Updating CP 443-5 Extended Firmware in Fault-Tolerant S7-400H Systems Without Controller Downtime

In SIMATIC PCS 7 fault-tolerant automation systems (S7-400H and CPU 410-5H), updating the firmware of communications processors (such as upgrading CP 443-5 Extended modules from v7.0 to v7.1.7) can be executed online in RUN mode with zero plant downtime. The redundant H-architecture allows updating modules in the Standby rack while the Master CPU continues controlling the process. The procedure requires transitioning the Standby CPU to STOP, updating its CP 443-5 Extended modules using the SIMATIC Firmware Loader over Industrial Ethernet, returning the Standby CPU to RUN so the controllers re-synchronize into redundant mode, executing an operating mode switchover to reverse Master/Standby roles, and repeating the update on the newly designated Standby rack.

Firmware Update Principles in Fault-Tolerant S7-400H Architectures

In continuous process industries (such as oil refining, chemical processing, and glass manufacturing), shutting down automation controllers to apply software patches or hardware firmware updates is financially and operationally prohibitive.

The SIMATIC S7-400H and CPU 410-5H fault-tolerant architectures are specifically engineered to support Firmware Updates During Operation (Update in RUN).

When a communications processor—such as the CP 443-5 Extended (6GK7443-5DX05-0XE0 / 6GK7443-5DX05-0XE1)—experiences communication buffer errors or stability bugs resolved by newer firmware revisions (such as updating from v7.0 to v7.1.7), the update can be applied progressively across the redundant controller racks.

By exploiting the redundant subrack separation, one half of the fault-tolerant system is temporarily halted and updated while the partner half maintains uninterrupted control of all field actuators and PROFIBUS DP lines.

Prerequisites for Online CP 443-5 Extended Firmware Updates

Before executing an online firmware update on active production controllers, the following prerequisites must be confirmed:
1. Redundant H-System State: The controller pair must be operating in steady-state RUN-Redundant mode with fiber-optic synchronization healthy and zero active diagnostic alarms.
2. Redundant Fieldbus Topology: All distributed I/O stations on the PROFIBUS DP lines must be connected redundantly (e.g., ET 200M stations equipped with active bus modules and redundant IM 153-2 interface modules, or redundant Y-Links). If a single-channel DP slave is connected exclusively to one CP, updating that CP will interrupt that specific slave.
3. Firmware File Integrity: Obtain the certified firmware container (v7.1.7.upd) directly from Siemens Industry Online Support (SIOS Entry ID 109483492).
4. Engineering Station Communication: The ES must possess a functional connection to the CP modules over Industrial Ethernet or MPI/PROFIBUS via the Firmware Loader utility (s7fldx.exe).

Step-by-Step Bumpless Firmware Update Execution Procedure

Execute the update following the strict nine-step sequence detailed in SIMATIC PCS 7 Compendium Part D:

flowchart TD
    A["1. Steady State: RUN-Redundant"] --> B["2. Stop Standby CPU (Rack 1)"]
    B --> C["3. Update CP 443-5 Ext Modules in Rack 1 to v7.1.7"]
    C --> D["4. Restart Rack 1 CPU: System Re-enters RUN-Redundant"]
    D --> E["5. Switchover Master Role: Rack 1 Becomes Master"]
    E --> F["6. Stop New Standby CPU (Rack 0)"]
    F --> G["7. Update CP 443-5 Ext Modules in Rack 0 to v7.1.7"]
    G --> H["8. Restart Rack 0 CPU: System Re-enters RUN-Redundant"]
    H --> I["9. Completed: All CPs Updated with Zero Plant Downtime"]

Phase 1: Update Communications Processors in Rack 1

Verify in SIMATIC Manager via PLC > Module Information that the operating mode is RUN (Redundant).
On the physical CPU in Rack 1 (Standby), turn the mode switch from RUN to STOP (or execute STOP from SIMATIC Manager).
- Rack 0 immediately assumes sole control; the plant experiences zero disruption.
Open the Firmware Loader utility (s7fldx.exe) from the Windows Start menu under SIMATIC > STEP 7.
Click Next, browse to the firmware file CP443-5_Extended_V717.upd, and enter the MAC or PROFIBUS address of the first CP in Rack 1.
Click Download: The firmware flash procedure initiates, running for approximately 2 to 3 minutes.
Repeat for all remaining CP 443-5 Extended modules residing in Rack 1.
Once all Rack 1 CPs report successful firmware loading, turn the Rack 1 CPU mode switch back to RUN.
The CPU completes self-tests, synchronizes memory with Rack 0 across the fiber-optic link, and returns to RUN (Redundant).

Phase 2: Role Switchover and Update in Rack 0

In SIMATIC Manager, select the CPU and choose PLC > Operating Mode....
Click Switch to CPU... (Role Switchover). Rack 1 now becomes the active Master controller.
Transition the CPU in Rack 0 to STOP.
Using the Firmware Loader, download firmware v7.1.7 to all CP 443-5 Extended modules in Rack 0.
Turn the Rack 0 CPU mode switch back to RUN.
The controllers execute automated synchronization and return permanently to RUN (Redundant) with all four CPs operating on firmware v7.1.7.

Redundant CP Firmware Update Sequence Matrix

The following matrix details the operational status across each phase of the update:

Step / PhaseMaster CPU (Rack 0)Standby CPU (Rack 1)Active Process ControlPlant DowntimeInitial StateRUN (Master)RUN (Standby)Handled by Rack 0ZeroPhase 1 UpdateRUN (Sole Master)STOP (Updating CPs)Handled by Rack 0ZeroIntermediate SyncRUN (Master)RUN (Synchronized)Handled by Rack 0ZeroRole SwitchoverStandby (Target for Stop)RUN (New Master)Handled by Rack 1ZeroPhase 2 UpdateSTOP (Updating CPs)RUN (Sole Master)Handled by Rack 1ZeroFinal StateRUN (Synchronized)RUN (Master)Redundant OperationZero

Verification

To confirm that the firmware update succeeded on all communications processors:
1. Open SIMATIC Manager and select the AS station.
2. Select menu PLC > Module Information.
3. Select each physical CP 443-5 Extended module across both Rack 0 and Rack 1:
- Check the General tab.
- Verify that Firmware Version displays V7.1.7.
4. Check the CPU operating mode: Confirm that both processors report RUN (Redundant) with status LEDs indicating normal operational states.
5. Check the CPU Diagnostic Buffer: Ensure no bus fault (OB86) or I/O access error (OB85) events remain active.

Limitations and Operational Precautions

Observe the following engineering precautions:
- Never Update Both Racks Simultaneously: Halting both CPUs concurrently will shut down the entire automated facility. Always wait for the first rack to fully synchronize into RUN-Redundant before touching the partner rack.
- Single-Channel Fieldbus Slaves: If any fieldbus device is connected via a non-redundant single bus cable directly to a single CP, that specific device will disconnect during the update of its associated CP. Verify fieldbus redundancy topologies beforehand.
- Power Supply Stability: Ensure that uninterrupted power supply (UPS) systems powering the controller racks are stable; a power outage during firmware EEPROM flashing can permanently damage the CP module.

Engineer FAQ

Will my plant shut down when I update CP 443-5 Extended firmware in an H-system?

No. The S7-400H architecture is specifically designed for online firmware updates in RUN mode. By updating one rack while the partner rack controls the plant, the update is executed with zero downtime.

What tool is used to download firmware to CP 443-5 Extended?

Firmware is downloaded using the Siemens 'Firmware Loader' utility (s7fldx.exe) included with STEP 7, connecting over Industrial Ethernet or PROFIBUS.

Why did Siemens recommend updating CP 443-5 Extended to v7.1.7?

Firmware v7.1.7 resolved critical communication buffer management bugs that could cause the standby CPU in S7-400H systems to enter STOP mode unexpectedly under heavy acyclic PROFIBUS DP telemetry loads.