S7-300 Software Redundancy: Configuration, Timing & RUN-Mode Modification
Software Redundancy (SWR) for SIMATIC S7-300 implements master/reserve backup without dedicated redundant CPUs. A standard CPU 315-2DP (or comparable) acts as master, executing the application program and copying the result image to a reserve CPU over a backplane, MPI, PROFIBUS, or Industrial Ethernet link. When the master fails, the reserve takes over the I/O in a bounded switchover window. This reference consolidates field-proven configuration rules, the timing behaviour of the SWR library, control-word structure, and the safe procedure for online program modification in RUN mode on systems using ET 200M remote I/O.
1. System Architecture and Component Selection
A SWR configuration for S7-300 consists of the following elements:
- Two CPUs of the same type, typically CPU 315-2DP (order number 6ES7315-2AG10-0AB0 and equivalent) or CPU 317-2DP. Mixed CPU types are not supported.
- Redundant backplane or network link between the two CPUs. The link can be implemented over MPI, PROFIBUS, or Industrial Ethernet. Ethernet is the recommended media; MPI is the slowest and least deterministic.
- ET 200M remote I/O stations (IM 153-2 redundant-capable interface modules). Only the master CPU holds the PROFIBUS token and exchanges I/O with the ET 200M; the reserve does not run the I/O bus while it is standby.
- Software Redundancy package on the engineering station: blocks FC100, FB101 and the working data blocks (DB_WORK_NO, DB_SEND_NO, DB_RCV_NO). The SWR package is sold separately from SIMATIC Manager and is not part of the base STEP 7 installation.
The engineering PG/PC is required only for configuration, commissioning, and online modification. It is not part of the runtime path.
1.1 Redundant Link Selection
| Media | Typical Use | Data Refresh Latency | Recommendation |
|---|---|---|---|
| Industrial Ethernet (ISO-on-TCP / TCP) | Large plants, many mirrored DBs | Lowest | Preferred |
| PROFIBUS DP | Mid-size plants, ET 200M bus shared with link | Medium | Acceptable |
| MPI | Smallest installations, bench testing | High (multiple seconds) | Avoid in production |
The link carries the SWR partner handshake and the data areas to be mirrored from master to reserve. Link speed directly bounds the data transfer time measured between a successful write to the master and the same write becoming visible on the reserve.
2. Operating Model: Master, Reserve, and Standby
In SWR only the master CPU executes the application program. The reserve CPU mirrors the relevant data areas but does not run the user's cyclic logic. Output modules (including analog outputs) hold their last written value on the master; on switchover the reserve begins driving the outputs as soon as it becomes the active partner.
Functional consequences that must be engineered around:
- Outputs freeze for the duration of the switchover. During this window the master has dropped off the network and the reserve has not yet taken ownership. Digital and analog outputs hold their last value. PID blocks freeze on their last manipulated variable; the integral term continues to be valid when the new master starts running.
- The reserve lags the master by the data transfer interval. Operator changes (setpoint writes, mode toggles) made on the HMI reach the master immediately but are not visible to the reserve until the next SWR update cycle elapses. A fault that occurs inside that window is served by a reserve still holding the older state.
- Engineering must compensate the worst-case transfer interval, not the average. Tune alarms and interlocks for the lag, and persist critical state (e.g. selected recipe, run/stop, manual/auto, current step) into the mirrored area immediately on operator action rather than relying on the next cycle.
3. Timing Behaviour
| Phase | Typical Duration (field-reported) | Determinants |
|---|---|---|
| Switchover from master to reserve after fault detection | < 2 s on a healthy link | Cyclic OB1 scan, partner watchdog, ET 200M bus re-arbitation |
| Data transfer cycle (master -> reserve) | Order of 10 s for full mirrored area on MPI/Profibus; lower on Ethernet | Link speed, volume of mirrored DBs, scan time of SWR FB |
| Reserve cold start (if data loss) | Several seconds; outputs remain at zero or default | OB100 execution, DB_WORK_NO regeneration, ET 200M parameterisation |
4. SWR Library Blocks and Their Placement
The SWR package delivers a small set of fixed-name blocks. Their placement is mandatory and their parameters are edited in OB100.
| Block | Type | Purpose | Placement |
|---|---|---|---|
| FC100 | Function | SWR control interface. Sets operating mode of the partner, holds the control word, and is called once per cycle from OB1. | OB100 (parameter edit) and OB1 (call) |
| FB101 (or equivalent in package revision) | Function block | Internal SWR state machine, performs partner handshake and data mirroring. | OB100, OB1 |
| DB_WORK_NO | Data block | Working DB for redundant software backup. Contains internal data only - do not edit in user code. | Generated by SWR; regenerated on restart |
| DB_SEND_NO | Data block | Send buffer for master -> reserve transfer. | Configured in OB100 |
| DB_RCV_NO | Data block | Receive buffer on the reserve side. | Configured in OB100 |
OB100 is the only place to configure SWR parameters. The configuration dialog assigns:
- Working DB number (DB_WORK_NO)
- Send DB number (DB_SEND_NO)
- Receive DB number (DB_RCV_NO)
- Number of mirrored user DBs (commonly up to 200 on large configurations)
- Partner MPI/PROFIBUS address or IP/connection parameters
5. Control Word and Mode Bits
SWR exposes a control word at user level. Two bits are reserved for online program modification:
| Bit | Symbolic Name | Effect |
|---|---|---|
| 11.0 | Deactivate redundant backup | When set, the master behaves as a standard CPU; the reserve no longer mirrors. Required before performing structural changes on the application program. |
| 11.1 | Activate redundant backup | When set, the partner handshake and mirroring resume. The system returns to high-availability mode. |
Additional bits in the same control word report partner status (master/reserve role, link state, partner alive, redundancy active). The HMI must use these bits to decide which partner is the source of truth; never trust the partner address alone.
6. Safe Procedure for RUN-Mode Program Modification
Altering the application program while the plant runs requires the sequence documented in section 4.8 of the SWR manual. Two cases are common in the field:
6.1 Code-only change (FC, FB body, OB1, OB35 logic)
- Edit the block in SIMATIC Manager on the engineering station.
- Download to the master CPU first. Test the new behaviour with the master still in control.
- Download the same modified block to the reserve CPU.
- Optionally perform a master-reserve changeover to verify the new code runs from the reserve side as well.
Deactivation of redundancy is normally not required for this case as long as the block interface (IN/OUT/STAT/TEMP) and any instance DB layout remain identical.
6.2 Structural change (new/renamed DB, new FB, hardware config change)
- Set the Deactivate redundant backup bit (control word 11.0) so the master runs as a stand-alone CPU.
- Modify the program on the reserve CPU first.
- Delete the working data blocks DB_WORK_NO, DB_SEND_NO and DB_RCV_NO from PLC memory if any SWR parameter changed (e.g. number of mirrored DBs).
- Load the new program into the reserve CPU and restart it (STOP -> RUN). The deleted working DBs are regenerated automatically.
- If a master-reserve changeover is needed, execute it now. The new code is now running on the master (formerly the reserve).
- Apply the same changes to the new reserve CPU (the old master) and restart it.
- Verify time-stamp consistency on every modified block in both partners (no timestamp conflict).
- Set the Activate redundant backup bit (control word 11.1) to restore the link.
7. Mandatory Engineering Conditions
These items are non-negotiable in a production SWR system; their absence is the most frequent source of unexplained STOP transitions during online modification:
- OB121 loaded on both CPUs. OB121 suppresses STOP on programming errors (e.g. access to a not-yet-loaded DB) and lets the cyclic scan continue. Without it, a single access error during a RUN-mode edit drops the CPU.
- OB100 present on both CPUs with identical FC100/FB101 parameters.
- Diagnostic buffer habit: on any INTF the first action is to open the diagnostic buffer. The cause recorded there is the source of truth; guessing wastes cycles.
- Master/Reserve status bit consumed by user logic so the reserve never runs the application in parallel with the master.
8. HMI Integration
The SWR package supplies HMI-side blocks intended for WinCC on a PC station. They expose role (master/reserve), partner address, and link health, and they give the HMI the means to remap tag connections to the active partner without operator intervention.
For WinCC flexible / ProTool panels (e.g. MP 370) the same package does not deliver blocks. The supported workaround is the CHANGE CONTROLLER function: the panel is configured with two connection paths (e.g. MPI address 3 for the master and MPI address 4 for the reserve) and a script toggles the active path based on the master/reserve status bit read from one of the two PLCs. Some scripting is required for fully automatic switching; the panel's OS (e.g. Windows CE on MP 370) determines what scheduling primitives are available.
9. Troubleshooting Matrix
| Symptom | Likely Cause | First Diagnostic Step | Remedy |
|---|---|---|---|
| Reserve CPU shows INTF after activating redundant link | Block timestamps diverge; structural change applied to one partner only | Read diagnostic buffer on both CPUs; run block consistency check | Deactivate link, delete DB_WORK_NO / DB_SEND_NO / DB_RCV_NO, re-load program, restart, reactivate |
| Time-stamp conflict on FB instance DBs | Instance DB was not regenerated after FB interface change | Open FB, accept interface, refresh block call sites with "Update" | Delete instance DBs in the project, let SIMATIC Manager recreate them, re-download |
| WinCC shows some areas live, others frozen after switchover | HMI tag remap only partial, or addresses both partners inconsistently | Inspect tag DB connections in WinCC, check partner status bit evaluation | Use the SWR WinCC blocks; switch all tags based on master/reserve bit |
| Switchover takes much longer than 2 s | MPI link used, or mirrored DB volume too large for scan time | Check link type and number/size of mirrored DBs | Move link to Ethernet or PROFIBUS; reduce mirrored area; partition DBs |
| Reserve goes STOP spontaneously on online edit | OB121 not loaded; programming error during edit triggered STOP | Diagnostic buffer, check OB121 presence | Load OB121, redo the edit with link deactivated |
| PID output jumps after switchover | Operator changed setpoint within the data-transfer window before the master failed | Verify the operator event log against the SWR transfer interval | Persist operator changes into the mirrored area on action; reduce transfer interval; re-tune PID |
| DB values appear corrupted after link activation | Asymmetric DB attribute/name change in one CPU only | Compare offline/online DB headers on both partners | Re-apply the DB change to both CPUs in deactivated state |
10. Commissioning Checklist
- Verify both CPUs are identical type and firmware version.
- Configure the redundant link first (Ethernet > PROFIBUS > MPI) and ping the partner from the engineering station through the same path.
- Load SWR library blocks and configure FC100 in OB100 with matching parameters on both CPUs.
- Load OB121 on both CPUs.
- Define the mirrored DB set; keep it as small as practical.
- Run a forced switchover test: stop the master and confirm the reserve takes control within the documented window. Verify outputs transition correctly and the HMI remaps.
- Run a power-cycle test: pull master power, confirm cold-start behaviour of reserve against the documented durations.
- Run a link-failure test: disconnect the redundant link, confirm both CPUs continue (or fail safe) per the design.
- Document the transfer interval measured under load; align operator and alarm procedures with that interval.
11. When to Prefer Hardware Redundancy or S7-400
S7-300 SWR is appropriate when the process tolerates the documented transfer interval and the brief output freeze on switchover. Where a sub-second, bumpless transfer is mandatory, evaluate the S7-400H (hardware-redundant) platform instead. Voting across three independent controllers is a separate architecture (commonly used in marine and aerospace) and is not provided by the S7-300 SWR package.
12. Frequently Asked Questions
What is the maximum number of mirrored data blocks in S7-300 software redundancy?
Up to 200 mirrored user DBs in the configurations documented in the SWR manual. The practical limit is the scan time of the SWR FB on the chosen link; the higher the count, the longer the master-to-reserve transfer interval becomes.
Can the reserve CPU run part of the application while the master is healthy?
No. The S7-300 SWR model has the master execute the application and copy the result image to the reserve. The reserve does not run the user's cyclic logic in standby; it only mirrors data and stands ready to take over.
How long does a switchover take on a healthy S7-300 SWR system?
Less than two seconds on a healthy link for the role handover and output take-over. The much longer time is the data transfer interval between master and reserve, which is on the order of ten seconds in MPI/PROFIBUS installations and lower on Ethernet.
Why does the reserve CPU go to INTF after I activate the redundant link following a program change?
The most common cause is a block timestamp conflict: the application was changed on one partner but not the other, or instance DBs were not regenerated. Deactivate the link, delete DB_WORK_NO / DB_SEND_NO / DB_RCV_NO, reload the program, restart the CPU, then reactivate the link. Confirm OB121 is loaded and read the diagnostic buffer on both sides.
Is MPI acceptable as the redundant link for S7-300 SWR?
Technically supported, but it is the slowest option and significantly extends the data transfer interval. Industrial Ethernet is the recommended media; PROFIBUS is the acceptable alternative. Reserve MPI for bench testing or very small installations where the transfer interval is acceptable.
Do I need OB121 for software redundancy to work?
Yes, on both CPUs. OB121 prevents a programming error encountered during a RUN-mode edit from stopping the CPU. Without it, a single access error during online modification can drop a partner and force a switchover that the plant was not designed to absorb.