Siemens S7-300 SW Redundancy: Setting CPU-A as Master at Startup

Problem Description

Two Siemens SIMATIC S7-300 CPU 315-2DP controllers (6ES7 315-2AG10-0AB0 or equivalent 2nd-generation variant) are configured in a Software Redundancy (SW Redundancy) pair, supervised by SIMATIC WinCC V6.2 with the Redundancy option. After a cold power-on, the standby CPU-B (MPI address 4) is brought up as the active master, even though CPU-A (MPI address 2) is designated in the STEP 7 hardware configuration and the WinCC project as the primary master. Manual switchover via the control bit at DB5.DBX10.0 from the HMI does not propagate to WinCC, so the SCADA continues to read from the wrong CPU and operator input values are blocked.

Symptoms in the field:

• Power-on always produces CPU-B as active partner, regardless of which rack is energised first.
• STEP 7 > NetPro > Master System on IM 153-2 (Redundant) shows the wrong Profibus master system as active (Profibus-2 / DP master ID-1 instead of Profibus-1 / DP master ID-0).
• WinCC does not follow the bit DB5.DBX10.0 toggle; redundancy partner swap is ignored.
• After a controlled switchover, both panels' authority transfers correctly, but the next cold start reverts to the wrong initial master.

System Architecture

The deployment is a classic SW Redundancy configuration: two S7-300 stations connected via MPI for non-redundant data and via Profibus DP for the redundant I/O islands. The I/O layer is built on ET 200M with redundant interface modules IM 153-2 (6ES7 153-2BA00-0XB0 or 6ES7 153-2BA02-0XB0) so that each Profibus master can take over the I/O in the event of a CPU or bus fault.

Each CPU hosts a copy of the SWR ZYK (FB 102) cyclic block and the SWR START (FB 101) initialisation block. The redundancy DBs (DB_HALT, DB_SEND, DB_RCV) are mirrored, and partner state is exchanged via MPI / Profibus using the SWR_AG_CN connection table.

Root Cause Analysis

SW Redundancy on S7-300 selects the active partner using a deterministic decision chain. When the active role is wrong at cold start, the failure is almost always in one of the following layers.

1. Initialisation Order / First-Up Wins

The SWR_START (FB 101) call on each CPU contains the input INITIAL_MASTER. With STEP 7 SW Redundancy V1.x / V2.x, both CPUs use the same user program; the first PLC to finish OB 100 (warm restart) and complete FB 101 claims the role Aktiv. If the standby cabinet is energised marginally sooner (for example, by a 24 V rail that rises a few hundred milliseconds before the other cabinet), the swap is permanent for that power cycle. Adjusting the Initial Master marker in the project is the supported way to bias the election when CPUs are dissimilar; however, when both CPUs are identical 315-2DP units, the only reliable levers are:

• The physical power-on sequence (energise CPU-A first, wait for OB 100 completion, then energise CPU-B).
• The MPI / Profibus topology such that CPU-A's interface module negotiates first.

2. IM 153-2 Redundant I/O Master System Selection

When NetPro shows that the IM 153-2 Redundant station is mastered by Profibus-2 / DP master ID 1 instead of Profibus-1 / DP master ID 0, the active PLC and the active DP master system are misaligned. SW Redundancy's DP_MASTER input on FB 101 expects a primary DP master ID (the one driven by the initial master CPU) and an alternate DP master ID (driven by the standby). When the two DP master systems are interchanged in NetPro, the library cannot align the I/O with the active CPU and WinCC reads inconsistent data.

3. WinCC Redundancy Connection and Control Bit

WinCC V6.2 Redundancy uses two logical connections per tag (@Connection1 / @Connection2) plus a system tag @ForceConnection or a user-defined DB5.DBX10.0 bit. The control bit only takes effect when:

• The Redundancy option is licensed on the WinCC server (Authorisation: Redundancy license disk).
• Both logical connections are configured as Redundant partner in Tag Management > SIMATIC S7 PROTOCOL SUITE > MPI/TCP.
• The bit is wired into the Connection monitoring configuration under Computer properties > Redundancy with the right Trigger tag selection.

If any of the above is missing, WinCC silently ignores the toggled bit and the panel never switches authority.

Step-by-Step Solution

Step 1 - Verify Hardware Configuration in STEP 7

1. Open SIMATIC Manager > CPU-A > Hardware > HW Config.
2. Confirm MPI address = 2 on the CPU properties dialog. The MPI address lives in the CPU's MMC only if "Set MPI address on the module" is unchecked in HW Config > CPU > Properties > MPI. By default the address is stored on the MMC.
3. Repeat for CPU-B and confirm MPI = 4. Do not swap MMCs to alter the role - the MPI address travels with the configured project, and the SWR library looks for the configured partner, not for the physical card. Swapping MMCs on 315-2DP will re-bind the project to the new slot and may corrupt the SWR DBs.
4. Open NetPro and verify the redundant ET 200M station: Right-click IM 153-2 station > Properties > Master system. The primary master system must be the one driven by CPU-A (Profibus-1, DP master ID 0). Swap the assignment by drag-and-drop if necessary.

Step 2 - Set the Initial-Master Behaviour in FB 101

Open the OB 100 of CPU-A and confirm that SWR_START (FB 101) is called with the correct parameters:

// OB 100 - Restart / Warm restart of CPU-A
CALL FB 101, DB 100  // SWR_START
   AG_KENNUNG  := DW#16#0001    // any unique 32-bit ID
   DB_HALT     := 100           // data block for partner state
   DB_SEND     := 101           // send data image
   DB_RCV      := 102           // receive data image
   VERBINDUNG  := 0             // index into SWR_AG_CN table
   DP_MASTER   := 0             // primary DP master ID (CPU-A)
   INITIAL_MASTER := TRUE       // bias this CPU for cold start

For CPU-B, the same FB is called with DP_MASTER := 1 (alternate DP master) and INITIAL_MASTER := FALSE. STEP 7 SW Redundancy treats INITIAL_MASTER as a tie-breaker only when the partner PLC is unreachable; it does not override the first-up rule. Therefore:

• Keep INITIAL_MASTER = TRUE on CPU-A and FALSE on CPU-B.
• Re-download both stations to the MMC and perform a complete power-off / power-on.

Step 3 - Control the Power-Up Sequence

The most reliable way to make CPU-A the active master at every cold start is to control the cabinet energisation order:

1. Close the main breaker on Cabinet A (CPU-A) only.
2. Wait until the CPU's RUN LED is steady green and the SF / BF LEDs are off. With CPU 315-2DP, this takes roughly 5 to 8 seconds from 24 V application.
3. Close the main breaker on Cabinet B (CPU-B). The standby detects the active partner via MPI and settles into passive state.
4. Verify in STEP 7 Online > Accessible Nodes that the active role is reported by CPU-A.

If both cabinets must be powered from a single 24 V supply (no separate breakers), insert a soft-start delay on the CPU-B side using a timing relay (for example, 3RP1505 or 7PV1508) sized to 10 s. The delay is short enough to keep the application in RUN but long enough that FB 101 on CPU-A has finished its initialisation handshake.

Step 4 - Configure WinCC V6.2 Redundancy Properly

1. Open WinCC Explorer > Computer properties > Redundancy on the WinCC server.
2. Enable Activate Redundancy. Insert both logical connections:
   • Connection 1: MPI / TCP → CPU-A (MPI 2 / IP 192.168.0.2)
   • Connection 2: MPI / TCP → CPU-B (MPI 4 / IP 192.168.0.4)
3. Map Connection 2 as the redundant partner of Connection 1.
4. Under Trigger tag, select DB5.DBX10.0. This tag must be a boolean process tag with the Update attribute set to On change and the S7 protocol suite address pointing to DB 5, byte 10, bit 0.
5. Install the WinCC Redundancy authorisation (soft key on USB or floppy) on the server. Without it, the option silently disables itself in the runtime.
6. Save and restart the WinCC runtime. Confirm in WinCC > Tools > Status of Redundancy that both connections show OK and the active partner equals CPU-A.

Step 5 - Wire the Control Bit to SWR Logic

Map DB5.DBX10.0 to the SWR switchover input. The cleanest way is to write it to the partner request byte of the SWR library:

// OB 1 - cyclic section
      U   DB5.DBX10.0
      =   DB100.DBX0.0     // SWR partner switchover request

      CALL FB 102, DB 200  // SWR_ZYK - cyclic call
         MODE           := B#16#0
         DB_HALT        := 100
         DB_SEND        := 101
         DB_RCV         := 102
         RETVAL         := MW 250

On a positive edge of DB100.DBX0.0, SWR_ZYK executes a controlled switchover and WinCC's @ForceConnection follows automatically when the redundancy option is licensed. The control bit is then reset by the operator (or the SCADA script) to allow a new switchover.

Verification Procedure

1. Power-cycle both cabinets in the correct order (CPU-A first).
2. In STEP 7 Online > CPU-A > Module Information > Diagnostic Buffer, confirm the entry Redundancy: CPU-A active, CPU-B passive.
3. In WinCC Graphics Designer, embed the system tag @ActiveConnection on a diagnostics screen; it should display Connection 1 (CPU-A).
4. Force DB5.DBX10.0 = 1 from the operator panel. The HMI should swap to Connection 2 (CPU-B) within two to four seconds and the redundancy partner should be marked active in the WinCC status dialog.
5. Reset DB5.DBX10.0 = 0, power-cycle again, and re-verify that CPU-A is the initial master.

Troubleshooting Matrix

Common Pitfalls and Field Notes

• MMC swap is not a fix. The MPI address and the SWR partner configuration are stored in the project on the MMC. Exchanging the cards to move the role simply rebinds the project to a different rack and breaks the partner handshake at the next restart.
• Identical CPU order numbers matter. Mixing a CPU 315-2DP (6ES7 315-2AG10) with a CPU 315-2DP (6ES7 315-2EH13) on the same SWR pair is not supported. Always pair same-order-number, same-firmware CPUs.
• Watch the 24 V rise time. Switching power supplies with long ramp-up times can cause both CPUs to believe they are the first up within a 100 ms window. Use regulated SITOP 24 V supplies with a rise time below 50 ms.
• Redundancy licence is per-server. If WinCC runs in a redundant server pair, each server needs its own Redundancy authorisation; the runtime silently falls back to a single connection otherwise.
• Operator-authority tag direction. The control bit DB5.DBX10.0 must be written by the panel. A read-only panel HMI, even with the bit mapped, will not trigger the switchover.

Reference Material

For deeper background on redundancy behaviour in industrial controllers, the manufacturer training manual Mitsubishi Programmable Controllers Training Manual - Redundant Systems provides useful context on role negotiation, hot-standby, and the importance of deterministic power-up sequencing. SCADA-level redundancy concepts (for comparison with WinCC's approach) are covered in the Inductive Automation Ignition - Setting Up Redundancy manual, which describes master/backup election, connection monitoring, and trigger-tag hand-off in a different platform.

FAQ