S7-400H to WinCC: S7-REDCONNECT and Fault-Tolerant S7 Configuration

A Siemens SIMATIC S7-400H (H-system) station is only useful in a WinCC/SCADA topology if the operator station can survive an H-CPU master/standby switchover without losing its process image, alarms, or trending buffers. The link between the AS 41xH pair and the WinCC server must therefore be a fault-tolerant S7 connection — not a normal single-ended S7 PUT/GET channel. This reference covers the two production-grade paths (PROFINET/Industrial Ethernet with S7-REDCONNECT, and Profibus with a redundant CPs) and the lower-cost alternative path that WinCC's Dynamic Wizard exposes for non-bumpless operation.

1. System Architecture Overview

Three logical blocks make up the link:

1. AS 41xH — fault-tolerant CPU pair, e.g. 6ES7 412-3HJ14-0AB0 (CPU 412-3H PN/DP) or the 6ES7 416-3HS06/6ES7 417-4HT04 families. The PN suffix indicates an integrated PROFINET interface that can terminate a fault-tolerant S7 connection directly, removing the need for a separate CP443-1 on small installations.
2. Ethernet / Profibus media — Industrial Ethernet (IE) for ISO/ISO-on-TCP/TCP fault-tolerant S7, or Profibus DP for a CP443-5 Ext. redundant pair.
3. WinCC station — a PC station running WinCC V7.x, with a SIMATIC NET PC software layer and either a hardware CP (CP1623, CP1613, CP5613/CP5623) or a Softnet-only license.

Siemens supports the S7 fault-tolerant connection only over Industrial Ethernet (PROFINET or classic IE), either with the ISO transport protocol or with ISO-on-TCP (RFC1006 / port 102). Profibus is supported via a different mechanism described in the SIMATIC S7-400H Fault-Tolerant Systems manual, chapter 13.6.4.2.

2. S7 Fault-Tolerant Connection — Protocol Requirements

A fault-tolerant S7 connection (S7 connection with H-station attribute) is the only S7 connection type that WinCC and S7-REDCONNECT will accept on an H-CPU. The following parameters are fixed by the protocol and cannot be relaxed:

3. PLC-Side Hardware — CP443-1 vs Integrated PN

On the AS side you have two options. Both terminate the fault-tolerant S7 connection to the PC station; both are configured in HW Config / NetPro and inserted into the S7-400H rack as a fault-tolerant CP pair.

3.1 External CP443-1 (recommended for production)

The 6GK7 443-1EX30 (CP443-1 EX30) and the newer 6GK7 443-1BX40 (CP443-1 Advanced) are the workhorses. Insert two of them — one in rack 0, one in rack 1 — and assign both to the S7-REDCONNECT subnet. CP443-1 supports up to 4 fault-tolerant S7 connections (per CP) for WinCC use cases.

3.2 Integrated PROFINET interface of the CPU

The PN/DP suffix CPUs (e.g. 6ES7 412-3HJ14-0AB0 with firmware V6.0.7 and newer) provide a PROFINET interface that can host a fault-tolerant S7 connection directly. This is acceptable when the network topology is simple and you do not need a separate IE switch port on the AS. The CP443-1 is still the recommended choice for any plant where the H-station talks to multiple PC stations, because the integrated PN port is also used for engineering / HMI Panel routing and is more exposed to traffic storms.

4. PC-Side Hardware — CP1623, CP1613, CP5613/CP5623

The WinCC station needs at least one Industrial Ethernet or Profibus CP that is supported by SIMATIC NET. For S7-REDCONNECT over IE, the recognized hardware is:

For a fault-tolerant S7 connection, the PC station must be configured with two Industrial Ethernet CPs in NetPro (one primary, one standby) — only the CP1623 / CP1613 family and the SOFTNET-IE S7 REDCONNECT license (available from March 2014) are validated for redundant operation. A standard onboard NIC terminated by SOFTNET-IE S7 REDCONNECT works, but the changeover time is the same ~5 s window as the WinCC-side approach because Softnet has no hardware to monitor the secondary path.

5. Software Stack — SOFTNET-IE vs HARDNET-IE S7 REDCONNECT

Two license tiers deliver the S7 fault-tolerant S7 connection to a WinCC station. The functional behavior is identical; the difference is hardware support and cost.

5.1 HARDNET-IE S7 REDCONNECT

Requires a CP1623 (or two CP1623s for PC-side redundancy). The CP1623 handles link-down detection in hardware and triggers the S7-REDCONNECT switchover without Windows network stack involvement, which is why this is the only option Siemens certifies for sub-second-class redundant SCADA.

5.2 SOFTNET-IE S7 REDCONNECT

Runs on any standard Ethernet NIC. Available since March 2014. It is not cheaper than HARDNET-IE S7 REDCONNECT in most regions, but it removes the hardware cost of a CP1623 when the application accepts the longer changeover. Industrial-grade NICs (Intel i350-T4 or similar) are still recommended for production.

6. PROFINET / Industrial Ethernet Configuration

6.1 Configure the S7-400H side in STEP 7 / NetPro

1. Open the S7-400H station in HW Config. Insert two CP443-1 modules — one in rack 0, one in rack 1 — with matching article numbers and firmware.
2. Open NetPro. Right-click the CP443-1 in rack 0 → Insert New Connection.
3. Connection partner: WinCC station. Connection type: S7 connection. Tick H-Station — this is the attribute that turns the connection into a fault-tolerant one.
4. Assign the same connection to the CP443-1 in rack 1. NetPro will mirror it automatically when Compile and Check Consistency is run with the H-system plug-in enabled.
5. Download the connection configuration to both CPUs of the H pair.

6.2 Configure the WinCC side in NetPro (PC station)

1. Open the PC station in the same STEP 7 project. Insert the appropriate IE CP (CP1623) or the Softnet IE driver.
2. Insert an OPC server or the WinCC application slot. Add an S7 connection to the H station with the same connection ID as on the AS side.
3. In the S7 connection properties, set the Partner to point to the H-station's logical address; NetPro will expand it into the two physical connections (one to CPU0, one to CPU1) automatically when the partner is flagged as H-station.
4. Compile and download the PC station. The XDB/STA file is read by the S7-REDCONNECT service at boot.

6.3 Activate S7-REDCONNECT

1. Open the SIMATIC NET Configuration Console → S7-REDCONNECT.
2. Assign the two S7 connections (primary and standby) to the IE CP pair.
3. Set the monitoring time (default 30 s; lower to 10–15 s for fast detection, but be aware that short values on noisy networks cause spurious switchovers).
4. Start the S7 redc service (Windows service SIMATIC S7 REDCONNECT).

7. Profibus Configuration (Alternative Path)

When the plant already has a Profibus DP backbone — for example, when ET 200M is on Profibus and the H-CP pair is a CP443-5 Ext. pair — it is also possible to connect WinCC over Profibus. The S7-400H manual, chapter 13.6.4.2, describes the procedure:

1. Insert two CP443-5 Extended (6GK7 443-5DX04) modules — one per rack.
2. Insert two CP5613 / CP5623 in the WinCC PC station (or one CP5623 plus an onboard port for non-redundant operation).
3. Configure a fault-tolerant S7 connection in NetPro as in the Ethernet path; the transport is the Profibus FDL equivalent of the S7 connection.
4. License the PC station with HARDNET-PB S7 REDCONNECT.

This path is rarely used for new installations because PROFINET gives higher bandwidth, easier diagnostics, and the same redundancy characteristics. It is, however, the only way to keep an H-station connected to WinCC when the existing Profibus infrastructure is fixed.

8. WinCC Redundant Connection Wizard — The Non-Bumpless Option

WinCC ships with a Dynamic Wizard called Redundant Connection. It is not the same thing as S7-REDCONNECT; it is a WinCC-side mechanism that opens two independent S7 connections to the H pair and switches between them in user space.

Procedure:

1. In WinCC Explorer, right-click Tag Management → SIMATIC S7 PROTOCOL SUITE → TCP/IP and create two connections — one to CPU0, one to CPU1.
2. Run the Dynamic Wizard Redundant Connection. It binds the two S7 connections to a single logical WinCC connection.
3. WinCC polls both connections; if the active one fails for longer than the configured threshold (default 5 s), it switches to the standby.

This is the path described as "the redundant connection wizard in WinCC but the changeover will take at least 5 seconds." It is acceptable when the SCADA is supervisory (alarms and trends survive a 5 s gap in the process image) but unsuitable for safety-critical or fast closed-loop SCADA functions.

9. Changeover Timing and Performance

The S7-REDCONNECT service holds the active connection on a primary IE CP and a standby connection on a secondary IE CP. Failure detection is hardware-based on the CP1623 and software-based on Softnet. Expect:

• CP1623 (HARDNET-IE S7 REDCONNECT): 200–800 ms typical switchover; bounded by the configured monitoring time. S7-REDCONNECT preserves all subscription and timestamp contexts, so the WinCC process image resumes without re-initialization.
• SOFTNET-IE S7 REDCONNECT: 1–3 s; uses Windows TCP keepalive plus periodic partner checks. Slightly longer because the link state is in the OS stack.
• WinCC Redundant Connection Wizard: ≥ 5 s; the wizard polls connection status with a default 5 s cycle.

10. Compatibility Matrix

The following combinations have been validated by Siemens and are documented in the S7-400H Fault-Tolerant Systems manual (entry ID 109736225) and the Compatibility Tool:

Always verify with the live Compatibility Tool; Siemens revises this table with every new S7-REDCONNECT SP.

11. Verification and Commissioning Steps

1. Watch the SYNC LEDs on the H-CPU pair — they must both be solid green before any SCADA test.
2. From the WinCC PC, open the SIMATIC NET Diagnostics applet and confirm that both S7 connections to the H-station are in state ESTABLISHED and that one is marked primary, the other standby.
3. Pull the primary IE cable at the AS side. The diagnostics applet must show the standby connection promoted to primary within the configured monitoring time. WinCC's tag status must remain good throughout.
4. Reconnect the cable. The service must return the active role to the primary CP without losing tags.
5. Trigger a real H-switchover: in STEP 7, set OB1 request STOP on the master CPU. The standby CPU takes over; verify the SCADA freeze window is within the design budget.
6. Cross-check the WinCC alarm log — no S7: connection broken alarms should be raised during the H-switchover with S7-REDCONNECT active. With the WinCC Redundant Wizard, a single connection broken / connection restored pair is expected.

12. Troubleshooting Matrix

13. Best-Practices Checklist

• Always deploy two CP443-1s in the H-station; one CP creates a single point of failure that defeats the H-system's purpose.
• Use a managed industrial Ethernet switch (e.g. SCALANCE XC/XB/XR) with MRP or HRP redundancy on the PROFINET ring. S7-REDCONNECT will survive individual link breaks, but a non-redundant switch in the path is itself a SPOF.
• Keep S7-REDCONNECT monitoring time between 5 s and 30 s. Sub-5 s values cause nuisance switchovers on transient CRC errors.
• Document both S7 connection IDs (one for CPU0, one for CPU1) in the WinCC project header. Engineers will need them when the H-system is reloaded.
• Use ISO-on-TCP (port 102) for new installations. ISO is the legacy transport; TIA-Portal-based H-stations default to ISO-on-TCP.
• Tag-name the standby WinCC connection differently (e.g. @S7_RED_SBY) so that diagnostics can tell which path is active in the alarm log.
• Re-validate the SCADA freeze window after every CPU firmware upgrade — Siemens has tightened and loosened H-switchover times across V5, V6, and V7 firmware.