Change Connection in WinCC flexible for Redundant PLC HMI

Overview: Redundant HMI Communication Problem

SIMATIC HMI panels and PC-based WinCC flexible Runtime stations that must remain visible across a controller failover face a persistent engineering challenge: the HMI configuration only binds tags to one connection per logical area, yet two physical controllers (a primary and a standby) are physically present on the network. When the active CPU goes to STOP, experiences a hardware fault, or is taken out of service for maintenance, the HMI must transparently re-point all tags at the surviving controller without operator intervention, screen rebuild, or loss of process visibility.

The WinCC flexible system function ChangeConnection (internal name HMIRuntime.Connection.ChangeConnection) implements exactly this re-pointing. It does not move tags between connection objects in the engineering station; it switches the runtime binding of the HMI's logical "dummy" connection to one of the physical connection objects that targets the standby CPU. The result: a single tag address (for example DB111.DBW0) keeps the same name on every screen, but the underlying transport (IP address, rack/slot, MPI/PN node) changes at runtime. The function is available in WinCC flexible 2008 SP4 and later, including WinCC flexible 2008 SP5 and SP7, and continues into WinCC (TIA Portal) as the WinCC Runtime Advanced change connection mechanism. See the official Siemens automation support entry Entry ID 23842653 for the canonical WinCC flexible change-connection documentation.

Prerequisites

Confirm the following before configuring the change-connection logic.

• Engineering software: WinCC flexible 2008 SP5 (or later service pack). For migration projects, TIA Portal V15 or later with WinCC Runtime Advanced.
• Runtime license: WinCC flexible PC Runtime license (single-station or multi-station) with sufficient power-tags to cover both the physical and logical connection tag sets.
• Communication driver: "SIMATIC S7 300/400" channel installed under Communication > Drivers. The "SIMATIC S7 1200/1500" channel is supported but requires appropriate firmware (S7-1200 V4.0 or S7-1500 with security settings configured).
• PLC hardware: Two controllers physically reachable on independent network paths. Typical pairings: S7-400H (true hardware redundancy), two S7-300 CPUs with redundant PROFINET, or an S7-400 with a backup S7-300.
• Network reachability: Each CPU must respond to the standard SIMATIC S7 discovery (ISO-on-TCP port 102 over TCP/IP, or PROFIBUS/MPI via CP). For PROFINET, enable the S7 connection endpoint in the CPU properties.
• Station names and IP addresses: Two static IP addresses (or PROFINET names) for the two controllers. Avoid DHCP on the redundant network segment.

Architecture: The Dummy Connection Pattern

The change-connection feature relies on three connection objects per redundant CPU pair:

1. Physical Connection A (Connection_PLC_A) — points to the primary CPU's IP/rack/slot via the SIMATIC S7 300/400 driver.
2. Physical Connection B (Connection_PLC_B) — points to the standby CPU's IP/rack/slot via the same driver.
3. Logical (Dummy) Connection (Connection_Active) — the connection referenced by every HMI tag and every script. It has its own driver assignment and parameters, but is not used to talk directly to either CPU. At runtime, ChangeConnection rewrites the transport handle of Connection_Active so that subsequent tag reads/writes flow through either Physical A or Physical B.

The dummy pattern keeps tag configuration stable. Operators continue to see "TankLevel", "MotorSpeed", and "AlarmWord1" regardless of which CPU is currently master. The PLC project is responsible for keeping process state synchronized between A and B (via S7-400H redundancy, or via application-level mirroring for non-H systems).

Connection Object Parameters

Configuring Connections in WinCC flexible

Open the project in the WinCC flexible ES and navigate to Project > Communication > Connections. Right-click in the empty connection table and choose Add Connection three times. Rename them according to the architecture above.

1. Select Connection_PLC_A. Set the Communication driver to "SIMATIC S7 300/400".
2. Enter the S7 station IP address under Station address. For PROFINET devices, enter the device name in lower-case if you use S7-1200/1500 DNS resolution; for classic S7-300/400 use the dotted IP.
3. Set Rack and Slot to match the CPU physical position (rack 0, slot 2 for a standard S7-300 CPU).
4. Repeat for Connection_PLC_B, pointing to the standby CPU's IP.
5. Create Connection_Active. Enter the same parameters as Connection_PLC_A. The active parameter values are only meaningful until the first ChangeConnection call; they will be overwritten at runtime.
6. Save and compile the project. Confirm the project download contains three connection objects under Connections with the names above.

Tag Configuration for the Dummy Connection

Every tag visible on screens, archives, and scripts must reference Connection_Active. Do not bind any tag directly to Connection_PLC_A or Connection_PLC_B; those connections exist solely as transport handles.

Example tag set:

The ActivePLC_ID tag is the runtime latched state of which CPU is currently master (1 = A, 2 = B). The latching is performed by the script after each ChangeConnection call so that restart recovery knows where to bind.

Writing the Change Connection Script

The system function is invoked through the WinCC flexible VBScript editor (under Scripts > VBScripts). The function returns a boolean indicating whether the runtime successfully switched transport.

System Function Signature

Minimal Example Script

'
' change_connection.vbs
'
Dim sTargetConn, bResult

'
' Decide which physical connection to bind to.
' ActivePLC_ID reflects the last-known master as stored in DB100.DBB0.
'
If SmartTags("ActivePLC_ID").Value = 1 Then
    sTargetConn = "Connection_PLC_B"   ' A failed, switch to B
    SmartTags("ActivePLC_ID").Value = 2
Else
    sTargetConn = "Connection_PLC_A"   ' either start-up or B failed
    SmartTags("ActivePLC_ID").Value = 1
End If

'
' Issue the connection switch.
'
bResult = HMIRuntime.Connection.ChangeConnection(sTargetConn)

'
' Latched feedback tag for diagnostics on the overview screen.
'
SmartTags("LastSwitchResult").Value = bResult
SmartTags("LastSwitchTarget").Value = sTargetConn

'
' Optional: force one read cycle to refresh initial tags immediately.
'
If bResult Then
    HMIRuntime.Tags.Refresh
End If

Health Monitoring and Trigger Logic

The script above is reactive — it must be invoked. Common trigger sources are:

• S7 H system status bit: For S7-400H, the redundancy status word (for example, OB70_RTAGF or the SW1 operand from the H-CPU firmware) indicates master/standby. Trigger the script on the rising edge of a transition in the standby status.
• Watchdog tag: Each CPU increments a counter (for example DB901.DBW0) every 250 ms; the HMI watches for two missed increments over 1 second and triggers the script.
• S7 connection-state system event: WinCC flexible raises the "Connection Status" event when the runtime detects a transport failure. Configure the event under Project > Communication > Events and bind the change-connection routine directly.
• Manual operator switch: Always provide an operator button (HMIRuntime.Authentication or a dedicated SwitchPLC tag) so maintenance engineers can swap CPUs without waiting for the watchdog.

Cyclic Watchdog: Scheduler Binding

Bind the script as a scheduled task with cycle 1000 ms. The script must check before calling ChangeConnection that the new connection is reachable; otherwise a fail-over attempt can bounce into a loop when both CPUs are momentarily unreachable.

'
' check_connection.vbs - cycle 1000 ms
'
Dim iAttempts
iAttempts = 0

'
' Read liveness bit from A and B via dedicated mirror tags.
' These tags ride on Connection_PLC_A and Connection_PLC_B respectively,
' read by auxiliary "poll" tags configured with the physical connections.
'
If SmartTags("PLC_A_Live").Value = 1 Then
    iAttempts = iAttempts + 1
End If
If SmartTags("PLC_B_Live").Value = 1 Then
    iAttempts = iAttempts + 2
End If

'
' Decisive logic:
'   iAttempts=3 (both live)         : stay put
'   iAttempts=2 (only B live)       : force switch to B
'   iAttempts=1 (only A live)       : force switch to A
'   iAttempts=0 (neither live)      : do not switch, log fault
'
Select Case iAttempts
    Case 2
        SmartTags("ActivePLC_ID").Value = 2
        HMIRuntime.Connection.ChangeConnection "Connection_PLC_B"
    Case 1
        SmartTags("ActivePLC_ID").Value = 1
        HMIRuntime.Connection.ChangeConnection "Connection_PLC_A"
    Case Else
        ' do nothing
End Select

Complete Implementation Outline

The shipping pattern for a redundant S7-400H + WinCC flexible Runtime PC station typically contains the following objects:

1. Three connection objects: Connection_PLC_A, Connection_PLC_B, Connection_Active.
2. User-defined tags bound to Connection_Active (all visible process tags).
3. Two auxiliary tags bound to physical connections (PLC_A_Live, PLC_B_Live) for watchdog.
4. One scheduler task check_connection with 1 s cycle invoking the watchdog script.
5. One event-handler task SwitchConnection bound to the "Switch PLC" button on the overview screen, invoking the manual switch script.
6. Two diagnostic tags LastSwitchResult, LastSwitchTarget for the operator screen.
7. One persistent tag ActivePLC_ID with persistence configured (so the last-known active CPU survives an HMI restart).

Integration with SIMATIC S7-400H Systems

When the redundant pair is an S7-400H (CPU 417-4H or 414-4H), the HMI workload is much smaller: a single logical connection pointing to the H-CPU redundancy partner covers both physical CPUs because the H system performs the transport-level redundancy. In that case ChangeConnection is normally not required — the H system presents one consistent image to the HMI.

The change-connection pattern is intended for the cases where two independent CPUs (no H system) must appear as a logical single CPU to the HMI. For S7-400H refer instead to the SIMATIC S7-400H fault-tolerant systems manual and configure the partner connection under Properties > Communication > S7 Connection > Active partner assignment.

Verification and Commissioning Steps

1. Tag audit: Project > Tools > Tag cross-reference. Verify every tag under visible categories points to Connection_Active. None should reference the physical connections.
2. Download and start Runtime: Confirm the runtime loads three connection objects in the diagnostic window (WinCC flexible Runtime > Tools > Diagnostics > Connections). Quality should be "good" for Connection_Active initially pointing at A.
3. Functional switch test: With both PLCs online, trigger the manual "Switch PLC" button. Verify on the diagnostics page that Connection_Active now binds to physical B and all tags continue to update.
4. Failover test: Stop CPU A via SIMATIC Manager > Online > Stop CPU. Within the configured 2 s ceiling (Connection Establishment Time in the connection properties), the runtime switches and displays continue to update from B.
5. Restart recovery: Restart the PC Runtime. Confirm the persistence tag ActivePLC_ID still reflects the last known active CPU and that the runtime does not blank out.
6. Tag quality trace: Run for 24 hours with diagnostics collection enabled. Quality="bad" events should be transient and no longer than the configured connection time-out (default 3 s).

Troubleshooting Matrix

Field-Proven Caveats

• Do not call ChangeConnection from the same script that is currently holding tag read/write locks. Run a two-script split — one to read tags, one to switch.
• When the project migrates to TIA Portal V17 or later, replace the WinCC flexible mechanism with the equivalent WinCC Runtime Advanced change connection or, for S7-1500R/H redundancy, bind the HMI connection to the system IP of the redundant pair directly.
• Maximum power-tag throughput remains the same regardless of which physical connection is active — the dummy redirect is a property swap, not a duplicate read path.
• The WinCC flexible Help file (WinCC_flexible_Help.chm) lists ChangeConnection under System functions > Communication > Connection. Use the index to jump directly.

FAQ