Resolving S7-400H Redundancy Failure with Flash EPROM Programming

Problem Details

The Siemens SIMATIC S7-400H fault-tolerant system fails to establish redundancy when flash EPROM memory cards (FEPROM) are inserted into both CPUs (CPU 0 and CPU 1). The same hardware configuration, with identical CPU rack order numbers and sync module wiring, achieves redundant operation immediately when the flash cards are removed and the project is loaded into integrated load memory (RAM). With FEPROM cards present, only individual block downloads to CPU 0 or CPU 1 are offered by STEP 7, and the standard block download operation does not create a redundancy link. The diagnostic buffer of each CPU shows no synchronization event after a warm restart, and the IFM (Interface to Fault-tolerant Module) LED behavior and STATUS LEDs do not transition to the expected redundant RUN pattern.

This symptom is reproducible on the standard S7-400H CPU families used for high-availability control: CPU 412-3H (6ES7412-3HJ14-0AB0), CPU 414-4H (6ES7414-4HM14-0AB0), CPU 416-3H (6ES7416-3HS06-0AB0), and CPU 417-4H (6ES7417-4HT14-0AB0). It also appears in S7-400F/FH safety configurations because the same load memory architecture applies.

System Architecture Recap

The S7-400H consists of two synchronized CPUs, each with its own load memory and work memory, linked through fiber-optic sync modules (up to four submodules per CPU, order code 6ES7960-1AA04-0XA0 for 10 m or 6ES7960-1AB04-0XA0 for 1 m) over the IFM (interface to the fault-tolerant module) connectors on the front of the H-CPU. Both CPUs run identical user programs in lock-step after redundancy is established, with a configurable update window (default 100 ms; range 1-1000 ms in HW Config) and a master/standby role assignment managed automatically by the system based on the rack in which the master was configured.

Load memory for each H-CPU can be either:

• Integrated RAM - retained with the backup battery on the PS 407/PS 405 power supply, used for fast block download during commissioning.
• Plug-in FEPROM card - 5 V Flash EPROM (5V-FEPROM) inserted in the load memory slot of the CPU, used for permanent program storage without battery backup.
• RAM card - battery-backed RAM card for projects too large for integrated RAM and requiring fast download.

FEPROM cards do not support online block modification in the same way integrated RAM does. The entire user program on the card is treated as a single image; partial block downloads do not patch the card in place - they target the integrated RAM. This is the source of the redundancy failure when the technician has been performing the usual "download to target" action after each program change.

Refer to the SIMATIC S7-400 Automation System S7-400H Fault-Tolerant System manual for the section "Load memory concept" and the S7-400 memory cards and parameter assignment entry ID for sizing guidance.

Root Cause Analysis

The root cause is a mismatch between the load memory image and the integrated RAM image across the redundant pair. Three conditions converge:

1. Partial download to RAM only. When the operator selects a single block (e.g., OB 1, FB 100, DB 50) in STEP 7 and uses the standard PLC > Download action, STEP 7 writes the block to the integrated load memory (RAM) of the target CPU, not to the FEPROM. The two CPUs end up with FEPROM images that no longer match the RAM image in which the redundant link is being negotiated.
2. Compressed FEPROM contents. STEP 7 cannot compress blocks on FEPROM the way it does in RAM. If a partial download has fragmented the RAM image, the resulting code is incompatible with the flash card layout. The redundancy startup routine on each H-CPU compares its load memory image with the partner; a mismatch in the block set, timestamps, or block container header causes the standby CPU to enter STOP with diagnostic event "Redundancy loss" or "Link-up aborted."
3. Wrong menu target in STEP 7. The required action - Download user program to memory card - is only enabled in STEP 7 V5.x when the cursor is placed on the Blocks folder of the offline project (the container that lists OB 1, SFB, SFC, FBs, FCs, DBs as a single user-program entity). Selecting Main(1) - the copy of the user program that STEP 7 uses internally for the partner CPU - or selecting an individual block disables the menu item, which is why the field engineer sees the option as unavailable.

Compounding the issue, the redundant user program is split into two offline representations inside the STEP 7 project: Main (the master) and Main(1) (the partner). The system software of the H-CPUs pairs Main with CPU 0 and Main(1) with CPU 1. Any modification made inside Main automatically appears in Main(1), but the operator must never edit Main(1) directly and must never place the download cursor on it.

Diagnostic Buffer Interpretation

When the redundant link-up fails, capture the diagnostic buffer from each H-CPU via STEP 7 PLC > Diagnostic/Setting > Module Information or the SIMATIC Manager > Accessible Nodes view. The events that indicate a FEPROM / load-memory mismatch are typically tagged as follows on a CPU 4xx-H:

The full list of diagnostic events is documented in the S7-400H System Manual under "Diagnostic events of the H-CPU". If a value other than 0x49A4 appears, fix that issue first (system data, SFB instance count) before treating the FEPROM download as the root cause.

Solution: STEP 7 Procedure to Load the Complete Project to FEPROM

The required workflow in STEP 7 V5.x is to perform a full program reload to the memory card after a memory reset on each H-CPU. The procedure preserves redundancy because the full image is written in one operation and then the CPUs link up against identical images. The procedure also re-initializes the retainable area so any prior in-RAM mods are wiped.

Prerequisites

• STEP 7 V5.5 SP4 or later with HSP (Hardware Support Package) corresponding to the H-CPU order number installed.
• The S7-400H project is open in SIMATIC Manager and the offline project is consistent (Edit > Check Block Consistency passes without errors).
• Both H-CPUs in STOP mode.
• The Ethernet or MPI cable from the engineering station is online to both CPUs (use the H-CPU PROFINET / PROFIBUS interfaces or the IFM-port-routed online path). The H system supports online access to both CPUs simultaneously from one STEP 7 instance.
• Two identical, freshly erased FEPROM cards (5 V) with sufficient capacity for the project. Use the SIMATIC Memory Card Parameter Assignment tool in STEP 7 (Start > SIMATIC > S7-STPCONF > Memory Card Parameter Assignment) to confirm that the user program fits.

Step-by-step procedure

1. Open the offline project in SIMATIC Manager. Verify that the S7-400H station contains a single S7 program, Main, and that the Main(1) source container is present and consistent.
2. Insert FEPROM cards into both CPU load memory slots with the CPUs powered down. The card write-protect switch must be in the write-enable position (slide toward the contacts, away from the label).
3. Power up both H-CPUs in STOP mode. Acknowledge any existing diagnostic events in the diagnostic buffer (PLC > Clear/Reset Diagnostic Buffer) so the next events are easy to read.
4. Perform a memory reset on CPU 0: in SIMATIC Manager select the target system > PLC > Operating Mode > STOP, then PLC > Clear/Reset > Memory Reset. Confirm the prompt. The CPU is now in STOP with cleared RAM and an empty FEPROM directory.
5. Perform a memory reset on CPU 1 using the same path.
6. Place the cursor on the Blocks folder inside S7-Program(1) > Main > Blocks. The Blocks object icon is the one that lists OB, SFB, SFC, FB, FC, DB and the system data blocks (SDB).
7. Navigate to PLC > Download User Program to Memory Card. The menu item is now enabled. STEP 7 will prompt: Download user program to memory card? This overwrites all existing data on the memory card.
8. Confirm the download to CPU 0 first. STEP 7 writes the full user program and system data to the FEPROM card in CPU 0. The progress dialog reports each block written; do not interrupt the transfer.
9. Wait for the prompt to download to the second CPU. STEP 7 automatically offers the option to download the same image to the FEPROM card in CPU 1. Confirm.
10. Verify the FEPROM contents on both CPUs by opening PLC > Accessible Nodes > [CPU 0] > Module Information > Memory. The used FEPROM size must match exactly between CPU 0 and CPU 1, and the block check sum list must be identical.
11. Initiate a warm restart on the master CPU (CPU 0 by default). The standby CPU detects the master's link-up request through the sync modules, exchanges its load memory image check sums, and once the comparison passes, transitions to RUN as the standby. The IFM LEDs on both CPUs should show solid green, and the RUN LED should be solid green on both.

Alternative: Online Block Download Without Interrupting the Process

The full program reload to FEPROM described above requires both CPUs in STOP, which is a process interruption. S7-400H supports two mechanisms that avoid this for routine engineering changes:

1. Online block download to integrated RAM (no FEPROM involvement). Use PLC > Download on the affected block while the redundant pair is in RUN. The system writes the new block to both CPUs' RAM and to retainable memory automatically. The FEPROM card image becomes stale relative to the running program, but the standby CPU remains in sync with the master because both are in RAM. This is the recommended method for small incremental changes.
2. Sequential download using role switch: download the new full user program to one CPU's FEPROM while that CPU is the standby, then switch roles (master/standby swap), then download to the other CPU's FEPROM, then switch back. This approach preserves process continuity but requires the H system to support STOP > RUN on the standby and a controlled role swap. S7-400H supports standby CPU warm restart with PLC > Operating Mode > Warm Restart on the standby while the master stays in RUN, so the sequence is feasible.

Detailed sequencing is described in the Siemens S7-400H System Manual section "Modifying the user program during redundant operation". In practice, most operators choose the RAM-only incremental download and accept that the FEPROM image is only refreshed during a planned outage or during a full memory-card download.

Verification Procedure

After the full download to FEPROM and the link-up, perform the following checks in sequence:

1. LED pattern check: both H-CPUs should show green RUN, green IFM1, green IFM2 (or green IFM1 only if single-link mode is configured). The SF (group error) and BF (bus error) LEDs must be off. The STOP LED must be off on both CPUs.
2. Diagnostic buffer check: confirm the latest entry on each CPU is "Redundancy established" (event ID 0x4906) and that there are no 0x49Ax events since the warm restart.
3. HW Config role check: open HW Config > CPU Properties > Redundancy tab. The "Operating state of CPU 0 / CPU 1" indicators should both show "RUN" with one as master and the other as standby. The "Last update time" should be in the configured tolerance (default < 100 ms).
4. Block consistency check: from the online Accessible Nodes view, compare the block list of CPU 0 and CPU 1. The block count, the block timestamps (date/time in the block header), and the block check sums must be identical.
5. Process-level forced link-up test: stop the master and confirm that the standby takes over within the configured update time. Restart the original master, confirm it joins as standby, and confirm redundancy is re-established automatically.

Flash EPROM Capacity and Compression

Blocks stored on FEPROM cannot be compressed. STEP 7 reports the FEPROM usage in Module Information > Memory under the Load memory row. If the offline project is larger than 80% of the FEPROM card capacity, expect occasional write failures during the Download user program to memory card action; the dialog will halt with Memory card full even though the integrated RAM still has headroom. The remediation is to either reduce the project size (consolidate DBs, remove unused FBs) or to upgrade to the next FEPROM card size in the table above.

Common sources of oversized projects:

• Large multi-instance DBs for motors/valves that are not reused.
• Recipe DBs with the full set of recipes pre-allocated in the offline project.
• Many S7-GRAPH or S7-HiGraph FB instances, each carrying a large status/transition table.
• Diagnostic extended blocks (SFB 52, 53, 54) instantiated at high counts.

To estimate the required FEPROM capacity: in HW Config use Station > Properties > Memory for the offline size estimate, then add 15-20% for system data blocks (SDBs) generated at compile time.

Common Error Conditions and Recovery

Best Practices and Field Tips

• Use FEPROM only when battery-backed RAM is not acceptable for the installation (e.g., long maintenance intervals with a real risk of PS 407 battery loss). Otherwise, the integrated RAM with a healthy battery is faster to modify and simpler to keep synchronized.
• Keep a checksum list of the FEPROM contents in the project documentation. After any field service, dump the contents via PLC > Upload Station to PG and re-compare.
• Always edit Main and never Main(1). Treat Main(1) as read-only and let STEP 7 regenerate it at compile time.
• Do not mix block download and Download user program to memory card in the same engineering session. Choose one workflow per change window.
• Reserve a 1:1 set of spare FEPROM cards at the cabinet. Label them with the H-station tag number, the project CRC, and the date. Swap and program off-line when a card fails.
• For redundant changes, perform a full download to memory card on both CPUs during a planned maintenance window; do not rely on the standby-only online download for major logic revisions, because the standby's RAM image will diverge from the master's once the next cycle of incremental downloads is performed.

Linked Offline Documentation

The following official Siemens documents are the authoritative reference set for the procedure above and should be consulted in case of discrepancies:

• SIMATIC S7-400H Fault-Tolerant System Manual (entry ID 11177422)
• S7-400 memory cards and parameter assignment (entry ID 30870796)
• STEP 7 V5.5 Programming and Operating Manual (entry ID 18654309)
• S7-400H Module Information and Diagnostic Buffer Reference (entry ID 16684248)