Configuring S7-300 SCALANCE W WiFi Redundancy to PROFIBUS

Problem Overview and Target Architecture

The application uses two S7-300 CPUs (CPU 315-2 PN/DP, e.g. 6ES7315-2EH14-0AB0) connected as a master/slave pair over PROFIBUS DP. A second communication path is required for redundancy. Because the customer environment cannot tolerate a hard cable break, an industrial WiFi link is added through:

• SCALANCE W788-1-M12 — Access Point, mounted on the master side, IP 172.20.16.32
• SCALANCE W748-1-M12 — Client station, mounted on the slave side, IP 172.20.16.13
• Subnet mask 255.255.240.0 (/20) on both PN interfaces

STEP 7 V5.5 + SP2 + HF1 is the engineering environment. The WiFi path is intended to carry the same process data block (DB) that the PROFIBUS path is carrying, so that if the PROFIBUS cable is severed, broken, or a DP slave drops out, the WiFi link keeps both controllers synchronized.

Why MRP, RSTP, and PROFINET Redundancy Cannot Solve This

Common industrial Ethernet redundancy mechanisms all assume an Ethernet physical layer:

The S7-300 PN interface and the SCALANCE W form a single Ethernet/IP network. RSTP can be enabled between multiple SCALANCE W devices for ring redundancy on the wired Ethernet side, but it does not bridge PROFIBUS and WLAN. A 30-second retry interval on the higher-priority path is a typical field-proven practice when implementing application-level failover.

SCALANCE W Hardware Setup and Web-Based Management

WiFi configuration is performed entirely through the SCALANCE W Web-Based Management (WBM) interface — NetPro is not required for the radio side. The PN interface of the SCALANCE, however, must be in the same IPv4 subnet as the CPU PN interface.

1. Connect a service laptop to the SCALANCE W management port (or to the same Ethernet segment as the SCALANCE PN interface).
2. Browse to the default IP (e.g. https://192.168.1.1) and log in. Default credentials: admin / admin — change on first login.
3. Navigate to Layer 3 > Subnets and set the management IP to 172.20.16.32 (W788) or 172.20.16.13 (W748) with mask 255.255.240.0.
4. Navigate to WLAN > Interfaces > WLAN1 and configure the radio:
   • Country code — set to the deployment country for legal channel set
   • Channel — fixed channel recommended (e.g. channel 36 in 5 GHz) to avoid roaming disconnects
   • 802.11 mode — 802.11a/n or 802.11g/n depending on regulatory domain
5. Navigate to WLAN > Security:
   • Set identical SSID on both devices (e.g. PLANT-BACKBONE)
   • Set identical WPA2-PSK passphrase (minimum 8 characters, recommended 20+)
   • Disable Auto channel; use a fixed channel
6. On the W748-1-M12 client, set Operating mode = Client. On the W788-1-M12, leave as Access Point.
7. Click Set Values > Commit. Both radios must show Link up in the Information > WLAN page before continuing.

S7-300 PN Interface and NetPro Configuration

The PROFIBUS subnet is configured in HW Config with the integrated DP master port of the CPU 315-2 PN/DP. The PROFINET interface is configured in the same project but is not used for PROFINET I/O — it is used for the S7 communication path over WLAN.

1. In HW Config, open the CPU 315-2 PN/DP properties and select the PROFINET interface tab.
2. Create or assign an Ethernet subnet named, e.g., WLAN-BACKBONE with IP 172.20.16.32 / 255.255.240.0 on the master and 172.20.16.13 / 255.255.240.0 on the slave. Do not enable PROFINET I/O mode on this interface.
3. Open NetPro. Right-click the master CPU, choose Insert New Connection, and select S7 connection as the partner.
4. In the connection properties:
   • Local end: master CPU PN interface
   • Partner end: slave CPU, address 172.20.16.13
   • Connection ID — record the value (e.g. ID 1, used as the ID input to BSEND/BRCV)
5. Compile and download NetPro to both stations. The connection is now established by the OS on the active path; BSEND/BRCV will use this connection handle.

According to Siemens documentation, an S7-300 CPU with an integrated PROFINET interface can be configured as a client for S7 communication, and the same blocks used for S7-400 and S7-1500 scenarios apply. See the Siemens TIA Portal documentation on S7 communication instructions for the formal instruction set.

User Program: BSEND / BRCV Blocks for the WiFi Path

BSEND (SFB 12) and BRCV (SFB 13) carry the redundancy DB in chunks. They are placed in OB1 (or OB35 for cyclic) and use the connection ID established in NetPro.

Inputs / outputs (BSEND, SFB 12):

• REQ — trigger to send
• R — abort
• ID — connection ID from NetPro (e.g. 1)
• R_ID — arbitrary 32-bit ID that must match BRCV (e.g. DW#16#00000001)
• DONE, NDR, ERROR, STATUS — result outputs
• SD_i — pointer to send area (e.g. P#DB100.DBX0.0 BYTE 240)
• LEN — length in bytes (1 to 65535, but for S7-300 the practical limit is the CPU work memory)

ST example — call on the master CPU:

// Master side: send DB100 to slave over WLAN
// Connection ID 1 is the S7 connection defined in NetPro on the PN interface
CALL "BSEND", DB12  // instance DB for BSEND
  REQ   := %DB11.DBX0.0    // rising edge triggers a send cycle
  R     := FALSE
  ID     := W#16#1          // NetPro connection ID 1
  R_ID   := DW#16#00000001  // must match R_ID on BRCV
  DONE  := %DB11.DBX1.0
  ERROR := %DB11.DBX1.1
  STATUS:= %DBW2
  SD_i  := P#DB100.DBX0.0 BYTE 240
  LEN   := 240;

// Evaluate result
IF %DB11.DBX1.1 THEN      // ERROR high
  IF (%DBW2 AND W#16#8000) = W#16#8000 THEN
    // Class A error — connection fault
    %DB11.DBX3.0 := TRUE;   // set WiFi link "down" flag for switchover logic
  END_IF;
END_IF;

ST example — call on the slave CPU:

// Slave side: receive DB100 from master over WLAN
CALL "BRCV", DB13  // instance DB for BRCV
  EN_R  := TRUE
  R     := FALSE
  ID    := W#16#1          // NetPro connection ID 1
  R_ID  := DW#16#00000001  // must match R_ID on BSEND
  NDR   := %DB21.DBX0.0    // new data received
  ERROR := %DB21.DBX0.1
  STATUS:= %DBW2
  RD_i  := P#DB100.DBX0.0 BYTE 240
  LEN   := %DBW4;          // actual length returned

User Program: PROFIBUS Path Using PUT / GET or I/O Slaves

On most S7-300 PROFIBUS master/slave topologies, the "PROFIBUS path" is either a DP slave exchange (consistent PKE/IND/PZD data over SFC14/SFC15) or an S7 connection on the integrated DP port using PUT/GET (SFB14/SFB15) or USEND/URCV. The redundancy switchover logic does not care which transport carries the data — it only watches the health of each path.

For a PROFIBUS-based S7 connection configured in NetPro on the DP port:

// PROFIBUS S7 connection ID — typically 2 when PN connection is ID 1
CALL "PUT", DB14
  REQ   := %DB11.DBX10.0
  ID    := W#16#2         // PROFIBUS S7 connection ID
  DONE  := %DB11.DBX11.0
  ERROR := %DB11.DBX11.1
  STATUS:= %DBW12
  ADDR_1:= P#DB200.DBX0.0 BYTE 240
  SD_1  := P#DB100.DBX0.0 BYTE 240
  LEN   := 240;

When a DP slave goes off-bus, PUT/GET reports STATUS = W#16#81A4 (connection aborted) or W#16#80B0 (no connection resource). Capture these and feed the switchover logic.

Software Redundancy: Application-Level Path Selection

The control algorithm runs every cycle. The DB to be exchanged (DB100) is written to or read from either:

1. Path A — PROFIBUS (preferred, lower latency ~5–20 ms typical for DP)
2. Path B — WiFi via SCALANCE W (higher latency 30–80 ms, but survives cable damage)

The state machine in the user program:

ST logic (master CPU, OB1):

// Path health flags (TRUE = healthy)
%DB11.DBX20.0 := NOT %DB11.DBX11.1;  // PROFIBUS OK (no ERROR)
%DB11.DBX20.1 := NOT %DB11.DBX3.0;   // WLAN OK (no ERROR)

// Retentive timer for PROFIBUS retry interval
IF %DB11.DBX20.0 AND %DB11.DBX21.0 = FALSE THEN
  // start a 30 s timer (using IEC timer TP or SFB4 / S_ODT)
  %DB11.DBX22.0 := TRUE;             // start pulse
END_IF;

IF TP_DB.TIME_OUT THEN
  %DB11.DBX21.0 := TRUE;             // PROFIBUS retry flag
END_IF;

CASE %DB11.DBB30 OF
  0:  // STATE_A_RUN — PROFIBUS
      IF NOT %DB11.DBX20.0 THEN
        %DB11.DBB30 := B#16#1;       // switch to WLAN
        %DB11.DBX21.0 := FALSE;
      END_IF;

  1:  // STATE_B_RUN — WLAN
      IF NOT %DB11.DBX20.1 THEN
        %DB11.DBB30 := B#16#2;       // failsafe
      ELSIF %DB11.DBX21.0 AND %DB11.DBX20.0 THEN
        %DB11.DBB30 := B#16#0;       // back to PROFIBUS
        %DB11.DBX21.0 := FALSE;
      END_IF;

  2:  // STATE_FAILSAFE
      IF %DB11.DBX20.1 THEN
        %DB11.DBB30 := B#16#1;       // WLAN recovered
      END_IF;

END_CASE;

// Trigger appropriate send block based on active state
IF %DB11.DBB30 = B#16#0 THEN
  %DB11.DBX10.0 := TRUE;  // PROFIBUS PUT
  %DB11.DBX0.0  := FALSE; // WLAN BSEND off
ELSIF %DB11.DBB30 = B#16#1 THEN
  %DB11.DBX0.0  := TRUE;  // WLAN BSEND on
  %DB11.DBX10.0 := FALSE; // PROFIBUS PUT off
END_IF;

Status / Error Code Reference for S7 Communication Blocks

Commissioning Procedure and Verification

1. Radio link test. On the W748, open WBM > Information > WLAN and confirm "WLAN1 Link = Up" with signal strength > -70 dBm. Anything below -75 dBm is unreliable for control traffic.
2. IP ping. From a service laptop attached to the master switch, ping the slave CPU PN interface: ping 172.20.16.13 -t. Zero loss expected. If the radio path is the only one up, latency should stay below 30 ms for 240-byte payloads.
3. STEP 7 online diagnostics. In NetPro, right-click the S7 connection and select Connection Status. Connection state should be Established. The local and partner connection IDs and port numbers must match.
4. BSEND / BRCV smoke test. Place a counter in DB100.DBD0 on the master and read it on the slave via VAT online. Increment the counter on the master and confirm the slave value tracks within one OB1 cycle.
5. PROFIBUS cut test. With both paths healthy, disconnect the PROFIBUS connector. The switchover should occur within one OB1 cycle after the error is registered. Confirm process data continues to update on the slave via WLAN.
6. WLAN cut test. Restore PROFIBUS, power off the W748. The application should remain on the WLAN path; when re-powered, a 30 s timer should bring the system back to PROFIBUS if the DP path is healthy.
7. Long-duration soak. Run for at least 24 hours with periodic background noise (e.g., arc-welding, VFD harmonics) and inspect the diagnostic buffer (CPU > Diagnostic Buffer) for transient STATUS 81C3 / 80C3 entries. More than one per hour indicates antenna or channel issues.

Performance and Cycle-Time Considerations

Set the PROFIBUS DP cycle to ≤ 5 ms, OB1 cycle to ≤ 20 ms, and the WiFi retry interval to 30 s. Avoid setting the OB1 priority below 10 — the switchover logic must preempt slow background blocks.

Troubleshooting Matrix

Alternative Controllers and Equivalent Implementations

The application-level redundancy approach used here is independent of the WiFi hardware and applies to other Siemens families. The same state machine in OB1 can drive a CPU 315-2 PN/DP, a CPU 317-2 PN/DP, an ET 200S IM 151-8 PN/DP CPU, or an S7-1500 with PN interface. For S7-1500, the official guidance is to use TSEND_C / TRCV_C or PUT / GET in the user program, since S7-1500 no longer exposes the older SFB 12 / SFB 13 calls in the same form. For S7-400H, the redundancy is handled at the system level (H-system) and this manual failover logic is unnecessary.

Safety and Operational Caveats

• This design is not safety-rated. Do not use it for SIL 1 / SIL 2 / SIL 3 communication. For functional safety, use PROFIsafe over PROFINET with a certified F-CPU and F-I/O.
• The failsafe state of the slave must be defined in the user program (hold last good value, or drive outputs to a defined safe state) before commissioning. Otherwise a WiFi-only environment will let outputs float.
• WPA2-PSK is acceptable for cell-level industrial WiFi; for higher assurance, use 802.1X with a RADIUS server. SCALANCE W supports both.
• Document the failover interval (30 s) in the FMEA and in the operations manual. Operators must understand that during failover, the system is on the slower path.

FAQ