WinCC Redundant Connection to S7-400H Without CP1613

When a WinCC 7.0 HMI station must supervise a SIMATIC S7-400H fault-tolerant controller, the default Siemens topology is the REDCONNECT pairing of two CP1613 communication processors synchronized by the H-Sync cable. This configuration delivers the shortest switchover time and full availability diagnostics, but it requires dedicated hardware that some smaller or retrofitted installations cannot justify. This reference consolidates the supported, semi-supported, and work-around techniques for building a redundant Ethernet path from WinCC to an S7-417-4H (or any S7-41x-H CPU) using only standard Ethernet NICs.

1. S7-400H Communication Architecture

The S7-400H rack pair contains two redundant CPUs (Rack 0 and Rack 1), each typically equipped with an CP 443-1 Ethernet CP. The CPs participate in the H-system's redundant address scheme so that a single logical IP (or the pair of physical IPs with redundancy role) is presented to supervisory systems.

WinCC is a passive S7 client in this relationship. It does not arbitrate which CPU is active; it must detect a loss of response from CPU A and re-open its PUT/GET or S7-connection to CPU B. The detection-and-reconnect logic is therefore the entire engineering problem.

2. Reference Architecture: REDCONNECT with CP1613

The reference solution is the Siemens REDCONNECT software stack (part of SIMATIC NET PC software) running on a WinCC station equipped with two CP 1613 PCIe cards. The CP 1613 supports an H-Sync external synchronization cable (sub-D 9) and exposes the redundant channel pair to WinCC as a single logical S7 connection.

REDCONNECT is the only configuration Siemens formally warrants for H-system hot-standby supervision. Every alternative below sacrifices some of these properties.

3. Alternative 1 - Dynamic Wizard "Create Redundant Connection"

Siemens ships a WinCC V7 Dynamic Wizard named Create Redundant Connection that compiles a C-script which monitors the primary S7 connection, opens a parallel connection to the backup CPU, and swaps the active tag prefix on detection of failure. The script lives in the WinCC project and runs in the background task of WinCC Explorer.

3.1 Prerequisites

• WinCC V7.0 SP3 or later (script API stable from SP1 onward)
• Both S7-400H CP 443-1 IP addresses reachable on a single LAN or VLAN
• Standard Intel or Broadcom gigabit Ethernet NIC (no CP1613)
• PC station must be able to maintain two independent S7 connections simultaneously

3.2 Wizard Parameters

3.3 Detection Loop Behavior

The generated C-script performs a GetTagWordState() call on a heartbeat tag configured on the active CPU. When the state returns NOT_CONNECTED or TIMEOUT for the configured retry count, it calls SetTagPrefix() to redirect the WinCC tag namespace to the backup connection and logs the event to the WinCC alarm log. The script is reset whenever WinCC restarts; no persistent state survives a WinCC crash.

3.4 Limitations

• Switchover time is governed by timeout × retry count and is typically 6-15 seconds - an order of magnitude slower than REDCONNECT.
• Alarms with timestamps generated during the switchover window are lost or stamped at recovery time.
• The wizard assumes a single PC with a single NIC; teaming two NICs (see Section 4) requires a different wizard or manual coding.
• Full event-buffer diagnosis from the S7-400H side is not surfaced to WinCC.

4. Alternative 2 - Dual-Port NIC with Adapter Teaming

By presenting a single virtual MAC/IP to WinCC while aggregating two physical links, NIC teaming hides the switchover from WinCC entirely. Intel PROSet, Broadcom BASP, and HP Teaming all support modes relevant to S7-400H supervision.

4.1 Intel PRO/1000 PT Dual Port Server Adapter Configuration

1. Install both ports; verify they appear in Windows Device Manager as Intel(R) PRO/1000 PT Dual Port Server Adapter (or the modern Intel I350-T2 successor).
2. Open Intel PROSet Adapter Configuration Utility (right-click one port → Properties → Teaming tab → Create Team).
3. Select Adapter Fault Tolerance (AFT) or Switch Fault Tolerance depending on the connected switch fabric.
4. Set Primary = port connected to CP 443-1 of Rack 0; Secondary = port connected to CP 443-1 of Rack 1.
5. Assign the team a single virtual IP, e.g., 192.168.0.20/24, with the team MAC.
6. Configure WinCC S7 connection with partner IP = team virtual IP, rack/slot = 0/3 (WinCC never needs to know about Rack 1).
7. Disable energy-efficient Ethernet (EEEModeration) on both ports - EEE drops ARP refresh on S7-400H and causes spurious timeouts.

4.2 Throughput and Switchover

5. Alternative 3 - Microsoft Network Bridge (Deprecated Practice)

It is technically possible to assign the same IP address to two Windows-bound NICs and bridge them with the legacy Network Bridge service. The intent is that a frame going to the bridge IP will be sent on whichever NIC has a live link. In practice this configuration is unstable for S7-400H and is listed here only because it appears in field reports.

6. Method Comparison Matrix

7. Implementation Workflow - Dynamic Wizard Path

The following procedure is the most commonly requested non-REDCONNECT configuration and is the one most likely to be deployed where CP1613 cards are unavailable.

7.1 Pre-commissioning checks

1. From the WinCC PC, ping both CP 443-1 IPs with a steady reply of ≤ 1 ms on the same VLAN.
2. From STEP 7, download the H-station and confirm both CP 443-1 connections show Active in NetPro.
3. Place a heartbeat tag in the active CPU's OB1: MW 100 incrementing every 100 ms; this is the tag the wizard monitors.
4. Open WinCC Explorer, locate Dynamic Wizards in the left pane, expand System, drag Create Redundant Connection onto the workspace.

7.2 Wizard configuration

1. Enter both partner IPs and rack/slot values as in Table 3.2.
2. Set timeout to 5000 ms for the S7-400H OB1 cycle of 100 ms (50 cycles of grace).
3. Set retry count to 3 to suppress spurious switches on a single dropped PDU.
4. Activate Generate diagnostic tags; this adds @RedundancyState and @ActiveConnection tags that can be displayed on a WinCC screen.
5. Click Finish; the C-script is added to the project under C-Scripts.

7.3 Verification

1. Start WinCC Runtime and open the diagnostics screen; verify the active connection is the primary.
2. Pull the Ethernet cable from CP 443-1 of Rack 0.
3. Observe @ActiveConnection change from 1 to 2 within 15-20 seconds.
4. Restore the cable; observe the script does not switch back automatically (cold-resume is by design; re-arm manually if required).
5. Repeat with CP 443-1 of Rack 1 to confirm symmetric behavior.

8. Implementation Workflow - Dual-Port NIC Teaming Path

1. Physically install the dual-port NIC; route port 1 to the Rack 0 switch and port 2 to the Rack 1 switch (or to two ports of a managed switch with separate VLANs).
2. In Intel PROSet (or vendor equivalent), create an AFT team, mark the Rack 0 port primary.
3. Configure a single IPv4 address and subnet on the team - do not configure addresses on the individual members.
4. Disable all energy-efficient Ethernet, TOE, and LSO features (Section 4.1 note).
5. In WinCC, create one S7 connection to the team IP, rack 0, slot 3.
6. Commission by pulling each port in turn and confirming WinCC values continue to update with ≤ 1.5 s interruption.

9. Operational Considerations and Edge Cases

9.1 Self-test fail during runtime start

If WinCC starts while the H-system is in a half-failed state (e.g., Rack 1 not yet synchronized), the Dynamic Wizard will mark the backup connection as bad and never poll it. Restart WinCC after the H-system is healthy, or add a one-shot script to re-validate the backup at startup.

9.2 Subnet mask and broadcast domain

The two CP 443-1 IP addresses must be in the same IP subnet and on the same VLAN as the WinCC station, or WinCC will not see both. Splitting them across two subnets (some redundant plants do this) requires two NICs, which then forces the Dynamic Wizard path and rules out NIC teaming.

9.3 Time stamping and archive consistency

During a switchover, alarms generated in the gap lose their original S7-400H time stamp. The wizard's Generate diagnostic tags option should be enabled on any installation where alarms are time-sensitive, so that the post-switch archive carries a continuous, post-recovery time stamp rather than gaps.

9.4 Load on the active CPU

When using the Dynamic Wizard, both connections are kept open even though only one carries data. This roughly doubles the S7-connection load on the active CPU. For H-systems already near their connection limit (a 417-4H supports up to 64 S7 connections), reduce the number of non-essential WinCC connections before deploying this method.

9.5 Switch fabric requirement for teaming

Switch Fault Tolerance mode requires that each port be on a different physical switch (or a different logical switch instance) so that a single switch failure can be tolerated. If both ports are patched into the same unmanaged switch, the team collapses on switch power loss. Industrial plants should use a redundant ring topology (Scalance XC/XR or similar) when adopting this pattern.

10. Reference and Further Information

Siemens maintains an official support entry (Entry ID 23842653) covering redundant WinCC connections on S7-400 systems using standard Ethernet adapters. The entry is the canonical starting point for the Dynamic Wizard approach and includes an FAQ on common error states such as Connection 0x0001 timeout and Partner unreachable raised during switchover. The latest SIMATIC NET PC software documentation describes REDCONNECT configuration in detail, including license handling and the H-Sync cable wiring diagram.

11. Recommended Selection Path

1. If the installation is process-critical (power, water, oil & gas, batch pharmaceutical): use REDCONNECT with CP1613 - the switchover time and diagnostic surface are worth the hardware cost.
2. If the installation is supervisory-only and switchover latency of 6-15 s is acceptable: use the Dynamic Wizard "Create Redundant Connection" script; no extra hardware required.
3. If a sub-second switchover is required but CP1613 is not procurable: use a server-grade dual-port NIC in AFT/AFT-with-primary-preference mode, with the two ports patched to independent switches.
4. Do not use the Microsoft Network Bridge - it is non-deterministic and not supported by Siemens.