Resolving PCS 7 AS 410-5H CiR Block Caused by REDF on PROFINET

Problem Overview

On a Siemens PCS 7 plant running a redundant AS 410-5H controller pair with PROFINET line structure and ET 200SP HA I/O stations, Configuration in Run (CiR) downloads are blocked whenever a downstream PROFINET station becomes unreachable. The CPU module reports the REDF (Redundancy Failure) LED, even though the redundant partner is fully operational and process execution continues on the surviving controller. The next attempt to download a hardware change "in run" is then rejected by the HCiR wizard.

This is a recurring pain point for plant operators because PROFINET station outages during partial maintenance, commissioning windows, or staged rollout of new field cabinets routinely trip the REDF, and that single bit is sufficient to lock the entire system out of CiR. Engineering stations refuse to apply further HW changes until the redundancy is restored, which can be days or weeks if a process train is locked out.

Affected System Configuration

The behavior documented in this article applies to the following reference architecture:

• Controller: SIMATIC PCS 7 AS 410-5H redundant pair, e.g. 6ES7410-5HX08-0AB0 (CPU 410-5H) or 6ES7410-5HM08-0AB0 (CPU 410 SMART), one primary and one backup CPU in an H-station frame.
• PROFINET topology: Line structure connecting the two AS 410-5H CPUs and downstream ET 200 stations.
• I/O: ET 200SP HA head modules (IM 155-6 PN HA, e.g. 6DL1155-6AU00-0PM0) with redundant PROFINET connections.
• Switches: SCALANCE XF204-BA managed switches forming MRP rings inside each cabinet.
• Configuration tool: SIMATIC Manager / STEP 7 V5.x with PCS 7 Engineering Toolset, or PCS 7 V9.x as installed.
• Firmware: CPU 410-5H firmware V8.2.x and later, which is the baseline for the documented H-CiR enhancements (see Siemens Support entry 109476571).

Root Cause Analysis

The root cause is the interaction between two plant-wide mechanisms:

1. PROFINET station failure detection. When an ET 200SP HA station becomes unreachable on the PROFINET line - for example because the cabinet power is locked out, the network cable is disconnected, or the head module has failed - the CPU raises a station failure event. In an H-system, this event is treated as a redundancy-affecting disturbance.
2. H-CiR wizard redundancy check. When an engineer initiates a Hardware Configuration in Run (H-CiR) operation, the STEP 7 / PCS 7 wizard verifies that the system is in the RUN-Redundant system state. If the REDF LED is lit because any PROFINET station is unavailable, the wizard aborts before any change is downloaded.

The default behavior of the wizard is therefore conservative: any single unreachable station is sufficient to lock out all subsequent CiR operations, even when the unavailable station is unrelated to the change being downloaded.

Why REDF Is Triggered

The CPU 410-5H / CPU 410 SMART documentation distinguishes between several redundancy loss conditions:

• Loss of redundancy on the CPUs.
• Redundancy loss / station failure of a switched DP station.
• Failure of a DP master.
• Disconnecting a redundant PROFINET device.

(Source: CPU 410 SMART Function Manual.)

For S7-1500R/H systems the same behavior is documented: a failed or STOP CPU transitions the redundant system from RUN-Redundant to RUN-Solo, and the operating state of the IO devices determines whether redundancy is fully lost or only degraded (S7-1500R/H Loss of Redundancy CPU). The principle is identical for the AS 410-5H line.

Interaction with CiR / H-CiR

CiR (Configuration in Run) is the standard STEP 7 mechanism that allows hardware changes to a running S7-400 station without stopping the CPU. In an H-system, the same mechanism is called H-CiR. The H-CiR wizard enforces additional checks because both CPUs must remain synchronized throughout the change. The relevant check in this scenario is the "system is in redundancy" check.

Symptoms and Diagnostic Indicators

Engineers typically observe the following chain of events:

1. A field cabinet is powered down for maintenance or commissioning. The PROFINET line drops one or more ET 200SP HA stations.
2. The primary CPU's REDF LED turns on, and the system transitions from RUN-Redundant (system state 6 / 7) to RUN-Solo. The remaining IO continues to update the process image.
3. The maintenance team completes work and powers the cabinet back up. Stations return and the LED normally clears within a few seconds.
4. Meanwhile, the engineering team attempts to download a hardware change (adding a new device, swapping a module, modifying slot assignments). The H-CiR wizard refuses to proceed.
5. If multiple cabinets are down for an extended period - for example, an entire process train is locked out for weeks - the engineering team loses the ability to add new field devices for other trains that are actively producing.

Diagnostic buffer entries on the CPU typically include the following patterns:

• "Station failure" with the PROFINET device number and station address (event class 3 / ID 0x033E family).
• "Redundancy loss" or "Loss of redundancy on PROFINET IO" (event class 3 / ID 0x135A family).
• OB 86 - Rack failure / IO station failure call indication.
• OB 83 - Hot-swap interrupt for pluggable PROFINET modules (head module, I/O modules).

Expected LED Pattern on AS 410-5H

Solution: Disable the HCIR Wizard Redundancy Check

Siemens provides an explicit toggle that relaxes the H-CiR wizard's redundancy check. The toggle is intended for engineering convenience during partial plant outages. The setting is local to the engineering station's STEP 7 installation, not a controller setting.

Step-by-step Procedure (SIMATIC Manager / STEP 7 V5.x)

1. Open HW Config for the AS 410-5H station in SIMATIC Manager.
2. From the menu bar select Options → Customize.
3. In the dialog that opens, switch to the CiR / HCIR tab.
4. Clear the checkbox "Canceling in the HCIR wizard in case of redundancy error".
5. Click OK to apply.
6. Re-launch the H-CiR wizard from Station → Open HW Configuration with CiR or via the standard HCIR download path.
7. Proceed with the download. The wizard accepts the change while REDF is lit.

Reference: Siemens Support entry 109476571 describes the toggle and related H-CiR considerations.

Verification

1. Confirm the wizard reaches the "Download to target system" step without aborting.
2. After download, confirm that the new or modified device appears in the online view of HW Config.
3. Inspect the diagnostic buffer of both CPUs for entries showing the CiR operation completed (event ID family around 0x135A, depending on firmware).
4. Verify the REDF LED clears once the affected cabinet returns online and the standby CPU re-synchronizes.
5. Confirm that the modified IO is updating the process image using a watch table on the relevant inputs/outputs.

Alternative: SFC 12 "D_ACT_DP" for Selective Deactivation

For engineers who prefer not to relax the wizard globally, system function SFC 12 D_ACT_DP can be used to selectively deactivate an unreachable station from the user program. With firmware V8.2.0 and later of the CPU 410-5H the function is usable in H-systems for routine maintenance (Siemens Support entry 109476571). On older firmware, SFC 12 inside an H-system risks desynchronization.

SFC 12 Interface

Example Call in STL / SCL

// STL - deactivate unreachable PROFINET station before H-CiR
CALL "D_ACT_DP" (
      REQ    := bDeactivateReq,
      MODE   := B#16#0,
      LADDR  := W#16#0FFE,   // diagnostics address of unreachable station
      RET_VAL := iRetVal,
      BUSY    := bBusy
    );

// SCL equivalent
IF bDeactivateReq THEN
  "D_ACT_DP"(REQ := TRUE,
             MODE := 0,
             LADDR := 16#0FFE,
             RET_VAL => iRetVal,
             BUSY   => bBusy);
  bDeactivateReq := FALSE;
END_IF;

SFC 12 Return Codes (excerpt)

Important Caveats

• Firmware dependency: Earlier firmware (< V8.2.0) does not support D_ACT_DP cleanly inside an H-system. On older firmware, deactivating one CPU's view of the station may desynchronize the two controllers.
• Mode 2 (test activation): Useful to confirm the station is reachable before reinserting it into the process.
• Diagnostic address: Use the address configured in HW Config under the device properties; this is the address reported in OB 82 / OB 86 diagnostics.
• H-system semantics: If called from a user program that runs on both CPUs, ensure both controllers process the call to keep redundant state consistent, and evaluate the RET_VAL carefully.

Physical Workarounds

For plants where CiR cannot be enabled during outages, two physical mitigations are common.

24 V Power Separation

For MCC applications with SIMOCODE pro V PN (e.g. 3UF7011-1A.0-0), separate the 24 V supply for the SIMOCODE device electronics from the 24 V supply that powers the SIMOCODE outputs. The device remains visible on PROFINET even when the motor starter outputs are locked out, so REDF is not raised.

Spur Topology with SCALANCE XF204-BA

If feasible, connect cabinets via SCALANCE XF204-BA managed switches so that each cabinet is on its own PROFINET spur. Loss of one spur does not break the ring and does not affect stations upstream of the failed switch. Configure MRP on each switch and designate one switch per ring as MRP Manager. Verify the role assignment with PRONETA before commissioning.

Firmware Considerations

The behavior of H-CiR and SFC 12 in H-systems has evolved across CPU 410-5H firmware releases:

Always confirm the firmware version in operation via Online → Accessible Nodes in STEP 7, or read CPU_FW_VERSION from the diagnostic buffer.

Troubleshooting Matrix

Best Practices and Recommendations

1. Disable the HCIR wizard cancellation only on the engineering station performing the change. It is a local STEP 7 option, not a controller setting. Do not enable it globally on a shared engineering server if other engineers do not need the relaxed behavior.
2. Document which cabinets are intentionally offline during partial maintenance. Add the cabinet, device, and planned outage window to a handover log so that subsequent CiR operations can be reasoned about.
3. Restore redundancy as soon as maintenance is complete. The relaxed wizard does not remove the underlying loss of redundancy. Any H-CiR operation still requires synchronization between the two CPUs, and prolonged solo operation increases risk if the surviving CPU fails.
4. Consider SFC 12 for clean deactivation. Calling D_ACT_DP from the user program makes the station state explicit and auditable in the diagnostic buffer rather than implicit.
5. Avoid mid-run CiR when major process segments are down. The system is more stable when both H partners and most IO are online.
6. Use MRP rings where possible. MRP provides a single point of failure protection against one cable break; without MRP, a single break in a line topology drops everything downstream.
7. Validate with PRONETA. Before going live with a new topology, run a PROFINET topology scan with PRONETA to confirm that the line / ring structure is correctly recognized and that every device is reachable.

Related Configuration: MRP on SCALANCE XF204-BA

When the cabinet layout uses SCALANCE XF204-BA managed switches to provide MRP redundancy inside each cabinet, configure MRP as follows:

1. Open Web-Based Management of the XF204-BA.
2. Navigate to Layer 2 → MRP.
3. Assign exactly one switch per ring as MRP Manager; the remaining switches are MRP Client.
4. Set the desired MRP domain name identical on all switches in the ring.
5. Connect ring ports (typically ports 1 and 2) to the ring neighbors.
6. Save and reboot the switch.

After commissioning, verify ring status with PRONETA or with the SCALANCE diagnostics: a healthy ring shows MRP state "Ring closed". A break causes MRP to fall back to "Ring open" within 200 ms typical recovery time.

Related OB Behavior on AS 410-5H

When a station is lost, AS 410-5H calls organization blocks that the user program can use to react:

Insert these OBs in the offline project and download once before relying on them for engineering diagnostics. OB 70 and OB 72 are H-specific and are documented in the S7-400H / CPU 410-5H manuals.

Frequently Asked Questions