Monitoring Redundant S7-400H Controller Connections in SIMATIC PCS 7 Using System Diagnostics vs CONEC and SFC 87

In SIMATIC PCS 7 fault-tolerant architectures (such as S7-400H and CPU 410-5H), utilizing legacy blocks like CONEC (FB88) and SFC 87 (C_DIAG) to monitor redundant controller availability and alert OS Clients when both CPUs fail is technically obsolete and ineffective. In redundant H-systems, stopping one CPU triggers an automated line switchover, meaning the redundant S7 connection remains healthy and FB88 only toggles its master/standby output (Q_MS) without reporting a discrete CPU failure. Instead, PCS 7 provides built-in system mechanisms: the standard WinCC Lifebeat Monitoring (@Livebeat) and Maintenance Station automatically generate high-priority alarms if both CPUs fail, while the Advanced Process Library (APL) diagnostic block HCPUDIAG (FB257) or @CPU_RT provides discrete health status for each physical CPU.

Functional Limitations of FB88 (CONEC) and SFC 87 in Redundant Architectures

In legacy STEP 7 automation systems, engineers utilized system function block SFC 87 (C_DIAG) and the standard library block FB 88 (CONEC) to query the dynamic status of configured S7 connections.

SFC 87 directly interrogates the operating system communication tables, returning the connection state:
- Connection established (0x03)
- Connection disconnected / aborted (0x01 / 0x02)
- Sub-connection states in multi-channel routes

FB 88 (CONEC) periodically calls SFC 87, evaluates the return codes, and sets output flags. However, in modern SIMATIC PCS 7 environments utilizing fault-tolerant controllers (such as CPU 410-5H or CPU 414-5H), deploying FB 88 inside user charts introduces unnecessary execution overhead and fails to provide reliable dual-CPU trip detection.

Why Stopping One CPU Only Alters the Q_MS Output

A frequent question among control engineers is why halting one CPU in an S7-400H redundant pair fails to assert connection error outputs on FB 88, changing only the Q_MS (Master/Standby) output bit.

This behavior occurs because of the fundamental nature of Fault-Tolerant S7 Connections (S7-H Connections):
1. In NetPro, an S7-H connection comprises four redundant physical sub-paths (linking redundant CP 1623 cards on the OS to redundant CP 443-1 modules or onboard PROFINET interfaces on CPU 0 and CPU 1).
2. When an engineer stops CPU 0, the S7-400H operating system immediately executes an automated redundancy switchover to CPU 1.
3. The S7-H connection does NOT disconnect. The communication stack seamlessly redirects all WinCC client packets through the surviving sub-path.
4. Because the logical connection remains valid, SFC 87 and FB 88 evaluate the connection status as Healthy.
5. The only parameter that shifts is Q_MS, which reflects that the local controller changed from Master to Standby or that the active transmission path flipped.

The Built-In PCS 7 System Approach: WinCC Lifebeat Monitoring

In a true Distributed Control System (DCS), alerting operators when controllers fail is an automatic, out-of-the-box system function that requires zero custom CFC programming.

SIMATIC PCS 7 handles total controller loss through WinCC Lifebeat Monitoring (@Livebeat):
1. When the OS project is compiled, the system automatically instantiates lifebeat monitoring agents.
2. The WinCC OS Server cyclically pings every configured Automation Station over the S7 Named Connection.
3. If both CPUs of an S7-400H pair stop or power is lost:
- WinCC immediately detects communication loss on all redundant sub-connections.
- The system triggers an un-suppressible high-priority system alarm:
$$\text{'Connection to Automation Station AS 410-5H interrupted'}$$
- The WinCC Picture Tree Navigator displays a red flashing fault indicator on the top navigation bar.
- The Maintenance Station (MS) marks the AS controller icon as completely failed (red wrench/cross symbol).

The Controller-Level Approach: APL Diagnostic Block HCPUDIAG

If control logic within an external controller (e.g., a peer PLC or safety system) requires discrete binary flags indicating whether CPU 0 or CPU 1 is healthy, engineers must deploy the standard APL diagnostic block:
$$\text{APL Function Block: } \textbf{HCPUDIAG (FB257)}$$

Configuration Workflow:

In the Master Data Library, locate HCPUDIAG under the APL Diagnostics folder.
Insert HCPUDIAG into a cyclic interrupt chart (e.g., OB32 or OB35).
Connect the block to the system diagnostic structures generated by Generate Module Drivers (@CPU_RT).
HCPUDIAG provides explicit, dedicated status outputs:
- CPU0_Run: TRUE when CPU in Rack 0 is running.
- CPU1_Run: TRUE when CPU in Rack 1 is running.
- Redundant: TRUE when both CPUs are synchronized in redundant H-mode.
- SyncError: Asserted if fiber-optic sync submodules or cables fail.
An engineer can easily connect CPU0_Run and CPU1_Run to an AND block or logic gate to detect single or dual processor trips.

Connection and Redundancy Monitoring Architecture Matrix

The following matrix compares methods for monitoring S7-400H controller availability:

Diagnostic MethodImplementation LevelSingle CPU Stop DetectionDual CPU Total Failure DetectionEngineering ComplexityFB 88 (CONEC) / SFC 87CFC User ProgramToggles Q_MS only; no explicit faultConnection disconnectedHigh; requires manual connection ID codingHCPUDIAG (FB257)APL Controller BlockExplicit CPU0_Run / CPU1_Run flagsHandled before total lossLow: Standard APL block with faceplatesWinCC Lifebeat MonitoringWinCC OS SubsystemN/A (Handled via Redundancy agent)Instant System Alarm & Visual BannerZero: Fully automated during OS compileMaintenance Station (MS)PCS 7 Asset ManagementDisplays yellow diagnostic maintenance alertDisplays red controller failure iconStandard PCS 7 system component

Verification

To confirm that controller failure monitoring functions properly:
1. Launch WinCC Runtime on an OS Client.
2. In the AS rack, switch CPU 1 to STOP mode while CPU 0 remains in RUN:
- Verify that WinCC runtime continues operating without data interruption.
- Verify that the WinCC system alarm list logs an incoming event: 'Loss of redundancy in S7-400H station'.
- In CFC, observe HCPUDIAG.CPU1_Run: It must transition from 1 to 0, while HCPUDIAG.Redundant drops to 0.
3. Switch CPU 0 to STOP mode (simulating total controller loss):
- WinCC Lifebeat Monitoring immediately logs 'Connection interrupted to AS'.
- All block icons associated with that AS display the communication fault indicator (crossed-out yellow warning icon).

Limitations and Operational Precautions

Observe the following engineering constraints:
- Do Not Rely on User Code for Total AS Failure: If both CPUs in an AS controller halt, the CPU ceases executing all CFC logic! A block inside that AS (such as FB88 or HCPUDIAG) cannot send an alarm because its execution engine is dead. Total AS failure alarms must always be generated by external nodes (WinCC OS or peer controllers).
- Fiber-Optic Synchronization Cables: Never hot-unplug fiber-optic sync cables without verifying in the CPU diagnostic buffer that the partner CPU is fully synchronized.
- SFC 87 Calling Rate: If legacy projects retain SFC 87, ensure it is called conditionally or in slow cyclic tasks (OB32 / 1000 ms). Calling SFC 87 in fast OB35 (100 ms) causes communication buffer bottlenecks.

Engineer FAQ

Why can't an AS controller generate an alarm when both of its CPUs stop?

When both CPUs stop, the processor stops executing instructions, meaning no function block, CFC chart, or ALARM_8P call can execute. The alarm must be detected and generated externally by WinCC Lifebeat Monitoring or an adjacent peer controller.

What does Q_MS mean on block FB88 (CONEC)?

Q_MS indicates the Master/Standby role or active sub-connection status of the S7 connection. In an S7-400H system, it flips state when communication switches from the master CPU path to the standby CPU path.