S7-400H CPU STOP Status Detection on HMI: WinCC TIA Guide

Problem: HMI Cannot See When an H-Station CPU Goes to STOP

In a SIMATIC S7-400H redundant station, two CPUs of the same type (for example, CPU 412-3H, CPU 414-4H, CPU 416-5H, CPU 417-4H, or the newer CPU 410-5H process automation CPU) run in hot-standby redundancy. At any moment only the master CPU holds the role of active CPU and updates the process image; the reserve CPU remains synchronized but does not execute the user program in write mode.

A Comfort Panel or WinCC Runtime running in TIA Portal V12 is connected to the H-station through one or more S7 connections. When the project is created in the non-integrated environment (WinCC TIA V12 paired with STEP 7 V5.5/SPx), the H-station cannot be configured directly inside TIA Portal. The workaround is the Tag Converter, which converts STEP 7 V5.5 symbols so that WinCC TIA can read them. Because the H-station contains two physical CPUs, two connections must be imported - one targeting CPU 0 and one targeting CPU 1.

The operator must be able to see at a glance which CPU is in RUN, which is in STOP, and which is currently the active master. Operators also need to switch the displayed connection manually using HMI buttons so that diagnostics and process values are always read from the live CPU.

The default system event 14001 "Connection to PLC failed" only fires when the connection breaks entirely, typically after a power-off, cable pull, or rack failure. A CPU transition to STOP caused by OB omission, programming error, or operator-initiated stop switch does not drop the S7 connection, so event 14001 is never raised. Clock memory bytes cannot be configured on an H-station in the same way as on a standard S7-300/400, because the OB1 clock-bit generator is part of the H-system firmware and is not exposed for user selection in the non-integrated path. A dedicated STOP-detection mechanism is therefore required.

Root Cause: H-Station Connection Model vs. Standard S7

On a standard S7-300/400 station, the HMI polls tags and infers status from the response. The TIA Portal system diagnostics view and the WinCC channel diagnostics both rely on the connection state. As stated in the Siemens function manual Showing diagnostic information on an HMI device:

If at least one CPU indicates an error, the overall status also indicates an error. The system diagnostics view reflects the current operating state of the CPUs and modules.

For an H-station, however, the HMI connection can remain alive even when the active CPU transitions to STOP, because the reserve CPU continues to acknowledge the connection at the CP/IE level. The HMI sees a healthy channel and a healthy partner - it just does not see that the program is no longer executing user code on the CPU it is bound to.

Three mechanisms must therefore be evaluated:

1. Reading the CPU operating-state bits (RUN/STOP/STARTUP/HOLD) directly from the CPU's system area.
2. Evaluating the H-system status word via FB523 STATUS_H (Siemens standard library).
3. Reading the diagnostic buffer via SZL/WRK16 or SFC51 RDSYSST to surface the cause of the STOP.

Solution 1: Read CPU RUN/STOP with a WinCC TIA PLC Status Tag

The simplest method requires no additional FB. Both H-CPU firmware variants expose the operating state in the system status list (SZL) at SSL 0x0019 / Index 0xxy. A user-defined WinCC PLC status tag can be configured on the connection so the runtime polls SZL 0x0019 and returns the byte that contains the current operating state. The same approach is documented in the Siemens application note "Evaluation of the PLC Status 'RUN/STOP' with a SIMATIC S7" (entry ID 109481628):

The HMI tag is updated until the CPU goes into the STOP status. In this way it can be determined at what time the CPU went into the STOP status.

Configuration Steps in WinCC TIA

1. Open the WinCC TIA project that uses the imported STEP 7 V5.5 connections (CPU 0 and CPU 1).
2. Right-click HMI tags → Add new tag. Select the connection that points to the CPU you want to monitor (use both connections - one tag per CPU).
3. In the tag properties, set Acquisition mode = Cyclic in the background with a 1 s cycle.
4. Set PLC status tag = <tag name>. This binds the connection's internal status flag to the tag.
5. Verify in the runtime that the tag flips between 0 (RUN) and 2 (STOP) when the CPU is toggled. The numeric encoding is defined by the SIMATIC S7 protocol and is documented in the WinCC Information System under "Connection status / PLC status".

Solution 2: FB523 STATUS_H from the SIMATIC H Standard Library

For a richer H-specific status that distinguishes master vs. reserve, link-up state, and self-test results, use FB523 STATUS_H from the SIMATIC H - Standard Library. The FB is part of the standard delivery of STEP 7 V5.5 and is installed under Library → SIMATIC H → Standard Library → STATUS H.

FB523 Interface

Recommended Wiring

Call FB523 once per CPU in OB1 with a dedicated instance DB:

CALL "STATUS_H" , DB_STAT_CPU0   // on CPU 0 side
CH_OK   := M 100.0
MASTER  := M 100.1
RESERVE := M 100.2
STOPPED := M 100.3
HALTED  := M 100.4
FORCE   := M 100.5
REDUND  := M 100.6
EXT_F   := M 100.7

CALL "STATUS_H" , DB_STAT_CPU1   // on CPU 1 side
CH_OK   := M 110.0
MASTER  := M 110.1
RESERVE := M 110.2
STOPPED := M 110.3
HALTED  := M 110.4
FORCE   := M 110.5
REDUND  := M 110.6
EXT_F   := M 110.7

These flag bytes are then imported via the Tag Converter into WinCC TIA as two separate tag groups (one per CPU connection). On the Comfort Panel, render two status panels side by side and show the STOPPED, MASTER, and REDUND flags as colored indicators:

• Green background = RUN + MASTER + REDUND
• Yellow background = RUN + RESERVE + REDUND
• Red background + flashing border = STOPPED
• Gray background = CH_OK = FALSE (fiber link failure)

Solution 3: Surface the Cause via the Diagnostic Buffer

When the operator sees a STOP indication, the next action is to identify the cause. The CPU stores up to 200 diagnostic entries in its internal buffer. Read them with SFC51 RDSYSST using SZL ID W#16#0131 (SSL 0x00A0 partial list - diagnostic buffer).

A typical pattern is:

CALL "RDSYSST"
REQ    := TRUE
SZL_ID := W#16#0131        // Diagnostic buffer
INDEX  := W#16#0001
RET_VAL:= MW 200
BUSY   := M 202.0
SZL_HEADER. := P#M 204.0 BYTE 20
DR     := P#DB_STAT_BUF.DBX0.0 BYTE 2400

Each 20-byte event is parsed in OB1 or a cyclic alarm OB to extract event ID, timestamp (10-byte date/time in BCD), and the OB that failed. WinCC TIA can then display the most recent event in plain text on the panel - "OB85 missing - priority class 1", "Stop because programming error in OB1", "Stop by mode selector".

Manual Master Switch from the HMI

Because TIA Portal V12 cannot fully model the H-station, master-switch commands must be implemented at the program level. Two common approaches exist:

Approach A: Switch Using the H-System Control Tag

Configure a WinCC tag that writes to a Boolean marker, e.g. DB_HMI.SWITCH_REQ. In OB1 on the reserve CPU, evaluate this flag and call FC 100 "H-SWITCH_REQUEST" from the SIMATIC H library when it rises - this triggers a controlled master swap without loss of redundancy state.

Approach B: Toggle the HMI Connection

In WinCC TIA V12, two connections (CPU 0 and CPU 1) coexist. Use a script on a button press to change the active connection pointer of the screen from connection A to connection B. The HMI tags remain defined once; only the binding switches. This is the preferred approach when the operator wants diagnostics about the failed CPU without losing the ability to read the surviving one.

1. Define all display tags twice - once on each connection.
2. On the master screen, expose a "Show CPU 0" / "Show CPU 1" selector button.
3. Wire the selector to a tag that re-binds the screen via a WinCC VBS script:\li>

' VBS - switch the active connection group on button click
Sub OnClick(ByVal item)
    Dim cur
    cur = SmartTags("HMI.ActiveCPU")     ' 0 or 1
    If cur = 0 Then
        SmartTags("HMI.ActiveCPU") = 1
        HMIRuntime.Trace "Switched view to CPU 1"
    Else
        SmartTags("HMI.ActiveCPU") = 0
        HMIRuntime.Trace "Switched view to CPU 0"
    End If
End Sub

Pair this with the STOPPED indicator so the operator knows which connection is currently the meaningful one.

Step-by-Step Commissioning Procedure

1. Verify firmware. CPU 41x-3H/4H/5H must be at firmware V5.x or higher; CPU 410-5H must be V8.x or higher to support the diagnostic buffer extensions.
2. Open STEP 7 V5.5 on the project for the H-station. Insert FB523 in OB1 of each CPU with separate instance DBs.
3. Compile and download both CPUs. Confirm in STEP 7 online that CH_OK, MASTER, REDUND rise correctly.
4. Run the Tag Converter on the STEP 7 symbols. Import the result into WinCC TIA V12.
5. Create two S7 connections in the WinCC TIA project: one targeted at CPU 0 rack/slot, one at CPU 1 rack/slot.
6. Configure two PLC status tags, one per connection. Set the cycle to 500 ms.
7. Build the status screen with two panels (CPU 0 / CPU 1) showing PLC status + FB523 flags.
8. Add manual switch buttons with confirmation dialog. Wire to HMI.ActiveCPU.
9. Add the diagnostic buffer viewer using SFC51 RDSYSST + a WinCC text list.
10. Simulate STOP by toggling the mode selector on each CPU and verify the panel flips the status icon within 1 s.
11. Simulate link loss by disconnecting one fiber. Verify CH_OK flag changes on both CPUs and the alarm is raised on the HMI.

Verification Matrix

Troubleshooting Common Pitfalls

Why Not Rely Solely on System Event 14001

System event 14001 is generated by WinCC only when the S7 channel driver detects the connection is broken (no ACK on TPDU within the configured timeout). The default timeout is typically 5-15 s, which is acceptable for a power-off but masks a STOP. In redundancy, the H-system keeps the partner CPU reachable for protocol-level ACKs even when one CPU halts its user program, so the channel never reports failure. The PLC status tag and FB523 outputs remain the authoritative sources for STOP detection.

Alternates and Field-Proven Tips

On very large HMI projects where the master switch must be transparent to scripts and recipes, define the connection in WinCC TIA as a multiplexed tag group bound to HMI.ActiveCPU. The multiplexing automatically re-resolves each tag's source connection whenever the selector changes, so the script layer does not need to touch individual tag bindings.

For WinCC Professional / WinCC Unified in TIA Portal V16 or later, the H-station is supported natively, and the system diagnostics view can be embedded directly on the panel without FB523. The principles above still apply, but the PLC status tag and diagnostic buffer handling can be replaced by the built-in "System Diagnostics" control.

For panel-class HMIs (Comfort Panel TP700/TP900/TP1200, WinCC RT Advanced), the script VBS shown above is the recommended implementation. Avoid C scripts in TIA V12 - they are deprecated and unsupported in subsequent TIA versions.

FAQ