Resolving Redundant S7-410H Node Discovery and Download Failures to Rack 1 Over Industrial Ethernet

In SIMATIC PCS 7 redundant controller architectures utilizing S7-400H or CPU 410-5H, when an Engineering Station (ES) can ping the IP address of the secondary CPU (Rack 1) but cannot download configuration via SIMATIC Manager—failing with the error 'Module CPU 410-5H is not obtainable via the address set. Specify the node address for connecting the PG to the module/station'—the issue is typically caused by the physical subrack selector switch on the CPU module. S7-400H/410-5H CPUs ship from the factory with their rack switch set to Rack 0 by default. If the switch on the second CPU is not toggled to Rack 1, both CPUs identify as Rack 0, causing SIMATIC Manager to reject the connection. Toggling the physical rack switch on the second CPU to Rack 1 immediately resolves the download conflict.

Executive Summary

High-availability automation plants rely on redundant S7-400H or CPU 410-5H controllers to ensure uninterrupted process continuity. When commissioning a new fault-tolerant system—especially during staging where temporary engineering laptops without specialized CP 1623 communications processors are deployed—engineers frequently encounter situations where network pings succeed to both CPUs, yet SIMATIC Manager refuses to download to Rack 1. Because ICMP ping only validates network-layer connectivity to the Ethernet interface, it cannot detect rack address collisions at the S7 communication layer. Understanding the hardware rack addressing switch and S7 protocol routing mechanisms resolves initial commissioning download deadlocks.

Architecture and Fundamental Mechanics

The hardware addressing and communication mechanics of fault-tolerant S7-400H/410-5H stations operate through distinct physical and protocol layers:

The Physical Subrack Numbering Switch:
* Every S7-400H and CPU 410-5H module features a physical hardware selector switch located on the upper rear/top of the module (or behind the battery compartment cover depending on hardware generation).
* This two-position switch designates the physical CPU subrack identity: Rack 0 or Rack 1.
* By default, every CPU shipped from the Siemens factory has this switch set to Rack 0.
Hardware Configuration vs. Physical Reality:
* In STEP 7 HW Config, a redundant S7-400H station is defined with two subracks: Rack 0 (UR2-H slot 3 or 4) and Rack 1 (UR2-H slot 3 or 4).
* Each CPU has its own distinct Industrial Ethernet IP address and MAC address assigned in the station configuration.
* If the physical switch on the Rack 1 CPU remains set to Rack 0, the controller hardware reports its identity as Subrack 0, Slot 3 during S7 communication handshakes.
The S7 Protocol Handshake Barrier:
* When SIMATIC Manager attempts an engineering download (PLC > Download) to the station at Rack 1's IP address, the S7 connection protocol queries the module's rack/slot credentials.
* The target module responds: 'I am Rack 0'. However, SIMATIC Manager expects 'Rack 1' based on the HW Config destination parameters.
* Because the expected station topology does not match the actual hardware identity, the S7 communication layer aborts with: 'Module CPU 410-5H is not obtainable via the address set', even though low-level TCP/IP pings pass without error.
Laptop ES Communication Without CP 1623:
* While redundant production systems utilize CP 1623 and S7-REDCONNECT, an engineering laptop with a standard commercial network interface card (NIC) can successfully communicate with and download to S7-410H controllers using standard TCP/IP (S7ONLINE -> Standard NIC.TCPIP.1), provided the rack addressing is correctly set.

Step-by-Step Implementation Procedure

Follow these procedures to correct subrack addressing and establish successful engineering downloads to both redundant CPUs:

Power Down and Inspect the Rack 1 CPU:
* Safely power off the power supply module for Rack 1 (or toggle the CPU run/stop switch to STOP and dismount the module if in a de-energized staging rack).
* Locate the physical rack selector switch on the CPU 410-5H module (typically marked RACK 0 / RACK 1 or a toggle switch on the upper rear housing).
Set the Selector Switch to Rack 1:
* Toggle the physical switch firmly into the Rack 1 position.
* Re-seat the CPU in Rack 1 and power up the subrack.
Verify LED Initialization:
* Observe the CPU diagnostic LEDs during boot.
* The CPU will initialize and recognize its physical assignment as Rack 1.
Configure PG/PC Interface on the ES Laptop:
* On the engineering laptop, open Set PG/PC Interface.
* Set the Access Point of the Application (S7ONLINE) to your active Ethernet card: <NIC_Name>.TCPIP.1 (or TCPIP.Auto.1).
Download Hardware Configuration from SIMATIC Manager:
* Open HW Config in the PCS 7 project.
* Click Save and Compile.
* Select PLC > Download to Module.
* In the target selection dialog, select Rack 0 and download. Verify completion.
* Select Rack 1 and download. Confirm that the S7 handshake succeeds without address errors.
Establish Redundant Coupling (Sync Cables):
* Once physical fiber-optic synchronization cables are installed in the sync submodules, toggle both CPUs to RUN.
* The primary CPU will enter RUN, and the secondary CPU will link and synchronize, entering redundant RUN mode (REDF LED extinguished).

Verification

In SIMATIC Manager, select PLC > Diagnostic/Setting > Module Information for both Rack 0 and Rack 1 controllers. Confirm that Rack 0 reports 'Operating Mode: RUN' in Rack 0, and Rack 1 reports 'Operating Mode: RUN' in Rack 1. Open NetPro; verify that active connections to both CPUs display healthy green communication status.

Limitations and Operational Precautions

Never change the physical rack selector switch while the CPU is powered on; doing so may cause hardware initialization faults. For redundant bumpless plant operation, fiber-optic synchronization cables must be installed; operating without sync cables restricts the system to standalone non-redundant operation.

Engineer FAQ

Why did ICMP ping work when SIMATIC Manager could not download to Rack 1?

Ping operates at Layer 3 (IP protocol) and only verifies Ethernet interface responsiveness; SIMATIC Manager uses S7 protocol (Layer 7) which validates the internal rack and slot address of the CPU.

Can an engineering laptop without a CP 1623 download to an S7-410H system?

Yes. A standard commercial Ethernet NIC can perform engineering downloads to S7-410H via standard TCP/IP; CP 1623 and S7-REDCONNECT are only mandatory for high-availability multi-connection OS servers.

What is the factory default position of the rack selector switch?

Siemens ships all S7-400H and CPU 410-5H modules with the rack selector switch set to Rack 0 by default.

Can an S7-410H system run redundantly without sync cables?

No. Without fiber-optic sync cables connecting the synchronization submodules, the controllers cannot synchronize memory or execution scans, preventing redundant operation.