Configuring S7-1500R Redundancy with PROFINET MRP and HMI

Overview

The S7-1500R redundant controller scales the SIMATIC S7-1500 family up to a software-redundant primary/standby pair. Both CPUs run the same user program from their own program memory; the standby keeps its outputs disabled and synchronizes application data with the primary over a dedicated PROFINET link. When the primary stops, runs the STOP switch, fails, or loses power, the standby promotes itself to the new primary within the documented failover time and continues driving the same PROFINET IO without forcing a reconfiguration of the IO devices.

This reference procedure documents a working TIA Portal V16 baseline using a CPU 1513R-1 PN as the redundant CPU, an ET 200SP distributed I/O station, a SCALANCE XC208 managed switch as the ring participant, and a TP 700 Comfort panel as the HMI. It also covers the commissioning checks required to make power-fail failover deterministic: when power is removed from the primary, the standby must still observe a valid PROFINET ring, accept the system IP, and hold itself ready to take over inside the keep-alive window.

Prerequisites and Component Selection

Use only the components and firmware versions that are explicitly listed for the SIMATIC S7-1500R/H system. Mixing a V2.8 firmware CPU with a V2.9 firmware CPU is not permitted; both R-CPUs in a redundant pair must run identical firmware. The matching TIA Portal project version must also support both.

Verify every firmware revision and HSP against the current Siemens support entry for S7-1500R/H before commissioning. The Siemens function manual "HMI communication with the redundant system S7-1500R/H" lists the supported configuration software versions and is the right reference for any new TIA Portal project.

HMI communication with the redundant system S7-1500R/H — official Siemens function manual

Network Topology Design

The reference layout uses one PROFINET ring shared by both R-CPUs, with the SCALANCE XC208 acting as an MRP client and the CPUs acting as MRP Manager (auto role). The dedicated CPU-to-CPU port-2 link carries the S7 redundancy state and forms the ring-closure path back to the Primary. Free SCALANCE ports carry the operator HMI and any non-PROFINET traffic.

The ring forward path runs Primary P1 → ET 200SP P1 → ET 200SP P2 → SCALANCE P1 → SCALANCE P2 → Standby P1. The ring return is the dedicated CPU-CPU link on P2. If additional PROFINET IO devices are added to the cell, insert them between SCALANCE and Standby P1, never behind ET 200SP without a second ring port, or the ring topology becomes a line and MRP cannot recover from a cable break.

Verify each cable with Wireshark and the Siemens PRONETA tool before connecting the standby CPU. A single reversed ring direction or a stray port in MRP role "Manager (auto)" on the wrong device prevents failover inside the documented 200–500 ms convergence window.

Project Setup in TIA Portal V16

1. Open TIA Portal V16 and create a new project. Select "Create new project", give the project a path on a local drive with at least 1 GB of free space (TIA Portal archives retain the full repository).
2. Add a SIMATIC S7-1500 station from the device catalog. Open the catalog, expand SIMATIC S7-1500 → CPU → S7-1500R, and drag CPU 1513R-1 PN into the project tree as the primary. TIA Portal automatically creates the device view, the device configuration, and the program blocks OB1, OB82, OB83, OB86, OB100 and OB102.
3. Add the second CPU 1513R-1 PN as the standby. From the project tree, right-click "Devices & Networks", choose "Add new device", and insert the same CPU type. Both CPUs must carry identical firmware; TIA Portal will refuse to compile otherwise.
4. Add the ET 200SP, the SCALANCE XC208, and the TP 700 Comfort from the device catalog in the same way. Place all four devices in the same PROFINET subnet.
5. Open "Devices & Networks" and switch to the Network view. Drag connections from each PROFINET port as per the topology diagram above. TIA Portal draws the PROFINET ring automatically once the CPU and switch MRP roles are configured.

If TIA Portal refuses to load a CPU firmware, install the matching Hardware Support Package (HSP) from the Siemens support portal. TIA Portal V16 may ship with a default firmware version that does not match the firmware on the physical CPU; the project must contain the matching HSP before the device configuration will compile and download.

CPU Configuration: System IP Address

The system IP address is the cornerstone of every S7-1500R/H IO connection. Both CPUs always share one common IP — the system IP — for PROFINET IO, HMI, and TCP/IP traffic. The individual IP addresses of each CPU are visible only on the device configuration as commissioning diagnostics; the running application and every external device (HMI, SCADA, IO device) sees only the system IP.

1. Open the device configuration of the primary CPU 1513R-1 PN.
2. Select the PROFINET interface → "Ethernet addresses".
3. Open the area "System IP address for switched communication" and tick "Enable".
4. Enter the system IP address (for example 192.168.0.100, subnet mask 255.255.255.0) and confirm with OK.
5. Repeat steps 1–4 on the standby CPU and enter the same system IP. Keep the two individual IP addresses different (set them from the topology pool: 192.168.0.101 and 192.168.0.102) so the diagnostics still identify each chassis uniquely.

For full IP planning in a typical commissioning cell, use the scheme below as a starting point and adjust to the customer's network policy.

PROFINET MRP Role Assignment and Multi-Assignment

Open each device's PROFINET port in TIA Portal, switch to "Advanced options" → "Media redundancy", and set the role. Only one device per ring is the active MRP Manager; if the CPUs are both "Manager (auto)", the active manager is whichever CPU currently holds the Primary role. The Manager toggles automatically on failover.

If multiple SCALANCE switches exist in the topology, only the ring ports need the "Client" role. Any other port (HMI, engineering, third-party traffic) must stay at "Not MRP node" so the switch does not try to integrate it into ring reconfiguration.

Every PROFINET IO device that needs to survive a failover must also be Multi-assigned to the system IP of the S7-1500R/H pair. Open the device view of the ET 200SP head module, click PROFINET interface → "Interface assignment", select "Multi-assigned to system IP of S7-1500R/H", and confirm. Repeat on the SCALANCE XC208 if it is exposed as a PROFINET device so its diagnostic pages stay reachable from either R-CPU side. TIA Portal warns if the assignment is wrong; treat the warning as a hard error in a redundant cell.

Programming the User Program

The application program is one standard S7-1500 program. The S7-1500R redundancy layer handles the program-execution side; you do not write redundancy blocks, run sync, or call any "redundancy library". Three commissioning-time disciplines are required and three runtime disciplines are recommended.

Commissioning-time disciplines

1. Compile the program once and download the same project to both CPUs. TIA Portal V16 supports a single download dialog with "Select target devices" so both R-CPUs receive the same load image.
2. Match the OB82, OB83, and OB86 diagnostic blocks to the actual station configuration. OB86 in particular must report the station failure of a multi-assigned IO device, otherwise the standby will not know the IO has been re-arbitrated.
3. Use the same hardware identifier names for the IO devices in both OBs and the symbol table. Any inconsistency produces a "Device differs from project" warning on download.

Runtime disciplines

1. Always read inputs from process image (I) addresses or from the IO controller interface; never read directly from the IO backplane. The redundancy layer arbitrates process-image access across failover.
2. Write outputs only via Q process image addresses. Avoid direct peripheral write (PQB) calls — these bypass the arbitration and will fail intermittently on failover.
3. Use only retentive M markers or retentive DB tags for state that must survive a STOP/RUN transition. Non-retentive markers reset to 0 on the new primary immediately after failover and may flip process state.

Download sequence

1. Open the project, select the primary CPU, and click "Download to device".
2. After the primary reaches RUN, select the standby CPU and click "Download to device". The download is identical; the redundancy layer detects that the standby just received the same project.
3. Watch the RUN/STOP and LINK LEDs on both CPUs. The expected steady-state after download is RUN on the primary, RUN on the standby with the redundancy-specific LED indicating standby role, and the PROFINET IO devices all in data exchange.

The "STOP" status LED on the standby CPU during a healthy dual-RUN state can be normal on older firmware revisions — verify with the on-board Web server of each CPU rather than reading the LED alone. The Web server "Redundancy" page shows the current Primary/Backup role and the last failover timestamp directly.

HMI Integration with TP 700 Comfort

The TP 700 Comfort connects to the S7-1500R/H pair through the SCALANCE XC208 in the reference topology. The connection in WinCC Comfort is set to "S7-1500R/H" with the System IP as the partner address. This makes the HMI survive failover transparently: while the primary CPU is healthy, the System IP resolves to the primary; during the failover window and after it, the System IP resolves to the standby without any change to the HMI connection configuration.

1. Open the device configuration of the TP 700 Comfort.
2. Open "Connections" → add a new connection → type "S7-1500R/H".
3. Enter the System IP (192.168.0.100) as the partner address. Do NOT enter the individual IP of either CPU — the System IP is the only address the HMI should reference.
4. Confirm the connection and compile the project. TIA Portal will warn if the project points to an individual CPU instead of the System IP.
5. Configure the area pointers (date/time, job mailbox, etc.) to point to the System IP connection.

For the full HMI recipe with exact settings for each area pointer, follow the Siemens application manual "Connecting a SIMATIC HMI Panel with a SIMATIC S7-1500R/H" linked below. It contains the project tree path, the connection dialog screenshots, and the screen-template recipe for both Comfort Panels and WinCC Runtime Advanced.

Connecting a SIMATIC HMI Panel with a SIMATIC S7-1500R/H — Siemens application manual (PDF)

Power-Fail Takeover Troubleshooting

During commissioning the most common finding is that the standby CPU correctly takes over from a primary CPU when the RUN/STOP switch is turned to STOP, but the standby does NOT take over when the primary is powered off. The two events look similar to the user, but the S7-1500R redundancy layer treats them differently:

• RUN/STOP transition. The primary CPU sends an explicit "I am stopping" announcement over the CPU-CPU link, the standby sees the announcement immediately, and promotes itself within the documented short failover time.
• Power removal. The primary CPU cannot announce anything. The standby must rely on (a) the S7 keep-alive timer on the CPU-CPU link expiring, (b) the MRP ring reconfiguration on the primary port — documented as 200–500 ms convergence per the MRP specification, and (c) the IO device re-arbitration after the IO controller connection is re-established. If any of these three conditions fails, the standby remains in STOP because the redundancy layer treats the failover as ambiguous and prefers a stable STOP state rather than risk duplicate process writes.

The four diagnostic checks below resolve the issue in more than 95% of field reports and should be the first action whenever a power-fail takeover test fails.

If all four checks pass but the standby still does not promote after a power event, perform a structured power-down test:

1. Verify both CPUs are in RUN with redundant status "SYNC" on the primary Web server and "PRIMARY/BACKUP" matching on the standby Web server. Record the diagnostic-buffer timestamp on both CPUs.
2. Power off the primary CPU at the system power supply. Do NOT press RUN/STOP — pull the power entirely.
3. Time from power removal to RUN on the standby. Anything up to roughly 500 ms is within the documented S7-1500R window; anything above 5 s indicates that the keep-alive timer is not configured correctly or the ring has not reconfigured.
4. Read the diagnostic buffer on the (now former) standby and check for the redundancy-state transition event (commonly OB 70 or OB 72, or a redundancy-specific event on current firmware). If the event is absent, the keep-alive timer has expired before the redundancy layer made the role decision — recheck System IP consistency and Multi-assignment.
5. Restore primary power. Watch for the role demotion event on the CPU that has just powered up. If the CPU powers up in RUN but does not write to the IO, the priority and MRP role of the newly powered CPU has not been recognized as Backup — recheck the role of the CPU port and the MRP Manager selection.

Firmware and HSP verification

Open the project properties of each CPU in TIA Portal and read the firmware version from "Device configuration" → "Properties" → "General" → "Firmware version". Both R-CPUs must report the same version. If they do not, install the matching HSP and download again. A "successful" download to mismatched firmware is not a reliable failover scenario.

Verification, Acceptance Test, and Field Caveats

Run the following acceptance script before declaring the cell ready for production. Capture the diagnostic buffer from both CPUs before and after each test and attach the timestamps to the customer hand-over package.

1. Steady-state RUN test. Both CPUs in RUN, ET 200SP in data exchange, TP 700 Comfort connected to the System IP, HMI tags updating. Hold for 10 minutes.
2. RUN/STOP takeover test. Primary CPU RUN/STOP switch moved to STOP. Standby CPU promotes to Primary within the S7-1500R failover time. Observe process values on HMI remain stable.
3. Power-fail takeover test. Primary CPU power supply turned off at the breaker. Standby CPU promotes to Primary within the documented keep-alive window. HMI tags remain stable.
4. Ring-break test. One PROFINET ring cable physically removed. Verify MRP converges within 200–500 ms and IO continues without interruption. Restore the cable and verify ring closes again.
5. Restore test. Power restored to the formerly-failed CPU. The formerly-failed CPU takes the Backup role and synchronizes application data with the new Primary. HMI tags remain stable throughout the recovery.

Three caveats appear repeatedly during field commissioning and are worth keeping in the maintenance manual of the cell.

• The S7-1500R system always uses a single S7 program, but if the project grows to include a second PROFINET subnet for a second cell, the second subnet cannot share the System IP with the first. Each redundant pair owns its own System IP.
• If the SCALANCE XC208 firmware is upgraded, ring convergence time can change. Re-run the ring-break test after every SCALANCE firmware update. The convergence figure is in the SCALANCE Web-Based Management "Information → MRP" page during the test.
• HMI connection type "S7-1500" is not equivalent to "S7-1500R/H" in WinCC Comfort — using the regular "S7-1500" type breaks the failover-recovery semantics on the HMI and is documented in the Siemens HMI manual. Always select "S7-1500R/H" for redundant cells.

FAQ