Resolving SIMATIC PCS 7 CPU 410-5H Maintenance Fault: IP Conflict

Problem Description: Persistent Maintenance Fault on CPU 410-5H

A redundant SIMATIC PCS 7 Automation Station built around two CPU 410-5H controllers raises a Maintenance Fault (SF / MAINT LED) immediately after the engineer assigns Ethernet IP addresses to the redundant pair. The PCS 7 diagnostic buffer reports "IP conflict on the network" even though the plant bus is dedicated solely to the AS and no other devices are present. The fault survives every remedial action attempted in the field: changing the IPs, powering the rack down, removing the PS-407 backup batteries to force a memory reset, and re-downloading the complete STEP 7 / PCS 7 project. Communication, download, and online functions continue to operate normally; the fault is cosmetic from a control standpoint but blocks clean acceptance and trips the HMI maintenance alarm page.

The 410-5H is the high-availability CPU used in SIMATIC PCS 7 V8.x and V9.x AS stations. A redundant pair is wired either as a fault-tolerant S7-400H station (two CPUs, two CP443-1 switches, two plant bus rings) or as a single CPU with a backup unit on a second rack. In both topologies the CPU has two onboard Ethernet interfaces (PROFINET / Ethernet IE1 and IE2) plus the external CP 443-1 used for plant bus termination. The maintenance fault described here is generated when one of these three MAC-bound interfaces is brought up with an IP that duplicates another device on the same Layer-2 segment — including the partner CPU's own mirror interface.

The official SIMATIC PCS 7 process control system CPU 410-5H manual documents the monitoring functions, status/error displays, and LED matrix used to surface this class of fault. The same manual is the authoritative reference for the corrective actions described below.

Affected Hardware, Firmware, and Software Versions

Root Cause Analysis: Why a "Standalone" Plant Bus Detects a Conflict

The diagnostic buffer entry "IP conflict on the network" is raised by the CPU's IP-Address Conflict Detection (RFC 5227) mechanism. The CPU listens for ARP announcements on every active Ethernet interface and compares the source IP against its own configured IPs. A conflict is logged the moment it sees a second device (or its own mirror) advertise the same address. The maintenance fault persists in the diagnostic buffer until cleared, even if the conflicting device is later removed, because the CPU's event log is non-volatile.

In a redundant 410-5H station, three independent paths can trigger this event:

1. CPU onboard PROFINET ports (X1 / X2) configured for plant bus use. The 410-5H has two PROFINET-capable interfaces. If both are enabled and bridged to the same plant bus subnet, the firmware will flag the partner CPU's mirrored MAC/IP as a duplicate as soon as redundancy takes over.
2. CP 443-1 + CPU onboard port sharing one subnet. The most common field case. The CPU IE1, CPU IE2, and CP 443-1 all sit on a single 192.168.x.0/24 ring. The duplicate is between the CP 443-1 MAC and the CPU's mirror MAC on the same L2 segment.
3. Two plant bus rings assigned IPs from the same subnet. Siemens' fault-tolerant plant bus design requires the two rings to occupy separate IP subnets. If Ring 1 and Ring 2 both use 192.168.1.0/24, every H-device and every switch appears as a duplicate to the CPU, generating a flood of maintenance events.

The reported "fix that worked" — disabling the CPU onboard ports and routing the plant bus exclusively through the CP 443-1 — eliminates paths 1 and 2 above. Path 3 is fixed by re-numbering the rings into separate subnets.

LED and Diagnostic Buffer Reference

Per the CPU 410-5H manual, the following LED states confirm an IP-related maintenance event:

Read the diagnostic buffer with STEP 7 / PCS 7: CPU → Diagnostic Buffer → Filter "All". The relevant event IDs are:

• Event ID 0x013C / 0xE0C0 – Duplicate IP address detected on the PROFINET interface.
• Event ID 0x0254 – IP parameter assignment inconsistent with interface mode.
• Event ID 0x0154 – Interface configuration mismatch between CPU and CP.

Solution Path 1 (Primary): Disable the CPU's Onboard PROFINET Ports

This is the fix that resolved the original case report. The CPU is taken off the plant bus; the CP 443-1 becomes the sole plant bus terminator. With only one MAC per ring, there is no longer a duplicate to detect.

Prerequisites

• STEP 7 V5.5 SPx (inside PCS 7 V8.2) or TIA Portal / STEP 7 V17+ (inside PCS 7 V9.0 SPx) installed on the engineering station.
• The PCS 7 project open in offline mode with the affected AS selected.
• Online connection to the AS via the CP 443-1 (not via the CPU port).
• Plant bus interface is reachable; redundant AS is in RUN-Solo or RUN-Redundant mode.

Step-by-Step Procedure

1. Open the HW Config of the redundant AS. In the rack view, click the CPU 410-5H slot.
2. Double-click PROFINET interface X1 (and X2 if used). Open the Properties dialog and uncheck "Activate PROFINET interface". Confirm with OK.
3. If the CPU was acting as a PROFINET IO controller or PN device, this change removes that role. The project must be recompiled and downloaded with the new configuration; do not skip this step.
4. Repeat for the redundant partner CPU so both halves of the 410-5H pair are consistent.
5. Ensure the CP 443-1 properties still show a valid IP, subnet mask, and router (if any). The CP must remain in Operating mode: Plant bus / Industrial Ethernet.
6. Save and compile the HW Config. Verify that NetPro shows the plant bus terminated only on the CP 443-1 MAC.
7. Download the HW Config to the AS using Target system → Download to target → All (with MRES if asked). The download is routed via the CP 443-1 — confirm the online path.
8. After the CPU restarts, re-read the diagnostic buffer. The "IP conflict" event should no longer be regenerated.
9. Clear the historic events with CPU → Clear/Reset Diagnostic Buffer so that the next acceptance walk-down sees a clean buffer.

Code Snippet — NetPro / HW Config Properties of CP 443-1

CP 443-1 (6GK7443-1EX30-0XE0)
  Interface type     : Industrial Ethernet
  IP address (Ring1) : 192.168.1.10
  Subnet mask        : 255.255.255.0
  Router             : 0.0.0.0
  MAC address        : 08-00-06-6B-xx-xx  (read from device label)
  Operating mode     : Plant bus / configured connection
  S7 subnet          : "Plant_Bus_Ring1"
  No PROFINET        : checked

Solution Path 2 (Mandatory Companion): Separate the Two Plant Bus Subnets

Even with Path 1 applied, a redundant 410-5H station requires the two plant bus rings to be numbered from distinct subnets. This is not a recommendation — it is a topology requirement of the fault-tolerant plant bus architecture (S7-400H redundancy over Industrial Ethernet with two rings).

Configure each ring on its own VLAN if a managed switch is used. The two rings must not share a Layer-2 broadcast domain under any circumstance, otherwise HSRP/standby switching and the duplicate-IP detector will both misbehave.

Solution Path 3 (When Path 1 Is Not Acceptable)

If a project genuinely requires the CPU's onboard PROFINET port (e.g. for PROFINET IO to ET 200SP HA on a PCS 7 V9.x system), then the CPU's plant bus binding must be removed and the CP 443-1 retained for plant bus only. Concretely:

1. In HW Config, set the CPU's PROFINET interface to operate purely as PN-IO Controller with its own subnet (e.g. 192.168.20.0/24 for PROFINET).
2. Remove the CPU's PROFINET interface from the "Plant_Bus" S7 subnet entry in NetPro.
3. Place the CP 443-1 in the "Plant_Bus_Ring1" and "Plant_Bus_Ring2" subnets only.
4. Re-download HW Config. Verify the IFM1F/IFM2F LEDs go off and the MAINT LED clears.

Verification Procedure

1. LED check: SF off, MAINT off, IFM1F / IFM2F off, RUN steady green on both CPUs of the redundant pair.
2. Diagnostic buffer: Filter the buffer for IP-related events. No new entries should appear after a 10-minute soak. Clear the buffer and confirm it stays empty after one more redundancy switchover test.
3. Online test: From the engineering station, open Accessible Nodes via the CP 443-1 IP. Both CPUs of the redundant pair must respond and report the correct firmware version.
4. Redundancy test: Pull the primary CPU. The backup takes over within the configured failure time (default 300 ms). No MAINT event should be raised. Reinsert the primary and verify re-synchronization completes without IP-conflict events.
5. Plant bus test: Run a sustained "S7 connection status" check from the OS for 24 hours. No intermittent disconnect alarms should appear.
6. Acceptance documentation: Print the diagnostic buffer and the NetPro screenshot showing only the CP 443-1 MACs on the plant bus subnets.

Preventive Measures and Engineering Rules

• For every new PCS 7 AS project, use a project template in which the plant bus is exclusively bound to CP 443-1. The CPU onboard port is left as PROFINET IO controller or disabled.
• Number Ring 1 and Ring 2 on separate subnets by default (e.g. 192.168.1.0/24 and 192.168.2.0/24). This avoids the class of fault described in the source case.
• Document the MAC address of every CP 443-1 in the AS layout drawing. During commissioning, validate that the MAC bound to each ring is unique.
• Use managed switches with DHCP snooping and ARP inspection disabled on the plant bus VLANs. The CPU does not use DHCP; ARP inspection can falsely flag the CPU's own gratuitous ARP as a conflict and generate phantom MAINT events.
• When upgrading PCS 7 from V8.2 to V9.x, the CPU firmware changes (Firmware V8 → V9) and the diagnostic event IDs shift slightly. Always cross-check with the current CPU 410-5H manual.

Field-Commissioning Notes and Edge Cases

Edge case 1 — Bridged CPU port and CP port on the same unmanaged switch: If the project is built in the field and the engineering laptop is connected to the same small office switch as the AS, the PC's IP, the CPU's IP, and the CP's IP can collide. Always use the CP 443-1 IP to communicate, and never bridge a second unmanaged switch onto the plant bus during commissioning.

Edge case 2 — Battery removal does not clear the diagnostic buffer. The 410-5H stores the diagnostic buffer in non-volatile memory backed by the PS 407. Removing the battery and re-downloading the project will not wipe it. Use CPU → Clear/Reset Diagnostic Buffer from STEP 7, or — if the buffer is completely corrupted — perform an MRES with the mode selector and then re-download the project.

Edge case 3 — PROFINET device name and IP both required. If the PROFINET port is used for IO, the IO devices are addressed by name, not by IP. Duplicate IPs on the PROFINET segment will still raise the same MAINT event. The fix is the same: clean subnet separation and one device per IP.

Edge case 4 — HMI / OS timeouts after the fix. After disabling the CPU's onboard PROFINET port, the OS station's S7 connection has only one path (the CP 443-1). Verify that the OS connection list in WinCC Explorer points to the CP 443-1 IP, not the CPU's IE1 IP. If an OS keeps reporting "connection broken," the OS is still targeting the disabled CPU port.

Troubleshooting Matrix

Reference Documentation

All corrective actions and LED/event interpretations in this article are anchored to the official SIMATIC PCS 7 process control system CPU 410-5H manual (Siemens Industry Online Support, article ID 74736822). Sections Monitoring functions of the CPU 410-5H and Status and error displays describe the LED states and the diagnostic event classes used to identify IP-related maintenance events. Always cross-check the latest revision of the manual before applying any change to a running plant, and confirm hardware/firmware compatibility through Siemens' product lifecycle (MLFB status) before ordering replacement CP 443-1 modules or PS 407 power supplies.