Resolving 43D8 Error on Siemens S7-400H 410-5H Standby Controller

The Siemens SIMATIC S7-400H is a fault-tolerant PLC platform built around two redundant H-CPUs synchronized through fiber-optic sync modules (Sync Module 6ES7960-1AA04-0XA0 / -1AB04-0XA0). When the standby controller of a CPU 410-5H (MLFB 6ES7410-5HX08-0AB0 or earlier index variants) enters the "defective" state and reports event 43D8 in the diagnostics buffer, the entire redundant pair loses its high-availability guarantee. This article documents the field-recovery sequence used to bring the standby CPU back to RUN, the way to interpret the diagnostics buffer entries, the meaning of the LED status, and the verification steps that confirm redundancy has been re-established without re-downloading the project.

1. S7-400H Redundancy Architecture and the Role of the Standby CPU

The S7-400H is specified in the SIMATIC S7-400H Fault-Tolerant Systems manual and the S7-400H Automation System, System Manual. Unlike a standard S7-400, an H-station contains two CPUs of identical type and identical firmware (one placed in Rack 0, the second in Rack 1) connected through redundant sync modules and sync cables. The pair operates in one of the following roles:

The transition from "Reserve" to "Defective" is the precondition for the 43D8 event. Once the standby CPU is flagged defective, all redundancy-supported communication (S7 H connections, S7 connection with redundancy error detection, fault-tolerant PROFINET IO, DP) is rerouted through the master until the standby is repaired. Loss of the master during this window would cause an unprotected process stop.

2. Observable Symptoms of a 43D8 Defective Standby CPU

Field reports on the CPU 410-5H (an H-CPU in the ET 200S / S7-400 family) describe a consistent symptom set. Each indicator is meaningful for the diagnostics sequence described in section 5:

• All LEDs flash on the standby CPU. The RUN, STOP, MAINT, BUS1F, BUS2F, IFM1F, IFM2F, and REDF LEDs blink in unison. This is the "defective / request for rack insertion / unknown state" indicator defined in the S7-400H System Manual. A steady STOP, RUN, or MAINT pattern is interpreted differently than a synchronized flash.
• No online connection to the faulty CPU. STEP 7 / SIMATIC Manager cannot establish an S7 online path to Rack 1 because the standby CPU has removed its Ethernet / PROFIBUS interface from the configured connections until it has cleared the internal error.
• Diagnostics buffer is still retrievable through the partner CPU when HMI/PG is connected to Rack 0, because the active CPU buffers the most recent events of both partners in its own diagnostics buffer (the "partner diagnostics" sub-list).
• Event 43D8 appears with a referenced FC and a logical / module address (I/O address or slot, depending on firmware). This is a signal that the OB where the error originated is identifiable, and that STEP 7 can navigate to the cause.
• Redundancy status from H status view shows the partner as "Defective" or "Not Available"; redundancy factor is reported as 1 instead of 2.

3. Decoding Diagnostics Buffer Event 43D8

The diagnostics buffer of an S7-400 CPU uses 16-bit event IDs grouped by class. Events in the 0x43xx range belong to the "CPU operating system / OB processing error" class. The exact meaning of the trailing digits depends on the firmware version of the CPU, the OB number that raised the error, and the parameter bytes supplied by the operating system. Cross-reference any 43D8 you see in the field against the SIMATIC S7-400H System Manual, Diagnostics Buffer section and the S7-400 CPU 41x Operating Instructions for your specific firmware index.

Open the diagnostics buffer in one of three ways:

1. From SIMATIC Manager, select the partner CPU (Rack 0) and choose PLC → Diagnostics → Diagnostics Buffer while connected online.
2. From STEP 7 Professional (TIA Portal), use Online & Diagnostics → Diagnostics Buffer on the accessible CPU.
3. Via the HMI's "CPU Diagnostics" area if the HMI is connected through the rack-coupled S7 connection.

For every 43D8 entry, the buffer records the following parameters:

Click the 43D8 event in the buffer to highlight the matching line. Then choose the "Open Block" button. STEP 7 navigates to the FC indicated in the event, and the cursor is placed on the network where the error was raised. This is the fastest way to convert the abstract event ID into a concrete cause: a divided-by-zero, an illegal pointer, a STOP request, a peripheral access fault, or an OB-not-found error.

4. Prerequisites for Recovery

Before performing the power-down procedure on a CPU 410-5H standby, verify the following so you do not create a second fault on the active master:

1. Confirm the active master is healthy. From the HMI or STEP 7 connected to Rack 0, read the H status. The master must be "Master" (not "Solo") and the redundancy status must be "Redundant" before the standby is taken offline.
2. Capture the diagnostics buffer of both CPUs. Use PLC → Save Service Data or Save to Text File on the partner CPU. Store the file with a timestamp on the engineering workstation. This is your only record of the 43D8 cause if the standby CPU clears its RAM after battery removal.
3. Verify the backup battery. CPU 410-5H uses 1 × 3.6 V type AA lithium thionyl chloride backup (e.g., Siemens 6ES7971-0BA00 or equivalent). If the BATF LED was already lit, the user program was held by the MMC (Memory Card, plug-in Flash) and not by the battery, but a low battery still has to be replaced as part of the recovery.
4. Confirm the MMC is present and matches the project. Removing the battery on a CPU without an MMC erases the retentive data and the user program. On a 410-5H, the MMC is mandatory for firmware ≥ V6.0. The program and project are stored on the MMC, so the "program copies through after RESTART" behavior in this scenario is the MMC being re-read, not the battery-backed RAM.
5. Confirm the sync modules and sync cables. The 410-5H requires two sync modules in each rack (slots 1 and 2 of the CPU base) and two fiber-optic cables. Inspect the cables for bending radius < 30 mm, kinks, or end-face contamination. A dirty sync cable can itself cause a standby to drop.
6. Prepare the engineering station. SIMATIC Manager V5.5 SPx (matching the project), the project archive, and the H-Station configurator must be installed. Confirm the rack configuration matches the physical layout before triggering the RESTART.

5. Step-by-Step Recovery Procedure

The procedure below is the sequence that has been demonstrated to clear a 43D8 defective state on a CPU 410-5H without losing the active process. It is built around the standard S7-400H maintenance workflow documented in the S7-400H System Manual, "Removing and Installing a CPU" chapter.

1. Do not pull the standby CPU yet. The first attempt should be a software "reboot": from the partner (active) CPU's H status, request a "Restart of partner" (often labeled "Restart (warm) reserve" or "Restart of standby"). If the standby CPU re-links, the 43D8 was a transient OB error and the recovery is complete. Verify with the redundancy LEDs and H status.
2. If the software reboot fails, perform a maintenance reset. With SIMATIC Manager online to the active CPU, choose PLC → Clear/Reset → Reset Module, and in the pop-up select "Reset module and copy from MMC." This is a diagnostic action that does not affect the active CPU's user program; it forces the standby CPU to do a full RAM test and reload from the MMC.
3. Remove the backup battery. With the standby CPU powered and unreachable (or already after step 2 if the CPU is in "defective / all LEDs flashing"), pull the backup battery. The MMC is unaffected.
4. Cycle the rack supply to the standby CPU. For a 410-5H in a separate rack (Rack 1), switch off the PS 405 / PS 407 power supply for that rack. Wait at least 30 seconds. This is a hard power cycle, not a STEP 7 STOP → RUN toggle.
5. Restore the rack supply. The standby CPU performs its full RAM test (the test takes 10 to 30 seconds for a 410-5H with a 4 MB / 8 MB / 16 MB MMC, depending on memory size and firmware). After the RAM test, the CPU stays in STOP with the MAINT LED on. The "all LEDs flashing" pattern must be replaced by a steady STOP pattern. If the LEDs continue to flash, the CPU is still defective and a hardware replacement is required.
6. Trigger a RESTART from SIMATIC Manager. With the partner CPU online, choose PLC → Operating Mode → Restart (warm) on the standby CPU, or in the H status view, choose "Start standby CPU." The standby CPU re-reads the user program from the MMC and begins the link-up sequence with the active master.
7. Wait for the program to copy through. The link-up on a 410-5H with a typical PCS 7 / Step 7 program takes between 3 and 15 minutes. The 10-minute figure in the field report is consistent with a multi-MB PCS 7 user program. The CPU may show MAINT / LINK / LINK-UP LED patterns during this time. Do not perform any online operation on the active CPU during link-up; this is a known trigger for re-entering 43D8.
8. Verify redundancy. The H status of both CPUs should now read "Master" on Rack 0 and "Reserve" on Rack 1. The redundancy factor should be 2 and the redundant PROFINET / PROFIBUS connections should report "OK."
9. Re-install the backup battery. With the standby CPU in RUN-Reserve, hot-insert a fresh battery. The BATT LED will extinguish within a few seconds. Verify with the diagnostics buffer that the BATF event has been removed.
10. Document the event. Export the partner diagnostics buffer again, label it "post-recovery," and archive both pre- and post-recovery buffers in the plant CMMS / service record. The 43D8 event is a process-quality record in most regulated environments (GAMP 5 / ISA-88 / ISA-95 sites).

6. Why the "All LEDs Flashing" Pattern Requires a Hard Cycle

The "all LEDs flashing" pattern on a CPU 410-5H is the equivalent of the PLC's "request for rack removal" or "module defect" signal. A normal online STOP → RUN or a SIMATIC Manager reset does not clear this pattern, because the pattern is set by the CPU firmware when an unrecoverable error has been latched. The only ways to clear the latch are:

• Power supply OFF/ON (hard cycle).
• MRES (mode reset) with a screwdriver or the MRES button held for the full 3+3-second sequence defined in the S7-400 CPU 41x operating instructions.
• Removal and re-insertion of the CPU from the rack, which also clears the latch.

Per the S7-400 CPU 41x Operating Instructions, a hard cycle is preferred over MRES on a 410-5H because the MRES sequence on an H-CPU also clears the redundancy link state and triggers an immediate link-up, which can race against the partner CPU and produce a second 43D8 event.

7. Link-Up and Program Copy Timing

The 10-minute program copy observed in the field report corresponds to the S7-400H link-up procedure. During link-up, the standby CPU:

1. Reads its project data from the MMC.
2. Compares the project version with the active master.
3. Initializes its process image to match the active master's PI.
4. Subscribes to all S7 H connections and fault-tolerant I/O.
5. Replicates the H-system status to the master.

Approximate link-up durations for a CPU 410-5H (firmware V6.0.x, MMC up to 16 MB):

8. Verification of Redundancy

After the standby CPU reaches RUN-Reserve, perform a structured verification of all redundancy-critical features. This is the section most field reports skip, and the one that prevents the next 43D8 from occurring a week later:

Forced switch-over test

After the static checks, perform a forced switch-over to confirm that the standby is fully capable of taking over the process. From the H status view, choose "Switch Master & Reserve." The master becomes the standby, the standby becomes the master, and the process continues without interruption. A successful switch-over confirms that link-up completed cleanly. If the switch-over fails or the new standby enters 43D8, the original 43D8 cause has not been cleared and a firmware / project-level investigation is required.

9. Related Event IDs in the 43xx Range and What They Mean

The 43xx range is reserved for "operating system / OB processing" events. The following IDs are the most commonly seen in field reports for S7-400 / S7-400H CPUs and are the first IDs to cross-check against a 43D8 occurrence:

10. Firmware, Battery, and Hardware Considerations

Firmware version

The 410-5H is shipped with firmware V6.0 or higher for current MLFB indices. The firmware version is visible in PLC → Module Information → Diagnostics → Version. If the 43D8 reoccurs after recovery, check the Siemens Firmware Update Service for SIMATIC S7-400 CPUs for a newer index. The CPU 410-5H family has multiple firmware index upgrades that explicitly address 43xx-class standby events. Always update both CPUs to the same firmware before commissioning, otherwise the link-up will fail with a "Different firmware versions" event.

Backup battery and MMC

The CPU 410-5H uses a single backup battery and a plug-in MMC. The battery keeps the retentive flags, timers, counters, and the realtime clock alive when the rack supply is removed. The MMC holds the user program, the project, and the firmware. The "program copy through after RESTART" behavior observed in the field is the firmware reading the project from the MMC, not from the battery. A failed battery does not, by itself, cause a 43D8; a failed MMC can. If the MMC has gone into read-only mode (Bit 0 of the diagnostic tag "CARD"), the user program will be partially loaded and the standby CPU will enter 43D8 on first link-up. Replace the MMC in this case.

Sync modules and fiber

The sync modules (6ES7960-1AA04-0XA0 standard, 6ES7960-1AB04-0XA0 high-availability) are hot-swappable. A sync cable with a contaminated end-face, an end-face too close to a sharp bend, or a length outside the 1 m to 10 m range (10 m for standard, longer for the high-availability type) will cause sporadic 43D8 events on the standby. Clean the end-face per the S7-400H System Manual — Fiber-Optic Cable chapter before ordering a new CPU.

11. Preventive Measures and Long-Term Stability

• Periodically save the diagnostics buffer to a network share via SIMATIC Manager or a script. The buffer is volatile across an MMC full-format and should be archived for at least the period required by your process-safety policy (typical: 12 months).
• Schedule a forced switch-over at the same frequency as the safety-instrumented function proof tests (e.g., annually). A forced switch-over that succeeds confirms that the standby is healthy; a forced switch-over that fails points to a latent 43D8 condition that will appear during the next real process disturbance.
• Keep the MMCs as a matched pair. Use the same vendor, the same part number, and the same revision. Mixed MMC vendors are a known root cause of rare link-up faults.
• Replace the backup battery on a fixed schedule (every 4 years for the 6ES7971-0BA00, or sooner if the plant temperature exceeds 35 °C). A failing battery does not raise 43D8 directly, but it changes the retentive data between STOP transitions and can produce intermittent 43D8 events during planned maintenance.
• Update firmware in lockstep. If you update one CPU, update the partner in the same maintenance window and verify with a forced switch-over before closing the window.
• Keep the STEP 7 / PCS 7 project aligned with the field firmware. A 410-5H running a project that references OB 121 / OB 122 and is missing those OBs in the download will produce a 43D8 the next time the program is downloaded. Run a project-wide "cross-reference for missing OBs" report before each download.

12. When to Escalate to a Hardware Replacement

If the sequence in section 5 is performed twice on the same 410-5H and the 43D8 reoccurs within 30 days, treat the CPU as hardware-degraded. The most common internal causes, in order of frequency, are:

1. DRAM bit degradation on the standby CPU's RAM test step — the CPU passes the test but a memory address fails under thermal load.
2. MMC read/write error in the first 8 KB of the user-program region.
3. Sync module socket on the CPU base has a dry joint and disconnects on thermal cycle.
4. Backplane connector (UR1 / UR2) has oxidized pins. Cleaning the connector with isopropyl alcohol and re-inserting the CPU is the field-level repair; replacement of the base is the permanent fix.

Order the replacement as a 6ES7410-5HX08-0AB0 (or whatever the current MLFB is at the time of order), with the same firmware index, and pre-load the firmware on the MMC using the SIMATIC Manager "Firmware Update via MMC" procedure. The replacement is hot-swappable on the standby CPU; do not attempt to hot-swap the active master.

13. Quick Reference Card

FAQ