Architectural Separation of Plant Bus and Terminal Bus in SIMATIC PCS 7 - Preventing OS Client to PLC Direct Communication Latency

In SIMATIC PCS 7, multi-station OS client/server architectures strictly require the physical and logical separation of the Plant Bus (System Bus) from the Terminal Bus. The WinCC OS Server is the exclusive communication interface to the automation controllers (S7-400 / S7-410); OS Clients never communicate directly with PLCs. Routing OS Client traffic or combining client and controller communication onto a single network adapter severely degrades determinism, introduces high communication jitter, overburdens controller communication buffers, and causes visible faceplate opening delays and alarm delivery latencies across operator stations.

PCS 7 Dual-Tier Industrial Network Topology

SIMATIC PCS 7 architectures enforce a deterministic, two-tiered network hierarchy:
1. The Plant Bus (System Bus / AS-OS Bus):
- Dedicated solely to high-speed communication between automation controllers (S7-400 / S7-400H / CPU 410-5H) and WinCC OS Servers / Engineering Stations.
- Utilizes Industrial Ethernet running ISO Transport or TCP/IP protocols over dedicated CP cards (e.g. CP 1623 or CP 1613) or server industrial network interfaces.
- Operates deterministic, low-latency cyclic data exchange and high-speed Sequence of Events (SOE) time stamping.
2. The Terminal Bus (Client-Server Bus):
- Dedicated exclusively to supervisory communication between WinCC OS Servers, OS Clients, Central Archive Servers (Process Historian), and Engineering Stations.
- Transports standard Windows RPC, Microsoft SQL Server database replication, WinCC server packages, and web client sessions.
- Operating in standard TCP/IP with corporate LAN integration, subject to standard non-deterministic IT network traffic.

Why OS Clients Must Never Connect Directly to Controllers

A frequent design question from system integrators is whether an OS Client can bypass the OS Server and fetch process data directly from the S7-400 PLC:
- Exhaustion of PLC Communication Resources:
- S7-400 CPUs have fixed communication connection budgets (e.g. 64 to 128 concurrent connection resources).
- If 15 OS Clients establish direct connections alongside engineering connections, redundant server connections, and fieldbus communications, the CPU's S7 connection pool is instantly exhausted.
- Multiplying Network Query Overhead:
- In standard PCS 7, the OS Server queries process tags cyclically once from the PLC, buffers the data in memory, and fans it out simultaneously to all connected OS Clients.
- If clients queried PLCs directly, the PLC communication processor (CP 443-1) would be flooded with duplicate polling requests for identical data, leading to communication timeouts and dropped alarms.
- Architectural Violation:
- The OS Server provides alarm logging, tag archiving, and central redundancy synchronization. Bypassing the server leaves clients without historical trends, alarm acknowledgment synchronization, or security access control.

Dual Network Adapter Configuration on WinCC OS Servers

To maintain strict network isolation, each WinCC OS Server must be equipped with at least two separate, unbridged network adapters:

Subnet IP Segmentation Rules:
- Plant Bus Interface: Assigned a private automation IP subnet (e.g. 192.168.1.x, Subnet Mask 255.255.255.0, Gateway: None).
- Terminal Bus Interface: Assigned the client-server subnet (e.g. 172.16.10.x, Subnet Mask 255.255.255.0, Gateway: Router to terminal bus).
- Strict Rule: The two network adapters on a single server machine must never reside in the same IP subnet, and Windows IP routing / network bridging must remain disabled.
Binding Communication Access Points:
- In Windows, open Set PG/PC Interface:
- Set S7ONLINE access point to the Plant Bus adapter (e.g. CP1623(ISO) or IE General).
- In WinCC Explorer, configure Simatic Shell:
- Select the Terminal Bus network adapter as the active communication adapter for WinCC inter-station broadcasts.
- Enable encrypted communication if operating on PCS 7 v8.2 or newer.

Plant Bus vs Terminal Bus Technical Comparison Table

The following table details the technical and operational differences between the Plant Bus and Terminal Bus:

ParameterPlant Bus (System Bus)Terminal Bus (Client-Server Bus)Interconnected NodesS7-400 CPUs, CP 443-1, OS Servers, ESOS Servers, OS Clients, Process Historian, ESCommunication ProtocolsS7 Protocol, ISO Transport, TCP/IP, NTPTCP/IP, Microsoft RPC, SQL TDS, NetBIOSNetwork HardwareSCALANCE X-300 / X-400, Industrial Ethernet CPsSCALANCE X-200, Managed Office/Plant SwitchesCommunication CharacterDeterministic, cyclic, real-time process dataAsynchronous, transactional, burst-heavyRedundancy ProtocolsMedia Redundancy Protocol (MRP), S2 / PRPRapid Spanning Tree Protocol (RSTP), Dual-LANImpact of OverloadController connection drops, delayed emergency tripsSluggish faceplate popups, delayed trend curves

Verification

To confirm proper network separation and optimal client/server communication:
1. On the WinCC OS Server, open Windows Command Prompt and execute:
cmd route print
Verify that traffic destined for PLC IP addresses routes exclusively through the Plant Bus NIC, and traffic for OS Clients routes through the Terminal Bus NIC.
2. Open Simatic Shell on all OS Servers and OS Clients. Confirm that every node is visible with a blue active icon and shows the Terminal Bus IP address.
3. On an OS Client, open a process screen and click a motor block icon:
- Verify the faceplate opens in less than 500 ms.
- Confirm that changing a setpoint or issuing a start command executes instantly on the PLC without delay.
4. Run continuous pings between clients and servers during high alarm activity; verify latency remains below 2 ms with zero packet loss.

Limitations and Operational Precautions

When configuring PCS 7 network topologies:
1. Never Bridge the Two Subnets: Enabling Windows Network Bridge or routing between the Plant Bus and Terminal Bus allows rogue corporate broadcast traffic (multicast video, DHCP requests, malware scans) onto the plant bus, risking controller CPU communication halts.
2. Proper Network Adapter Binding Order: In Windows Advanced Network Settings, ensure the Terminal Bus adapter is prioritized at the top of the provider binding order for Windows networking services.
3. Simatic Shell Adapter Selection: If Simatic Shell accidentally binds to the Plant Bus NIC, OS Clients will fail to connect to the OS Server project, generating 'Server Not Available' errors.

Engineer FAQ

Can a small PCS 7 system run both Plant Bus and Terminal Bus on a single network card?

While technically functional on a test bench with an OS Single Station, running both buses on a single network card is strictly forbidden in production PCS 7 systems. It violates Siemens availability guidelines and introduces latency bottlenecks.

Why do OS Clients open faceplates slowly when network cards share a subnet?

When two NICs share the same IP subnet, the Windows TCP/IP stack encounters routing ambiguity (asymmetric routing). Packets are sent via one card and acknowledged on the other, triggering TCP retransmissions and 5 to 10-second faceplate delays.

Does the Engineering Station connect to the Plant Bus or Terminal Bus?

The Engineering Station (ES) must connect to both buses: the Plant Bus for downloading logic and hardware configurations to the PLCs, and the Terminal Bus for downloading WinCC runtime projects to OS Servers and Clients.

What network speed is required for the Terminal Bus?

Siemens recommends a minimum of 100 Mbps Fast Ethernet, with 1 Gbps Gigabit Ethernet strongly recommended for systems with multiple OS Clients or Process Historian servers.