C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Monitoring Redundant OS Server Runtime Availability in S7-400 Automation Stations

Monitoring Redundant OS Server Runtime Availability in S7-400 Automation Stations

To monitor whether at least one redundant OS Server is actively in runtime from an S7-400 or CPU 410 Automation Station (AS) in SIMATIC PCS 7 V9.0, the industry standard practice is implementing a bidirectional watchdog / heartbeat counter (Lebenszähler). A cyclic WinCC C or VBScript on each OS Server periodically increments an integer tag mapped to an AS CFC monitoring block. If neither OS updates its counter within a defined watchdog timeout window, the AS initiates a safe process fallback. Alternatively, S7 connection status can be monitored using the IK_STATE block from the CFC library, though network connectivity alone does not confirm WinCC script runtime health.

Table of Contents

Executive Summary

In high-integrity chemical, pharmaceutical, and oil & gas facilities controlled by SIMATIC PCS 7 V9.0, an automated production unit must not continue operating blind if both supervisory Operator Stations (OS Servers) crash or lose network communication. When both redundant OS servers fail, plant operators lose visualization and manual intervention capabilities. The Automation Station (S7-410-5H or S7-400) must autonomously recognize this condition and transition the physical process to a predetermined safe state (e.g., closing feed valves, holding batch reactors). While standard APL blocks monitor field I/O and CPU health, monitoring OS application runtime status from the controller requires a robust watchdog architecture that distinguishes physical network link status from active WinCC runtime health.

Architecture and Fundamental Mechanics

Evaluating OS Server health from the AS involves evaluating two distinct architectural layers: transport connection state versus application-level execution state.

1. Transport Layer Monitoring: The IK_STATE Block

The standard PCS 7 CFC library provides the IK_STATE block (located in CFC Library -> ELEM_400 -> Blocks). IK_STATE queries the internal S7 connection status table for a configured S7 connection (configured as a Named Connection in NetPro). By instantiating two IK_STATE blocks—one for the AS-to-OS1 connection and one for the AS-to-OS2 connection—the AS detects if the ISO-on-TCP or Industrial Ethernet transport connection is severed. However, IK_STATE only confirms that the communication endpoint is responding. If WinCC Runtime crashes, freezes, or encounters script deadlocks while the Windows operating system and CP1623 driver remain operational, IK_STATE falsely reports the connection as healthy.

2. Application Layer Monitoring: Bidirectional Heartbeat (Lebenszähler)

The most reliable engineering practice is an active software heartbeat (Lebenszähler):
- A WinCC Global Script (C-action or VBScript) runs cyclically (every 5 seconds) on both OS Server 1 and OS Server 2.
- The script verifies that WinCC Runtime is active and increments an integer tag (OS1_Watchdog_Val, OS2_Watchdog_Val) mapped directly to an S7-400 CFC block.
- In the AS, a custom monitoring block or standard timer logic (TimerP / SampleTime accumulator) checks whether the tag value changes within a parameterized timeout window (e.g., 15 to 20 seconds).
- If neither OS1 nor OS2 updates its counter before the timeout expires, an output flag Both_OS_Down is asserted, triggering safe process interlocks.

Step-by-Step Implementation Procedure

To implement a robust OS heartbeat monitoring mechanism between redundant OS servers and the AS:

Step 1: Create Watchdog Variables in the AS CFC Chart

  1. In SIMATIC Manager, open your CFC chart on the AS.
  2. Create or instantiate an OS monitoring function block (e.g., custom SCL block OS_Watchdog or a combination of TimerP blocks).
  3. Define two integer inputs: OS1_LifeBit (or INT counter) and OS2_LifeBit.
  4. Assign the attribute S7_m_c = 'true' to both inputs so they compile automatically into WinCC Tag Management.
  5. Compile the AS and execute an OS Compilation in SIMATIC Manager.

Step 2: Implement Logic in the AS Monitoring Block

  1. In the monitoring block algorithm, store the previous cycle's counter values (Prev_OS1, Prev_OS2).
  2. At each execution cycle:
    - If OS1_LifeBit <> Prev_OS1, reset Timer_OS1 to 0 and update Prev_OS1.
    - If OS1_LifeBit == Prev_OS1, accumulate Timer_OS1 by SampleTime.
    - Repeat identical logic for OS2.
  3. If Timer_OS1 > 20.0 seconds, set OS1_Healthy = FALSE.
  4. If Timer_OS2 > 20.0 seconds, set OS2_Healthy = FALSE.
  5. Combine states: OS_Loss_SafeState = NOT (OS1_Healthy OR OS2_Healthy).

Step 3: Configure Cyclic WinCC Scripts on OS Servers

  1. Open WinCC Explorer on the Engineering Station.
  2. Open Global Script -> C-Editor (or VBS-Editor).
  3. Create a project function with a 5-second cyclic trigger:
    c // WinCC C-Action on OS Server #include "apdefap.h" void OnWatchdogTrigger() { // Check redundancy state if desired, or write from both servers short val = GetTagWord("OS_Watchdog_Block_OS1_LifeBit"); val = (val >= 32767) ? 0 : val + 1; SetTagWord("OS_Watchdog_Block_OS1_LifeBit", val); }
  4. Use internal WinCC @ServerName tags to determine whether the script runs on OS Server 1 or OS Server 2, updating the respective tag.
  5. Save scripts and compile the OS project.

Verification

Verify watchdog fail-safe operation:

  1. Normal Redundant Operation:
    - With both OS1 and OS2 in runtime, monitor the CFC chart online. Both OS1_Healthy and OS2_Healthy must read TRUE.

  2. Single Server Failure Test:
    - Deactivate WinCC Runtime on OS Server 1.
    - Verify that after 20 seconds, OS1_Healthy drops to FALSE, but OS_Loss_SafeState remains FALSE because OS Server 2 is active.

  3. Dual Server Failure / Safe State Activation:
    - Deactivate WinCC Runtime on OS Server 2.
    - Verify that after 20 seconds, OS2_Healthy drops to FALSE and OS_Loss_SafeState asserts TRUE, successfully activating the process interlocks.

Limitations and Operational Precautions

Operational limitations and precautions:

  1. Script Freezing Risks: If the WinCC Global Script engine hangs due to an infinite loop in another script, the watchdog timer will trip even if graphics display remains active. Keep watchdog scripts completely isolated.
  2. Timeout Parameterization: Do not set the watchdog timeout too short (< 10 seconds). OS server high-load conditions (such as opening large trend archives or executing OS compilation downloads) can briefly delay cyclic scripts.
  3. Network Failover Times: In redundant Industrial Ethernet rings (MRP), switchover takes up to 200 ms, which does not affect a 20-second watchdog window.
  4. Commercial Disclaimer: Verify all hardware components, controller licensing, and communication software with an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

Why isn't IK_STATE sufficient on its own to monitor OS health?

IK_STATE only verifies the S7 transport connection layer. If WinCC Runtime crashes or freezes while Windows and the network card remain alive, IK_STATE will continue reporting the connection as healthy.

Can this logic be implemented without writing custom C or VBS scripts?

Not entirely for WinCC runtime application health. S7 connection blocks (like IK_STATE) require no scripts, but verifying that WinCC graphics and runtime engines are actively processing requires an active script heartbeat.

What is a recommended watchdog timeout setting?

A script cycle of 5 seconds paired with an AS timeout window of 15 to 25 seconds provides high reliability while preventing nuisance trips during brief OS server peak loads.

How does the WinCC script know which redundant server it is executing on?

The script reads the internal system tag @ServerName or @LocalMachineName to distinguish between OS Server 1 and OS Server 2.

Does the watchdog communication increase CPU 410 communication load significantly?

No. Incrementing two 16-bit integer tags every 5 seconds represents negligible communication overhead on Industrial Ethernet.

Technical References

Related Articles

Related Tags

  • Redundant OS
  • S7-400
  • Heartbeat Watchdog
  • WinCC Runtime
  • Fail-Safe Interlock
20 respuestas