Configuring Manual Switchover of Redundant WinCC OS Servers via Script in SIMATIC PCS 7

To manually trigger a redundancy switchover between a SIMATIC PCS 7 WinCC redundant OS Server pair from an HMI button, toggle the internal WinCC system tag '@RM_MASTER' from 1 to 0 on the active server node using a C or VBScript action. When '@RM_MASTER' is reset, the WinCC Redundancy component evaluates partner availability, detects that the active master is relinquishing leadership, and promotes the standby partner to master mode. Before executing this toggle, scripts must verify that the partner server is fully operational and synchronized via '@RM_SERVER_STATE' and '@RM_FAULT_WAIT' to avoid dual master conflicts or communication dropouts.

Executive Summary

In critical process facilities running SIMATIC PCS 7 OS redundant servers, maintenance operations or network adjustments often require moving client connections from the active server to the standby partner without shutting down the physical server machine. WinCC Redundancy manages server leadership through a dedicated set of internal system tags, primarily '@RM_MASTER', '@RM_MASTER_WATCH_CYCLE', and '@RM_SERVER_STATE'. While redundancy switchovers typically occur automatically following hardware or network connection faults, engineers can initiate a controlled manual switchover by executing an HMI script that resets '@RM_MASTER'. This article details the internal mechanics of the Redundancy Manager, provides production-grade C-script and VBScript routines with safety interlocking, outlines verification procedures, and highlights operational precautions.

Architectural and System Mechanics

The WinCC Redundancy package coordinates two server stations (Master and Standby) to provide uninterrupted plant visualization and data archiving.

Key internal redundancy tags governing switchover behavior include:
- @RM_MASTER: A binary tag indicating whether the local server is operating as the active redundancy master (1 = Master, 0 = Standby).
- @RM_MASTER_WATCH_CYCLE: A counter tag updated cyclically by the redundancy manager across the Redundancy connection (serial or dedicated Ethernet network).
- @RM_SERVER_STATE: An integer tag indicating local runtime state (1 = Fault/Unknown, 2 = Master, 3 = Standby).
- @RM_FAULT_WAIT: Indicates whether a redundancy fault or synchronization cycle is pending.

When @RM_MASTER is cleared to 0 on the active master, the local Redundancy service signals the partner server across the terminal bus and redundancy link that mastership is voluntarily surrendered. The partner verifies its own process bus connections and transitions to state 2 (Master), causing connected WinCC OS Clients to switch their project context seamlessly.

Step-by-Step Engineering and Implementation Procedure

Step 1: Verify Preconditions and Redundancy Health

Open WinCC Explorer on both OS Server 1 and OS Server 2. Verify in the Redundancy editor that project synchronization is fully configured and the redundancy link is active without errors. Ensure both servers communicate over the terminal bus and plant bus.

Step 2: Implement the Safe Manual Switchover C-Script

In Graphics Designer, open the maintenance faceplate or system administration screen. Insert a button titled 'Switchover OS Master'. Attach the following C-Action to the Mouse Click event:

#include "apdefap.h"
void OnClick(char* lpszPictureName, char* lpszObjectName, char* lpszPropertyName)
{
    // Read redundancy status tags
    BOOL bIsMaster = GetTagBit("@RM_MASTER");
    long nFaultWait = GetTagBit("@RM_FAULT_WAIT");

    // Verify local station is currently master and no fault wait is active
    if (bIsMaster && !nFaultWait)
    {
        // Prompt operator confirmation or proceed with switchover
        SetTagBit("@RM_MASTER", 0);
    }
    else
    {
        // Station is already standby or synchronization is in progress
    }
}

Step 3: Implement VBScript Alternative with Operator Feedback

For systems utilizing VBScript actions, implement the switchover using HMIRuntime tags:

Sub OnClick(ByVal Item)
    Dim objMasterTag, objFaultWaitTag
    Set objMasterTag = HMIRuntime.Tags("@RM_MASTER")
    Set objFaultWaitTag = HMIRuntime.Tags("@RM_FAULT_WAIT")

    If objMasterTag.Read = 1 And objFaultWaitTag.Read = 0 Then
        objMasterTag.Write 0
    End If
End Sub

Step 4: Restrict Access via SIMATIC Logon Authorization

Assign an authorization level (e.g., Level 6 - Higher Process Controlling, or Level 1100 - System Maintenance) to the button object to prevent unauthorized operators from initiating server switchovers.

Verification

To verify the manual switchover:
1. Monitor @RM_MASTER and @RM_SERVER_STATE in the WinCC Tag Management variable simulator or WinCC runtime status display.
2. Click the switchover button on the active server. Confirm that @RM_MASTER changes to 0 on the local station.
3. Observe the partner server: its @RM_MASTER tag must transition to 1 and @RM_SERVER_STATE becomes 2.
4. Inspect connected OS Clients; verify that client process communication switches to the new master without alarm generation or process disruption.

Limitations and Operational Precautions

Operational precautions and limitations:
- Never toggle @RM_MASTER if the partner server is offline, stopped, or experiencing network disconnection; doing so will leave both servers in standby, disconnecting all OS Clients from live process data.
- Manual switchover does not bypass archive synchronization. If online synchronization is active, switchover must be deferred until synchronization completes.
- Rapid, repeated toggling of @RM_MASTER can trigger redundancy race conditions and temporary client connection blackouts.

Engineer FAQ

Q: Can `@RM_MASTER` be toggled directly from an OS Client?

A: No. The @RM_MASTER tag is a local internal tag evaluated on the OS Server. To trigger switchover from an OS Client, the client must write to a server prefix tag or trigger a server-side script.

Q: What happens if both servers have `@RM_MASTER` set to 1 simultaneously?

A: This condition indicates a split-brain failure typically caused by failure of both the terminal bus and the redundancy connection. Both servers act as independent masters until network links are restored.

Q: Does manual switchover cause data gaps in trend archives?

A: No. When redundant servers are healthy, Tag Logging and Alarm Logging archives synchronize continuously, ensuring seamless continuity across client trend displays.

Q: Why did `@RM_MASTER` revert back to 1 immediately after being set to 0?

A: If the partner server is faulted or cannot assume mastership, WinCC Redundancy automatically resets the local server back to master to maintain system operability.

Q: Can this method be used on WinCC Single Station Redundancy?

A: Yes. The same @RM_MASTER and @RM_SERVER_STATE mechanisms apply to WinCC Single Station Redundancy configurations.

Technical References

Related Tags

WinCC Redundancy, PCS 7 OS Server, @RM_MASTER, Server Switchover, SIMATIC PCS 7

20 respuestas

Configuring Manual Switchover of Redundant WinCC OS Servers via Script in SIMATIC PCS 7