Diagnosing CPU 410-5H STOP Events from I/O Errors and SDB Startup Failures

On SIMATIC PCS 7 fault-tolerant controllers (CPU 410-5H, 6ES7410-5HX08-0AB0), a controller entering STOP mode with Event ID 16# 494D ('STOP due to IO error') followed by restart prevention Event ID 16# 530D ('Startup prevented by: Module or submodule assignment not evaluated or evaluation aborted with errors in SDB 1, 3, 5, 2X, 9X') indicates an unhandled peripheral bus communication failure accompanied by non-volatile configuration memory corruption. To recover and prevent recurrent trips, engineers must ensure mandatory fault Organization Blocks (OB82, OB83, OB85, OB86, OB122) are present in the CPU to prevent I/O drops from halting execution, execute an overall Memory Reset (MRES) to clear the damaged SDB evaluation tables, verify physical PROFINET/PROFIBUS line integrity, and perform a full hardware configuration download.

Analysis of Diagnostic Buffer Event 16# 494D (STOP due to IO error)

The SIMATIC S7-400H and CPU 410-5H Process Automation controllers are designed to sustain hardware component failures without interrupting process execution. However, when an unexpected peripheral event occurs and the operating system finds no software exception handler, the CPU executes an emergency transition to STOP mode to protect equipment.

In the CPU Diagnostic Buffer, Event ID 16# 494D reads:
$$\text{Event ID 16# 494D: STOP due to IO error}$$
$$\text{Coding: 16# 494D F094 5050 9405 59AD 802F}$$

The hex parameters provide critical diagnostic telemetry:
- Z1: 9405: Indicates an internal priority class execution fault—specifically that an I/O access error occurred in an execution task (such as OB1 or cyclic interrupt OB35) while attempting to read or write to a peripheral address that no longer responded on the backplane or fieldbus.
- Z2 / Z3: Encodes the logical base address and module identifier of the failing I/O component or communications processor (CP 443-5 Ext / CP 443-1).

If the peripheral module experiences power loss, severe electrical transient spikes, or fieldbus severed lines, and the CPU does not possess the appropriate fault handling block, the CPU operating system transitions from RUN (Redundant) to STOP (Internal).

Analysis of Startup Prevention Event 16# 530D (SDB Evaluation Aborted)

Following the I/O trip, attempts to restart the CPU (via power cycling or SIMATIC Manager operating mode toggle) fail with Event ID 16# 530D:
$$\text{Startup prevented by: Module or submodule assignment not evaluated or evaluation aborted with errors}$$
$$\text{SDBs: 1, 3, 5, 2X, 9X - Cold restart or warm restart necessary}$$

System Data Blocks (SDBs) are the compiled binary representations of HW Config:
- SDB 1: CPU and rack configuration
- SDB 3: Work memory and retentive memory allocation
- SDB 5: Process image partition (PIP) mappings
- SDB 2x: Industrial Ethernet / PROFIBUS communication parameters
- SDB 9x: Distributed I/O topology and module parameters

Event 16# 530D signifies that when the CPU attempted a warm restart, the operating system detected that the volatile RAM image of the SDB configuration was corrupted during the abrupt hardware crash. The CPU refuses to enter RUN mode because it cannot safely verify whether the active I/O modules match the compiled safety boundaries.

The Role of Fault Organization Blocks (OB82 to OB86, OB122)

In SIMATIC PCS 7, the compilation option Generate Module Drivers automatically places diagnostic blocks and instantiates system Organization Blocks. However, if charts are compiled incorrectly or if blocks were manually deleted from the Blocks folder, the CPU lacks critical exception handlers:

Organization BlockSystem Event MonitoredCPU Behavior if OB is MissingOB 82Diagnostic Interrupt (wire break, short circuit, module fault)CPU transitions to STOP immediately upon any channel faultOB 83Insert / Remove Module Interrupt (hot-swapping ET 200 modules)CPU transitions to STOP when a module is pulled or insertedOB 85Priority Class Error (I/O access error during process image update)CPU transitions to STOP upon peripheral read/write failureOB 86Loss of Rack / Fieldbus Station (PROFIBUS DP / PROFINET IO drop)CPU transitions to STOP if an ET 200 station drops off the busOB 122I/O Access Error (direct peripheral read/write L PIW / T PQW)CPU transitions to STOP if addressed peripheral does not exist

Ensuring all five fault OBs are loaded in the CPU guarantees that fieldbus dropouts or module failures trigger alarms and channel passivations rather than halting the automation controller.

Step-by-Step Controller Recovery and Re-commissioning

To clear the startup block and restore the CPU 410-5H to redundant RUN mode:

Step 1: Execute Controller Memory Reset (MRES)

Because Event 16# 530D indicates damaged RAM configuration tables, a warm restart is rejected. An overall reset is mandatory:
1. On the physical CPU front panel, turn the mode switch from RUN to STOP.
2. Hold the switch in the MRES position for 3 seconds until the STOP LED flashes slowly.
3. Release the switch and immediately return it to MRES within 3 seconds.
4. The STOP LED flashes rapidly, confirming that the CPU has erased volatile RAM and reloaded the valid system configuration from the System Expansion Card (SEC).

Step 2: Full Hardware Configuration Compilation and Download

In SIMATIC Manager, open HW Config.
Select menu Station > Save and Compile. Confirm zero errors.
Select PLC > Download to Module... and download the compiled hardware configuration directly to both CPUs.

Step 3: Verify Fault OBs in the Blocks Folder

In SIMATIC Manager, inspect the AS Blocks folder.
Confirm that OB82, OB83, OB85, OB86, and OB122 exist.
If any are missing, copy them from the Standard Library > System Function Blocks into your Blocks folder.
Download the blocks to the CPU.

Step 4: Redundant Coupling and Synchronization

Switch the Master CPU to RUN. The CPU completes its startup checks and enters standalone RUN mode.
Switch the Standby CPU to RUN.
The controllers execute automated memory synchronization and transition to RUN (Redundant).

CPU 410-5H Diagnostic Buffer and Fault OB Parameter Matrix

The following matrix details the relationship between critical diagnostic buffer events and system recovery actions:

Event IDEvent DescriptionRoot Hardware / Software CauseMandatory Recovery Action16# 494DSTOP due to IO errorUnhandled fieldbus fault or missing OB85/OB86Insert fault OBs into Blocks folder; fix bus wiring16# 530DStartup prevented: SDB abortedCorrupted RAM configuration tablesExecute physical MRES; re-download HW Config16# 3501SDB could not be evaluatedMismatch between physical module and HW ConfigVerify MLFB and firmware versions in HW Config16# 4521Communication resource exhaustedTotal S7 connection limit exceededReallocate reserved OP connections in HW Config16# 7301Loss of redundancy in H-systemFiber-optic sync cable severed or partner stoppedInspect sync submodules; restart partner CPU

Verification

To confirm that the CPU 410-5H is fully stabilized:
1. Open SIMATIC Manager and select PLC > Module Information.
2. Check the Operating Mode: Verify that both CPU 0 and CPU 1 show RUN (Redundant) with the redundant link established.
3. Select the Diagnostic Buffer tab: Verify that the latest entry reports Operating mode transition from STARTUP to RUN (Redundant).
4. Disconnect a single distributed I/O station (ET 200M/SP) on the fieldbus: Verify that the CPU remains in RUN, logs an OB86 rack fault alarm to WinCC, and does NOT enter STOP mode.

Limitations and Operational Precautions

Observe the following engineering constraints:
- CPU 410-5H Maintenance-Free Design: Unlike legacy S7-400 CPUs, the CPU 410-5H does NOT use backup batteries. All retentive data and firmware configurations are maintained via non-volatile internal ferroelectric RAM (FRAM) and the System Expansion Card (SEC). Never attempt to disassemble the CPU or force battery connections.
- Do Not Mask Bus Faults: Loading fault OBs prevents the CPU from halting, but it does not fix broken cables or failing power supplies. Promptly investigate any OB82 or OB86 diagnostic alarm in WinCC.
- PROFINET Ring Redundancy (MRP): If distributed I/O is connected over PROFINET, verify that Media Redundancy Protocol (MRP) is correctly configured with the CPU acting as MRP Manager to ensure loop breaks heal within $200\text{ ms}$.

Engineer FAQ

Why did the CPU 410-5H stop when an I/O module faulted?

The controller entered STOP mode because fault Organization Blocks (specifically OB85 and OB86) were missing from the CPU block container. When a peripheral error occurs without these OBs present, the CPU operating system halts execution to prevent uncontrollable process outcomes.

Does the CPU 410-5H have a backup battery?

No. The CPU 410-5H is 100% battery-free. It utilizes a plug-in System Expansion Card (SEC) for Process Object capacity and non-volatile internal memory to retain data during power outages.

What does 'SDB evaluation aborted' mean in Event 16# 530D?

It means the internal System Data Blocks that define the hardware configuration could not be parsed during startup due to memory corruption caused during the preceding hardware crash, requiring a memory reset (MRES).