C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Resolving S7-400H Redundancy Errors and Download in RUN Failures in SIMATIC PCS 7

Resolving S7-400H Redundancy Errors and Download in RUN Failures in SIMATIC PCS 7

In SIMATIC PCS 7 high-availability configurations, a redundancy warning during Hardware Download in RUN (CiR) occurs when one redundancy partner cannot confirm full synchronization due to an active fault on a switched DP slave, redundant optical sync module, or uncommitted delta state. To resolve this without plant disruption, verify redundant subnets in the AS diagnostic buffer, ensure both CPUs reside in redundant mode without loss of redundancy, and resolve passive ET 200M IM 153-2 interface failures before downloading.

Table of Contents

Root Cause Analysis of H-System Download in RUN Invalidation

In dual-controller fault-tolerant architectures utilizing SIMATIC S7-400H CPUs (such as the CPU 417-4H MLFB 6ES7417-4HT14-0AB0 or CPU 417-5H MLFB 6ES7417-5HT06-0AB0), downloading hardware modifications while the plant is operating requires Configuration in RUN (CiR). The operating system executes a coordinated sequence: it freezes I/O states, downloads hardware descriptors to the standby CPU, switches mastership, verifies station coupling, and synchronizes memory across the fiber-optic sync modules (6ES7960-1AA04-0XA0).

When the engineering station triggers the warning "There is a redundancy error in the H system. You can experience a data loss when downloading in Run. Do you want to download?", one or more conditions have broken the redundancy prerequisites:
1. Asymmetric Switched DP/PA Slave Status: A distributed I/O station (e.g., an ET 200M station with active backplane bus module 6ES7195-7HD10-0XA0 and redundant interface modules 6ES7153-2BA10-0XB0) has lost communication on one PROFIBUS-DP line (IM2 passive link down while IM1 active link is running).
2. Sync Submodule Coupling Degraded: One of the four duplex optical transceivers or fiber-optic synchronization cables has encountered cyclic frame parity errors or physical disconnection, dropping the CPU from Redundant Mode into Solo Mode.
3. Pending Asynchronous Interrupts (OB 70/72/82/86): The operating system diagnostic buffer contains unacknowledged I/O redundancy loss events. If the engineer forces a download under these conditions, the master-standby transition cannot guarantee bumpless control, causing the download process to hang indefinitely or abort to prevent a dual CPU stop.

Hardware Redundancy Diagnostic Matrix

Before initiating CiR or hardware downloads in an operating S7-400H cluster, evaluate the diagnostic indicators and buffer events according to the following operational matrix:

Subsystem ComponentHealthy State IndicationFailure Indication / Error CodeRoot Cause on S7-400H SystemCorrective Action Before DownloadRedundant CPU Pair (6ES7417-5HT06-0AB0)RUN solid green on both Rack 0 and Rack 1REDF solid red or flashing redLoss of redundancy; one CPU in Solo modeInspect diagnostic buffer for OB 72 event W#16#43xx; do not downloadSync Submodules (6ES7960-1AA04-0XA0)LINK green, ERROR darkERROR flashing redFiber bend radius violated, dirty ST connector, or defective transceiverClean fiber tips, verify optical link budget, replace duplex cableSwitched ET 200M (6ES7153-2BA10-0XB0)ACT green on primary, ACT dark on secondaryBF red on either IM 153-2 modulePROFIBUS DP line fault, bad terminator, or failed active bus moduleReplace DP connector, verify 24 V DC power redundancy, reseat active IMRedundant Power Supplies (6ES7407-0KR02-0AA0)DC24V green, BAF darkBAF red or FAULT yellowBattery low, line supply phase drop, or internal regulator faultReplace lithium backup buffer batteries, verify AC/DC feedsDelta Memory BufferConsistent online/offline checksumsDownload changes greyed outManual stop/start sequence cleared the CPU online change logPerform online block comparison; execute full download during outage

Procurement and hardware note: Verify replacement components and fiber-optic cables against authorized Siemens distributor specifications.

Step-by-Step Procedure to Clear Redundancy Errors and Download in RUN

Follow this validated sequence to recover redundant synchronization and safely complete a Hardware Download in RUN:

  1. Investigate AS Diagnostic Buffer:
    * In SIMATIC Manager, select the H-CPU station, navigate to PLC > Diagnostic/Setting > Module Information.
    * Open the Diagnostic Buffer tab for both Rack 0 and Rack 1.
    * Filter for organization blocks OB 70 (I/O redundancy loss) and OB 72 (CPU redundancy error). Note the hexadecimal error codes (e.g., W#16#7301 indicating loss of redundancy in DP slave, or W#16#4301 indicating synchronization link failure).
  2. Locate and Remediate Physical Bus/IM Faults:
    * Open HW Config and select Station > Open ONLINE.
    * Identify any ET 200M rack or distributed slave showing a red slash or diagnostic alert.
    * Inspect the physical field enclosure. Check the bus connectors (standard 9-pin D-sub 6ES7972-0BB42-0XA0), verify terminating resistors are switched ON only at physical line ends, and measure 24 V DC supply across both L+ terminals of the redundant IM 153-2 pair.
  3. Restore Full Redundant State:
    * Ensure both CPUs transition from Solo mode back to Redundant mode (RUN LEDs illuminated green, REDF dark).
    * Confirm in Module Information that the operating state displays: Redundant (Rack 0: Master, Rack 1: Standby).
  4. Execute Hardware Download in RUN:
    * In HW Config offline, select PLC > Download to Module.
    * Select Download to both CPUs in RUN mode.
    * Verify that the prompt reports no redundancy warnings and completes the master switchover sequence bumplessly.

Resolving CFC Download Changes Invalidation After CPU Switchover

When an engineer manually stops one CPU in an H-pair or switches mastership during an interrupted download, the CPU's internal online change buffer (delta log) becomes invalidated. The option Download > Changes only in CFC Editor becomes disabled (greyed out), presenting only Entire program.

To regain change-download capability without stopping the operating plant:
1. Analyze Consistency of Compilations: In SIMATIC Manager, perform a full consistency check (Options > Check Block Consistency) and recompile the CFC chart partition (PLC > Compile > Scope: Changes only).
2. Synchronize Online System Attributes: Ensure that both CPU work memories are consistent. If work memory usage is low (e.g., 19% utilization) but changes are blocked, verify that no blocks were manually copied or deleted via STEP 7 LAD/STL/FBD editor. Manual manipulation outside CFC immediately invalidates the delta log.
3. Recover Delta Tracking via S7 Archive: If the offline project diverged from the online CPU state during the abortive switchover, restore the validated project archive corresponding to the online timestamp, perform a change compilation, and download changes. If diversion cannot be resolved, plan a scheduled plant maintenance window to execute a coordinated stop-and-download of the standby CPU followed by a redundant catch-up.

Verification

Confirm successful remediation through the following criteria:
1. In HW Config Online, all ET 200M distributed racks, communication processors, and power modules display normal green checkmarks with zero red diagnostic slashes.
2. The front panel LEDs of both S7-400H CPUs show solid green RUN, dark REDF, and dark EXTF.
3. The Diagnostic Buffer displays event W#16#4304 or W#16#4302: Transition of the fault-tolerant system to redundant mode completed.
4. In CFC Editor, selecting PLC > Download allows selecting Changes only, executing without error or CPU stoppage.

Limitations and Operational Precautions

  • Never attempt a Hardware Download in RUN (CiR) if the REDF LED is lit or if any switched I/O rack is operating on a single channel. Doing so risks station failure and tripping plant actuators.
  • Do not manually switch one CPU to STOP mode as a troubleshooting shortcut during active process control. While an H-system can run on a single CPU, you lose all redundancy protection and risk total outage if the remaining master encounters an internal exception.
  • CiR modifications have upper limits: you cannot alter CPU base properties, cycle times, or memory allocations online; only modular I/O expansions on designated CiR-enabled DP/PA lines are permissible.

Engineer FAQ

What happens if I click 'Yes' to the redundancy error prompt during download?

Clicking 'Yes' forces the engineering system to attempt a master-standby switchover despite detected hardware faults. If the standby CPU cannot acquire healthy communication with all field slaves, the switchover aborts, the download hangs, and communication between the engineering station and controller may freeze, requiring a PC reboot.

Why does CFC 'Download Changes' get greyed out even when work memory has 80% free space?

CFC change downloads do not depend solely on free work memory. They require the offline project's generation stamps to match the online CPU change log exactly. If an uncompleted download, offline block modification outside CFC, or manual CPU restart cleared the online tracking table, change download is permanently disabled until the next full compilation and download.

Can I replace a faulted IM 153-2 interface module while the plant is in RUN?

Yes, provided active bus modules (6ES7195-7HD10-0XA0) are installed on the ET 200M DIN rail. You can hot-swap the passive IM 153-2 module without interrupting field I/O processing on the active partner module.

Technical References

Related Articles

Related Tags

  • S7-400H
  • CiR
  • Download in RUN
  • Redundancy Error
  • ET 200M
  • IM 153-2
  • CFC Download Changes
6 respuestas