Diagnose Fail-Safe I/O Passivation During CPU Changeover on PCS 7 V9.0 SP3

If the redundant CPU410-5H system remains in RUN but fail-safe ET 200M channels passivate during only one direction of master/standby changeover, investigate the S7 F/FH monitoring-time and redundancy configuration rather than assuming the CPU RUN state proves the safety I/O transition was healthy. Siemens documentation ties F-system response and passivation behavior to configured monitoring times, hardware/bus configuration and the safety program. The ticket omits its H-parameter attachment and detailed diagnostics, so it does not establish a specific correction.

Distinguish CPU RUN from F-I/O availability

A redundant H CPU can remain in RUN while a fail-safe I/O station or channel enters a passivated state. The operating state of the standard CPU and the status of F-I/O are separate observations. In the report, switchover from Rack 0 to Rack 1 passivates FDI/FDO modules and reintegration clears the state; the reverse direction does not. This asymmetry calls for comparison of both subsystems and their configured transfer/monitoring conditions.

Record the exact configuration

Before changing parameters, collect CPU410-5H firmware and rack assignment, PCS 7 V9.0 SP3 and S7 F Systems versions, F-CPU/F-module types, ET 200M interface-module configuration, bus topology, H parameters for both subsystems, safety program data and diagnostic buffer entries. Record the event order and timestamps for both switch directions, including which CPU is master and the affected module/channel diagnostics.

Review monitoring times using the version-matched tools

Siemens' PCS 7 Process Safety documentation describes calculating F-system monitoring times using the configured system and bus parameters. Compare the calculated values and relevant parameters on both CPUs, including transfer of safety-related parameters and I/O retention/passivation behavior where applicable. Do not copy default values from another CPU or project; the correct values depend on the configuration and safety reaction requirements.

Compare both switch directions

Preserve the current project and CPU parameter export before edits.
Compare the two CPU H-parameter sets and confirm the standby update/transfer settings are consistent with the design.
Compare F-monitoring calculations and the configured I/O/passivation behavior on each subsystem.
Review ET 200M IM and F-module diagnostics at the exact changeover time; determine whether the issue is module communication, parameter transfer, safety monitoring timeout or reintegration logic.
Check the safety program's required startup/monitoring data and any version-specific PCS 7 configuration conditions.
Test changes only in a validated safety-engineering workflow and confirm both switchover directions.

Do not rely on reintegration as the correction

Reintegrating channels restores the reported modules to healthy state, but does not explain why passivation occurs in one direction. Repeated reintegration may mask a communication or monitoring-time issue. Treat passivation as an explicit safety diagnostic condition and follow the project's approved response.

Verification

After a documented parameter or hardware correction, validate both master-to-standby transfer directions under a controlled test plan. Confirm each fail-safe module reaches its specified operating state, safety diagnostics remain clear, and the system satisfies its response-time requirements. Record CPU and module diagnostics during the tests; a CPU RUN indicator alone is not sufficient.

Limitations and Operational Precautions

The attachment containing the configured H parameters is unavailable, and the source has no confirmed answer. Exact module types, firmware and S7 F Systems version are missing. A generic monitoring-time value or online change cannot be responsibly prescribed. This is a safety-related redundant system; use the validated safety lifecycle, backups, change authorization and qualified review.

Engineer FAQ

Does CPU RUN mean the F-I/O is healthy? No. Verify F-module and channel state separately.

Why compare both changeover directions? The reported fault is asymmetric, so subsystem parameters, transfer and diagnostics must be compared by direction.

Can I increase monitoring times until passivation stops? Not without calculation and safety review; monitoring limits determine F-system response.

Does reintegration solve the cause? It restores the current channel state in the report but does not diagnose the initiating condition.

What is missing to give an exact correction? H-parameter settings, hardware/firmware details, safety-system versions and event-time diagnostic buffers.

Technical References

Siemens, PCS 7 Compendium Part B – Process Safety V9.1, section 6.2 “Adapting CPU parameters (fault-tolerant F system)” and F-system monitoring: https://support.industry.siemens.com/cs/attachments/109809645/pcs7_compendium_part_b_en-US_en-US.pdf
Siemens, PCS 7 High Availability Process Control Systems V9.0 SP1 Function Manual, PROFINET/high-availability architecture and I/O communication: https://support.industry.siemens.com/cs/attachments/download/109754977/ps7red_b_en-US.pdf