FM458-1DP All LEDs Blinking: Decoding Events 7 and 19

1. Problem Overview

The Siemens FM 458-1DP (Siemens MLFB 6DD1607-0AA2) is the application module of the SIMATIC T400 family and slots into any S7-400 base alongside a CPU such as the CPU 416-2 / CPU 416-3. It executes the time-critical technology functions - closed-loop torque/speed control, cross-cutter, winder, hydraulic axis, cam, and high-speed closed-loop position control - that the CPU cannot meet on its own scan cycle. In the field configuration described in the source case, a single FM458-1DP controls two SINAMICS drives (S120 or G120 family) over PROFIBUS DP, while the user works online with CFC, D7-SYS V9.0, and STARTER for the SINAMICS commissioning.

The recurring fault is unambiguous and reproducible:

• Every front-panel LED on the FM458 begins to flash synchronously.
• Communication between the CPU 416 and the FM458 collapses - the I/O area assigned to the FM goes to zero / substitute values.
• STARTER loses its online link to the SINAMICS drives that were routed through the FM.
• The FM no longer accepts CFC online commands, although the CPU program itself continues to run.

The fault has been observed after 2 to 3 days of continuous operation from a cold start, both on first commissioning and after MMC replacement. Reading the FM458 diagnostic buffer shows entries with event identifiers 7 and 19.

2. Affected Hardware and Firmware Versions

3. LED State Decoding on the FM 458-1DP

The FM458 front panel exposes five LEDs: INTF (internal fault), EXTF (external fault), RUN, STOP, and DP (PROFIBUS status). The blink patterns are documented in the SIMATIC T400 manual, but the failure described here - every LED flashing at the same ~2 Hz rate - is the universal FATAL / HARDWARE-FAULT pattern.

The synchronized all-LED flash is the key tell. It is never produced by a PROFIBUS wiring issue, a CPU OB error, or a SINAMICS-side fault. It is produced by the FM458 boot monitor when its application loader cannot complete a checksum or read transaction on the MMC.

4. Diagnostic Buffer Events 7 and 19 - What They Mean

The FM458 diagnostic buffer is identical in structure to the S7-400 CPU diagnostic buffer. Each entry carries a 16-bit event ID, a timestamp (relative to module power-up), and up to four associated 32-bit information words. The events that appear in this failure mode are:

Events 7 and 19 in this combination are not a hardware defect on a working FM458. They are a post-mortem signature of MMC corruption. The CPU does not see any OB121/OB122 because the FM has not crashed the backplane - it has simply walked itself into STOP and stopped answering I/O updates.

5. Root Cause Analysis

The pattern is consistent with the MMC write-during-online-debug race condition documented for FM458 firmware V2.1 and earlier.

1. The CFC online "Download changes" function writes the modified chart blocks to the MMC in small 512-byte sectors.
2. If the download is interrupted - PG cable unplugged, TCP socket reset, STARTER interrupting the route through D7-SYS - one or more sectors on the MMC remain at the old contents while the FAT pointer advances.
3. On the next reboot the application image fails its CRC. The FM458 boot monitor records event 7 and falls back to STOP.
4. The boot monitor then attempts to load the configuration block from the same corrupted MMC, hits a read fault, and records event 19 with information word 0x0004.
5. From this point every LED blinks and the CPU receives only "module failed" diagnostics on the FM slot.

Field evidence supporting this model:

• Both reported occurrences manifested after 2-3 days. This is the typical CFC online-debug cadence for a complex motion application.
• Reloading the MMC offline - i.e. removing the MMC, programming it in the PG's MMC adapter with the complete project, and reinserting it - resolves the fault deterministically, even on the original FM458 module.
• Swapping the MMC alone does not always clear the fault: the new MMC must also be programmed offline, not transplanted from another running FM.

6. Resolution Workflow

1. Isolate power. Bring the S7-400 rack to a safe state. Do not pull the FM under voltage - the MMC may be left in a half-erased state if removed live.
2. Read the diagnostic buffer first if the FM is still partially responsive. Use STEP 7 -> Accessible Nodes -> right-click the FM -> Diagnostic Buffer. Record event 7 / 19 timestamps and any preceding warnings.
3. Remove the MMC from the slot on the front of the FM458 after power-off.
4. Program the MMC offline on the PG using the external MMC adapter and STEP 7 / D7-SYS:
   Project -> Charts (CFC) -> FM458 -> Chart Folder -> right-click -> Chart -> Download -> MMC Programming
   Select the complete project download - not a delta. Tick "Erase MMC" before write.
5. Re-seat the MMC in the FM458 and power the rack.
6. Observe the boot sequence. The LEDs should flash briefly during POST, then settle to RUN on (solid) within 30 s. If the synchronized blink returns, the FM module itself is suspect.
7. Go online with D7-SYS and verify the chart matches the project archive version.

7. MMC Offline Programming Procedure (Detail)

A complete MMC programming sequence erases any half-written sectors and re-issues the application image atomically, so the post-mortem CRC failure on next boot cannot recur unless the MMC hardware itself is marginal.

8. Retrieving the Diagnostic Buffer in Fatal State

The follow-up question - how do I read the diagnostic buffer when the FM is locked up? - is a real engineering problem because the FM458 responds to no PG requests while in fatal blink. The supported recovery paths are:

1. STEP 7 Accessible Nodes - even in fatal state the FM458 still appears in the S7-400 backplane topology. Accessible Nodes often works because it polls the rack directly through the CPU, not through the FM. Right-click the FM458 -> Diagnostic Buffer will succeed and surface events 7 and 19.
2. CPU diagnostic buffer - if the FM has been offline long enough, the CPU records a "module failure" entry. The CPU buffer itself will not contain events 7 and 19 (those are FM-side) but it confirms the timeline.
3. Forced STOP via PG - issuing a STOP from STEP 7 to the FM slot can pull the FM out of fatal blink on some firmware revisions. After STOP, Online -> Diagnostic Buffer becomes accessible.
4. Web server of the CPU - if the CPU is a CPU 416-3 PN/DP with an enabled web server, the web page "Module Information -> FM458" returns the same buffer text as STEP 7.
5. HMI panel read - a PanelView or TP that is configured to display the FM's diagnostic buffer via an S7 function block can also serve as a read path.

If none of the above returns the buffer, the only remaining option is to swap the MMC, boot the FM clean, and accept that the original buffer entries are lost. They are nevertheless useful as a maintenance log if the PG or HMI captured a screenshot before the failure.

9. Verification After Repair

10. Preventive Measures

• Perform all CFC chart changes during scheduled maintenance windows, then trigger an explicit "Download complete project to MMC" - never leave a half-written application image on the MMC at the end of a session.
• Disable simultaneous STARTER online connections while a CFC download is in progress. Either close STARTER or move its routing through a different network interface.
• Keep the PG TCP socket alive with a long keep-alive, or use a direct MPI/DP cable to the S7-400 for CFC download instead of routed Ethernet.
• Use only Siemens-approved MMCs (6ES7953-8Lxxx). Counterfeit MMCs from third-party vendors are known to fail CRC at a much higher rate than OEM.
• Schedule periodic MMC replacement on a preventive interval (24 months) for installations that run continuous 24/7.
• If firmware V2.1 can be upgraded to V3.x or V4.x via the Siemens firmware update package, do so - later revisions include improved boot monitoring that detects partial MMC writes and rolls back to the previous image automatically.
• Configure OB82, OB83, OB85, and OB86 in the CPU so that a transient FM failure does not bring the CPU into STOP.

11. When to Replace the FM458 Module

Replacement of the FM458 itself - not just the MMC - is indicated when:

• The synchronized LED blink returns immediately after an offline-programmed MMC is inserted on a known-good card.
• The diagnostic buffer shows event 19 with information word 0x0001 (true firmware error) rather than 0x0004 (MMC access).
• Multiple different MMCs fail in the same module within a few power cycles.
• The module exceeds its electrolytic-capacitor service life (~10 years continuous at 60 °C ambient).

When ordering a replacement FM458, request the current firmware version - newer 6DD1607-0AA3 or 6DD1607-0AA4 variants are backward compatible with CFC charts compiled for 6DD1607-0AA2 firmware V2.1, but the diagnostic buffer event IDs change. Document the new mapping in the project maintenance procedure.

12. Companion Documentation

• SIMATIC T400 - FM 458-1DP Function Manual: Siemens Support entry 77411706
• D7-SYS V9 Installation and Operation Manual: Siemens Support entry 109769396
• FM458 firmware update packages and release notes: Siemens Support entry 109763476
• S7-400 CPU 416 Module Data Manual: Siemens Support entry 11177407