Siemens PCS 7 Redundancy: S7-400H vs Software Redundancy Setup

Overview of PCS 7 Redundancy Architectures

Siemens SIMATIC PCS 7 supports two distinct redundancy strategies for process automation: Software Redundancy (SWR) on standard S7-300/S7-400 controllers and High Availability (S7-400H) on dedicated fault-tolerant controllers. The choice drives the switchover time, the cost of the I/O layer, and the way the operator system (WinCC) handles partner failover.

Selection rules of thumb from the field:

• Process section that can tolerate 2 to 5 seconds of unavailability during a CPU swap → SWR.
• Process section where bumpless transfer within sub-100 ms is mandatory → S7-400H with fiber-optic sync modules.
• Single CPU plus redundant OS server pair (redundant terminal bus) → separate from controller redundancy; both layers can coexist.

For the official platform description, refer to the SIMATIC S7-400H fault-tolerant systems manual (entry ID 1186523) and the Software Redundancy for S7-300/S7-400 manual (entry ID 1137637).

Software Redundancy (SWR) Architecture and Behavior

Software Redundancy is implemented as a set of function blocks (FB programs) that you load onto two standard CPUs. Each CPU carries two program partitions:

1. Non-redundant partition – assigned to a unique plant division (A or B).
2. Redundant partition – identical program for the high-availability plant division (C), executed only by the master.

The two CPUs do not run cycle-synchronized. At any given instant, CPU A may be executing OB1 while CPU B has already advanced to OB35. This absence of sync is acceptable because the reserve CPU does not execute the redundant partition; it merely receives updated data blocks and process images from the master via the redundant link.

Implications of the asynchronous design:

• Reserve CPU always lags master by N processing cycles, where N grows with link bandwidth and link traffic.
• DP/PN slaves on PROFIBUS or PROFINET ignore the reserve CPU's outputs; only the master's telegrams update actuators.
• Outputs freeze during the switchover window until the reserve becomes the new master and the slaves accept its telegrams.
• HMI/SCADA partner swap is performed by a WinCC C or VB script using the @RM_MASTER / @RM_STANDBY redundancy tags.

SWR Link Performance — Actual Measured Behavior

Switchover time therefore scales with: (1) volume of mirrored data, (2) link bandwidth, (3) DP/PN slave count, and (4) fault type (CPU stop vs. bus fault vs. slave dropout).

S7-400H Hardware Redundancy and Event-Driven Synchronization

The S7-400H platform (e.g., CPU 412-3H, 414-4H, 416-5H, 417-4H) achieves fault-tolerant behavior through Event-Driven Synchronization (EDS), a Siemens-patented technique. Each H-CPU pair is connected through fiber-optic synchronization modules and synchronization cables (redundant pair — two FO cables per chassis pair for true media redundancy).

How EDS differs from SWR:

• Both CPUs execute the redundant program in lock-step — they start OB1 at the same instant and complete it at the same instant.
• After each event (OB tick), the active CPU sends its internal state (PI, accumulators, tag values) to the standby; the standby compares and signals an error if divergence exceeds threshold.
• Switchover on detected fault: typically ≤ 100 ms (often quoted as a few msec for CPU-stop faults).
• DP/PN slaves still ignore the standby's output telegrams, so they remain master-locked; Y-Link or dual-interface ET200M is needed for I/O-side redundancy.

Configuration rules for an S7-400H station:

1. Both H-CPUs install in a single 18-slot UR2-H rack; each CPU occupies 9 isolated segments (no backplane connection across the two CPU segments).
2. Each H-CPU has its own PROFIBUS DP port and (optionally) its own PROFINET interface, giving two independent bus trunks out of one chassis.
3. Sync modules (e.g., 6ES7 960-1AA04-0XA0 for older series) plug into the rear of the CPU; pair them with FO patch cables of equal length.
4. Configuration lives in STEP 7 / PCS 7 engineering as an H Station; HW Config inserts both CPUs, sync modules, and CPs.

For detailed wiring and parameterization, see the S7-400H manual chapter 10 (redundant I/O) and chapter 11 (fault-tolerant communication).

Y-Link and I/O-Side Redundancy

A common misconception is that a redundant CPU pair automatically yields redundant I/O. The DP trunk leaving each H-CPU is independent; the I/O layer needs explicit handling to survive a CPU or bus fault.

Option A — Y-Link (Single DP Trunk, No I/O Redundancy)

The Y-Link (module 6ES7 197-1LA04-0XA0) accepts two DP masters (CPU A and CPU B) and forwards telegrams from the active master to a single downstream DP segment. The I/O stations (ET200M, ET200S, ET200pro, DP/PA couplers) require only one DP interface.

• Pros: Cheaper I/O hardware; any DP slave works.
• Cons: Loss of the Y-Link itself or the single DP cable halts I/O. The slave is not redundant.

Option B — Dual-Interface ET200M (Red Bundle, True I/O Redundancy)

Each redundant I/O station uses two IM 153-2 interface modules. The pair plus the Active Backplane (Active Bus Unit) is ordered as the Red Bundle:

Both CPUs and both PROFIBUS trunks remain active; one IM acts as primary, the other as backup. On cable or CPU loss the surviving IM takes over without process interruption. This is the configuration called "fully redundant I/O" in PCS 7.

Communication Redundancy (Terminal Bus and OS Server Pair)

Controller redundancy is independent of OS/HMI redundancy. PCS 7 supports both, and most plants run them as two stacked layers.

Terminal Bus — OS Server Pair

The terminal bus carries WinCC client/server traffic. A redundant OS server pair is implemented with the PCS 7 redundancy option:

• Master OS server: maintains the live archive, alarms, and tag database.
• Standby OS server: receives continuous updates via redundancy DLL (file-based replication of segment data).
• On master failure, clients reconnect to the standby within the configured switchover timeout (typical 30–60 s for archive replay).

The OS server pair uses the PCS 7 internal redundancy driver; no special CPs are required on the PC side beyond standard Ethernet. However, for the connection between the S7-400H and the OS servers, you may use either:

1. Single CP443-1 per CPU — fault-tolerant connection (S7 connection with redundancy) multiplexed by WinCC.
2. Dual CP443-1 per CPU — media-redundant network path; OS server picks the first CP that responds.

The CP443-1 Advanced (e.g., 6GK7 443-1EX50-0XE0) is a 4-port switch variant that can act as a media-redundant gateway for a single CPU. Configuring two CP443-1 per H-CPU yields four Ethernet cables out of one chassis, doubling both the media and the partner-switchover resilience.

Reference: SIMATIC PCS 7 PC Configuration (V10.0 SP1) entry ID 109986626 documents the available redundancy communication channels, including the null-modem COM link for OS server keep-alive.

REDCONNECT for Engineering / Operator Stations

For PCs that need sub-second switchover (e.g., engineering stations that own the S7 connection to a non-redundant CP pair), Siemens offers REDCONNECT software paired with CP1613 PCIe cards (or CP1623). The CP1613 pair provides two physically independent Ethernet paths and the OS layer swaps between them in < 1 s.

Program Structure in a Redundant Station

A typical PCS 7 redundant user program is built from the PCS 7 master data library (APL — Advanced Process Library). Two blocks drive the redundancy behavior:

• FB 101 "SWR_ZYK" (or its PCS 7 equivalent wrapper): redundant data exchange coordinator.
• FB 104/FB 105: channel status and partner status reporting.

Recommended structure for SWR:

// OB1 — cyclic main
  CALL "SWR_ZYK"               // handles partner handshake
  CALL "RED_GET_STATUS"        // query master/standby state

// Non-redundant OB35 (each CPU has its own instance)
  CALL "CTRL_PID"              // closed-loop control for Plant A

// Redundant OB35 (identical on both CPUs)
  CALL "CTRL_PID"              // closed-loop control for Plant C

The H system, by contrast, requires no FB redundancy wrappers — the runtime EDS layer guarantees identical execution on both H-CPUs; user code is written once and loaded identically to both.

Commissioning Procedure for S7-400H

1. Insert both H-CPUs in HW Config; assign sync modules and FO cables of equal length (≤ 10 m for plastic, ≤ 10 km for glass depending on module).
2. Configure both PROFIBUS subnets (one per CPU); set the same DP master address on both segments.
3. Attach Y-Link to each subnet and a redundant ET200M station to the downstream DP trunk, or connect dual-IM ET200M stations directly to both subnets.
4. Download hardware configuration to both CPUs simultaneously (PCS 7 > Target System > Download to H Station).
5. Run H-CiR (Configuration in Run) only after the initial download; do not mix with SWR blocks.
6. From the PCS 7 Operator Station, open WinCC Explorer and verify both OS servers show "Master" and "Standby" in the redundancy status dialog.
7. Force a CPU-stop test on CPU A; record switchover time stamp from the H diagnostic buffer (menu: PLC > Diagnostic/Setting > Operating Mode).
8. Force a PROFIBUS cable pull; verify ET200M continues and H station logs a bus fault.

Commissioning Procedure for Software Redundancy (SWR)

1. Configure HW Config on CPU A and CPU B as two separate standard stations (no H station).
2. Insert the SWR FB library from the SWR installation DVD; copy to project under "Blocks".
3. Connect the redundant link (MPI, PROFIBUS, or Ethernet CP).
4. Map the redundant data blocks in the SWR coordinator FB; tag the master-only outputs explicitly.
5. Add the @RM_MASTER, @RM_STANDBY, @RM_ERROR WinCC redundancy tags and write the C/VB script for partner switching.
6. Trigger a power-off on CPU A; observe that CPU B becomes master within the configured failure detection time (typical 2–5 s over MPI).
7. Power CPU A back on; verify it re-enters as standby and that the partner handshake completes without restarting CPU B.

Switchover Time Comparison Matrix

Troubleshooting Matrix

Firmware and Library Versions

The behaviors above are valid against the following baseline; older firmware may lack features:

Verify against the current PCS 7 release notes — Siemens phases out SWR in favor of S7-1500H for new projects, while S7-400H remains the legacy H platform.

Selecting the Right Architecture

Decision matrix for new projects:

For additional configuration depth, follow the S7-400H fault-tolerant systems manual chapters 10 (redundant I/O) and 11 (redundant communication).

FAQ