C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Step-by-Step Procedure for Replacing One CPU in a Redundant AS 410-5H System During RUN

Step-by-Step Procedure for Replacing One CPU in a Redundant AS 410-5H System During RUN

Replacing a single CPU 410-5H in a redundant SIMATIC PCS 7 system while maintaining plant operation is supported by Siemens redundancy mechanisms, even when the replacement CPU arrives with newer firmware (e.g., V8.2.3 replacing V8.1.0). The replacement must be executed through a coordinated sequence: stopping the standby subsystem, transferring the System Expansion Card (SEC), updating CPU firmware to achieve version parity, executing a master-standby failover, and updating the partner CPU. Adhering to this procedure preserves bumpless continuous control without interrupting active field I/O.

Table of Contents

Redundant CPU Replacement Principles and Firmware Discrepancies

In a fault-tolerant SIMATIC PCS 7 automation system (AS 410-5H Redundant), two identical CPUs operate in an event-synchronized master-standby relationship interconnected via high-speed fiber-optic sync modules. When one CPU requires physical replacement:

  • Bumpless Redundancy Execution: The plant process continues to run seamlessly on the active Master CPU while the Standby CPU is stopped, removed, replaced, and re-commissioned.
  • Firmware Parity Requirement: A redundant S7-400H / CPU 410-5H pair cannot enter redundant mode (RUN-Redundant) if the two CPUs run different firmware versions (e.g., one CPU running V8.1.0 and the other running V8.2.3). While a single CPU running newer firmware can run in solo mode, synchronization will be rejected until both CPUs share the identical firmware level.
  • The Upgrade Workflow: When a replacement CPU arrives with newer firmware, the engineer must either downgrade the replacement CPU to match the running master, or perform an online step-by-step firmware upgrade sequence to bring both CPUs to the newer firmware level.

System Expansion Card (SEC) Hardware Transfer Rules

Before unboxing the new CPU, adhere to Siemens commercial and hardware guardrails:

  • The Hardware Capacity Resides on the SEC: The physical processing capacity (PO entitlement) is stored inside the cryptographic memory of the System Expansion Card plugged into the rear of the CPU.
  • Transfer the Card: The engineer must extract the SEC from the defective CPU and insert it into the replacement CPU 410-5H.
  • Software Licensing Compliance: AS Runtime Process Object (AS RT PO) software licenses are pooled centrally in ALM and are required only once for a redundant AS pair. Replacing one CPU does not require purchasing new software licenses.
+-------------------------------------------------------------------+
|            Redundant CPU 410-5H Online Replacement Flow           |
+-------------------------------------------------------------------+
|  Active Master CPU (Running Plant) | Standby CPU (Defective / Stop)|
|                                    |                              |
|                                    v                              |
|  [Step 1: Power Down Standby Rack & Transfer SEC to New CPU]      |
|                                    |                              |
|                                    v                              |
|  [Step 2: Insert New CPU -> Update FW to Match Master (V8.1.0)]   |
|                                    |                              |
|                                    v                              |
|  [Step 3: Power On Standby -> Auto-Sync to RUN-Redundant]         |
|                                    |                              |
|                                    v                              |
|  [Step 4: Switchover Master Role -> Update Second CPU to V8.2.3]  |
|                                    |                              |
|                                    v                              |
|  Both CPUs Synchronized at V8.2.3 in Full Bumpless RUN-Redundant  |
+-------------------------------------------------------------------+

Step-by-Step Replacement Sequence Without Plant Shutdown

Follow this exact sequence to replace the standby CPU without process interruption:

Phase 1: Decommissioning the Standby Subsystem

  1. Verify that the automation system is currently in RUN-Redundant mode. Confirm that CPU 0 is Master and CPU 1 is Standby.
  2. Switch the mode switch on the Standby CPU (CPU 1) to STOP. The active Master CPU continues controlling the process alone (solo mode; IFM1F/IFM2F LEDs illuminate).
  3. Disconnect power to the Standby CPU rack / power supply module.
  4. Disconnect fiber-optic synchronization cables, Ethernet plant bus leads, and PROFIBUS/PROFINET cables.
  5. Extract the Standby CPU from the rack.
  6. Extract the System Expansion Card (SEC) from the rear of the old CPU and insert it securely into the replacement CPU 410-5H.
  7. Verify that the Rack Number switch on the replacement CPU (behind the lower door) is set correctly (e.g., set to Rack 1 to match its position).

Phase 2: Installing and Aligning Firmware

  1. Seat the replacement CPU into the rack, secure the screw, and reconnect network and sync cables.
  2. Power on the rack.
  3. Allow the unbuffered boot sequence to complete (2 to 5 minutes) until the STOP LED is steady.
  4. Connect the Engineering Station directly or across the plant bus.
  5. In SIMATIC Manager, check the firmware version via Ctrl + D:
    * Recommended Option (Downgrade/Match): If the master CPU runs V8.1.0 and plant shutdown is prohibited, downgrade the replacement CPU's firmware to V8.1.0 using PLC -> Update Firmware. Once firmware matches, switch the CPU to RUN. The controller automatically executes an online synchronization (Link-Up and Update) and enters RUN-Redundant.
    * Alternative Option (Online Upgrade to V8.2.3): If elevating the entire plant to V8.2.3 is intended, follow the official Siemens Firmware Update in RUN sequence (detailed below).

Phase 3: Executing Firmware Update in RUN (If Elevating to V8.2.3)

  1. With the new CPU (V8.2.3) in STOP, load the HW Config and S7 program.
  2. Execute a redundant switchover (PLC -> Operating Mode -> Switch over to CPU with altered configuration).
  3. The new CPU (V8.2.3) assumes the Master role. The process continues running without interruption.
  4. Stop the original CPU (now Standby), update its firmware from V8.1.0 to V8.2.3 via PLC -> Update Firmware.
  5. Turn the mode switch to RUN. Both CPUs sync and resume RUN-Redundant at V8.2.3.

Firmware Synchronization and Redundancy Pairing

During the Link-Up and Update sequence:

  • The master CPU transfers its entire dynamic work memory, execution sequence state, and data block contents across the fiber-optic sync cables to the standby CPU.
  • This memory synchronization occurs in microseconds without pausing cyclic I/O updates, achieving true bumpless transition.

Verification

Confirm complete restoration of high-availability redundancy:

  1. Front Panel LED Inspection:
    * Master CPU: Steady green RUN.
    * Standby CPU: Steady green RUN.
    * All Fault LEDs (SF, EXTF, IFM1F, IFM2F) must be extinguished.
  2. STEP 7 Module Information Audit:
    * Select both CPUs in SIMATIC Manager and press Ctrl + D.
    * Verify that the operating state reports Redundant.
    * Confirm that both CPUs report identical firmware revisions (e.g., V8.2.3).
  3. Test Redundancy Switchover:
    * During an authorized maintenance window, test manual switchover from the ES to verify bumpless handover.

Limitations and Operational Precautions

  • Distributor Quotation Disclaimer: Validate all spare CPU part numbers and firmware compatibility against current Siemens catalogs and authorized distributor quotations.
  • Never Power Down Master CPU: Accurately verify which CPU is actively in Master mode before disconnecting power; powering off the Master while the Standby is in STOP halts the entire plant.
  • Handle Fiber Cables with Care: Fiber-optic sync cables are delicate; do not exceed bend radius limits or contaminate fiber ferrules.
  • Matching SEC Ratings: Both CPUs in a redundant pair must have identical SEC cards with identical PO capacity ratings.

Engineer FAQ

  • Can a redundant AS 410-5H system run with two different firmware versions?
    No, both CPUs must run the identical firmware version to enter the redundant operating state (RUN-Redundant).
  • What is the safest way to replace a CPU if the spare arrives with newer firmware?
    The safest method is to downgrade the spare CPU's firmware to match the existing master CPU, allow automatic synchronization, and plan an upgrade later.
  • Does replacing one CPU require buying additional AS RT PO licenses?
    No, AS RT PO software licenses are pooled for the redundant pair, and the hardware PO capacity is transferred via the physical SEC card.
  • What must be transferred from the old CPU to the new CPU?
    The hardware System Expansion Card (SEC) located on the rear of the CPU must be transferred to the replacement unit.
  • Why did the replacement CPU fail to sync with the running master?
    Common causes include mismatched firmware versions, mismatched SEC capacity cards, disconnected fiber sync cables, or incorrect rack number switch settings.
  • How long does memory synchronization take during link-up?
    The internal link-up and update process typically requires only a few seconds, transferring memory without pausing I/O updates.
  • What switch on the CPU determines if it is Rack 0 or Rack 1?
    The physical rack selection rotary or slide switch located behind the lower interface door must match the rack assignment in HW Config.
  • Can I replace synchronization submodules while the CPU is powered?
    No, always power off the CPU rack before inserting or removing fiber-optic synchronization submodules.
  • What does the IFM1F LED indicate on a CPU 410-5H?
    It indicates an Interface Module Fault on Sync Submodule 1, typically caused by a disconnected or damaged fiber-optic cable.
  • Does an online firmware update in RUN cause bumps in analog outputs?
    No, Siemens S7-400H / CPU 410-5H redundancy architecture guarantees bumpless switchover without disturbances to analog or digital outputs.

Technical References

  • Siemens Industry Online Support (SIOS) Portal: Fault-tolerant Process Control Systems (S7-400H / CPU 410-5H) Manual (Entry ID: 82478488).
  • SIMATIC PCS 7 CPU 410-5H Firmware Update in RUN Guidelines.
  • SIMATIC S7-400H High Availability Systems System Manual, Siemens AG.

Related Articles

Related Tags

PCS 7, CPU 410-5H, Redundancy, S7-400H, Firmware Update, Bumpless Switchover, High Availability, Maintenance

20 respuestas