WinCC V6.2 Redundancy

Hi!

We are working on a 2 redounded servers (WinCC V6.2) system which communicates through two CP-1613 cards.

Our system is required to be fail safe operational (stay operative after 1 error on any part of the system). That was the main reason for choosing the redundancy.

However, the WinCC redundancy manual states that:

Activating the redundancy servers

You can activate WinCC Redundancy as follows:

Activate initially the configured Master server. Next, start its existing clients. Once they are active, activate the second server and its existing clients.
The first synchronization process is completed. The downtime for this synchronization encompasses the interval between activating the first and second server.

And as a result of that we have found that, during startup, in case we have a problem on the predefined master server, the system cannot be started normally (and therefore we are not "Fail Safe Operational")

We have checked this possibility and seen how, if we start first the predefined Standby server, then the Redundancy dos not work properly. During the time the Standby server is the only server active, it cannot identify himself as a master (is the only server active but stays as Standby) and it cannot show all the incoming alarms/messages either.

Does anybody have any advice on this issue? Siemens Tech support has not shown very familiar with this situation (although it seems to me a quite obvious question, considering that both redounded servers are supposed to be completely equivalent in all aspects -which does not happen according to this problem-)

Thanks !

José