Switching WinCC PLC Connections via VBScript: S7 MPI Setup

1. Overview

Engineers running multi-PLC architectures with a single WinCC station frequently encounter the requirement to share one HMI project across several controllers. A typical configuration pairs two or more S7-300 CPUs (for example, 6ES7313-5BF03-0AB0) on a shared MPI or PROFIBUS segment, each driving a similar process unit such as a boiler, pump skid, or repeating machine cell. Maintaining duplicated WinCC graphics and tag structures for each unit doubles engineering effort and creates ongoing maintenance overhead.

The engineering goal is therefore to keep one set of screens, one set of tags, and one set of dynamic links, and to logically retarget those tags at runtime toward the controller that is currently in focus. WinCC does not support a true "connection swap" by directly renaming an active channel at runtime. The supported mechanism is the built-in Redundant Connection feature, which exposes a system tag called @AlternateConnectionAddress. By writing a properly formatted connection string into that tag, the HMI runtime re-resolves the active logical path to the alternate PLC.

This article documents the constraint, the exact procedure, the connection string syntax, the VBScript and C-Script calls required, the diagnostics, and the limitations you must respect when implementing this pattern on WinCC V7 with S7-300 CPUs.

2. The Runtime Constraint You Cannot Avoid

WinCC Runtime cannot rename a configured logical connection (e.g., changing the MPI address of an active channel) directly from a script. The connection name, network type, and station address are compiled into the runtime database at project startup. The supported workaround leverages the Software Redundancy feature in WinCC, which was originally designed for redundant S7 H systems but works for any two physical stations when the runtime is non-redundant.

The Redundant Connection wizard generates a shadow connection and creates the system tag @<ConnectionName>@AlternateConnectionAddress. Writing to this tag tells the runtime which of the two preconfigured paths is currently active. This is the only sanctioned route for runtime connection switching without a project restart.

3. System Architecture: Two-Boiler / Two-PLC Reference Design

Consider the canonical use case: two identical boilers, each controlled by a CPU 313C, supervised by a single WinCC station. The same PLC program, the same screens, and the same tag names are required on both units. Only the underlying MPI station address changes between unit #1 (MPI 2) and unit #2 (MPI 3).

The VBScript on the operator button writes the alternate connection string into the system tag, and the runtime resolves the next tag read/write against the new path. From the operator's perspective, the same screen and the same tag names refer to a different physical CPU.

4. Prerequisites

Reference the official WinCC V7 documentation for the redundancy option and system tag namespace at the Siemens Industry Online Support portal.

5. WinCC Connection String Format

WinCC stores each logical connection as a comma-separated string. The format is fixed per network type. For MPI and PROFIBUS connections, the canonical syntax is:

6. Step-by-Step Configuration

1. Create the primary WinCC connection. In WinCC Explorer, open Tag Management, right-click and add a new driver (SIMATIC S7 PROTOCOL SUITE). Add a new connection, name it (for example, Test), and set its parameters to MPI, 2, 0, , 0, 2, 02 targeting the first CPU 313C.
2. Define external tags. Create the tag set (boiler status, temperatures, setpoints, etc.) under the Test connection. Use identical names on both PLC projects so the WinCC tag namespace is shared.
3. Open a graphics page. Launch the Graphics Designer and open any picture in your project. The Dynamic Wizards pane must be visible; if hidden, enable it via View > Toolbars > Dynamic Wizard.
4. Launch the Redundant Connection wizard. Double-click Create Redundant Connection in the Dynamic Wizards list. Follow the wizard's form navigation. When prompted for the Alternate Address, change only the MPI station address from 2 to 3. All other fields (segment, AS station, rack, slot) remain identical.
5. Enable automatic switching. In the wizard's summary step, check the Change connection Automatically checkbox so the runtime is allowed to evaluate the alternate path. Save and close the picture.
6. Enable Global Script Runtime. In WinCC Explorer, right-click the computer name, choose Properties, and on the Runtime tab enable Global Script Runtime. Without this, the script action in step 8 will not execute.
7. Inspect generated tags. Open Tag Management and expand the Test connection group. The wizard has generated a system tag named @Test@AlternateConnectionAddress of data type Text tag (8-bit character set) or Text tag (16-bit character set) depending on WinCC version. Confirm it appears with the correct name and that it is set to the alternate connection string.
8. Place a button and write the script. Drop a button onto the graphics screen. In the Event tab, configure the mouse click action (Left Mouse Click, Press, or Release per your standard) and enter the script. Example code is given in section 7.
9. Compile and test. Save the picture, activate WinCC Runtime, and verify the behavior with the diagnostics in section 10.

For background on the wizard, see the WinCC V7 documentation set linked from WinCC V7 Manuals (entry page) and Siemens Knowledge Base article ID 2987284: https://support.industry.siemens.com/cs/document/2987284.

7. Runtime Scripting: SetTagChar and HMIRuntime Equivalents

The wizard generates C-Script scaffolding. You may keep the C-Script call or convert it to VBScript. The exact call writes the alternate connection string to the system tag.

7.1 C-Script (generated / minimal)

// Triggered on left mouse click of the change-connection button
SetTagChar("@Test@AlternateConnectionAddress","MPI,3,0,,0,2,02");

7.2 VBScript equivalent (preferred for new projects)

' VBS_ChangeConnection_ToBoiler2
' Trigger: Button "Switch to Boiler 2" - Mouse Action > Left Click

Dim sConnString
sConnString = "MPI,3,0,,0,2,02"

HMIRuntime.Tags("@Test@AlternateConnectionAddress").Write sConnString

' Optional: log the change to a diagnostics tag for verification
HMIRuntime.Tags("Diagnostics_ActiveConnection").Write sConnString

7.3 VBScript with safety wrapper

' VBS_ChangeConnection_Safe
' Validates runtime state and confirms the tag write

Const EXPECTED_PRIMARY = "MPI,2,0,,0,2,02"
Const EXPECTED_ALT     = "MPI,3,0,,0,2,02"

Dim oTag
Set oTag = HMIRuntime.Tags("@Test@AlternateConnectionAddress")

If Not oTag Is Nothing Then
    oTag.Write EXPECTED_ALT
    ' Read back after a short delay (50 ms typical)
    HMIRuntime.Trace "Connection switched to: " & EXPECTED_ALT & vbNewLine
Else
    HMIRuntime.Trace "ERROR: @Test@AlternateConnectionAddress not found" & vbNewLine
End If

8. State Machine and Timing

The runtime does not switch instantly. After the script writes the new connection string, the next tag access resolves through the new path. The figure below shows the relevant state transitions.

Practical implication: do not chain multiple rapid button presses expecting an instantaneous tag update. Build a 200 ms minimum dwell between the SetTagChar call and the first tag read of the newly active path.

9. Indirect Addressing Alternative (for Many-Boiler Topologies)

If the goal is to support more than two units or to share a deeper set of object properties dynamically, the recommended engineering pattern is indirect addressing using the WinCC @-prefix tag system combined with the import/export tool. The approach decouples the visible tag name from the connection path entirely.

1. Define each unit's tag set in the WinCC project using a unique prefix: Boiler1_Temp_SP, Boiler2_Temp_SP, and so on. The PLC programs and STEP 7 symbol tables are aligned to match.
2. On every screen object that must switch context, configure the dynamic property to use a tag-prefix tag, e.g. \Boiler\Temp_SP, where \Boiler\ is a text variable holding the current prefix string ("Boiler1_" or "Boiler2_").
3. Use the WinCC Import/Export tool (Tag Management right-click > Import/Export All Tags) to duplicate the tag set across prefixes, keeping them in lockstep.
4. Script the prefix change on the navigation button: HMIRuntime.Tags("BoilerPrefix").Write "Boiler2_". All dynamic properties that reference the indirect tag automatically resolve against the new prefix.

This is more scalable than the Redundant Connection trick for >2 units because it requires no per-unit connection and the project structure remains flat. It is also robust to WinCC version differences, since the @-prefix mechanism has been stable since WinCC V6.

10. Limitations and Edge Cases

11. Verification and Diagnostics

After implementing the change-connection script, validate with the following checklist:

1. Tag Management inspection: Confirm the system tag @Test@AlternateConnectionAddress exists, is of character type, and is configured with the alternate string by default.
2. Graphics Designer test screen: Place an I/O field bound to the @AlternateConnectionAddress tag and a separate I/O field bound to a process tag (e.g., Boiler_Temp). Toggle the connection and verify both values update.
3. Trace output: Enable the WinCC Runtime trace (Tools > Trace in WinCC Explorer) and confirm the HMIRuntime.Trace lines from your script appear.
4. Tag simulator test: Use the WinCC Tag Simulator to inject values into a non-critical tag on each CPU and confirm the HMI follows the swap.
5. Connection diagnostics: Open Tools > Connection Status in WinCC Explorer to monitor which logical path is active. The status indicator must change within 1-2 seconds of the script execution.
6. Edge case - hot restart: Trigger WinCC Runtime restart and confirm the connection returns to the primary (MPI 2) by default. Re-arm the swap if needed.

For a deep dive on diagnostics and the redundancy fault model, see the WinCC V7 Communication manual on the Siemens support portal: Siemens Industry Online Support.

12. S7-300 CPU 313C Reference Data

The hardware used in the canonical example is the S7-300 CPU 313C, article number 6ES7313-5BF03-0AB0 (later revisions may apply). The table lists the fields relevant to the WinCC connection.

Confirm current revision status and any successor part numbers via the official Siemens product page on the Siemens Industry Online Support portal before ordering or migrating projects.

13. Field-Commissioning Tips

• Document the connection strings. Print both the primary and alternate strings and pin them next to the operator panel. The 7-field comma-separated syntax is easy to mistype.
• Keep one CPU as the time master. When you share a WinCC alarm archive across units, the time source must be unique to avoid scrambled time stamps in the alarm log.
• Use the same DB layout on both PLCs. If the boiler programs diverge even slightly, the WinCC tag namespace breaks immediately on swap. The simplest safeguard is a shared STEP 7 source library.
• Test with both CPUs powered on and off. Runtime must behave correctly even if the alternate CPU is unreachable. A connection fault should be raised, not a hang.
• Apply a 200 ms dwell before reading after a swap. This is empirically the minimum safe window for the WinCC tag cache to invalidate and re-resolve through the new path.
• Avoid swapping during write actions. Lock operator writes while a swap is in flight; otherwise the write may land on the wrong CPU during the transition window.