Configuring S7-300 Software Redundancy with WinCC over MPI

System Architecture Overview

A standard redundancy requirement in a SIMATIC S7-300 environment pairs two S7-315-2DP CPUs (a master and a standby) with a single WinCC station that monitors the active controller. When a fault, stop, or communication failure is detected on the master, the standby takes over process control and WinCC automatically switches its data source to the partner PLC, preventing a loss of view for operators.

The original project request in this scenario is deceptively simple: connect two 315-2DP CPUs to one engineering PC using two physically separate MPI/Profibus networks, so that the loss of either cable or either CPU does not interrupt HMI visibility. In practice, this requirement immediately runs into two architectural constraints that determine everything that follows:

1. The S7-300 family does not support H-system fault-tolerant S7 connections. Fault-tolerant S7 connections (redundant S7 connections terminated in both CPUs simultaneously) are a feature of the S7-400H only, and they require specific CP hardware (for example CP1613 on the PC side) and the H-CPU firmware.
2. Only one CP 5611 can be installed per PC. The CP 5611 is a single-channel Profibus/MPI card and only one access point can be active in the PG/PC interface at a time. To bring two physically separate Profibus/MPI masters into one PC, you must use two cards (typically two CP 5613, or two CP 5623, or one of each generation).

The correct path for S7-315-2DP plus WinCC is therefore software redundancy (Siemens terminology: Software Redundancy for S7-300 / S7-400), combined with the WinCC Redundant Connection Wizard. The wizard creates two S7 connections in WinCC - one to PLC A and one to PLC B - and toggles between them based on the standby/active status reported by the redundancy logic running in the PLCs themselves.

S7-300 Redundancy Models: H-System vs. Software Redundancy

Siemens documents two distinct ways to build a redundant control system. They are not interchangeable, and selecting the wrong one is the most common reason S7-300 redundancy projects fail at the planning stage.

Hardware Requirements: CP Card Selection

Choosing the right PC communication module is the second decision point and it has direct consequences on what WinCC will let you configure.

Field-proven rule for S7-315-2DP software redundancy: install two CP 5613 (or two CP 5623) in the PC, assign one to the Profibus network of PLC A and the other to the Profibus network of PLC B. Each card is configured in PG/PC Interface with a unique access point (for example S7ONLINE_A and S7ONLINE_B) so that WinCC can resolve both connections independently. Trying to share a single CP 5611 between two masters is not possible because the PG/PC interface only exposes one active access point per device.

Network Topology Design

For a 2 x 315-2DP software redundancy cell that is also connected to ET 200M distributed I/O, the bus assignment is fixed by the physical ports on the CPU:

• Port 1 (MPI/DP, X1) - default Profibus master, used for the ET 200M stations.
• Port 2 (DP, X2) - second Profibus interface on the 315-2DP, also MPI-capable, used here for the HMI segment.

The PC connects to the HMI segment of each PLC through its own CP card. The two HMI segments must be electrically isolated from each other (two separate Profibus cables, two Profibus terminators, two distinct bus addresses for the two 315-2DPs and the two CP cards) so that a short or break in one cable cannot take down both connections.

Because the HMI segment of each 315-2DP runs as an MPI bus at 187.5 kbps (the default and the most reliable MPI baud rate; faster 1.5 Mbps MPI is supported by the 315-2DP but rarely used in mixed Profibus/MPI cells), the HMI data rate is the limiting factor on the WinCC side. Plan tag counts and update times accordingly - large tag lists with sub-100 ms updates will saturate the MPI channel before the Profibus I/O segment does.

STEP 7 Project Setup for Software Redundancy

The redundancy function in the PLCs is provided by the Software Redundancy library (commonly referred to as the SWR library). The library is installed with STEP 7 and added per project. Key function blocks from the library:

Minimum call sequence in OB 1 on both 315-2DP CPUs:

// OB 1 - software redundancy calls (both PLCs)
CALL FB 101, DB 101  // SWR_START - only on cold restart in OB 100 normally
    Partner_CPU      := 3           // MPI address of the other 315-2DP
    Partner_DB       := 101         // redundancy DB number on partner
    Local_DB         := 101         // redundancy DB number on this CPU
    Cycle_Time       := T#200ms

CALL FB 102, DB 102  // SWR_ZUSTAND - cyclic, OB 1
    Mode             := 'A'         // 'A' = primary or backup,
                                    // 'S' = solo, 'X' = unknown

// Application code: copy of process-relevant DBs
// Use FC 100 (SWR_SEND) and FC 101 (SWR_RCV) for each
// mirrored DB. The DBs must exist with identical
// numbers and identical structure on both PLCs.
CALL FC 100          // SWR_SEND for DB 200 (process image mirror)
CALL FC 101          // SWR_RCV  for DB 200

WinCC Channel Configuration

On the PC side, two SIMATIC S7 Protocol Suite channels are created - one per CP card. Each channel exposes a separate logical access point in the PG/PC interface:

1. Open PG/PC Interface (Control Panel → Set PG/PC Interface). Configure CP card A with access point S7ONLINE_A pointing to the Profibus/MPI network that carries PLC A (address 2). Configure CP card B with access point S7ONLINE_B pointing to the network that carries PLC B (address 3).
2. In WinCC Explorer open Tag Management → SIMATIC S7 PROTOCOL SUITE. Add two PROFIBUS (MPI) channel units, one bound to S7ONLINE_A, the other to S7ONLINE_B. Inside each unit create one S7 connection: connection A targets PLC address 2 on MPI, connection B targets PLC address 3 on MPI.
3. Set the partner slot/rack to match the CPU. For a 315-2DP in slot 2 of rack 0 the connection parameters are rack = 0, slot = 2.

WinCC Redundant Connection Wizard Procedure

The wizard replaces manual A/B connection management and is the documented path for S7-300 software redundancy with WinCC.

1. In WinCC Explorer, right-click the S7 Protocol Suite channel and select Redundant Connection (or run the wizard from Options → Redundancy → Create Redundant Connection). WinCC launches the connection pair wizard.
2. Step 1 of the wizard: select the PLC A connection you just created. This is the connection that will carry tags while PLC A is in MASTER state.
3. Step 2: select the PLC B connection. WinCC pairs the two connections internally as a redundancy group.
4. Step 3: define the status tags that WinCC reads from each PLC to determine the active partner. Typical choices are the SWR_ZUSTAND output word (one bit set when CPU is primary, another when backup) or user-defined flags updated in OB 1.
5. Step 4: define the switchover condition. WinCC switches to the backup connection when (a) the active connection is in error state, OR (b) the status tag on the master indicates it is no longer primary.
6. Step 5: assign the redundancy group name and complete the wizard. WinCC generates a redundancy tag set and a connection-pair internal variable used by the channel driver.

After the wizard finishes, every tag in the WinCC project can be configured to use the redundancy group instead of a specific connection. The tag will be read from PLC A while PLC A reports primary, and seamlessly from PLC B on failover.

Data Tag Synchronization and Partner PLC Selection

Software redundancy on S7-300 does not duplicate I/O - the standby CPU has no field wiring. It mirrors the master's process image (the relevant DBs) via the FC 100 / FC 101 calls in OB 1. Three consequences are important when sizing the system:

• Standby must run the same STEP 7 program as the master. Mirrored DBs, FB call structure, and SWR block instance DBs must be identical.
• Outputs on the standby are disabled - SWR forces the standby to suppress DO writes to the Profibus I/O. The master is the only writer to the field. If you need bumpless handover of analog outputs, the receiving device (drive, valve positioner) must support last-value-hold on signal loss, or the application code must ramp outputs on switchover.
• Tag selection in WinCC is by area, not by signal type. If PLC A is the master for the first 500 tags and PLC B is the master for the next 500, the wizard still reads all tags from the active connection. Mirror the full process image on both sides to avoid undefined tag values during the few hundred milliseconds of failover.

Communication Performance and Timing

Verification and Commissioning Checklist

1. Both 315-2DPs are in RUN; SWR_START reports status word = 0x0003 (both primary and backup recognized).
2. STEP 7 online → PLC → Operating Mode shows PLC A as Master, PLC B as Standby. Swap master manually via the SWR control tag to confirm the partner correctly takes over outputs.
3. WinCC channel diagnostics (Tools → Channel Diagnosis) shows both S7 connections as Connected.
4. Force a STOP on the master CPU. WinCC values should freeze for the duration of one SWR cycle and then resume from PLC B. Operator should see a redundancy active alarm, not a connection failure alarm.
5. Pull the Profibus cable between the PC and PLC A. WinCC should report connection A failed and continue reading from PLC B.
6. Reconnect the cable. WinCC should automatically restore connection A and mark both as healthy without operator intervention.
7. Verify the standby CPU's output modules (ET 200M DO cards) are not writing. Probe a representative DO with a meter - it should read 0 V while the standby is in backup state, even though the application code on the standby is still updating the output process image.

Field-Proven Caveats and Common Pitfalls

Cross-Reference: When to Upgrade from S7-300 to S7-400H

If the project later demands sub-100 ms failover, bumpless analogue handover without ramp logic, or synchronized hot-standby execution of motion blocks, the S7-300 software redundancy path is no longer the right answer. The upgrade decision criteria:

• Switchover time required < 200 ms: requires S7-400H.
• Process must not see an output glitch on switchover: requires S7-400H with bumpless DO modules, or external hold-last-value on the field device.
• PC side must use the H-driver channel unit (S7-H Connection in WinCC): requires S7-400H plus CP 1613 or CP 1623.

For the original 2 x 315-2DP use case, the software-redundancy-plus-wizard approach described above is the only configuration that the firmware and the WinCC channel driver both support, and is the configuration that has been deployed successfully in many discrete-manufacturing cells where 1 - 3 s of HMI re-sync is acceptable.

FAQ