Redundant S7-400H Download Procedures: Process Object Licensing Rules, Fiber Sync Links, and OB34 Overruns

In SIMATIC PCS 7 fault-tolerant automation systems (S7-400H / AS 410-5H), downloading redundant controllers does not consume double the AS Runtime Process Object (PO) licenses. Siemens licensing rules dictate that AS RT PO licenses are booked per redundant automation station, not per individual physical CPU. Furthermore, downloading an H-system is executed as a unified transfer to the primary CPU; the partner CPU automatically synchronizes its memory image across redundant fiber-optic sync cables without requiring a separate user download. If sync cables are disconnected, coupling fails; if cyclic execution exceeds task limits, OB34 triggers Event 16#3502 and invokes OB80.

AS Process Object Licensing Rules for Redundant H-Systems

When commissioning redundant fault-tolerant automation controllers (e.g., S7-416H / CPU 416-5H or CPU 410-5H), commissioning engineers frequently encounter confusion regarding Automation License Manager (ALM) Process Object (PO) accounting.

A common misconception occurs when an engineer loads the user program onto the first CPU (Rack 0), observes that 254 PO licenses have been consumed, and fears that loading the second CPU (Rack 1) will require another 254 POs, exceeding the licensed quota.

The Siemens Manufacturer Licensing Rule

Under official Siemens PCS 7 licensing rules:
* AS RT PO licenses are charged per logical Automation Station, NOT per physical CPU.
* A redundant fault-tolerant controller pair (e.g., two CPU 416-5H processors or two CPU 410-5H processors in an H-rack) executing the identical automation program counts as one single AS station.
* The license manager books PO licenses for the station's technological blocks (e.g., motors, valves, analog inputs) once. The redundant partner CPU executes the synchronized mirror image under the identical license authorization.
* In CPU 410-5H systems, System Expansion Cards (SEC) provide capacity for each CPU, but software runtime PO licensing follows station-level accounting.

Redundant Memory Synchronization Mechanics (Coupling and Updating)

In S7-400H systems, engineers do not perform independent, separate program downloads to the second CPU. Doing so is an engineering error that can destabilize controller synchronization:

The Coupling and Updating Workflow ('Ankoppeln und Aufdaten')

Initial Load: With both CPUs in STOP mode, the engineer executes Target system -> Download in SIMATIC Manager. The engineering system downloads hardware configuration and user blocks to CPU 0 (Master).
Master Startup: CPU 0 is switched to RUN mode. The controller begins executing automation logic in standalone mode.
Partner Synchronization: The engineer simply switches CPU 1 (Standby) to RUN mode.
Automatic Memory Mirroring: The S7-400H operating system automatically initiates Coupling and Updating. Across the multimode fiber-optic synchronization cables connecting the sync submodules, CPU 0 transfers its complete internal memory image (data blocks, bit memory, timers, I/O process images) to CPU 1.
Redundant Coupling: Once synchronization completes, both CPUs transition to redundant coupled mode (RUN-Redundant), with the yellow REDF (Redundancy Fault) LED extinguishing.

If a fiber-optic cable is unplugged, dirty, or damaged, CPU 1 cannot receive the memory image and immediately drops back into STOP mode.

Diagnostic Buffer Event 16#3502 and OB34/OB80 Overrun Analysis

During controller startup, the CPU diagnostic buffer may log:
* Event ID 16# 3502: OB request error / Cause: Cyclic interrupt clock pulse generator / Causing OB: OB 34 / Requested OB: OB 80 (Timing error)

Failure Mechanism

OB34 Execution Overrun: Organization Block 34 is a cyclic interrupt task configured with a specific execution period (e.g., 200 ms).
If the combined execution time of all CFC charts assigned to OB34 exceeds 200 ms, the CPU's internal clock pulse generator attempts to trigger the next execution of OB34 while the previous execution is still running.
The operating system flags a timing error and invokes OB80.
Remediation:
1. Ensure OB80 is present in the CPU offline block folder; without OB80, the CPU will enter STOP mode upon a timing error.
2. In CFC Editor, open Options -> Customize -> Compile/Download and inspect task runtimes.
3. Re-assign non-time-critical algorithmic blocks from OB34 (200 ms) to slower tasks like OB33 (500 ms) or OB32 (1000 ms).
4. Alternatively, in HW Config -> CPU Properties -> Cyclic Interrupts, increase the OB34 cycle time.

S7-400H Redundant System Operating States and Diagnostic Matrix

The following table outlines the operating states and diagnostic indicators for redundant S7-400H controllers:

CPU 0 LED StateCPU 1 LED StateREDF LED StatusSystem Operating ModeOperational MeaningRUN (Solid Green)RUN (Solid Green)OFFRedundant (Duplex)Bumpless failover active; healthy synchronizationRUN (Solid Green)STOP (Solid Yellow)ON (Yellow)Solo / Standalone ModeCPU 1 down; zero failover capabilityRUN (Solid Green)RUN (Blinking Green)ON (Yellow)Coupling / UpdatingMemory sync in progress over fiber linksSTOP (Yellow)STOP (Yellow)OFFSystem STOPPlant halted; configuration download permittedAny ModeAny ModeFlashing RedHardware/Firmware FaultFiber submodule defective or mismatched FW

Verifying that both CPUs enter solid green with REDF extinguished confirms full redundancy.

Verification

To verify proper redundant system operation:
1. Inspect the physical front panels of both CPUs: confirm that RUN LEDs are solid green on Rack 0 and Rack 1.
2. Confirm that REDF and EXTF LEDs are completely extinguished.
3. In SIMATIC Manager, open the AS Diagnostic Buffer (Ctrl+D):
* Confirm that the operating mode indicates: Redundant mode (416-5H / 410-5H).
* Verify zero unhandled OB 80 timing errors or fiber sync link errors.
4. In Automation License Manager on the ES, confirm that the AS RT PO license count is deducted once for the redundant station.
5. In WinCC Runtime, confirm that S7-H Named Connections report active bidirectional data communication.

Limitations and Operational Precautions

Never bend fiber-optic synchronization cables beyond their minimum allowable bend radius (typically 30 mm); tight bends cause light attenuation and intermittent redundancy dropouts.
Both physical CPUs in an S7-400H redundant pair must possess identical hardware order numbers (MLFBs) and identical firmware revisions.
When loading HW Config changes online, always follow the Step 7 Redundant Download wizard to prevent tripping the running master controller.
For procurement and ordering, always validate final license quantities and MLFBs against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Does loading both CPUs in an H-system consume twice the Process Object licenses?

No. Siemens licensing counts Process Objects per redundant automation station. A redundant pair shares the same PO allocation.

Why did CPU 1 drop into STOP after switching it to RUN?

If the multimode fiber-optic sync cables are unplugged, crossed, or damaged, CPU 1 cannot execute the memory synchronization procedure and immediately aborts to STOP.

What should I do when Event 16#3502 appears in the diagnostic buffer?

Event 16#3502 indicates a cyclic interrupt overrun where OB34 took longer than its allocated time. Move heavy calculation blocks to slower OBs or increase the OB34 cycle time in HW Config.