Troubleshooting License Key Activation Failures for CPU 410 System Expansion Packs in ALM

In SIMATIC PCS 7, when attempting to expand Process Object (PO) capacity on a CPU 410-5H using Automation License Manager (ALM) and the PO upgrade fails—preventing the license from being loaded onto the controller—the failure is typically caused by omitting the official PO activation file workflow, network communication timeouts between ALM and the target AS, or asymmetric license application in a redundant H-system. In fault-tolerant S7-400H / CPU 410-5H pairs, expansion packs must be purchased and applied symmetrically to both CPUs (e.g., 300 POs on AS 1 requires 3x 100 PO packages for CPU 0 and 3x 100 PO packages for CPU 1). To complete the upgrade, establish an online connection to the AS410 in ALM, generate the PO activation request file, and submit it through the Siemens Industry Online Support portal to receive the signed activation key file.

Executive Summary

The SIMATIC PCS 7 CPU 410-5H controller utilizes a flexible hardware-scaling architecture where controller execution capacity (Process Objects) is governed by a physical System Expansion Card (SEC). When plant expansions demand additional controller POs, engineers purchase CPU 410 System Expansion Packs in increments of 100 or 500 POs. However, commissioning engineers frequently encounter errors when attempting to transfer these license keys directly via Automation License Manager as if they were standard PC software licenses. The SEC requires a cryptographically paired challenge-response activation procedure linked to the SEC hardware serial number. Understanding the symmetric ordering rules and PO activation file workflow ensures seamless controller capacity expansion.

Architecture and Fundamental Mechanics

The hardware security and licensing architecture of CPU 410-5H System Expansion Packs operates through a multi-step cryptographic handshake:

The System Expansion Card (SEC) Hardware Anchor:
* The SEC card inserted into the rear of the CPU 410-5H contains a unique hardware serial number and an encrypted non-volatile memory partition.
* The internal firmware of the CPU continuously evaluates the number of active technological blocks in CFC against the maximum PO limit encoded in the SEC.
The Symmetric Licensing Rule for Redundant H-Systems:
* In a redundant S7-400H / CPU 410-5H pair, both controllers must maintain identical Process Object capacities to guarantee bumpless redundancy and identical memory layouts.
* If a plant requires adding 300 POs, the engineering schedule requires purchasing six 100 PO expansion packs: 3 packages for Rack 0 CPU and 3 packages for Rack 1 CPU.
* Expansion capacity cannot be split or shared across different SEC cards.
The Challenge-Response PO Activation Workflow:
* Standard software license keys (.ekb) cannot be written directly into controller RAM.
* ALM queries the target CPU 410-5H over Industrial Ethernet to read the SEC serial number, generating a PO Activation Request File (.txt).
* This request file is submitted to Siemens (via the automated web licensing portal or a Support Request).
* The Siemens licensing server validates the license entitlements and generates a matching PO Activation Response File digitally signed for that specific SEC serial number.
* ALM transfers this response file into the CPU, permanently elevating the SEC capacity.

Step-by-Step Implementation Procedure

Follow these procedures to activate CPU 410 System Expansion Packs and increase PO capacity:

Procure Symmetrical Expansion Packs:
* Calculate total additional POs required (e.g., 300 POs).
* For redundant H-systems, order double the quantity: 3x 100 PO packs for CPU 0 and 3x 100 PO packs for CPU 1 through an authorized Siemens distributor or the Siemens Industry Mall.
* Transfer the delivered license keys into Automation License Manager on your Engineering Station.
Connect to Target AS410 in ALM:
* Open Automation License Manager (ALM) as Administrator.
* Select Edit > Connect Target System > Connect AS410.
* Enter the IP address of the target CPU (e.g., CPU 0) and click Connect.
* The CPU 410 appears in the ALM navigation tree, displaying its current SEC serial number and active PO capacity.
Drag Expansion License and Initiate Upgrade:
* In ALM, drag the purchased CPU 410 Expansion Pack license keys from the local drive and drop them onto the connected AS410 node.
* Select the license key in the AS410 window, right-click, and select License > Upgrade.
Generate and Submit PO Activation File:
* ALM prompts that an activation file must be processed.
* Save the generated PO Activation Request File (.txt) to a known directory.
* If the ES has direct internet access, ALM can execute the online web activation automatically.
* If the ES is air-gapped: Transfer the .txt file to an internet-connected PC, browse to the Siemens Automation License Upgrade Portal (or submit a Siemens Support Request), and upload the file.
* Download the returned PO Activation Key File.
Download Activation Key into the SEC:
* In ALM, reconnect to the AS410.
* Select License > Complete Upgrade (or load the activation key file onto the SEC).
* The SEC firmware validates the cryptographic signature and updates its permanent PO capacity.
Repeat for Redundant Partner CPU:
* Disconnect from CPU 0 and connect to CPU 1 (Rack 1).
* Repeat Steps 2 through 5 using the remaining half of the purchased expansion pack licenses.

Verification

In SIMATIC Manager, select the CPU and choose PLC > Module Information > Performance. Verify that 'Maximum Process Objects' displays the newly expanded capacity (e.g., expanded from 1,000 to 1,300 POs). In CFC, compile charts with additional blocks and verify that download in RUN executes without licensing error dialogs.

Limitations and Operational Precautions

CPU 410 System Expansion Packs cannot be transferred back or uninstalled once applied to an SEC card; capacity upgrades are permanent. The maximum PO capacity cannot exceed the hardware platform ceiling of the CPU 410-5H (typically 2,600 POs).

Engineer FAQ

Can I buy 500 POs and split them: 300 for CPU 0 and 200 for CPU 1?

No. The volume of an expansion pack cannot be split; expansion packs are dedicated to a single SEC card, requiring symmetrical package ordering for redundant pairs.

Why did ALM report that the target system was not reachable?

Connecting to an AS410 in ALM requires direct S7 communication over ISO-on-TCP (port 102); verify that PG/PC interface is configured correctly and firewalls allow S7 traffic.

Can PO capacity be upgraded while the AS is running?

Yes. Activating additional PO capacity on the SEC can be performed online while the AS controller is in RUN mode without interrupting process control.

What happens if redundant CPUs have different PO capacities?

The H-system will operate, but the allowable project PO count is constrained to the capacity of the smaller SEC; a mismatch will trigger diagnostic warnings.