Overview of S7-400H Redundancy with CPU 410-5H
The SIMATIC S7-400H is a high-availability PLC family designed for process automation where downtime is unacceptable. The CPU 410-5H Process Automation is the current generation redundant controller derived from the S7-400 platform and is the standard H-CPU shipped with SIMATIC PCS 7 V8.x and later. Redundancy in the S7-400H architecture covers the CPU subsystem, the backplane/RACK, the synchronization links, and - depending on the field level selected - the distributed I/O stations. The redundancy model is based on two identical controllers operating in hot standby, with one acting as the master and the other as the reserve, switching roles within milliseconds when a fault is detected on the active CPU.
The CPU 410-5H differs from earlier H-CPUs such as the CPU 417-5H in three ways: (1) it requires a mandatory system expansion card (SEC) plugged at the rear of the CPU to enable the process automation firmware features, (2) it cannot be hardware-upgraded from older S7-400 CPUs at firmware V6.0, and (3) the redundancy firmware and licensing model are tied to PCS 7 software maintenance contracts rather than legacy standalone S7-400H licenses. Reference the official SiePortal comparison between S7-417-5H and S7-410-5H for migration constraints.
Redundancy Topology and Fault-Tolerant Architecture
The S7-400H architecture consists of two independently powered racks, each containing a CPU 410-5H, a power supply (PS 405/PS 407), and the CPU-specific communication modules. The two CPUs are interconnected via two redundant fiber-optic sync links that plug into the IF1 and IF2 interface slots of each CPU. These two interfaces are mandatory: even if only one fiber pair is wired during initial commissioning, the system reserves the second interface for the redundant path.
According to the official CPU 410-5H Process Automation V10 manual, the calculated system MTBF for a fully redundant CPU 410 configuration is approximately 400 years assuming a 24-hour Mean Time To Repair (MTTR) and standard Common Cause Failure (CCF) modeling. This figure degrades if non-redundant components (single PS, single sync module, or single fieldbus) are present in the chain.
The X8 interface on the CPU 410-5H is reserved for S2 system redundancy configuration - a Siemens-proprietary extension that allows redundant PROFINET IO devices to be addressed through a single logical PROFINET interface. The X8 port is firmware-managed and should not be confused with the IF1/IF2 sync link slots, which are dedicated to CPU-to-CPU redundancy over fiber.
Hardware Requirements for a Redundant CPU 410-5H Station
To convert a single CPU 410-5H station into a fully redundant S7-400H station, the following hardware delta must be provisioned. Each item must match the active station's catalog number, hardware release, and firmware version exactly.
| Component | Single-Station Requirement | Redundant Delta |
|---|---|---|
| CPU 410-5H | 1 unit | 1 additional identical unit (same MLFB, same firmware) |
| UR2-H rack (or equivalent H-rated backplane) | 1 standard rack | 1 redundant rack, H-rated, identical slot layout |
| Sync modules (fiber interfaces) | 0 | 2 (one in IF1, one in IF2 of each CPU) |
| Fiber-optic patch cables | 0 | 2 pairs (crossed between CPU A IFx and CPU B IFx) |
| Power supply PS 405 / PS 407 | 1 PS | 2 PS (preferably redundant) |
| System Expansion Card (SEC) | Required | Required on both CPUs (mandatory for 410-5H) |
| Rear plug-in configuration module | 1 | Identical replacement module on reserve CPU |
| Redundancy license | Not required | Required, tied to PCS 7 / STEP 7 license model |
The rear plug-in configuration module (the small electronic key plugged at the back of the CPU containing the serial number and module identifier) must be cloned to the reserve CPU. Siemens does not support mixing a CPU 410-5H with a CPU 417-5H in the same redundant pair - the H-link synchronization firmware differs between the two controllers and will refuse to establish a hot-standby link.
ET200M Distributed I/O - IM153-1 vs IM153-2
The CPU 410-5H redundancy stops at the PROFINET or PROFIBUS interface module of the distributed I/O stations. The most common ET200M configuration on legacy S7-400H plants uses PROFIBUS DP with IM 153-1 interface modules. The IM 153-1, however, is a single-channel PROFIBUS slave: it cannot connect to two redundant DP masters simultaneously, and therefore cannot be used as a redundant PROFIBUS segment in an S7-400H configuration.
To deploy ET200M in a redundant segment, the IM 153-1 must be replaced by an IM 153-2. The IM 153-2 supports PROFIBUS DP with redundant masters via the Y-link coupler (e.g., 6GK1 416-2AA00 or DP/PA Y-link 6GK1 416-2AA01) and accepts two PROFIBUS cables - one from each CPU's PROFIBUS interface. The IM 153-2 also requires the active backplane (6ES7 195-1GF30-0XA0 or equivalent) rather than the passive BM IM153/IM154 baseplate used with the IM 153-1.
| Module | PROFIBUS Redundancy | Backplane | Compatible with H-CPU |
|---|---|---|---|
| IM 153-1 (e.g., 6ES7 153-1AA03-0XB0) | No - single channel | Passive (BM) | Yes - non-redundant segment only |
| IM 153-2 (e.g., 6ES7 153-2BA10-0XB0) | Yes - via Y-link | Active (6ES7 195-1G...) | Yes - redundant segment |
| IM 153-2 with FO | Yes - fiber-optic PROFIBUS | Active | Yes - redundant, long-distance |
Firmware, License, and Configuration Matching
Siemens enforces a strict identity rule for redundant CPUs: the master and reserve must share the same article number (MLFB), the same hardware release (HW Rev), the same firmware version (FW), and the same firmware update level. The CPU 410-5H ships with PCS 7 firmware only - it cannot be flashed to classic STEP 7 firmware. Conversely, a CPU 417-5H running classic S7-400 firmware cannot be downgraded to PCS 7 firmware. Field engineers should verify the firmware identity via the CPU's online diagnostics (Module Information > Identification) before commissioning a redundancy link.
The redundancy capability is unlocked by a software license (the "Redundancy" license, sold as a separate article in the PCS 7 catalog). The license is loaded onto the master CPU during commissioning using the Automation License Manager (ALM). When the reserve CPU boots, it reads the license from the active CPU via the sync link. If the reserve CPU detects a license mismatch, it reports diagnostic buffer entry "License missing for redundancy" and remains in stop state until corrected.
System Expansion Card (SEC) - mandatory on both CPUs of the redundant pair - contains the CPU's serial number, the type identifier, and the SIMATIC memory configuration. The SEC for the CPU 410-5H is ordered separately and is not interchangeable with the SEC for older S7-400 CPUs. The SiePortal S7-410 vs S7-417 H-CPU comparison explicitly states that the system expansion card is mandatory for the 410 series, unlike the 417 series where the card is optional.
STEP 7 vs PCS 7 - Which Engineering Tool?
A frequent point of confusion is whether S7-400H redundancy requires PCS 7 or whether it can be implemented in classic STEP 7. The technical answer: S7-400H redundancy can be configured in both STEP 7 (Classic, up to V5.6 / V5.7) and PCS 7. The differences are in licensing, project templates, and the operator interface, not in the redundancy mechanism itself.
| Aspect | STEP 7 Classic | PCS 7 |
|---|---|---|
| CPU type | S7-417-5H (legacy) | S7-410-5H (current) or S7-417-5H |
| Redundancy library | RED_LIB (older versions) | PCS 7 redundancy blocks integrated |
| License model | Redundancy license per CPU | Redundancy license + PCS 7 system license |
| HMI integration | Manual WinCC / TIA project | Native PCS 7 OS templates |
| Typical use case | Custom high-availability machines | Process plants, DCS replacement |
For new CPU 410-5H installations, PCS 7 is the standard commissioning tool because the CPU firmware is locked to PCS 7 features. The CPU will technically boot under STEP 7 V5.7 project shells, but Siemens recommends PCS 7 for full library support, version consistency, and lifecycle management. For older CPU 417-5H installations being migrated, STEP 7 V5.x projects can be carried over, but the migration to PCS 7 is required when switching to a 410-5H.
Commissioning Procedure for a Redundant CPU 410-5H Station
- Mount both UR2-H (or UR2 with H-rated backplane) racks in the cabinet. Ensure the rack earthing is bonded to a single common ground point to avoid ground loops across the fiber sync links.
- Insert the PS 405/407 power supplies in slot 1 of each rack. Apply 24 VDC or 120/230 VAC depending on the PS model. Verify the PS "OK" LED before proceeding.
- Insert the CPU 410-5H in slot 2 of each rack. Confirm the SEC is firmly seated at the rear of the CPU. Power up and verify both CPUs reach the "STOP with SF" state (expected - no project loaded).
- Install the sync modules (fiber interface cards) in IF1 and IF2 of each CPU. Connect the fiber patch cables in a crossed configuration: CPU A IF1 -> CPU B IF1, CPU A IF2 -> CPU B IF2. Maximum fiber length per Siemens documentation is 10 m for plastic fiber, 50 m for PCF, and up to 10 km with single-mode converters.
- Download the PCS 7 project (or STEP 7 project for 417-5H systems) to CPU A. CPU A becomes the master. CPU B remains in STOP until the project is downloaded to it.
- Download the same project to CPU B. CPU B performs a self-test and then attempts to link with CPU A via the sync modules. On successful link, CPU B transitions to RUN-R (redundant) state.
- Activate the redundancy license via ALM. Confirm both CPUs report "H-Sync OK" and "Master/Reserve" status in the diagnostic buffer.
- Connect the ET200M segments to the redundant PROFIBUS or PROFINET interfaces. If using IM 153-2 with Y-link, verify both PROFIBUS paths report "OK" in the diagnostic buffer of each ET200M station.
Verification and Diagnostic Indicators
After commissioning, verify the following indicators to confirm proper redundant operation:
| Indicator | Expected Value | Diagnostic Source |
|---|---|---|
| CPU A mode LED | Solid green (RUN with redundancy) | CPU front panel |
| CPU B mode LED | Solid green (RUN-R reserve) | CPU front panel |
| SF / BF LEDs on both CPUs | Off | CPU front panel |
| IF1/IF2 link LEDs | Solid green on all four ports | Sync module front panel |
| Diagnostic buffer: "H-Sync established" | Present on both CPUs | Online > Module Information > Diagnostic Buffer |
| Operating mode displayed in HMI | Master/Reserve or Solo | PCS 7 OS faceplate or STEP 7 HMI |
Common Configuration Mistakes
Engineers new to S7-400H frequently encounter the same set of issues. The following matrix summarizes the most common pitfalls and their root causes.
| Symptom | Likely Root Cause | Resolution |
|---|---|---|
| Reserve CPU stays in STOP with "License missing" diagnostic | Redundancy license not loaded on master CPU | Load redundancy license via Automation License Manager, restart both CPUs |
| H-Sync fails to establish, diagnostic "Different CPU type" | Master is 410-5H, reserve is 417-5H (or vice versa) | Replace reserve CPU with matching 410-5H variant |
| IM 153-1 modules report "Station failure" alternately on both CPUs | IM 153-1 is single-channel, cannot handle redundant masters | Replace IM 153-1 with IM 153-2 and add Y-link couplers |
| Sync link LED on IF1 only, IF2 dark | Fiber swapped or only one cable connected | Connect both fiber pairs (IF1 and IF2), verify crossed wiring |
| Reserve CPU reports "Different firmware version" | Firmware update applied to master but not reserve | Flash reserve CPU to same firmware, perform cold restart on both |
| System runs in solo mode after PCS 7 upgrade | Redundancy license not migrated to new PCS 7 version | Re-activate redundancy license in ALM, import license key from previous version |
Performance, Memory, and Fieldbus Limits
The CPU 410-5H Process Automation supports up to 16 PROFINET IO devices and up to 96 PROFIBUS DP slaves in redundant mode (exact limits depend on PCS 7 version and project type). Memory scalability is set by the System Expansion Card - SEC variants range from 4 MB to 40 MB work memory. For most PCS 7 process plants, the 8 MB or 16 MB SEC is the default selection.
The cycle time for the H-sync link is 100 ms by default and can be tuned down to 50 ms for fast-failover applications. The master-reserve switchover time is approximately 50-200 ms depending on the configured sync time, the number of IO devices being synchronized, and the MTTR setting. During switchover, all outputs are frozen at their last value unless the application uses PCS 7's "Output hold on failover" feature or external output modules with bumpless behavior.
For PROFINET IO S2 redundancy (the modern equivalent of PROFIBUS redundancy via Y-link), the CPU 410-5H supports S2 devices directly on the X8 interface without a coupler. S2 redundancy requires PROFINET devices that explicitly support the S2 profile. As of PCS 7 V9.1, the CPU 410-5H V9.1 documentation lists the supported S2 device families. Newer PCS 7 versions extend this list - always cross-reference the current PCS 7 release notes before specifying S2 devices.
Migration Path from Single CPU to Redundant
Migrating an existing CPU 410-5H installation from solo to redundant operation follows the same procedure as a greenfield installation, with the additional step of cloning the active project's hardware configuration. The high-level migration steps are:
- Document the master CPU's MLFB, hardware release, firmware version, and SEC part number. The reserve CPU must match all four attributes exactly.
- Order the second UR2-H rack, second PS, second CPU 410-5H, second SEC, and the sync module / fiber cable bundle.
- Pre-stage the reserve rack next to the active rack. Wire power, ground, and sync fiber in advance to minimize the switchover window.
- Schedule a maintenance window. During the window, power up the reserve CPU, download the same project, and verify H-Sync establishes.
- Force a master-reserve switchover (via STEP 7 / PCS 7 online command "Switchover") to validate that the application continues to run uninterrupted on the new master.
- Restore the original CPU to reserve role. Document the commissioning in the plant's lifecycle management system.
Frequently Asked Questions
Can I mix a CPU 410-5H with a CPU 417-5H in the same redundant pair?
No. Siemens does not support mixed H-CPU types in a redundant pair. The synchronization firmware differs between the 410-5H (PCS 7-only) and the 417-5H (STEP 7 / PCS 7 dual-capable). The reserve CPU will report "Different CPU type" in the diagnostic buffer and refuse to enter hot-standby mode. Both CPUs must share the same MLFB, hardware release, and firmware version.
Do I need PCS 7 to run a redundant S7-400H system?
Not strictly. STEP 7 Classic V5.x supports S7-400H redundancy for the CPU 417-5H with the legacy RED_LIB. However, the CPU 410-5H ships with PCS 7 firmware only and is the recommended H-CPU for new installations. PCS 7 is the standard commissioning tool because it provides integrated redundancy blocks, OS templates, and lifecycle licensing that STEP 7 does not include.
Why must I replace IM 153-1 with IM 153-2 for redundant ET200M?
Is the System Expansion Card (SEC) mandatory on both CPUs of a redundant pair?
Yes. The SEC is mandatory on every CPU 410-5H, whether the CPU runs as master or reserve. The SEC contains the CPU serial number, type identifier, and memory configuration. Without a correctly seated SEC, the CPU will not complete its self-test. Both CPUs must have identical SEC contents for the H-sync link to establish.
What is the master-reserve switchover time for CPU 410-5H?
Switchover time is approximately 50-200 ms depending on the configured sync cycle time (default 100 ms), the number of IO devices being synchronized, and the MTTR setting. During switchover, outputs remain frozen at their last commanded value unless the application uses PCS 7's output-hold-on-failover feature or the IO modules themselves provide bumpless behavior.