S7-300 Software Redundancy Resolving Manual STOP Switchover

Problem Overview

On an S7-300 station configured for Software Redundancy with two CPUs (PLC A and PLC B) linked through a redundant PROFIBUS pair of CP modules, the following symptom is observed:

• Switching OFF the power supply on the reserve CPU → outputs remain driven. Switchover completes cleanly.
• Pulling either PROFIBUS connector on the reserve CPU → outputs remain driven. Switchover completes cleanly.
• Turning the mode selector on the reserve CPU to STOP → DO signals drop to zero on every connected output module. The partner does not take over.
• The diagnostic VAT on the master CPU shows DBW 8 of the SWR_ZYK instance DB reporting "PLC A is the only master" in every operating state, including a forced switchover attempt.

The configuration is otherwise healthy: no SF, no BF, the program downloaded cleanly to both CPUs, and NetPro shows the redundancy link as established. The failure is therefore not in the wiring, the PROFIBUS, or the application program logic, but in how the SWR state machine reacts to the type of partner failure it is being asked to handle.

Why Power-Off and Manual STOP Behave Differently

The S7-300 CPU operating system reports partner-station availability through a small number of OBs and through the status bits on the SWR partner link. Each failure mechanism produces a different signature:

The critical difference: STOP via the selector switch does not break the PROFIBUS link. The PROFIBUS CP on the stopped CPU is still physically alive and still exchanging life frames. From the partner's point of view, the link is healthy. SWR, which decides whether to take over based on partner life and on the SWR_ZYK status word, therefore concludes that the system is still in master/reserve mode with PLC A as master — even though PLC B has actually stopped executing user program and is no longer driving its outputs.

When the master then attempts to read redundant data from the reserve, the reserve's OB 100 and OB 1 are no longer cycling. The last valid output image freezes on the master's side, but the actual DO modules on the stopped CPU's rack drop out (outputs de-energize). If the outputs that the application expects are on the stopped reserve, those outputs are gone.

S7-300 Software Redundancy Architecture

SWR works on top of a standard S7-300 station. There is no special redundant CPU; both stations are normal S7-300 CPUs (typically CPU 315-2 DP/PN or CPU 317). Each station must run a copy of the SWR library blocks and the partner link must be configured in NetPro/STEP 7 before the SWR DB is generated.

Two reference architectures are supported:

1. Two-CP redundant link – each CPU owns a dedicated PROFIBUS CP (e.g. CP 342-5) connected back-to-back or via a PROFIBUS segment. The partner link is carried on this secondary CP. This is the architecture used in the field case.
2. MPI/Industrial Ethernet partner link – a single integrated port or external CP carries both the I/O and the SWR partner frames. Less common in production plants because the I/O bus and the redundancy bus share bandwidth.

The role assignment (master vs. reserve) is dynamic. On every cold/warm restart (OB 100) and on every pass through SWR_ZYK, the library reads the partner's status and assigns the role. The first CPU that completes startup and sees no partner becomes master; the second becomes reserve.

SWR Library Block Reference

The S7-300 Software Redundancy library is delivered as a set of FBs and UDTs. The block numbers depend on the STEP 7 version:

Status word offsets in the instance DB of SWR_ZYK (DBW 8, DBW 10, etc.) follow the SWR manual convention. The exact layout depends on the SWR library version installed. Open the instance DB in STEP 7 and look for the symbolic names "STATUS", "MASTER_RESERVE", or the equivalent localized names.

Status Word Diagnostics – DBW 8 of the SWR Instance

DBW 8 of the SWR_ZYK instance DB is the heart of the diagnostics. Reading it from a VAT on each CPU is the first thing to do when investigating any SWR anomaly:

The reported symptom — "PLC A is the only master in every condition" — typically maps to:

• PLC A: MASTER = 1, PARTNER_OK = 1, LINK_OK = 1
• PLC B (the one being stopped via selector): MASTER = 0, RESERVE = 1, PARTNER_OK = 1, LINK_OK = 1

Because PARTNER_OK and LINK_OK remain SET, SWR on PLC A believes that PLC B is still alive and available as a reserve. It has no rule that says "the reserve stopped, promote me." SWR only promotes reserve→master on partner link loss or on a user-issued SWR_FORCE call.

Mode Switch Positions and Their Effect on SWR

The S7-300 CPU mode selector has four positions. Each one produces a different SWR-relevant behavior:

NetPro Redundant Link Configuration

The two-CP PROFIBUS redundant link must be set up explicitly in NetPro/STEP 7 Hardware Configuration. The points that are most often mis-configured in field installations:

1. Both CPs must be on the same PROFIBUS subnet (logical, not necessarily physical).
2. The "SWR Partner Connection" must be assigned on each CP. In NetPro, right-click the CP, select "Object Properties," then "S7 Connection" or "Partner Connection" – the SWR slot must reference the partner CP's MAC or PROFIBUS address.
3. The PROFIBUS addresses must differ. Typical practice is master = 2, reserve = 3.
4. Transmission timing: the partner link should not be set faster than 100 ms. SWR recommends 200–500 ms for stability.
5. If a DP/PA coupler or repeater is in line, the link life frames can be delayed or dropped, producing false link-down events.

Verify the connection in NetPro by double-clicking the SWR connection and confirming the connection status displays "Established" in the online view of both stations.

Redundant Data Blocks and Memory Bytes

SWR allows the user to mark certain DBs as redundant. Marked DBs are copied from master to reserve on every cycle so that the reserve always has a current copy. Non-redundant DBs (e.g. recipe data, large lookup tables) are not copied.

Steps to mark a DB as redundant:

1. Open the DB in STEP 7.
2. Right-click → Properties → tab "Redundancy."
3. Check "Generate as redundant DB." This sets the relevant attribute bits in the DB header.
4. Rebuild and download to both CPUs.

If a DB that is read on the reserve is NOT marked redundant, the reserve may use stale data on switchover. The user reports outputs only are affected, which is consistent with the application reading DO state from a DB that was not marked redundant.

Memory bytes (Merkers / M-Bits) used for interlock signaling between the two CPUs must also be declared redundant through SWR. Plain M-bits are local to each CPU and are NOT shared.

Step-by-Step Diagnostics Procedure

Use this procedure when "manual STOP kills outputs" symptom is reported:

1. Open the SWR_ZYK instance DB on PLC A in online view. Read DBW 8 and the surrounding status words. Capture a screenshot of every bit.
2. Repeat on PLC B. Compare the two views.
3. Confirm the partner link by opening NetPro, right-click the SWR connection, and selecting "Connection Status." Both stations should report "Established."
4. Check OB 100 on PLC B. If PLC B is being started in STOP, OB 100 is not executed. If SWR_START (FB 102) lives in OB 100 and not in OB 1, the reserve will not initialize properly.
5. Check OB 86 on PLC A. If OB 86 is missing or empty on PLC A, the partner station failure will not be processed.
6. Check OB 82 for diagnostic interrupts (PROFIBUS diagnostic on the CP).
7. Read the diagnostic buffer on PLC A. Look for station failure / station return events on the PROFIBUS subnet. If none appear when PLC B is stopped via selector, the OS truly has not seen a failure.
8. Inspect redundant DBs. List every DB the application reads on outputs. Mark each as redundant if not already.
9. Inspect the I-slave assignment. SWR with two CPs typically assigns the reserve as an I-slave of the master. Confirm the I-slave configuration matches the SWR manual for the installed SWR version.
10. Force a switchover through SWR_FORCE instead of the selector. SWR_FORCE is the supported API for user-initiated switchover.

Correct Verification Test Procedures

To prove the SWR system actually works, use one of these test scenarios. The manual selector at STOP is NOT one of them.

Document each test: capture DBW 8 before, during, and after the trigger. The diagnostic buffer should show OB 86 events with station failure and station return.

OB Handling Required for Reliable SWR

SWR depends on certain OBs being present and executing. Missing OBs are a common reason that SWR behaves oddly under stress:

Verification Checklist

1. PLC A and PLC B both report SF = no, BF = no in online diagnostics.
2. Both CPUs show the partner link as Established in NetPro online view.
3. SWR_ZYK instance DB on PLC A shows MASTER = 1, PARTNER_OK = 1, LINK_OK = 1.
4. SWR_ZYK instance DB on PLC B shows RESERVE = 1, PARTNER_OK = 1, LINK_OK = 1.
5. Every DB the application reads on the reserve path is marked as redundant.
6. OB 1, OB 100, OB 82, OB 86 exist in both CPUs.
7. Diagnostic buffer of PLC A shows OB 86 events when reserve power is pulled.
8. Outputs remain driven through a reserve power loss event.
9. Outputs remain driven through a master power loss event (reserve takes over).
10. User-initiated SWR_FORCE produces a clean role swap with no output bounce.

Field-Proven Caveats

• SWR is licensed per CPU. The library must be licensed on both stations or the role assignment is not stable.
• STEP 7 V5.5 and TIA Portal V13+ have different SWR library versions. Mixing a TIA master with a STEP 7 V5.5 reserve on the same PROFIBUS subnet has caused intermittent link-loss events on the older CP.
• S7-300 SWR is end-of-life as of 2018. New installations should consider S7-1500R/H or migrating the application.
• The mode selector is a hardware feature. SWR cannot read it. There is no API that tells SWR "the operator put me in STOP."

Related Siemens Documentation

• Siemens: S7-300 Software Redundancy – Function Manual (entry ID 1137635)
• Siemens: S7-300 CPU 31x Operating Instructions (entry ID 19798202)
• Siemens: S7-300/S7-400 OB Reference (entry ID 15364496)
• Siemens: CP 342-5 Manual (entry ID 45532370)