Configuring S7-300 Software Redundancy with WinCC Flexible HMI

Overview

The SIMATIC S7-300 PLC family does not support hardware (fault-tolerant) redundancy; that capability is reserved for the SIMATIC S7-400H and S7-400F/FH systems with optical synchronization modules. For an S7-300 application, the correct redundancy approach is Software Redundancy (SWR) – an application-level scheme in which a standby CPU 31x maintains a shadow image of the primary's process data over an MPI or PROFIBUS link and takes over control with a brief interruption if the primary fails. This reference describes the configuration of SWR on a CPU 315-2DP and provides a practical script-based approach for monitoring the active CPU and switching the HMI's data source in WinCC Flexible on an MP277 10" Touch panel.

The discussion that frames this article began with a request for a "script for hardware redundancy in WinCC Flexible" on a CPU 315-2DP and an MP277. The correct interpretation, as clarified in the original exchange, is that the engineer needed software redundancy, not the S7-400H-class hardware redundancy. The sections below separate those two concepts, then step through the SWR library, the WinCC Flexible connection configuration, and a VBScript that drives the HMI's active-CPU awareness.

Hardware Redundancy vs. Software Redundancy

Before commissioning, confirm which redundancy class the application actually requires. The two are not interchangeable, and selecting the wrong one is the most common source of confusion in S7-300 projects.

Architecture and Prerequisites

Hardware

• Two S7-300 CPUs of the same type and firmware version (the example uses CPU 315-2DP / 6ES7 315-2AG10 or later, but any CPU 31x that supports the SWR option is acceptable).
• One MPI or PROFIBUS cable between the two CPUs to carry the redundancy frames.
• Single PROFIBUS DP master network or PROFINET IO network on the primary CPU for the I/O.
• SIMATIC MP277 10" Touch (6AV6 643-0CD01-1AX1 or compatible) with WinCC Flexible 2008 SP3 or later.
• PG/PC with STEP 7 V5.5 + SP4 and the SWR option package installed.

Software

• STEP 7 V5.5 with the Software Redundancy option installed (entry ID 1137637 in the Siemens support portal covers installation and authorization).
• WinCC Flexible 2008 SP3 (or later 2008 SP) installed on the configuration PC.
• The SWR library files SWR_V12x.zip (or current revision) unpacked so the FBs are visible under Libraries > Redundancy in the STEP 7 Standard Library.

Network Topology

The two CPUs exchange a shadow image of selected data areas. Keep the redundancy link separate from the I/O network so that an I/O fault does not also break redundancy communication. A typical layout is:

• CPU-A (primary): MPI/DP interface X1 = redundancy link to CPU-B. MPI/DP interface X2 (if present) or PN interface = field I/O.
• CPU-B (standby): MPI/DP interface X1 = redundancy link to CPU-A. No I/O attached, or its outputs disabled in the user program.
• MP277: MPI/PROFIBUS to one CPU; the HMI's connection table is configured to both CPUs (see HMI section).

PLC Software Redundancy Configuration (STEP 7)

Project Setup

Create two STEP 7 stations in the same project – one for the primary (CPU-A) and one for the standby (CPU-B). Both stations must use identical hardware, identical user program blocks, and identical data-block structure; only the call to the SWR start-up block differs by role.

Inserting the SWR Library

Open File > Open > Libraries > Standard Library > Redundancy. The library contains the function blocks required to start, monitor, and synchronize the two CPUs. Per the Siemens FAQ (entry ID 1137637), the most commonly used FBs for S7-300 software redundancy are:

Wiring the Start-up (OB 100)

In OB 100 of each CPU, call SWR_START with parameters that identify the partner CPU by MPI/PROFIBUS address and that declare the local role. A typical instance is:

// OB 100 - Warm restart
CALL FB 101, DB 101  // SWR_START
  PARTNER_ADR  := 2          // MPI address of partner CPU
  LOCAL_ROLE   := TRUE       // TRUE = this CPU is primary at startup
  MODE         := 1          // 1 = master/standby
  RET_VAL      := MW 100     // Return code
  BUSY         := M 101.0    // Initialization active

The two CPUs negotiate the role during start-up: whichever CPU is the first to complete OB 100 becomes the primary; the other becomes the standby.

Cyclic Operation (OB 1)

In OB 1 of both CPUs, call SWR_DIAG to refresh status flags. In OB 1 of the primary only, call SWR_SEND; in OB 1 of the standby only, call SWR_RCV. A common pattern uses a flag (e.g. M 0.0) that is set true only on the primary via the result of SWR_DIAG to gate the send/receive call.

// OB 1 - Primary side
      A     M      0.0       // "I am primary" flag
      JCN   NO1
      CALL FB 103, DB 103     // SWR_SEND
        SEND_AREA := P#DB 50.DBX 0.0 BYTE 200   // 200 bytes of shadow data
        RET_VAL   := MW 110
NO1: NOP 0
      CALL FB 102, DB 102     // SWR_DIAG (in both CPUs)
        RET_VAL   := MW 112
        STATE     := MW 114   // 1=primary, 2=standby, 3=failover

Define the shadow-image DB (e.g. DB 50) to contain every value that must survive the failover – typically the values of the retentive DBs that you would otherwise want preserved. RETAIN attributes on data alone are not sufficient when the standby takes over because the original RAM image belongs to the failed CPU.

HMI Connection Setup in WinCC Flexible

WinCC Flexible does not provide a one-click "redundancy" wizard. The practical approach is to create two S7-MPI/PROFIBUS connections (one to CPU-A, one to CPU-B), expose a status tag from the PLC that indicates the active CPU, and use a VBScript to drive the HMI's tag values from the correct connection.

Step 1 – Create Two Connections

In the WinCC Flexible project tree, open Connections and add:

1. Connection_1 – MPI/PROFIBUS to CPU-A at address 1, slot 2 (CPU 315-2DP default).
2. Connection_2 – MPI/PROFIBUS to CPU-B at address 2, slot 2.

Use the same PG/PC interface profile for both. Verify that the HMI can be pinged or polled in Transfer > Available Nodes on each PLC separately before going further.

Step 2 – Define Tag Pairs

For every process tag the screens must display, define two HMI tags that point to the same PLC address but use different connections:

On the screen, bind the IO field or trend to Press_A in normal operation and to Press_B when the status tag indicates CPU-B is active. The next section automates that with a VBScript that mirrors the tags every cycle.

Step 3 – Area Pointers (Optional but Recommended)

Configure the Coordination and Project ID area pointers on both connections. WinCC Flexible uses the coordination byte to detect which CPU the HMI is currently exchanging life signs with. The coordination byte is also where WinCC Flexible itself signals to the PLC that the HMI is online – useful for graceful shutdown of the standby.

Status Tag and Diagnostic Tags

The SWR library surfaces a small set of status words that the HMI can use to drive screens, alarms, and the script. Always expose the status on a connection that is reachable in normal operation – typically the primary. Mirror the same status to the standby so that the HMI's view is consistent whichever CPU is up.

VBScript for Active CPU Detection

WinCC Flexible supports VBScript under Scripts > Global Script. The script below is scheduled on a 1-second timer; it reads the status word from both connections and copies the tag values of the active connection into a parallel set of "display" tags that the screens actually use. The pattern keeps the screen bindings static while the data source can change without a screen reload.

'--- GlobalScript: Sync_RedundantTags (1 s cycle) ---
Dim iStatusA, iStatusB, sActive, i

' Read STATE word (MW 114) from each connection
iStatusA = SmartTags("STATE_A").Value   ' from Connection_1
iStatusB = SmartTags("STATE_B").Value   ' from Connection_2

' Determine which CPU is currently authoritative
If (iStatusA = 1) Or (iStatusA = 3) Then
    sActive = "A"   ' CPU-A is primary or in failover (still valid briefly)
ElseIf (iStatusB = 1) Then
    sActive = "B"   ' CPU-B has taken over
Else
    sActive = ""    ' no valid CPU
End If

' Mirror the active side into the display tags
If sActive = "A" Then
    SmartTags("Disp_Press").Value   = SmartTags("Press_A").Value
    SmartTags("Disp_Temp").Value    = SmartTags("Temp_A").Value
    SmartTags("Disp_ActiveCPU").Value = "CPU-A"
ElseIf sActive = "B" Then
    SmartTags("Disp_Press").Value   = SmartTags("Press_B").Value
    SmartTags("Disp_Temp").Value    = SmartTags("Temp_B").Value
    SmartTags("Disp_ActiveCPU").Value = "CPU-B"
Else
    SmartTags("Disp_ActiveCPU").Value = "NO LINK"
End If

' Optional: log transitions to the alarm buffer
If sActive <> SmartTags("Prev_ActiveCPU").Value Then
    SmartTags("Prev_ActiveCPU").Value = sActive
    ' Raise a WinCC Flexible alarm via the bit-triggered message system
    SetBit SmartTags("Alarm_RedundancyChange"), 0
End If

Scheduling the Script

Open Global Script > Project Functions, add the function Sync_RedundantTags, then create a Scheduled Task in Schedules with a 1 s trigger. Do not use a 100 ms cycle for this function – the SWR status word updates only once per scan, and excessive polling adds no information.

Event-Driven Alternative

For systems with many tags, replace the polling with an event-driven copy. In the tag properties of STATE_A and STATE_B, attach a Value Change event that triggers the same copy logic. This removes the 1 s latency and reduces HMI CPU load, at the cost of more tag-property configuration.

Commissioning Procedure

1. Power up both CPUs simultaneously. Observe the SF/BF LEDs – both should extinguish once the SWR relationship is established.
2. Confirm the role assignment on the PG: open PLC > Accessible Nodes and read the diagnostic buffer of each CPU. OB 100 should contain an entry from SWR_START reporting the negotiated role.
3. Force the standby to take over by stopping the primary (MRES not required; power down is sufficient). Watch the MP277: within a few seconds the system status should switch to "CPU-B" and the displayed values should resume from the last shadow image.
4. Restore the primary. Confirm the system returns to the original state without losing the live process image (the new primary will re-read the shadow image once the link is re-established).
5. From the HMI, navigate to the diagnostics screen and verify that the alarm log captured the failover event with the correct timestamp.

Verification and Diagnostics

PLC-Side Checks

• Diagnostic buffer – Filter for entries from SWR_ blocks. Look for RET_VAL non-zero, partner not reachable, or role reversal events.
• Status word – Force MW 114 to 1 in the primary and confirm the HMI displays "CPU-A"; force it to 2 in the standby and confirm the HMI displays "CPU-B".
• Watchdog – Add a counter in OB 1 that increments only on the primary; it must freeze when the primary is offline, then resume from the previous value on the new primary.

HMI-Side Checks

• Connection status – WinCC Flexible's connection diagnostics (under Tools > Status) shows whether each of the two S7 connections is in "Online" or "Offline".
• Tag simulation – Use the tag simulator to force STATE_A and STATE_B and confirm that the VBScript flips the display tags.
• Audit log – Verify that the redundancy-change alarm appears in the alarm log with the correct priority and that it is acknowledged and reset properly.

Troubleshooting Matrix

Migration to TIA Portal / WinCC Unified

WinCC Flexible has been succeeded by WinCC Comfort/Advanced (TIA Portal) and most recently by WinCC Unified V21. The newer platforms do not change the underlying SWR principle on S7-300, but they do change the HMI-side implementation:

• WinCC Unified V21 adds native Runtime redundancy: a single HMI device can be configured with two S7 connections and a "Redundancy" runtime setting that handles the active-CPU switchover internally, removing the need for a custom VBScript. See the official configuration guide at Configuring redundancy in WinCC Unified V21.
• WinCC Comfort/Advanced (TIA Portal) retains the dual-connection + script pattern from WinCC Flexible. The script is migrated to a TIA script in C or VB and is scheduled on a cyclic trigger.
• STEP 7 V5.5 → TIA Portal projects can be migrated, but the SWR library must be re-inserted from the TIA Portal version. The FB numbers and instance DBs may differ; verify against the TIA Portal help on "Software Redundancy".

If you are starting a new project today, prefer a TIA Portal-based S7-300 with WinCC Comfort on a Comfort Panel (MTP/Comfort series), or move to an S7-1500 with WinCC Unified for full native redundancy support.

Standards and Documentation References

• Siemens Support Entry 1137637 – Software Redundancy for S7-300/S7-400 (STEP 7 V5.x)
• WinCC Unified V21 – Configuring Redundancy (RT Unified)
• SIMATIC S7-300 CPU 31xC and CPU 31x Operating Instructions (Siemens manual package, current edition)
• WinCC Flexible 2008 SP3 User's Manual (Siemens, 6AV6 691-1AB01-0AB0)
• STEP 7 V5.5 Reference Help – "Redundancy" library description