Resolving S7-400H Standby CPU STOP Error 16#494D on Y-Link

This reference documents the field-reproducible fault where the standby CPU of an SIMATIC S7-400H system (CPU 417-4H) drops to STOP with diagnostic event 16#494D the moment the 24 V DC feeder of a downstream Profibus DP segment is switched off, while the master CPU continues in RUN. The behavior is independent of which physical rack (rack 0 or rack 1) currently holds the standby role and occurs whether the panel feeding the SIMOCODE / SIPROTEC slaves is de-energized under load or simply opened at the line breaker. The trigger is the Y-Link's reaction to a station-removal event (16#3961) on the single-sided Profibus and the H-system's interpretation of that event when OB83 is present but the H-parameter Reaction to RAM/PIQ error is left at its default.

1. Affected Hardware, Firmware and Topology

The Y-Link (catalog 6ES7197-1LAxx) is the only Siemens-approved gateway between a single-channel Profibus DP master system (the lower-level DP cable to the 15 slaves) and the redundant Profibus DP segment that the two H-CPUs own. It transparently forwards process data, but it cannot regenerate station diagnostics beyond DP-V0. Two hard limits apply that matter for this fault:

• Maximum 244 bytes input / 244 bytes output total across all stations behind the Y-Link. STEP 7 / TIA Portal hardware configuration enforces this and silently truncates larger configurations.
• Maximum 32 DP slaves downstream of the Y-Link. Anything above is rejected by HW Config.

2. Diagnostic Buffer Decoded

The field-reported diagnostic buffer on the standby CPU showed the following sequence inside one PLC scan (events 2–15). The events arrive at the same millisecond timestamp 09:01:52.429 AM 06/08/2009 because the DP station-failure interrupt is the root cause and all subsequent entries are derived.

2.1 Decoded detail of event 16#494D

Event ID 16#494D is documented in the S7-400H system manual as a generic "STOP caused by I/O error". The Z1/Z2/Z3 fields localize the failure source:

Notice the asymmetry: the Z2 value points to the lower-level segment, not to a fault on the redundant segment. The master CPU sees the same lower-level segment loss but interprets it as a non-fatal station failure and continues. The standby CPU interprets the same event as a redundancy violation because of the H-parameter described in section 5.

2.2 Decoded detail of event 16#3961

Event ID 16#3961 is the standard "Module/Interface Module removed or cannot be addressed" entry. The "Actual type: Empty slot" wording is the standard STEP 7 phrasing when a slave that previously responded to a GetCfg request no longer replies. Important fields:

• Station number 47 — this is the PROFIBUS address of the failing slave (or the lowest address in the failing group). Note that on a Y-Link the station numbers are renumbered into a contiguous range starting above the highest station on the redundant segment, so 47 is consistent with 15 slaves on addresses 32–46 plus the Y-Link itself on address 31.
• DP master system ID 4 — internal STEP 7 master system index, not the PROFIBUS segment ID. Each CPU has its own master system ID even though they share the wire, so the same event may appear with different IDs on the two CPUs.
• Input address 15819 — first byte of the input image associated with the failing station. Decode: 15819 ÷ 8 = 1977.3, so the first bit is I1977.3. Use this as the cross-check that the right station has been identified.
• Requested OB: OB83 — STEP 7 signals a removal/insertion interrupt. If OB83 is missing the CPU goes to STOP unconditionally; if OB83 is present the CPU runs the OB and continues unless the OB itself returns an error code or another H-system check rejects the new topology.

3. Root Cause Analysis

The fault is not a single defect but a stack of three contributing factors. Each one alone is survivable; together they cause the standby CPU to STOP while the master keeps running.

3.1 Y-Link cannot mask lower-segment station loss from the redundant side

The Y-Link is a pure gateway. When a downstream slave is de-energized, the Y-Link's slave side raises a station-failure indication. That indication is propagated on the upper (redundant) side as a station-removal interrupt on the master system of both CPUs. The Y-Link does not generate a "station failed but Y-Link is alive" event; it only generates the standard PROFIBUS "slave removed" diagnostic that the master CPU passes through.

3.2 H-parameter "Reaction to RAM/PIQ error" defaults to "STOP of H system" on legacy firmware

The H-parameter tab in HW Config → CPU properties → tab H-Parameters contains the line Reaction to RAM/PIQ error. The two valid choices are:

• Stop of H system — both CPUs go to STOP if either detects a RAM or process-image error. This is the legacy default on older CPU 417-4H firmware.
• Stop of CPU only — only the CPU that detected the error goes to STOP; the other CPU continues. This is the desired setting for Y-Link-fed segments.

On the affected CPU 417-4H the parameter was left at the legacy default. When the standby CPU evaluated the station-removal interrupt (16#3961) it compared the expected RAM/PIQ against the value it would now hold if it took over. Because the expected image could not be reconstructed (the slave was already gone), the standby concluded that a takeover would corrupt the process and executed "Stop of H system". In practice the master CPU had already masked the same event, so it stayed in RUN while the standby went to STOP.

3.3 OB83 present but not handling the redundancy-aware retry

OB83 was loaded in the user program, which prevented the CPU from going to STOP because of the missing OB alone. However, the OB body was empty (the default from the wizard inserts only the header). When the H-system diagnostic handler evaluates a station-removal event on the standby side it expects OB83 to call SFC 59 "DB_REC_RD" or at minimum to set the redundancy handshake flag. An empty OB83 returns without touching the redundancy image, and the H-system handler then raises 16#494D as a downstream effect.

4. Preconditions Checklist

Before applying any fix, verify the following. If any precondition is not met, the fault may be a different one with identical symptom.

1. Both CPU 417-4H units carry the same firmware version. Mixed firmware levels are not supported and produce 16#494D on the lower-level CPU.
2. The Y-Link firmware matches the catalog version listed in section 1. Firmware <V3.0 has a known bug (Siemens hotline reference Entry ID 16669103) that misreports lower-segment station loss as a redundant-segment fault.
3. OB83, OB70, OB72, OB80, OB82, OB85, OB86, OB87, OB88, OB100, OB102 are all loaded in both CPUs. Use CPU → Operator Panel → Module Information → OB list to verify.
4. The 24 V DC supply of the DP panel feeds the Y-Link, the terminators, and any repeaters independently from the slaves. The original panel shared the supply rail; this is acceptable but must be documented.
5. The 244-byte total I/O budget across all 15 slaves is confirmed. Use the STEP 7 menu PLC → Module Information → Diagnostic Buffer of the DP Master and check Bus statistics → Slave diagnosis.
6. The PROFIBUS cable is terminated on both ends (resistor on, both terminators powered). An unterminated cable after the panel is opened can mimic the same event.

5. Step-by-Step Resolution Procedure

Step 1 — Open HW Config and load the active configuration

1. Connect STEP 7 V5.5 SP4 (or TIA Portal V16+) to the master CPU.
2. Open SIMATIC Manager → HW Config (or Device configuration in TIA Portal).
3. Right-click the CPU 417-4H in rack 0 → Object Properties → tab H-Parameters.

Step 2 — Change "Reaction to RAM/PIQ error" to "Stop of CPU only"

1. In the dropdown Reaction to RAM/PIQ error select Stop of CPU only instead of Stop of H system.
2. Confirm the warning dialog. Siemens explicitly warns that this changes the safety behaviour; acknowledge with the engineering change ticket number.
3. Repeat on the rack 1 CPU so the parameter is identical on both sides (H system requires mirrored parameters).
4. Compile and download to both CPUs. Wait for the link-up handshake and verify both LEDs show RUN with active redundancy (LED REDF off, MSTR on one CPU, STBY on the other).

Step 3 — Implement OB83 with the minimum redundancy-aware body

The OB83 header is fixed. Inside the OB you must at least acknowledge the redundancy handshake and decide whether the system can stay redundant. A minimal working implementation in STL:

FUNCTION_BLOCK OB83
TITLE = 'Removal/Insertion interrupt for redundant I/O'
VERSION : '1.1'
VAR_TEMP
    info : STRUCT
        evt_class    : BYTE;   // 39h for incoming, 38h for outgoing
        fault_id     : BYTE;   // 33h, 34h, 38h depending on type
        prio_class   : BYTE;   // 25 (default for OB83)
        ob_number    : BYTE;   // 83
        reserved1    : WORD;   // reserved
        reserved2    : WORD;
        module_no    : WORD;   // logical base address of slot
        submodule    : DWORD;
        channel      : WORD;   // DP station number when on DP
        multi_error  : WORD;   // 0 = single, >0 = multi
    END_STRUCT;
    tmp_dw : DWORD;
END_VAR
BEGIN
    // Read OB83 start info
    info.evt_class := OB83_EV_CLASS;   // SFR 32.0
    info.fault_id  := OB83_FLT_ID;     // SFR 33.0
    info.module_no := OB83_MDL_ADDR;   // logical base address (matches 15819/8 = 1977 for this fault)
    info.channel   := OB83_POINT_ADDR; // DP station number 47 for this fault

    // Type 33h = module removed, 34h = module inserted
    IF info.fault_id = 16#33 THEN
        // Do NOT call SFC 59 here; only flag for H-system monitor
        // Set marker for the OS, set redundancy status bit
        "dbRedundancy".StationLost[info.channel] := TRUE;
    ELSIF info.fault_id = 16#34 THEN
        "dbRedundancy".StationLost[info.channel] := FALSE;
    END_IF;
END_FUNCTION_BLOCK

Compile to both CPUs. The marker dbRedundancy.StationLost can be visualized on the HMI so the operator can see which DP slave is currently missing.

Step 4 — Update Y-Link firmware if below V3.0

1. Download the current Y-Link firmware from the Siemens support portal (search for "6ES7197-1LA04 firmware" or "6ES7197-1LA11 firmware").
2. Connect directly to the Y-Link's serial service port (X2) with a Siemens PC adapter (6ES7972-0CA34-0XA0) and SIMATIC Automation Tool or the legacy ProSave.
3. Update to the latest approved revision. Record the new firmware version in the change log.

Step 5 — Verify the 244-byte budget

1. In HW Config, right-click the Y-Link → Object Properties → tab DP Slave Properties.
2. Open I/O addresses. The total of inputs must be ≤ 244 bytes, total of outputs ≤ 244 bytes.
3. If the total exceeds the limit, STEP 7 already warns during compile; reduce the number of slaves or split them across two Y-Link segments.

Step 6 — Install missing OB100/OB102 if not already present

The H system expects symmetric warm-restart OB100 and OB102 on both CPUs. Missing OBs cause the standby to refuse the link-up after the next restart. Add empty OBs of every required type listed in the STEP 7 standard library.

6. Verification Procedure

After applying all five changes, perform the verification under controlled downtime. Document each step in the SAT report.

1. Baseline: Confirm both CPUs are in redundant RUN (MSTR/STBY LEDs visible, REDF off). Read both diagnostic buffers and save them.
2. Test 1 — Single panel off: Open the panel breaker feeding the 15 slaves. Within 5 seconds the master CPU should remain in RUN, the standby CPU should remain in RUN, and the system should remain in redundant mode (REDF off). The HMI should show 15 slaves flagged "StationLost" but no CPU status change.
3. Test 2 — Panel off for 10 minutes: Leave the panel open. The standby CPU should NOT switch to STOP. Master and standby should both still be in redundant RUN. After re-energizing the panel the OB83 should fire the insertion half and clear the StationLost marker within one PROFIBUS cycle (typ. < 1 s with default retries).
4. Test 3 — Force a takeover: While the panel is open, execute a STOP on the master CPU. The standby must NOT inherit any STOP request from the previous event; it must take over as the new master and continue in solo mode. Read the new diagnostic buffer on the (now new) master CPU and verify it shows 16#43E4 (Standby becomes master) but no 16#494D.
5. Test 4 — Restore redundancy: Switch the previous master CPU back to RUN. The H system should perform an update and return to redundant mode. Both CPUs in RUN, REDF off, no 16#494D in any buffer.
6. Test 5 — Stress test: Cycle the panel breaker five times in 30 s. No CPU may go to STOP. No 16#494D may appear. The OB83 may fire repeatedly; that is the expected behaviour.

7. Diagnostic Buffer Reference Table

The following table summarizes every event ID that has been observed in this fault scenario and on related Y-Link installations. All IDs are taken from the S7-400H system manual (entry ID 109751626 on the Siemens support portal).

8. Alternate Platform Notes

8.1 S7-1500H equivalent

On the S7-1500H (CPU 1517H-3 PN / 1518HF-4 PN) the same physical topology uses the DP/DP coupler in place of the Y-Link. The DP/DP coupler does not support the 244-byte limit because both sides are independent master systems, but it does require explicit input/output ranges on both sides. The H-parameter equivalent is in Device configuration → CPU properties → Redundancy → Reaction to I/O failure, with the same two options "Stop of H system" vs "Stop of CPU only". The procedure described above applies 1:1, except that OB83 is replaced by the modular alarm mechanism and the Y-Link firmware update step is unnecessary.

8.2 PCS 7 environment

When the same hardware runs PCS 7 V8.x or V9.x, the CFC chart @YLink_Degraded (provided in the PCS 7 APL library V8.1+) already implements the redundancy-aware OB83 logic. If the chart is not instantiated, the OB83 returns empty and the same fault appears. Verify with CFC → Plant view → right-click the Y-Link → Go to OB83.

8.3 PROFIBUS PA segment

If any of the 15 slaves is a PROFIBUS PA device fed through a DP/PA coupler, the coupler counts as one DP slave but raises its own 16#3961 when PA segment power is removed. The fault is identical, the diagnosis is identical, and the fix is identical. The only additional check is the PA coupler power supply: it must be backed up or the same fault will recur after the UPS runs down.

9. Preventive Maintenance Recommendations

1. Add a periodic (weekly) test where the panel breaker is opened for 5 seconds under controlled conditions. The resulting diagnostic buffer dump becomes part of the maintenance log.
2. Store the H-parameter spreadsheet (machine-readable CSV) in the project archive so a future firmware upgrade or hot-spare replacement does not silently revert to "Stop of H system".
3. When replacing a CPU, copy the project from the running CPU first; never download a project from the engineering station that has not been opened in HW Config since the last maintenance window.
4. Add the 16#494D and 16#43E3 event IDs to the WinCC alarm log so the operator can see standby-CPU STOP events that happen outside of business hours.
5. For PCS 7 environments, schedule a yearly DR (disaster recovery) test that includes a panel-off scenario to validate the OB83 logic.

10. Safety and Operational Considerations

Refer to the official STEP 7 diagnostic documentation for the general procedure to determine the cause of a STOP transition: Determining the cause of a STOP of a CPU.

11. Frequently Asked Questions