WinCC V7.5 to S7-1500R/H: HMI Connection and Redundancy

Overview: WinCC V7.5 and S7-1500R/H Integration

Siemens S7-1500R and S7-1500H redundant controllers extend the S7-1500 family with two distinct redundancy concepts: the S7-1500R uses a PROFINET ring with MRP (Media Redundancy Protocol, IEC 62439-2) for CPU redundancy, while the S7-1500H adds H-Sync forwarding for fast bumpless failover in a PROFINET ring. HMI stations such as WinCC V7.5 SP2 connect to these controllers as PROFINET/S7 partners and must be configured to tolerate the media-redundant ring topology. The integration is fundamentally different from the classic S7-400H approach that relied on S7-Redconnect over two dedicated CP 1628 cards.

For an engineer evaluating a WinCC V7.5 SP2 station against a S7-1500R/H controller, the practical questions are: which PC network interface to use, which Simatic Net components to install, and whether the legacy CP 1628 + S7-Redconnect stack (the proven S7-400H solution) carries over to the new redundancy concept. This reference consolidates the official Siemens guidance and provides the field-proven configuration steps.

S7-400H vs S7-1500R/H: Why HMI Redundancy Differs

Classic S7-400H redundancy is implemented at the application level: the HMI establishes two parallel S7 connections (one to CPU 0, one to CPU 1) using S7-Redconnect on the PC side. The PC requires two CP 1628 (or compatible CP 443-1) cards, one for each CPU, and the S7-Redconnect software stacks the two channels into a single logical connection. If one CPU fails, S7-Redconnect automatically switches the HMI traffic to the surviving CPU without operator intervention. This architecture is mature and has been documented for over a decade.

S7-1500R/H shifts the redundancy model. The two CPUs are paired at the PROFINET level, share a common system IP, and present themselves to the outside world as a single S7 communication partner. From the HMI's perspective, there is no CPU 0 and CPU 1 to address - the S7-1500R/H station is a single node. The HMI does not need to maintain two parallel connections, and there is no S7-Redconnect on the PC side. The redundancy is achieved by the ring topology (any single cable break is tolerated) and by the CPU pair (any single CPU failure is tolerated) being managed inside the S7-1500R/H station.

The critical consequence is that the S7-400H playbook (two CP 1628 cards + S7-Redconnect) does not directly apply to S7-1500R/H. Attempting to configure S7-Redconnect on a S7-1500R/H system is unnecessary and, depending on the firmware combination, may not be supported. Use the standard S7 channel of WinCC V7.5 SP2 against the S7-1500R/H system IP, and let the S7-1500R/H handle the redundancy internally.

Media Redundancy Protocol (MRP) and H-Sync Forwarding

Every device that participates in a PROFINET ring must support MRP (IEC 62439-2). MRP defines a manager role (typically a switch or the CPU acting as ring manager) and a client role (every other ring node). The ring manager sends test frames on a blocked port; if it stops receiving them, it unblocks the port and the ring breaks. The maximum recovery time for MRP is 500 ms with default parameters, which is fast enough for most process applications but not for time-critical motion control.

For S7-1500H, Siemens adds H-Sync forwarding on top of MRP. H-Sync forwarding synchronises the two CPUs via the ring and pre-configures the switchover path. The combination delivers sub-50 ms failover and supports the bumpless S7-RECONFIG mechanism. The S7-1500R product line does not implement H-Sync forwarding; failover time on S7-1500R is longer (typically several hundred milliseconds, project-dependent) and is not bumpless from the application perspective.

Refer to the S7-1500R/H system manual (Siemens entry ID 109754833) for the canonical ring topology, role assignment, and the chapter on HMI integration. The same document is the primary source for the figures referenced in the original technical question (figure 4-24, "WinCC station in the PROFINET ring with one network connection").

CP 1628 and S7-Redconnect: Capability Evaluation

The CP 1628 (Siemens article number 6GK1162-8AA00) is a PCI Express PROFINET interface card for PCs. It supports PROFINET IO controller, IO device, and S7 communication, and it integrates with Simatic Net to provide S7-Redconnect channels for S7-400H systems. For an S7-1500R/H system, the question is whether the CP 1628 adds value over a standard on-board NIC.

Three points must be verified before selecting the CP 1628 for a S7-1500R/H project:

1. MRP client support on the CP 1628. If the WinCC PC is to sit inside the PROFINET ring as an MRP client (ring node), the CP 1628 firmware must support the MRP client role. The CP 1628 product pages (Siemens entry ID 109749590) list the supported PROFINET roles; confirm MRP client is included in the firmware revision you are using.
2. H-Sync forwarding. For S7-1500H systems, H-Sync forwarding is recommended for HMIs. Confirm that the CP 1628 firmware and driver package support H-Sync forwarding for the WinCC version in use.
3. Driver and Simatic Net version. The CP 1628 requires a matching Simatic Net PC software version (currently Simatic Net V16 or V17 for S7-1500R/H support). Mismatched firmware/drivers will produce channel-down events even though the card itself is functional.

If any of these three points is unresolved, the conservative choice is a standard on-board Intel or Broadcom Gigabit Ethernet NIC plus an external managed MRP switch. This is the architecture Siemens recommends in the S7-1500R/H manual for the simple case of one WinCC station with one network connection.

Recommended Network Architecture for Single-NIC WinCC

The pragmatic and Siemens-recommended topology for a single WinCC V7.5 SP2 station connecting to a S7-1500R/H system is shown above. The PC has a single standard Ethernet NIC. The NIC is patched to a small unmanaged or managed switch that itself sits inside the PROFINET ring. The S7-1500R/H CPUs close the ring on their PROFINET ports. This keeps the WinCC PC outside the ring as a "leaf" node, removes the MRP client requirement from the PC, and survives any single cable break in the ring.

Key design constraints:

• The PROFINET ring consists of the two S7-1500R/H CPUs and the switch ports that close the ring. The WinCC PC is a leaf node off the switch and is not part of the ring itself.
• The switch must support PROFINET (or at minimum, must pass PROFINET frames transparently with low latency). A standard unmanaged switch works for the S7-1500R case; for S7-1500H, Siemens recommends a managed PROFINET switch with MRP manager and H-Sync forwarding capability.
• The WinCC PC has only one active Ethernet path. If the cable between the PC and the switch fails, the HMI is offline, but the S7-1500R/H process continues. This is the most common trade-off: HMI redundancy is sacrificed for simplicity, while controller redundancy is preserved.
• For higher HMI availability, add a second NIC and connect it to a different switch in the ring (or use a dual-NIC MRP client configuration on the PC).

For sites that require maximum HMI availability, the dual-NIC configuration connects each WinCC PC to a different physical switch in the ring. Both NICs run the standard S7 channel; the S7-1500R/H system IP is reached via either path. The HMI redundancy is then handled by the WinCC/Redundancy option across two PCs, each with dual-NIC leaf connections. This adds cost but removes the single-cable single-switch failure mode for the HMI.

Simatic Net and WinCC V7.5 SP2 Software Stack

WinCC V7.5 SP2 ships with a "lean" installation of Simatic Net that is sufficient for the S7-1500H channel (S7-DOS, S7-PCI, or named connections). The lean installer is selected in the WinCC setup under "WinCC V7.5 SP2 - Communication - Simatic Net". It does not include the full Simatic Net PC software suite (no OPC server configuration UI, no S7-Redconnect configuration tool, no advanced diagnostics). The lean install is enough for a single-connection, single-NIC WinCC V7.5 SP2 station talking to a S7-1500R/H system.

When you must use the CP 1628 or when you run a redundant WinCC station pair, you need the full Simatic Net PC software. Use the version that matches the WinCC release:

The TIA Portal project that contains the S7-1500R/H station must be at TIA V16 Update 4 or later (V17 recommended). Earlier TIA versions do not expose the HMI integration chapter and the S7-1500R/H connection resource counts in the expected way. The TIA Portal information system entry "Connection resources of the redundant system S7-1500R/H" is the canonical reference for the resource count per CPU model.

Step-by-Step: Configuring the WinCC Connection

The procedure below assumes a single WinCC V7.5 SP2 PC with one on-board NIC connected to an MRP switch inside the PROFINET ring of a S7-1500R/H station. The S7-1500R/H station has already been configured in TIA Portal V16/V17 and downloaded to the controllers.

1. Verify TIA Portal configuration. Open the S7-1500R/H station in TIA Portal. In "Devices & Networks", confirm that the PROFINET interface of CPU 0 and CPU 1 is part of the same MRP domain, that the ring role is correctly assigned, and that the HMI connection is enabled. The WinCC connection is established via the standard S7 channel; no special block is required in the S7-1500R/H program.
2. Define the S7-1500R/H system IP. In TIA Portal, open the PROFINET interface properties of the S7-1500R/H station. Under "PROFINET interface [X1] > Ethernet addresses", set the IP address and subnet mask. This single IP is what WinCC will use. Both CPUs of the pair share it.
3. Set the MRP role. In the same PROFINET interface properties, open the "MRP" tab. Assign one device in the ring as MRP manager (typically the S7-1500R/H CPU 0 or the external switch). All other ring nodes are MRP clients. Set the MRP domain name consistently across all devices.
4. Install WinCC V7.5 SP2 and Simatic Net lean. Run the WinCC V7.5 SP2 setup. Select the "Simatic Net" component under communication. Do not select the full Simatic Net PC software unless you have a confirmed use case for it.
5. Configure the PC network interface. In Windows, set the NIC IPv4 address to a free address in the same subnet as the S7-1500R/H system IP. The S7-1500R/H system IP is the address that the CPU pair presents to the outside world; it is the address WinCC will connect to. Disable Windows firewall on the private profile or add an exception for the Simatic Net service (default port 102/TCP for ISO-on-TCP S7 communication).
6. Add the S7 connection in WinCC Explorer. In WinCC Explorer, right-click "Tag Management" and select "Add new driver". Choose "SIMATIC S7-1200, S7-1500 Channel" (the S7-1500 channel also serves S7-1500R/H). Open the channel, right-click "S7 Connection", and select "New Connection".
7. Configure the connection parameters. Set the connection name, the S7-1500R/H system IP, the rack/slot (rack 0, slot 1 for a S7-1500 CPU), and the connection resource number. The default connection resource on S7-1500R/H is "S7 Connection" type OP, which is appropriate for WinCC.
8. Add tags. Add the tags you need for monitoring. The tag address format is the standard Siemens absolute address (e.g., DB100.DBX0.0 for a bool, MW10 for a word, DB100.DBD4 for a real). Confirm the tags are present in the S7-1500R/H program and downloadable.
9. Activate WinCC Runtime. Start WinCC Runtime. The connection should establish within 5 to 10 seconds. The connection status is visible in the WinCC Channel Diagnosis tool.
10. Run a failover test. Disconnect one PROFINET cable in the ring. The MRP manager should heal the ring within 500 ms. The WinCC connection should remain up because the IP path through the S7-1500R/H system is preserved. If you have a S7-1500H station, take down CPU 0 and confirm that the HMI traffic continues on CPU 1 within the documented H-Sync forwarding time.

Redundant WinCC Station Pair

When the application requires WinCC redundancy (two PCs, one active, one standby, automatic failover), the configuration steps up:

1. Build two identical WinCC V7.5 SP2 stations with identical project files (use the WinCC Project Duplicator to keep the projects in sync).
2. Install WinCC V7.5 SP2 with the WinCC/Redundancy option on both PCs. This adds the WinCC Redundancy licence and the redundancy service.
3. Configure the WinCC Redundancy channel in the project. The redundancy is at the WinCC application layer (server-to-server state synchronisation) and is independent of the S7-1500R/H controller redundancy.
4. Each WinCC PC has its own NIC and its own S7 connection to the S7-1500R/H system IP. Only the active WinCC server holds the active S7 connection at any given time; the standby server holds the connection in warm-standby.
5. For the highest availability, use two physically separate switches and two physically separate paths to the S7-1500R/H system. This protects against both a switch failure and a cable break.

Note that for S7-1500R/H, the S7-Redconnect mechanism (used in the S7-400H + WinCC architecture) is not required for WinCC redundancy. The standard S7 channel on each WinCC PC connects to the S7-1500R/H system IP, and the S7-1500R/H system handles the controller-side redundancy transparently. The WinCC redundancy service handles the server-side failover independently.

Connection Resources on the S7-1500R/H Station

Every S7 communication connection to the S7-1500R/H station consumes connection resources in both CPUs of the redundant pair. The resource is shared between the primary and the backup; only one connection instance is active at a time, but the resource must be reserved in both CPUs. The number of available connection resources depends on the S7-1500R/H CPU model and is documented in the "Communication - Connection resources of the redundant system S7-1500R/H" chapter of the TIA Portal information system.

For planning purposes, a single WinCC V7.5 SP2 station uses one S7 connection (one resource) to the S7-1500R/H system. A redundant WinCC pair uses two S7 connections (one per WinCC station, both warm). A typical engineering station, historian, and additional operator clients add to the count. Always check the connection resource count in TIA Portal under "Devices & Networks > S7-1500R/H CPU > Properties > Communication > Connection resources" before commissioning.

If a connection resource is exhausted, the new S7 connection is rejected with the S7 error code 0x031E (no more connection resources). The fix is to free a resource, switch to a larger CPU model, or reduce the number of S7 connections to the S7-1500R/H station. The same error code applies to OPC UA and PROFINET connections when the resource pool is exhausted.

Refer to the TIA Portal information system entry "Connection resources of the redundant system S7-1500R/H" for the canonical counts per CPU model. The exact table is updated with every TIA Portal release and should be reviewed at design time. For the S7-1500R product line, the resource count is more constrained than the equivalent non-redundant S7-1500 CPU; the S7-1500H product line doubles the available resources to accommodate the larger process applications.

Performance, Tag Throughput, and Cycle Time

Tag throughput between WinCC and a S7-1500R/H station is limited by the update cycle of the S7 channel and the S7-1500R/H backplane bus. In a typical WinCC V7.5 SP2 configuration, the default update cycle is 1 second; this is appropriate for operator monitoring. For high-speed visualisation (e.g., trending at 100 ms), reduce the update cycle to 250 ms or 500 ms per tag, and verify the load on the S7-1500R/H station in TIA Portal under "Online & Diagnostics > Communication load".

Each S7 read of a tag block consumes CPU time on the active S7-1500R/H CPU. The recommended ceiling is around 2000 tags per WinCC station at 1 s cycle time; at 250 ms cycle time, the ceiling is roughly 500 tags. Exceeding these limits produces increasing communication errors and a growing connection timeout count in the WinCC Channel Diagnosis tool.

For applications that require more than the typical operator-tag volume (e.g., a WinCC station acting as a historian), use the WinCC DataMonitor or a separate archive server. Do not crowd the S7 channel with archive reads; this is a common source of intermittent "connection flaps" that are actually timeouts caused by channel saturation.

Verification, Diagnostics, and Troubleshooting

The primary diagnostic tool for a WinCC V7.5 SP2 connection to a S7-1500R/H station is the WinCC Channel Diagnosis tool (Start > Siemens Automation > WinCC > Channel Diagnosis). It shows the live state of every configured S7 connection, the error counters, and the last error code in plain text. The tool is the fastest way to confirm that the connection is up, that tags are updating, and that no warning conditions exist.

On the S7-1500R/H side, the TIA Portal online diagnostics provide the connection resource usage, the CPU pair state (primary/backup), and the PROFINET ring state. The PROFINET diagnostics in TIA Portal show the ring role, the ring port status, and the last MRP topology change. For S7-1500H, the H-Sync forwarding status is also visible in the same view.

For deeper diagnostics, enable the Simatic Net trace (Start > Siemens Automation > Simatic Net > Commissioning > Trace) and reproduce the failure. The trace logs every frame sent and received on the S7 channel and is the most detailed view of the S7-1500R/H ↔ WinCC exchange. The trace log can be exported to a CSV and shared with Siemens Product Support if a support case is opened. The Simatic Net trace is part of the full PC software installation, not the lean install.

For ring-level diagnostics, the S7-1500R/H web server (default URL http://<system-ip>) exposes the current ring state, the MRP role of each port, and the last topology change. This view is invaluable during commissioning because it is reachable from any browser on the same subnet and does not require TIA Portal to be installed.

Common Commissioning Pitfalls and Field-Proven Caveats

Across multiple S7-1500R/H + WinCC V7.5 SP2 deployments, the same handful of issues appear at commissioning. Pre-empting them saves hours of on-site time:

• Spanning Tree on the PROFINET switch. Many IT-managed switches default to RSTP/STP enabled. PROFINET MRP and RSTP on the same switch port interfere and the result is a ring that flaps every few minutes. Disable STP/RSTP on the PROFINET ring ports and on any port connected to the S7-1500R/H CPUs.
• Duplicate IP detection. If the S7-1500R/H system IP is already in use on the network, the CPU pair will start, hold the IP for a few seconds, and then drop it. The WinCC connection will appear to fail randomly. Verify IP uniqueness with an ARP scan before commissioning.
• Wrong Simatic Net version. A common mistake is to install Simatic Net V15.1 (which predates S7-1500R/H support) on the WinCC PC. The S7 channel driver loads, but the connection to the S7-1500R/H station is rejected at the protocol level. Confirm the installed Simatic Net version in the Windows control panel and re-install the V16+ package if required.
• Firewall on the WinCC PC. Windows Defender Firewall with the default "public" profile blocks the Simatic Net service. Switch the active network profile to "private" or add an inbound rule for the Simatic Net service on port 102/TCP.
• MRP domain name mismatch. If the MRP domain name configured on the S7-1500R/H CPUs does not match the name on the MRP manager switch, the devices will not join the same ring and the failover test will fail silently. Verify the MRP domain name on every ring device.
• System IP vs CPU IP confusion. In TIA Portal, the S7-1500R/H station shows two CPU PROFINET interfaces, each with its own IP. The HMI must connect to the "system IP" (also called the redundancy IP) assigned to the CPU pair, not to either individual CPU IP. Connecting to a single CPU IP works until that CPU fails, at which point the connection is lost until the other CPU takes over and the HMI reconnects to the system IP.

Migration Considerations from S7-400H

Plants that are migrating an existing S7-400H + WinCC V7.4 station to a S7-1500R/H + WinCC V7.5 SP2 station should plan for the following changes:

1. The two CP 1628 cards can be removed. A single standard NIC is sufficient. The S7-Redconnect licence and configuration can be decommissioned.
2. The WinCC project must be re-pointed to the S7-1500R/H system IP. The two historical CPU IPs (CPU 0 and CPU 1) collapse to a single system IP.
3. The Simatic Net installation on the WinCC PC must be updated to V16 or later. The S7-400H-specific S7-Redconnect drivers are no longer required.
4. The PROFINET ring must be configured in TIA Portal with MRP roles and (for S7-1500H) H-Sync forwarding. This is configured in the PROFINET interface properties of the CPU pair.
5. The WinCC application logic (graphics, scripts, archives) is unchanged. Only the connection configuration and the physical network are different.

A typical migration is a planned downtime of 4-8 hours, dominated by the TIA Portal project rebuild and the WinCC project re-pointing. The field wiring is unchanged; the S7-1500R/H CPUs reuse the existing PROFINET cabling. A migration plan should include a fallback to the original S7-400H configuration in case of unexpected issues, and the cutover should be rehearsed in a test bench with the new S7-1500R/H station before the production cutover.

Frequently Asked Questions