Configuring WinCC Redundancy for S7-300 SWR Systems

1. Problem Description

Engineers running WinCC 6.0 SP4 with an S7-300 CPU pair configured for SWR (Software Redundancy) frequently encounter a tag-value freeze during a CPU changeover. Symptoms observed in the field:

• Process values displayed on WinCC pictures stop updating immediately when the standby CPU 315-2 DP/PN takes over from the master.
• Archive segments do not capture the transition; the last value remains "frozen" on the screen until the next operator action.
• WinCC does not log a connection-loss event in the WinCC SysLog because the underlying channel driver is still bound to the connection name.
• After the new master CPU assumes control, no automatic reconnect is performed by the HMI station.

The PLC side is healthy: the SWR backplane pair swaps roles, the program is replicated by the SWR synchronisation service, and STEP 7 diagnostics show clean role transitions. The data loss is isolated to the WinCC station.

2. Root Cause Analysis

WinCC 6.0 SP4 ships two distinct redundancy mechanisms, and the two are not interchangeable:

When the OS Project Editor is applied, it reorganises the picture tree and the area hierarchy. The wizard that injects the @RedundantConnection C-script into the start picture is no longer wired to the picture events because the area tree no longer matches the wizard's expected navigation nodes. The wizard code itself still exists on the installation media, but the Graphics Designer no longer enumerates it.

The S7-300 SWR pair does not present itself as a single redundant HMI connection to WinCC. WinCC sees two independent S7-300 named connections, each with its own MPI/DP/TCP address. The channel driver has no concept of which CPU is currently the active partner, so a role swap appears to the driver as a partner going offline. WinCC holds the last polled value because the connection name still resolves to a configured partner, and the polling task continues without an error event.

The Make Redundant Connection dynamic wizard is a client-side, server-pair feature, not an S7-300 SWR feature. It is intended for the SIMATIC S7-400H / WinCC Server Redundancy topology, where the S7 redundancy is performed by the PLC and exposed to WinCC through the Redconnect service running on a PC station equipped with a CP1613.

3. Technical Background

3.1 S7-300 Software Redundancy (SWR)

SWR is the Siemens package for S7-300 that allows a standby CPU to mirror the program and data of a master CPU. The library blocks (FB 101 "SWR_START", FB 104 "SWR_SYM"¶, etc.) handle the role assignment, the cyclic copy of the synchronised data areas, and the diagnostics. SWR does not use the S7-400H backplane bus; the redundancy is implemented entirely in software at the application level. As a result, the OS layer (WinCC) cannot use the S7H/Redconnect stack and must poll both CPUs independently.

3.2 OS Project Editor Behaviour

The OS Project Editor is a WinCC add-on normally deployed in PCS 7 plants. It performs three functions relevant to this fault:

1. It generates the area hierarchy ("Overview", "Unit", "Unit overview") from the STEP 7 plant view.
2. It rewrites the start.pdl and root pictures to navigate by area name rather than by picture name.
3. It re-binds the Dynamic Wizard catalogue that the Graphics Designer exposes to a project-specific subset.

Item 3 is what hides the Make Redundant Connection wizard: the project-specific subset omits the wizard because the OS Project Editor considers server-pair WinCC Redundancy to be the supported topology. SWR is treated as a PLC-level concern that WinCC should handle through normal channel polling.

3.3 Why WinCC Holds the Last Value

The SIMATIC S7 Protocol Suite channel maintains a polling cycle per logical connection. On a partner failure, the channel does not raise a connection-lost event; it transitions the connection to the DISCONNECTED state only if the configured retry count is exhausted. With default retry settings (3 retries, 1 s timeout), a momentary SWR changeover (typically 200–800 ms) is too short to be classified as a disconnect, so the connection stays "up" from WinCC's perspective, the tag retains its last cached value, and the new partner's data is never requested.

4. Prerequisites

Before reconfiguring the WinCC station, confirm the following:

• WinCC 6.0 SP4 installed with the Dynamic Wizard Editor option enabled (default in a full install).
• STEP 7 V5.4 SP3 or later with the S7-300 SWR option package installed on the engineering station.
• Both S7-300 CPUs programmed with the SWR library blocks; role diagnostics available via FB 101 outputs.
• The two CPUs reachable from the WinCC station over the configured transport (MPI/PROFIBUS or Industrial Ethernet/TCP).
• WinCC station has at least 32 free internal tags for the failover mirror (see §6).

5. Solution A: Restore the Dynamic Wizard (Not Recommended for SWR)

The Dynamic Wizard Editor can be used to re-inject the Make Redundant Connection C-script. The procedure follows.

1. Start the editor from Start > SIMATIC > WinCC > Tools > Dynamic Wizard Editor.
2. Open the file Error Box.wnf via File > Open.
3. From the toolbar select Dynamic Wizard > Create DWD and close the editor.
4. Re-open the WinCC project; the Make Redundant Connection entry should now appear in the Graphics Designer Dynamic Wizard tree.

6. Solution B: Manual Tag-Based Failover (Recommended)

The reliable path is to poll both CPUs and route values through an internal tag mirror that is selected by a "role" tag. The procedure below uses only standard WinCC features and does not require the dynamic wizard.

6.1 Define Two External Connection Channels

In WinCC Explorer > Tag Management > SIMATIC S7 Protocol Suite, create two logical connections:

Set the connection properties to:

• Update time: 500 ms (matches the SWR transition window).
• Timeout: 300 ms.
• Maximum retries before disconnect: 2.

6.2 Mirror Each Process Tag

For every process tag T_xxx that the operator needs to see continuously, create two external tags (T_xxx_M and T_xxx_S) bound to the master and standby connections respectively, and one internal tag T_xxx_Active. The internal tag is the one the HMI screens read from.

6.3 Read the SWR Role Status

FB 101 "SWR_START" exposes the current role of the local CPU on a status word (typically DB 101 area). Read a single byte SWR_Role_M from the master connection and SWR_Role_S from the standby connection. A common mapping is:

6.4 Implement the Selection Logic in a Global Script

Open Global Script > C-Editor and add the following function. It runs on a 500 ms trigger and writes the active partner's value into the internal tag:

// Failover selection - 500 ms trigger
void SWR_Failover()
{
    DWORD roleM  = GetTagDWord("SWR_Role_M");   // master role
    DWORD roleS  = GetTagDWord("SWR_Role_S");   // standby role
    float valM   = GetTagFloat("T_xxx_M");
    float valS   = GetTagFloat("T_xxx_S");
    DWORD qerr   = 0;

    if (roleM == 1)            // master connection is the active CPU
    {
        SetTagFloat("T_xxx_Active", valM);
    }
    else if (roleS == 1)       // standby has taken over
    {
        SetTagFloat("T_xxx_Active", valS);
    }
    else                       // transition: hold last good value
    {
        // do nothing - T_xxx_Active keeps the previous value
    }
}

For a project with many tags, generate the body of SWR_Failover in a script that walks the tag list, e.g. using a comma-separated tag list stored in an internal text tag.

6.5 Update the Pictures

Search & replace every reference from T_xxx to T_xxx_Active in the .pdl files. Use WinCC Explorer > Cross Reference to confirm no reference to the old T_xxx remains.

6.6 Tag Naming Convention

7. System Tags for Server-Pair Redundancy (Reference)

If the project is later migrated to a WinCC Server Pair topology (RT Professional or WinCC 7.x), the redundancy control tags differ from the SWR approach. Reference values from the official TIA Portal documentation:

• @RM_MASTER – internal flag identifying the currently active WinCC server in a redundant server pair.
• @RM_MASTER_NAME – string containing the computer name of the active server; clients use this to redirect their connection.

For full parameter and event tables see the WinCC Redundancy system tags documentation (TIA Portal V20). These tags are not applicable to the S7-300 SWR scenario described in this article; they are listed only for engineers planning a migration to a server-pair topology.

8. Verification

1. Force a SWR role swap from STEP 7 (online > CPU > SWR > Switch Master).
2. Observe SWR_Role_M and SWR_Role_S in the WinCC tag simulator; expect roleM=2, roleS=1 within 1 s.
3. Watch the value of T_xxx_Active; it must update to the new master's value within one cycle (500 ms + 1 scripting cycle).
4. Check the WinCC SysLog for connection errors; the master connection should report DISCONNECTED and then be re-established, but the script must not have logged any operator-visible fault.
5. Repeat with the PLC disconnected (unplug the master CPU's PROFINET cable); the internal tag must freeze on the last good value, not drop to zero.

9. Field-Proven Caveats

• Update time alignment. The polling cycle must be shorter than the SWR transition window. With a 1 s update and 800 ms changeover, the value is captured during the gap and never refreshed.
• Quality code propagation. The internal _Active tag has the quality code "Good (Non-cascade)" regardless of which partner supplied the value. If the screen uses Output/Input fields with quality-code driven colours, copy the quality code from the source tag explicitly.
• Archive segments. Both external tags should be archived if a complete post-event audit is required; the internal tag is the one shown live.
• MPI/DP vs TCP. The failover logic works the same way on PROFIBUS and Industrial Ethernet, but the channel parameters differ. On MPI, the address is the partner's MPI node number; on TCP, it is the IP address plus rack/slot.
• PCS 7 OS Project Editor regeneration. Re-running the OS Project Editor will re-bind the picture tree and may strip the global script trigger. After any OS Project Editor run, re-attach the trigger and re-verify.

10. When to Use Redconnect Instead

If the requirement is a true zero-data-loss HMI failover rather than a value-hold display, the only Siemens-supported solution is:

• Upgrade the PLCs to an S7-400H pair.
• Equip the WinCC server PCs with CP1613 (or CP1623 / CP1628 on later hardware) and install the Redconnect software.
• Configure the connection via the Make Redundant Connection dynamic wizard that is available in a non-OS-Project-Editor project.

This topology supports sub-second, in-sync server failover and is documented separately. It is not applicable to the S7-300 SWR case because S7-300 SWR does not implement the S7H redundancy protocol that Redconnect requires.