S7-300 Redundancy Module Replacement with Different MLFBs

Problem Overview

Field engineers maintaining legacy SIMATIC S7-300F (fail-safe) and S7-300FH (fault-tolerant) installations are routinely forced to migrate from phased-out digital output modules to successor articles. The specific case discussed here is migrating from the 6ES7326-1BK01-0AB0 SM 326F digital output module to its successor 6ES7326-1BK02-0AB0. Because both modules participate in a redundant pair (channel-gruppe or full module redundancy), the swap raises three distinct engineering questions:

1. Can a redundant pair contain two different order numbers (mixed MLFBs) at the same time?
2. Is the running process interrupted, or can the module be hot-swapped while the CPU stays in RUN?
3. If the order number changes, must the hardware configuration (HW Config / STEP 7) be reloaded?

Siemens' published rules for SIMATIC S7-300F/FH redundancy are explicit: redundantly used modules must be identical — they must carry the same order number (MLFB), the same product version (FS), and the same firmware version. The same restriction appears in the ET 200M redundancy documentation for PROFIBUS DP and PROFINET distributed I/O. As a direct consequence, a pair containing one 6ES7326-1BK01-0AB0 and one 6ES7326-1BK02-0AB0 is not a valid redundant pair; either the swap must be performed on both partners within the same maintenance window, or the system must first run degraded (single-channel) until the second module is also replaced.

Identifying the Affected Modules

Both modules belong to the SM 326F (F-DO) family — the fail-safe digital output channel that drives actuators up to SIL 2 / SIL 3 / PL d / PL e in S7-300F and S7-300FH controllers. The functional envelope is preserved across the MLFB transition, but the order number must be re-mapped in HW Config.

Confirm the exact product version (FS number) on the front-panel inscription or via STEP 7 → Online → Module Information. Two modules with the same MLFB but different FS numbers are not automatically interoperable in a redundant pair; see the firmware/FS section below.

S7-300 Redundancy Architecture Fundamentals

S7-300 supports three fundamentally different redundancy mechanisms, and the rules for module replacement differ between them:

1. S7-300F (fail-safe) — single-channel fail-safe with self-diagnostics inside the SM 326F/SM 336F module. There is no peer module; the redundancy is internal.
2. S7-300FH (fault-tolerant with hot standby) — two S7-300FH CPUs (e.g. CPU 317F-2 PN/DP) running in parallel; either can take over within milliseconds.
3. Distributed I/O redundancy on PROFIBUS DP / PROFINET — ET 200M stations with redundant IM 153-2 or redundant PROFIBUS segments, where the SM 326F channels themselves may be configured as 1-out-of-2 redundant outputs.

For the SM 326F module swap to apply, the most common architecture is the 1-out-of-2 redundant channel pair: two physical outputs (one on each of two SM 326F modules, mounted in two ET 200M stations on redundant PROFIBUS DP segments) drive the same actuator. Loss of one channel pair is tolerated for the duration of the swap window.

MLFB Matching Rule in Redundancy

The matching rule is enforced both in HW Config and by the F-runtime library at every safety-cycle tick. The CPU performs a cyclic comparison of:

• The expected MLFB (stored in the safety program generation log)
• The actual MLFB read back from the module via PROFIBUS / PROFINET diagnostics
• The expected and actual firmware version

If any field differs, the F-CPU raises SF (Collective Fault) and enters the safe state. The failure is not a transient nuisance: the actuator is de-energised until the operator acknowledges the mismatch and brings the affected channel into a service state. This is by design — a SIL 3 system cannot rely on a configuration whose identity is uncertain.

Hot Swap Capability and Prerequisites

SM 326F modules support module change during operation (German: Modultausch im Betrieb) on ET 200M stations, provided the following prerequisites are met simultaneously:

1. The ET 200M uses active backplane modules (6ES7195-7HA00-0XA0 or successor) so that one module can be removed without powering the whole station down.
2. The PROFIBUS DP master (CPU 31xF) or PROFINET IO controller has the slot configured for module change during operation (HW Config → Properties → Module → Operating Mode).
3. The CPU and the F-runtime library both contain the diagnostic OBs listed in the next section.
4. For F-modules: a valid safety acceptance test certificate is on file for the station, and the swap is documented in the safety log book.

Even with all prerequisites met, removing one redundant partner destroys redundancy. The system runs single-channel until the replacement is inserted and parameterised. This is acceptable for short maintenance windows, but operators must be informed that the availability figure (PFD_avg, PFH) is degraded for the duration.

Required Diagnostics Organization Blocks (OBs)

To prevent the CPU from going into STOP the moment a module is pulled, the user program must contain the following OBs in the project, downloaded to the CPU, and called from the cyclic OB1 cycle:

If OB 83 is absent, pulling any module — even non-redundant — drives the CPU to STOP. This is the single most common reason a planned hot swap escalates into a full plant shutdown.

Step-by-Step Replacement Procedure

The following procedure assumes the engineering station has STEP 7 V5.5 (or TIA Portal V15+ for a re-imported project) and that a current S7 backup exists on the programming device.

1. Pre-work

1. Open the project in STEP 7 → SIMATIC Manager → HW Config.
2. Note the slot of the 6ES7326-1BK01-0AB0 in the ET 200M station and the partner slot in the redundant station.
3. Read the current safety signature from the F-CPU (HW Config → Safety → Print / Verify).
4. Print the safety acceptance test record — it must be re-issued after a module swap because the CRC of the I-slave changes.

2. Hardware reconfiguration

1. In HW Config, right-click the slot → Replace Object → Module.
2. Select the new MLFB 6ES7326-1BK02-0AB0 from the catalog. STEP 7 will warn that the order number is changing; confirm.
3. Repeat the swap on the partner slot in the second ET 200M station — do not leave one module as -1BK01 and the other as -1BK02 in service simultaneously for longer than the swap itself.
4. Save and compile the station.

3. Download

1. With the CPU in STOP-P (for F-systems the safety password is required), select the target station and click Download to Target System → Hardware Configuration.
2. Confirm the safety prompt — the download invalidates the previous safety signature. Re-issue the signature per the safety program regeneration step (S7-FCT or Distributed Safety).
3. Switch the CPU to RUN.

4. Physical swap

1. Wait for the F-CPU to come up cleanly; verify no SF / BF LED is active on either ET 200M.
2. Open the safety log book entry: "Beginning of maintenance window; station X slot Y; redundancy degraded from 1oo2 to 1oo1."
3. Pull module 1 (6ES7326-1BK01-0AB0). The CPU should remain in RUN; OB 83 fires; OB 86 fires for the DP segment if the station goes offline momentarily.
4. Insert module 2 (6ES7326-1BK02-0AB0). The IM 153-2 parameterises the new module; OB 83 fires again; diagnostics buffer shows Module inserted, parameter assignment OK.
5. Repeat for the partner station.

5. Safety acceptance

1. Run the safety acceptance test (S7-FCT or SIMATIC Safety) — this re-validates the I-slave CRC against the safety program.
2. Re-print and sign the safety acceptance certificate.
3. Close the maintenance window in the log book.

Mixed-Module Operation Scenarios

Three scenarios are encountered in practice. The first two are invalid in a SIL-rated system; the third is the only correct path.

Firmware Considerations

Each SM 326F carries an internal firmware version (e.g. V3.0.x). The F-CPU compares the expected firmware (saved in the safety program on download) with the actual firmware (read from the module's identification data). Mismatched firmware versions between redundant partners raise the same SF condition as mismatched MLFBs. Practical rules:

• Before the swap, capture the firmware version of the installed -1BK01 via STEP 7 → Online → Module Information.
• Confirm the -1BK02 successor ships with firmware ≥ that version; if not, plan a firmware update via SIMATIC PDM or the field PG with the appropriate firmware file.
• After the firmware update, re-issue the safety signature — the F-CPU records the new firmware as part of the validated configuration.

Verification and Commissioning

After the swap, perform the following verification sequence to confirm the redundant pair is back in 1oo2 mode:

1. Inspect the diagnostic buffer of the F-CPU: no SF, no "safety mode deactivated", no channel-level discrepancies.
2. In STEP 7 → Monitor/Modify, force each F-DO channel pair briefly and confirm both modules energise the actuator simultaneously (within the safety-cycle window, typically ≤ 25 ms).
3. Read the Quality of Operation of the F-channel pair in S7-FCT — it should return VALID with a quality index > 0.98.
4. Run the built-in self-test of the ET 200M station (right-click → Station → Self-Test in STEP 7).
5. Sign the safety acceptance certificate and archive the HW Config export together with the new safety signature log.

Common Errors and Diagnostics

Documentation to Archive

Per IEC 61511 and the S7-F/FH operating manual, the following records must be retained for the life of the installation:

• HW Config export (STEP 7) showing the new MLFB on both slots
• Safety program generation log with the new CRC
• Updated safety acceptance test certificate
• Maintenance log book entry: window, modules swapped, signature change, operator acknowledgement
• Diagnostic buffer dump of the F-CPU before/after the swap

Cross-Platform Reference

The same principle of identical MLFB in a redundant pair applies across vendors. On Allen-Bradley ControlLogix 5570 redundancy, the Redundancy Module Configuration Tool (RMCT) likewise requires matched catalog numbers and firmware revisions; a module with a different catalog must be replaced in both chassis within the same update window. The exact procedure and RMCT workflow are documented in Rockwell publication 1756-RM010 and the redundancy user manual 1756-UM015. Engineers porting S7-300FH to ControlLogix Hot Backup will recognise the same pre-conditions: matched catalog, matched firmware, RMCT re-synchronisation, and an updated safety signature.