S7-400H PCS 7 Fault-Tolerant Connection: ISO vs TCP Setup

Overview: S7-400H to PCS 7 Fault-Tolerant Communication

Siemens S7-400H fault-tolerant controllers communicate with PCS 7 operator stations (OS) through a single named S7 connection of type S7 fault tolerant. The connection is configured once in NetPro (within SIMATIC Manager) or in the TIA Portal hardware/net editor, compiled into the OS, and resolved at runtime by WinCC against the active CPU of the H pair. The transport layer for fault-tolerant S7 connections is ISO Transport (ISO 8073 class 4) or, where configured, ISO-on-TCP (RFC 1006). The H system monitors both partners through keep-alive exchanges on this transport, so a single, consistent transport selector is mandatory across all redundancy paths.

Two distinct redundancy layers exist in a PCS 7 installation:

• Network / connection redundancy – multiple physical paths between the OS server pair and the H-CPU pair, terminated on separate CPs (CP 443-1, CP 1623). This is what is meant by redundant fault-tolerant plant bus and is implemented inside the S7 connection.
• WinCC server redundancy – two WinCC servers that synchronize message archives, process-value archives, and user administration across the terminal bus using TCP/IP. See the WinCC Options Redundancy documentation and the How Redundancy Works (RT Professional) reference for the archive-pairing mechanism.

These two layers are independent. Compiling two named connections (one ISO, one TCP) into the OS to obtain path redundancy does not satisfy either layer correctly: the WinCC redundancy layer does not switch transports, and the S7 fault-tolerant layer does not accept mismatched transport selectors on the redundant paths.

Why ISO and TCP/IP Cannot Share a Single Fault-Tolerant S7 Connection

The OS compiler resolves one S7 fault-tolerant connection to exactly one S7 connection object per OS server. The S7 connection object in NetPro carries a single type (ISO / ISO-on-TCP / TCP) and a single local/partner TSAP/port pair. When the H system activates a backup path, the redundant CP 443-1 on the partner CPU takes over the same connection identifier (connection ID, TSAP, IP if used) – it does not negotiate a new transport with the OS.

Mixing ISO on path A and TCP on path B leads to:

1. Compiler rejection in PCS 7 V9.x and earlier: the OS compile dialog rejects two named connections of differing transports attached to the same connection point of an S7 fault-tolerant connection.
2. Silent misconfiguration in PCS 7 V10 / TIA-based projects: the second named connection is ignored or assigned to a non-existent connection target, producing SF on the CP and connection status 0x0003 / 0x0010 in the diagnostic buffer.
3. Asymmetric keep-alive: ISO Transport uses TPDU acknowledgements on the connection's own session; raw TCP relies on socket keep-alive that the S7 fault-tolerant state machine does not evaluate. The H switchover logic will declare the path failed even when TCP traffic is flowing.

The general rule: an S7 fault-tolerant connection uses one transport, end to end. Path redundancy is achieved by duplicating the same transport over two physically separated Ethernet networks.

Transport Selector Reference

PCS 7 Server Redundancy vs. Network Path Redundancy

WinCC server redundancy operates at the terminal bus. Both servers run WinCC with the Redundancy option activated. They exchange the following traffic over TCP/IP on the terminal bus:

• Lifecycle telegrams (default every 1 s) – SysTag "@RM_SERVER" status changes drive the partner-aware failover in the client.
• Archive synchronization – on partner recovery, the standby requests the delta of messages and process values and replays them into its own SQL/MSSQL archives.
• Time synchronization – the standby aligns its internal time to the master within ±250 ms using the same TCP channel.

This is independent of the S7 fault-tolerant plant bus. A site can have WinCC server redundancy without any redundant plant bus and vice versa. The classic PCS 7 architecture – and the one most relevant to a fiber-damaged site – uses both: redundant fault-tolerant plant bus for the S7-400H, and WinCC server redundancy for the OS pair.

Supported Redundancy Topologies (Overview Matrix)

Option 1 – Redundant Fault-Tolerant Plant Bus (Two Physical Rings, Both ISO)

This is the canonical Siemens-recommended topology for a S7-400H with PCS 7 when fiber damage is a known risk. The H pair carries two CP 443-1 modules per CPU – one per physical network – and the OS server carries two CP 1623 modules – one per physical network. Both networks use ISO Transport exclusively; no TCP/IP is introduced on the S7 connection.

Hardware requirements per side:

• OS server side: 2× CP 1623 (PCIe) – order number 6GK1162-3AA00. Each occupies its own PCIe slot and is bound to a separate Ethernet VLAN/subnet.
• S7-400H CPU side: 2× CP 443-1 per CPU (so 4 total for the H pair). Use CP 443-1 EX30 (6GK7443-1EX30-0XE0) or later, with firmware ≥ V3.2 for PRP-capable variants, or CP 443-1 EX40 (6GK7443-1EX40-0XE0) for advanced routing.
• Each CPU in the H pair must use a different slot index for the two CPs, and the redundant CP on CPU-A is paired with the redundant CP on CPU-B through the S7 redundancy configuration in HW Config (not NetPro).

NetPro configuration produces a single S7 fault-tolerant connection with the 4-way redundancy checkbox enabled. The OS compile dialog shows one named connection of type "S7 fault tolerant" and four sub-paths (Network A: CPU-A CP-A1 + CPU-B CP-A2; Network B: CPU-A CP-B1 + CPU-B CP-B2). The WinCC channel uses both CP 1623 instances as alternative access points.

Logical view

Option 2 – Redundant Fault-Tolerant Terminal Bus

Terminal bus redundancy is a WinCC/PCS 7 server-pair concern, not an S7 fault-tolerant one. Both OS servers connect to the same CP 443-1 pair on the H system via standard TCP/IP (or ISO) but the redundancy is the WinCC server-failover mechanism, not the S7 connection. The plant bus remains a single network. This option does not address the original problem of fiber damage between the OS server room and the H system; it only protects against OS server failure.

It is listed here only to clarify the matrix. For a fiber-damaged link, this option is insufficient on its own.

Option 3 – PRP with SOFTNET-IE S7 (IEC 62439-3)

PRP (Parallel Redundancy Protocol, IEC 62439-3) duplicates every Ethernet frame onto two physically separated networks at the link layer, so zero packets are lost during a single-path failure. Siemens implements this with SOFTNET-IE S7 Redundancy on the PC side and CP 443-1 modules with PRP-capable firmware on the PLC side. From the perspective of the S7 fault-tolerant connection, the transport is still ISO; PRP is invisible above the data-link layer.

Components:

• SOFTNET-IE S7 Redundancy license on the OS server – order number 6GK1704-1LW08-3AA0 (bundled with PCS 7 V9.0+ in the SOFTNET-S7 RED Edition).
• CP 443-1 EX30 (6GK7443-1EX30-0XE0) with firmware ≥ V3.2 on each H CPU.
• Two independent Ethernet networks (e.g. fiber ring A and fiber ring B), each with PRP-capable switches (SCALANCE XC-200 / XC-300, firmware ≥ V4.1).

PRP gives zero-loss switchover at the cost of doubling the wiring and the switches. For process cells where losing even one scan during failover is unacceptable (e.g. SIS-integrated PCS 7), PRP is the correct answer. The cell latency on the redundant path is independent: the H system sees both networks as a single logical link.

Option 4 – Intel Teaming at the OS Network Adapter Layer

Intel Teaming (now Intel ANS / Intel Ethernet Suite) bonds two physical NICs into a single virtual adapter visible to the OS. Modes Adaptive Load Balancing and Switch Fault Tolerance (IEEE 802.3ad static, or "team") provide failover at the data-link layer without any S7-stack changes. From PCS 7's perspective there is still only one IP address, one CP 1623-equivalent (in this case the Intel team), and one S7 fault-tolerant connection.

This is the lowest-cost option and is appropriate when:

• The OS server has two free PCIe slots for Intel I350-T2 / I350-T4 NICs.
• The H system side already has two CPs (or you accept installing a second CP 443-1 EX30 on each CPU).
• Switchover latency of 1–3 s is tolerable (default Intel failover detection is approximately 1.5 s).

Intel Teaming is not PRP. It does not duplicate frames; it only fails over. If a single frame is in flight on the failed NIC when the fault occurs, that frame is lost and the S7 stack must retransmit. For non-critical HMI traffic this is invisible; for tight control loops it can produce one cycle of jitter.

Hardware Reference – CP 443-1 and CP 1623 Selection

Step-by-Step – Configure 4-Way Redundancy in NetPro

1. Open SIMATIC Manager, load the S7-400H station. In HW Config, verify each CPU has two CP 443-1 modules inserted and that both are networked with two separate Ethernet subnets (Subnet A and Subnet B).
2. Open NetPro. Right-click the OS server – Insert New Connection – S7 fault-tolerant connection. The connection is established against the H system, not a single CPU.
3. In the connection properties dialog, set transport to ISO for both Subnet A and Subnet B. The dropdown is identical across both paths – do not attempt to change one to TCP.
4. Check the 4-way redundancy box. NetPro will show four redundant sub-connections (CP1623-A ↔ CP443-1-A1, CP1623-A ↔ CP443-1-A2, CP1623-B ↔ CP443-1-B1, CP1623-B ↔ CP443-1-B2).
5. Compile the OS. The OS project editor must show one named connection of type "S7 fault tolerant" – never two.
6. In WinCC Explorer, under Tag Management → SIMATIC S7 PROTOCOL SUITE → [Logical Device Name], set Connection Name to the same named connection produced by the OS compile. Do not add a second logical device for the alternate transport.
7. Download the OS server project. The CP 1623 instances appear under Set PG/PC Interface as CP1623.A and CP1623.B. Both must be reachable from the OS before activation.
8. On the OS runtime startup banner, verify "4-way redundancy active" is reported. If only 2-way is reported, one CP on either side has not bound – check the CP 443-1 diagnostic buffer for event 0x031C "Connection setup – no partner reachable".

Verification and Diagnostics

After commissioning, run the following checks on each PCS 7 OS server:

1. Channel diagnostics: WinCC Explorer → Tools → Channel Diagnosis. Confirm all four S7 fault-tolerant sub-connections show status "Connected (OK)". Status "Disconnected" on any one is normal during a single-path test; status "Fault" on three is a configuration error.
2. CP 443-1 diagnostic buffer: HW Config → CP 443-1 → Diagnostic Buffer. Filter for events between the activation timestamp and the current time. Look for:
   • 0x0301 – Connection established
   • 0x0302 – Connection aborted
   • 0x031E – Protocol error (mismatched transport, the symptom of a failed ISO/TCP mix attempt)
3. Latency check: In WinCC, open the online tag @RM_MASTER_CONNECTION_TIME and verify < 100 ms on each path. The maximum tolerable for S7 fault-tolerant is 500 ms; above 1 s the H system will declare the path degraded.
4. Switchover test: Disconnect Subnet A fiber. The H system must complete the switchover in < 1 s. WinCC should not lose any process value archive entries – the archive buffer at the OS level is sized for 60 s of network loss by default.

Troubleshooting Matrix

3G Modem Considerations for Cellular Backup Links

Cellular 3G/4G/5G links are commonly proposed as a low-capex backup for damaged fiber, but several field-proven constraints apply to a PCS 7 S7-400H installation:

• Latency budget: a healthy LTE link carries 40–80 ms one-way RTT, which is acceptable. A degraded 3G link can exceed 1 s RTT during congestion. The S7 fault-tolerant state machine default timeout is 1.5 s; values above this trigger a connection drop, not just a degradation.
• Jitter: cellular links exhibit ±200 ms jitter routinely. The H system keep-alive timer assumes a symmetric ISO Transport ack inside 500 ms; jitter above this produces spurious path failures.
• Address translation: 3G modems on cellular carriers NAT the customer-side IP. ISO Transport and ISO-on-TCP use TSAPs (transport selectors) rather than IP/port pairs, so NAT is not fatal for S7, but the OS-side CP 1623 / SOFTNET-IE must be configured with the public-facing TSAP and the carrier must allow inbound UDP/TCP on port 102 (ISO-on-TCP). Most do not, by default.
• Throughput: a typical PCS 7 OS polls 500–2,000 tags at 1 s and 5,000–20,000 tags at 5–10 s. The S7 payload over the redundant path is on the order of 50–500 KB/s, well below 3G capacity. Throughput is rarely the limiter.
• Carrier SLAs: consumer 3G services do not provide deterministic availability. For industrial use, a private APN with a fixed-IP SIM is required; even then, SLA is typically 99.5%, equivalent to 3.6 hours of downtime per month.

For sites where cellular is the only viable alternative to damaged fiber, the recommended approach is:

1. Establish a private LTE or licensed 450 MHz link with deterministic latency < 100 ms.
2. Use SOFTNET-IE S7 with PRP (Option 3 above), so that cellular and fiber are parallel paths and a single cellular drop is masked by the fiber path until the cellular reconnects.
3. Configure the S7 fault-tolerant connection's maximum partner timeout to 3 s to absorb cellular jitter. This is set in NetPro → Connection Properties → Special → Timeout. The H system then tolerates one or two cellular anomalies without declaring a partner failure.
4. Disable WinCC's tight @RM_SERVER lifecycle on the cellular path; route only S7 plant bus traffic over cellular, keep WinCC redundancy on a separate, wired terminal bus.

Choosing Between the Four Options

FAQ