restoration the role is renegotiated. If the link is intermittent, the system repeatedly cycles between master and standby, producing a flood of redundancy messages. The visible alarm in the WinCC alarm window is therefore not a software bug — it is the system correctly reporting that it cannot reach its partner.

The relevant physical-layer checks are:

6. SIMATIC Shell Configuration Verification

SIMATIC Shell is the WinCC service that publishes the redundancy partner, file share, and print services over the terminal bus. The redundancy tab of SIMATIC Shell must be configured on each OS server.

6.1 Open SIMATIC Shell

On each OS server, click Start → SIMATIC → SIMATIC Shell. The shell icon appears in the notification area of the taskbar. Right-click the icon and select Settings.

6.2 Verify the Terminal Bus Adapter Binding

In the Network Adapter dropdown, select the network interface that is physically connected to the terminal bus. This must be the same interface used by the WinCC project. If a Hyper-V virtual switch, a backup management NIC, or a VLAN-tagged interface is bound instead, redundancy heartbeats will be sent on the wrong segment.

6.3 Confirm Redundancy Activation

Open Redundancy → Settings. Verify the following:

• Redundancy activated checkbox is set on both servers.
• Partner server name resolves to the correct Windows hostname of the partner OS server.
• Terminal bus adapter is bound to the correct NIC and listed first in priority order.
• Redundancy synchronization path points to a local folder on each server (typically D:\WinCCProj\Redundancy or similar). Both servers must be able to read/write this path through the redundancy file share.

6.4 Common Misconfigurations

7. @RM_MASTER Internal Tag Verification

WinCC exposes a set of internal system tags that report redundancy state. The most important is @RM_MASTER.

7.1 Locate the Tag

In WinCC Explorer, navigate to Tag Management → Internal Tags. Filter or search for tags beginning with @RM_. The following tags are part of the standard WinCC V7.2 redundancy tag set:

7.2 Validation Procedure

1. On each server, open a WinCC tag simulation or a Graphics Designer screen with an I/O field bound to @RM_MASTER.
2. Confirm that exactly one server shows @RM_MASTER = 1 and the other shows @RM_MASTER = 0.
3. Confirm that @RM_PARTNER_STATE = 1 on both servers.
4. Read @RM_MASTER_NAME on both servers; both must report the same hostname.
5. Toggle the value of @RM_MASTER only if you intend to force a controlled switchover — never toggle it to "fix" an alarm.

8. SIMATIC S7 Protocol Suite Diagnostics

The SIMATIC S7 Protocol Suite is the channel unit that connects the OS to the S7-400H AS. It is independent of the WinCC redundancy layer, but its health is a common secondary cause of "AS connection lost" alarms that appear alongside redundancy alarms.

8.1 Channel Configuration

For an S7-400H AS, two connections per server are typically configured in the SIMATIC S7 Protocol Suite:

• Connection 1 — Primary H-CPU, rack 0, slot configured per PCS 7 hardware configuration.
• Connection 2 — Redundant H-CPU, rack 1, slot configured per PCS 7 hardware configuration.

8.2 Capturing the Log

The channel log file is generated under the project diagnostics folder, typically:

When contacting Siemens support or peer engineers, always attach this file from both OS servers and the ES, with matching timestamps around the alarm window. The file is plain text and contains channel connection establishment, keepalive, and disconnect events with millisecond timestamps.

8.3 Interpreting the Log

If the S7-400H itself is in a healthy state (both H-CPUs in RUN, sync modules in LINK, no OB72 / OB82 / OB83 events), the S7 Protocol Suite log will show only WinCC-side events. Any H-CPU redundancy event on the AS will be visible first in the AS diagnostic buffer and should be addressed at the AS level before WinCC.

9. Step-by-Step Resolution Procedure

The following procedure was used to resolve the source case and applies to similar installations. It is intentionally conservative: it preserves evidence, validates the redundant pair at each step, and avoids forced master changes.

9.1 Preparation

1. Schedule a maintenance window of 30–60 minutes.
2. Notify operations that one OS will be restarted if required.
3. Capture a fresh SysLog snapshot from both servers and the ES before any change.
4. Capture the current values of @RM_MASTER, @RM_SLAVE, @RM_PARTNER_STATE, and @RM_MASTER_NAME on both servers.

9.2 Physical Layer Validation

1. Inspect Server 1 terminal bus cable. Re-seat the RJ45 connector on both ends (server NIC and switch port).
2. Inspect Server 2 terminal bus cable in the same way.
3. Inspect plant bus cables on both servers.
4. Confirm switch port link state on the terminal bus ports for both servers.
5. Open Device Manager on both servers, locate the terminal bus NIC, open Properties → Power Management, and uncheck Allow the computer to turn off this device to save power.
6. Open the NIC Advanced properties and disable any Energy Efficient Ethernet, Green Ethernet, or Power Saving Mode features.

9.3 SIMATIC Shell Re-verification

1. On both servers, open SIMATIC Shell → Settings → Network Adapter. Confirm the terminal bus NIC is selected.
2. Open SIMATIC Shell → Redundancy → Settings. Confirm the partner server name and the local redundancy folder path.
3. Restart the SIMATIC Shell service on the affected server (or reboot if service restart alone is not supported by site procedures).

9.4 Runtime Validation

1. Confirm that no WinCC Runtime is running on the ES.
2. Start WinCC Runtime on Server 1. Wait for the redundancy state to stabilize.
3. Start WinCC Runtime on Server 2. Wait for the redundancy state to stabilize.
4. Read @RM_MASTER on both servers. Exactly one must be 1.
5. Read @RM_PARTNER_STATE on both servers. Both must be 1.

9.5 Simulated Switchover Test

1. From the master server, open the Redundancy control dialog (WinCC Explorer → Redundancy → Switchover).
2. Initiate a controlled switchover.
3. Confirm the new master is reachable, @RM_MASTER flipped to 1 on the new master, and that archives are resynchronizing.
4. Wait for the redundancy state to return to Synchronized on both servers.

10. Verification and Long-Term Monitoring

After the physical fix and configuration re-verification, a multi-week observation window is appropriate, as performed in the source case. The recommended monitoring is:

10.1 WinCC Alarm Logging Filter

Create a dedicated alarm filter for redundancy-class messages and assign a higher message class so that any future recurrence is immediately visible to operators. Typical filter criteria:

• Class contains Redundancy or System
• Source contains @RM_ or Redundancy

10.2 Switch Port Counters

From the managed switch, schedule a daily export of the terminal bus port counters for both servers. Watch for incrementing CRC errors, runts, giants, or late collisions. Any non-zero trend is a sign that the physical layer is degrading and should be addressed before another alarm storm.

10.3 NIC Driver and Firmware

Confirm that the NIC driver and firmware on both OS servers are at a version that Siemens has validated for WinCC V7.2 on Windows Server 2008 R2. Vendor-specific NIC firmware updates have resolved similar intermittent link loss symptoms, particularly on Intel I350 and Broadcom NetXtreme adapters used in industrial PCs. Apply vendor firmware updates during a planned maintenance window, since the update typically requires a reboot.

10.4 OS Server Patch Level

Confirm that Windows Server 2008 R2 is at the latest available patch level supported by the WinCC V7.2 installation. Pay specific attention to NIC driver and TCP/IP stack patches that have been validated by Siemens for the relevant WinCC version.

11. Preventive Maintenance and Hardening

To prevent recurrence, apply the following hardening measures during the next scheduled maintenance.

11.1 Cabling and Physical Layer

• Replace terminal bus and plant bus cables with industrial-grade Cat 6A or Cat 7 SF/UTP, terminated to manufacturer specification.
• Use locking RJ45 connectors (industrial IP20/IP67) on both ends to prevent partial dislodgement during vibration or routine maintenance.
• Label both ends of every cable with the server hostname and the switch port number.

11.2 NIC and Switch Configuration

• Force a fixed speed and duplex on both the server NIC and the switch port (typically 1000/Full). Avoid auto-negotiation in redundant infrastructure.
• Disable EEE (Energy Efficient Ethernet) and any vendor-specific green Ethernet features on both server NICs and switch ports.
• Enable storm control and BPDU guard on access ports serving the OS servers.

11.3 SIMATIC Shell and WinCC Redundancy

• Document the SIMATIC Shell redundancy entry on both servers, including the network adapter GUID, the partner hostname, and the redundancy folder path.
• Configure the redundancy heartbeat to a value aligned with the project requirement (default is typically 5–10 seconds).
• Enable detailed logging in the WinCC redundancy service for the duration of the next 30 days, then revert to default to avoid excessive log growth.

11.4 Documentation and Change Control

• Add the redundancy tag set (@RM_MASTER, @RM_SLAVE, @RM_PARTNER_STATE, @RM_MASTER_NAME) to the operator HMI screen with a clear, single-line summary.
• Add a redundancy diagnostic procedure to the site operations manual, including the SIMATIC Shell re-check and the @RM_ tag validation.
• Include the SIMATIC_S7_Protocol_Suite_<NN>.log in the standard diagnostic bundle for any future OS alarm investigation.

12. Frequently Asked Questions