S7-1500 WinCC Redundancy: MRP Ring and System IP Failover

1. Problem Definition

A common plant-bus design pattern pairs a SIMATIC WinCC station with a SIMATIC S7-1500 controller using two physically separate Ethernet networks to provide redundancy:

• Plant Bus 1 (Control LAN 1): S7-1500 CPU PROFINET interface X1 (or X2) <-> Ethernet card #1 of the WinCC server PC.
• Plant Bus 2 (Control LAN 2): S7-1500 CP 1543-1 (6GK7543-1AX00-0XE0) <-> Ethernet card #2 of the WinCC server PC.

The desired behavior is that WinCC communicates with the CPU through LAN 1 under normal conditions and automatically switches the connection to LAN 2 (via CP 1543-1) when LAN 1 fails. Although this design looks correct on paper, the stock WinCC V7.x and WinCC Professional (TIA) runtime does not provide built-in connection-level failover between two distinct configured connections of a single CPU. This article documents the supported redundancy mechanisms available in the S7-1500/WinCC product family and the engineering required to deploy each one.

2. Architecture Options Overview

Three engineering paths deliver a redundant path between WinCC and an S7-1500:

1. Media Redundancy Protocol (MRP) ring — physical layer / network redundancy using IEC 62439-2. Single logical connection, two physical paths.
2. System IP addresses — one S7-1500 CPU presents two IP addresses on the same subnet through different PROFINET interfaces. WinCC keeps one configured connection; the controller forwards packets internally if one interface fails.
3. S7-1500R/H redundant system — two synchronized CPUs (1515R / 1517H) acting as a single logical controller with hot-standby failover. WinCC connects to the system IP of the redundant pair.

3. Why WinCC Cannot Auto-Failover Between Two CP Connections

WinCC V7.x and WinCC Professional (TIA Portal) treat each S7 connection (S7-CONN / ISO-on-TCP / TCP) as an independent channel. The runtime will establish keep-alive watches on a configured connection and report "connection failed", but it does not contain logic that, upon detecting failure of connection #1, automatically rebuilds and switches runtime tag acquisition to a previously defined connection #2 on the same CPU. This is documented behavior in the WinCC system manuals and is the root cause of the design problem raised by the operator.

WinCC Advanced / Comfort panels, on the other hand, expose the Change connection system function. That function is intended for changing the active HMI connection at runtime, and can be wired to the ConnectionStatus event to give a rudimentary failover against an S7-1200 or S7-1500 with two PROFINET interfaces. It is not available on a WinCC Runtime Professional server, and it is not available on WinCC V7.x.

Therefore, to obtain true redundancy between WinCC and an S7-1500, you must rely on mechanisms that are transparent to the WinCC connection configuration:

• Make the network itself redundant so WinCC never loses its single TCP session, or
• Make the controller redundant so the system IP never changes address, or
• Use System IP addresses so the CPU itself absorbs a single-link failure.

4. Option A — Media Redundancy Protocol (MRP) Ring

MRP is defined in IEC 62439-2 and is the standard PROFINET redundancy mechanism. In an MRP ring, one device is the MRP Manager (typically a SCALANCE switch, e.g. SCALANCE XC/XB/XR/XC-200 family manuals) and the others are MRP Clients. When the ring is intact, the Manager blocks one port; on detection of a link failure it opens the blocked port and re-establishes the topology. The maximum recovery time is 500 ms for a ring with up to 50 devices, and as low as 50–200 ms in SCALANCE XC-200/XR-500 with fast MRP.

For a WinCC <-> S7-1500 link the MRP ring is the lowest-cost option because no additional CP card is required — the CPU's onboard PROFINET ports already include an internal 2-port switch with MRP client capability.

4.1 Required Components

4.2 Topology Rules

• Maximum 50 nodes per MRP ring (50 ms — 500 ms reconfiguration time scales with node count).
• The ring must be closed; the Manager closes a port during normal operation.
• Do not mix MRP with HRP (High-speed Redundancy Protocol) or PRP in the same ring.
• The PROFINET interface used for MRP cannot simultaneously act as PROFINET IO controller and IO device with shared device — MRP operates at port level, independently of the PROFINET role.

4.3 TIA Portal Configuration

1. Open the Devices & Networks view and place the S7-1500 CPU and the SCALANCE switch.
2. Select the switch and in the inspector open Properties > PROFINET interface [X1] > Topology. Assign the role MRP manager (auto or manager).
3. Select the CPU's PROFINET port that participates in the ring and set MRP role to MRP client.
4. Draw the ring connections (CPU — SW1 — SW2 — ... — SWn — CPU) using the port-to-port interconnect editor.
5. For PROFINET IO devices, set Transmission mode / Watchdog on the device properties to a value that tolerates the worst-case ring reconfiguration (e.g. 600–1000 ms). Default of 300 ms is usually acceptable with SCALANCE XC-200.
6. Compile and download. In the switch web UI (or using PRONETA) verify MRP-Ring-State = Open / Closed and the manager's blocked port.

5. Option B — System IP Addresses (Connection Failover within a single CPU)

The S7-1500 firmware supports system IP addresses on a single CPU. In this mode the CPU is reachable on two different IP addresses (typically one per PROFINET interface) and the firmware internally routes frames to the user program so that, from a WinCC point of view, the connection is maintained even if one interface fails. WinCC only configures one connection, but the underlying interface may be either X1 or X2.

5.1 Prerequisites

• S7-1500 CPU with two PROFINET interfaces that can act as separate IP stations (e.g. CPU 1515-2 PN, CPU 1516-3 PN/DP, CPU 1518-4 PN/DP).
• CPU firmware ≥ V2.5 for the System IP feature on X1 and X2.
• Both interfaces in the same IP subnet is not required — the two addresses can sit on physically separate networks (Plant Bus 1 and Plant Bus 2 in the original request).

5.2 TIA Portal Configuration

1. In the device view, select the CPU and open Properties > PROFINET interface [X2] > Ethernet addresses.
2. Tick "Activate system IP address" and assign an IP address in the Plant Bus 2 subnet (e.g. 192.168.2.10 / 255.255.255.0).
3. Optionally, activate the Router field if WinCC traffic must traverse a Layer-3 device between LAN A and LAN B.
4. Compile hardware configuration and download.
5. In WinCC, configure the S7 connection to the primary system IP (X1). The X2 address is held in standby at the controller side and is used by WinCC automatically only in specific firmware-conditional scenarios — refer to the CPU system manual for the exact behavior on your firmware release.

6. Option C — S7-1500R/H Redundant Controller Pair

The S7-1500R/H family consists of:

• CPU 1513R / 1515R / 1517H — redundant pairs that present a single System IP address to WinCC.
• Backplane connection via PROFINET cable for R-cpus, or via Sync Modules for H-cpus (fiber-optic up to 10 km for 1517H).

Switchover occurs automatically on a primary failure with a typical sub-300 ms break in the S7 connection (see S7-1500R/H system manual entry ID 109751578). WinCC sees a momentary loss of keep-alive but, because the IP address does not change, the TCP session is re-established on the new primary without operator intervention. WinCC does not need to know that two CPUs exist.

6.1 Restrictions

• Per the official Siemens TIA Portal documentation, the PROFINET X2 interface of an S7-1500H does not support MRP at that interface (S7-1500R/H redundancy — media redundancy limitations). MRP must be planned on PROFINET X1 or on a SCALANCE ring that does not terminate on the H CPU X2.
• S7-1500R/H firmware V4.0 or higher is required to use both PN ports of X2 in a redundant way.
• CP 1543-1 behind an S7-1500R/H is supported as a router / firewall but does not take part in the controller redundancy itself.

7. Step-by-Step TIA Portal Configuration for the Recommended Design

The recommended design for the original question (one WinCC station, two physical plant buses, redundant S7-1500 controller) is:

1. Controller: S7-1500R/H pair on PROFINET X1 of each CPU.
2. Network: SCALANCE MRP ring connecting X1 ports of both R/H CPUs and the WinCC station's NIC.
3. WinCC: Single S7 connection to the System IP of the redundant pair.
4. CP 1543-1: retained for firewall / routing to a separate office network (not used for the redundant HMI path).

7.1 Configuration Sequence

1. Create project & add devices. In TIA Portal, insert the two CPUs (e.g. 6ES7515-2RN03-0AB0 CPU 1515R) and configure them as a redundant pair from the device properties (Redundancy > Configure as redundant system).
2. Assign the System IP. In the redundancy wizard, define the shared System IP address (e.g. 192.168.1.10) and the individual partner addresses (e.g. 192.168.1.11 and 192.168.1.12).
3. Enable MRP on PROFINET X1. In Properties > PROFINET interface [X1] > Topology, mark the role as MRP client on both CPUs.
4. Configure the SCALANCE manager. On the SCALANCE XC-200 / XR-500, set MRP Manager (default), connect its two ring ports to CPU-A X1 and CPU-B X1.
5. Add the WinCC station. Insert a SIMATIC PC station and add a regular PROFINET interface. Connect its port to the SCALANCE ring port.
6. Configure the S7 connection in WinCC. WinCC V7.x: in Tag Management > SIMATIC S7-1200, S7-1500 Channel, add a new connection with the System IP 192.168.1.10, slot 1, rack 0. WinCC Professional: in Connections, add an S7-1500 connection with the System IP.
7. Download. Compile and download both CPUs, the SCALANCE configuration, and the WinCC project.

7.2 Verification

• Open WinCC Online tag diagnosis and confirm Connection state = Connected with a steady round-trip time.
• Pull the SCALANCE ring cable between SW2 and SW3 (or between SWn and CPU-A X1) and verify that the S7 connection in WinCC remains Connected after ≤ 500 ms.
• From the CPU web server, verify redundancy status Primary = CPU-A, Backup = CPU-B, Status = RUN-Redundant.
• Power down CPU-A and verify failover to CPU-B within the documented switchover budget (< 300 ms typical, < 1 s worst case).

8. WinCC Connection Configuration

WinCC supports a single S7 connection to the redundant pair. To avoid spurious alarms during the brief switchover window, tune the following parameters:

9. Comparison of the Three Options

10. Troubleshooting Matrix

11. Diagnostics Commands and Tools

• Web server of the S7-1500 — Diagnostics > Redundancy > Status shows primary/backup CPU, last switchover cause, and MRP ring state.
• PRONETA — free Siemens tool for PROFINET network analysis. Verifies MRP role, ring closure, and port status. Available from SIOS entry 67460624.
• S7-1500 Diagnostic Buffer — read via TIA Portal online; look for event ID 0x013C (redundancy loss) and 0x013E (redundancy restored).
• Wireshark on WinCC NIC — filter on s7comm or tcp.port==102; verify a continuous stream of S7 read/write requests and absence of TCP RST frames on failover.
• SCALANCE Web UI — Information > MRP shows blocked port and ring state.

12. Field Commissioning Checklist

1. Document the IP plan (System IP, partner IPs, subnet masks, router, DNS if S7-1500 with NTP).
2. Verify PROFINET topology in TIA Portal matches the physical cabling before powering up devices.
3. Confirm firmware compatibility between the two R/H CPUs (same firmware version, mandatory).
4. Run ring break test three times in each direction and measure the longest observed break in WinCC tag diagnostics.
5. Run primary power-down test on CPU-A and CPU-B; record the longest switchover observed.
6. Validate that no spurious alarm is raised on the HMI within 5–10 s of a ring break (WinCC connection timeout setting).
7. Sign off the redundant path with a signed commissioning report attached to the project documentation.