Resolving S7-410 CPU System Expansion Card (SEC) PO Activation and Release File (*.rel) Errors

In SIMATIC PCS 7, when activating Process Object (PO) capacity upgrades on an S7-410-5H controller using a technical support Release SEC PO file (*.rel) fails with the error '... please repeat the process while in expert mode', the engineer must enable Expert Mode in Automation License Manager (ALM). In ALM, navigate to File > Settings > Expert Mode, enable the 'Activate expert mode' checkbox, and re-execute the transfer under License Key > Upgrade / Restore SEC License. A CPU memory reset will not resolve licensing errors because the capacity resides on the physical System Expansion Card (SEC).

Architecture of S7-410-5H System Expansion Cards (SEC)

The SIMATIC S7-400 CPU 410-5H (6ES7410-5HX08-0AB0) represents a fundamental departure from legacy controller hardware. Instead of purchasing different physical CPU tiers (e.g., 414, 416, 417), the CPU 410-5H utilizes a single high-performance hardware model whose processing capacity and Process Object (PO) volume are unlocked exclusively by a physical hardware dongle: the System Expansion Card (SEC) (6ES7653-2BA00-0XB5).

Key architectural attributes of the SEC card:
* Physical Hardware Token: The SEC card inserts directly into a dedicated slot beneath the CPU 410 front door.
* Firmware Capacity Management: The SEC card stores the cryptographic license determining the maximum number of AS Process Objects (ranging from 100 POs up to 2600+ POs, or unlimited).
* Decoupled from Work Memory: CPU hardware performance, communication bandwidth, and cycle execution speed are identical across all tiers; only the permissible compiled PO ceiling is enforced.
* Online Scalability: PO capacity can be expanded dynamically without shutting down the controller, swapping hardware, or touching wiring.

The PO Capacity Expansion Mechanism: ALM vs Release Files (*.rel)

There are two operational workflows for managing SEC PO capacity:

Standard PO Booking Workflow (Automation License Manager):
* The engineer purchases a PO volume expansion package (e.g., CPU 410 Expansion Pack 100 POs 6ES7653-2CC00-0XB5).
* The license key is installed on the Engineering Station via ALM.
* In ALM, the engineer targets the online CPU 410-5H over the network and transfers the POs, writing cryptographically signed license tokens directly to the SEC card.
Emergency Technical Support Release Workflow (*.rel files):
* If an online PO transfer is aborted mid-stream (e.g., due to network disconnection, power failure, or database timeout), the SEC card enters an uncommitted or faulted transaction state.
* The original license key in ALM becomes locked, while the SEC card has not yet accepted the new capacity.
* To recover from this state, Siemens Technical Support generates a specialized cryptographic Release File (*.rel) tied to the unique serial number of the physical SEC card.

Why the 'Repeat Process in Expert Mode' Error Occurs in ALM

When an engineer attempts to inject a technical support *.rel file using the standard ALM user interface, the transfer aborts with:

License transfer failed. Please repeat the process while in expert mode.

The Security Lock:
By default, Automation License Manager operates in a restricted user mode to prevent accidental tampering with industrial cryptographic keys. High-risk operations—such as forcing low-level firmware write operations, re-initializing corrupted dongles, or applying manual emergency release files (*.rel)—are hidden from standard menus.
The Remedy:
The engineer must explicitly unlock ALM's Expert Mode. Once activated, ALM exposes low-level recovery tools under the License Key menu, permitting manual selection of the .rel file and overriding the transaction mismatch on the SEC card.

Why CPU Memory Reset (MRES) Fails to Solve SEC License Issues

When encountering SEC activation errors, engineers frequently attempt a CPU Memory Reset (MRES) or power cycle. This action is completely futile:

Separation of Hardware Layers:
Performing an MRES clears the CPU's internal RAM (wiping data blocks, organization blocks, and dynamic runtime registers).
SEC Independence:
The SEC card is an independent non-volatile cryptographic module. Its internal license counters and transaction logs are physically isolated from the CPU's work memory. Performing an MRES has zero effect on the SEC card's internal state.
Risk of MRES:
In a production plant, performing an MRES stops the controller and wipes the running automation program, requiring a full download without fixing the underlying licensing fault.

SEC License State Matrix and Recovery Procedures

The following table details diagnostic states on the CPU 410-5H and their corresponding recovery paths:

SEC License StatusDiagnostic Buffer MessageUnderlying Root CauseVerified RemediationNormal OperationalSEC license valid; PO capacity: XXXXNormal licensed executionStandard operation; no action requiredPO Overrun WarningConfigured POs exceed SEC capacityProgram compiled with more POs than licensedBook additional POs via ALM, or reduce CFC PO countTransaction InterruptedSEC write error; transaction uncommittedNetwork drop during online PO transferApply Siemens Technical Support *.rel file in ALM Expert ModeRepeat in Expert ModeLicense transfer failed (Error 0x... )Attempting to apply .rel file in standard ALMEnable "Activate expert mode" in ALM Settings and re-executeSEC Missing / UnrecognizedSEC defective or not insertedPhysical card not seated, or dirty contactsPower down rack, reseat SEC card securely, power upSEC Serial MismatchRelease file invalid for this SEC*.rel file generated for wrong SEC serial numberRequest revised release file matching exact SEC serial number

Step-by-Step Procedure to Enable Expert Mode and Apply *.rel Files

Follow this verified engineering workflow to apply an SEC release file:

Verify SEC Serial Number:
* In SIMATIC Manager, select the CPU 410-5H and press Ctrl+D (Module Information).
* In the General or Special Properties tab, locate and record the exact serial number of the System Expansion Card.
* Confirm that the received *.rel file name or documentation matches this serial number.
Enable Expert Mode in Automation License Manager:
* Open Automation License Manager (run as Administrator).
* In the top menu, click File > Settings....
* In the Settings dialog, navigate to the Expert Mode tab.
* Check the box Activate expert mode.
* Click Apply and OK.
Establish Online Connection to the CPU:
* In the ALM navigation tree, expand Target Systems > Connect Computer / Device.
* Select the S7ONLINE communication profile pointing to the CPU 410-5H IP address.
Execute License Recovery / Upgrade:
* Select the online CPU 410-5H device in ALM.
* In the menu, click License Key > Upgrade... (or Restore SEC License).
* Browse to the directory containing the *.rel file.
* Select the file and click Transfer.
Confirm License Booking:
* Wait for the progress bar to complete.
* Confirm that ALM reports: License key transferred successfully to SEC.

Verification

Verify that SEC PO activation is completely restored:
1. In SIMATIC Manager, select the CPU 410-5H and press Ctrl+D to open Module Information.
2. Navigate to the Performance Data / Process Objects tab; verify that the Current PO Capacity reflects the expanded volume (e.g., upgraded from 500 to 1,000 POs).
3. In SIMATIC Manager, open Options > PCS 7 License Information; confirm that the AS Process Objects tab displays sufficient licensed capacity with zero shortfall warnings.
4. Open the CPU Diagnostic Buffer; verify that no license violation warnings or SEC error entries are present.

Limitations and Operational Precautions

Card Pairing: The SEC card is paired with the physical CPU. If a CPU hardware unit must be replaced, the SEC card must be physically removed from the damaged CPU and inserted into the replacement CPU to transfer the PO entitlements.
Do Not Remove SEC Card Under Power: Never insert or remove the System Expansion Card while the CPU 410-5H is powered on. Doing so corrupts the non-volatile memory and can physically damage the card.
Safeguarding Release Files: Release files (*.rel) are single-use cryptographic tokens tied to a specific hardware serial number. Retain a backup of the release file in the plant engineering documentation repository.
Commercial Accuracy: System Expansion Cards (6ES7653-2BA00-0XB5) and PO expansion packages (6ES7653-2CC00-0XB5) represent hardware capacity entitlements. All license modifications must be processed through an authorized Siemens distributor quotation.

Engineer FAQ

Can I swap an SEC card from one CPU 410-5H into another CPU 410-5H?

Yes, provided the CPU is completely powered down before removing and inserting the card. The capacity resides entirely on the SEC card, so the target CPU immediately inherits the PO capacity of the inserted card upon power-up.

What happens if my configured POs exceed the SEC capacity during runtime?

The CPU does not enter STOP mode. The program continues executing, but the CPU asserts an internal diagnostic warning, lights the internal maintenance LED, logs a permanent licensing violation, and restricts further delta downloads until capacity is increased.

Why did Siemens introduce the SEC card concept for the CPU 410-5H?

The SEC card standardizes hardware procurement on a single physical CPU part number (6ES7410-5HX08-0AB0), reducing spare parts inventory costs while allowing scalable software capacity upgrades on demand.

Is an internet connection required on the Engineering Station to transfer POs to the SEC?

No. The PO license keys reside locally in Automation License Manager. The transfer occurs entirely over the local plant bus S7 connection between the ES and the CPU.