S7-400H PROFINET Redundancy: Configuration Options and Limits

Engineers migrating PROFIBUS DP redundant I/O on the S7-400H platform routinely ask whether PROFINET can replace PROFIBUS as the redundant I/O fieldbus. The short answer, fixed by the S7-400H firmware architecture, is no: PROFINET IO cannot be inserted as the redundant fieldbus on an H-system. This reference documents the exact boundary, the reasons behind it, and the four field-proven workarounds - PROFIBUS DP with IM 153-2BA02, plain S7-connections over Ethernet, PROFINET S2 on standard (non-H) S7-400 CPUs, and software redundancy on S7-300 with ET200S PN.

Overview of the S7-400H Redundancy Problem

The S7-400H (High Availability) system is built around two synchronized CPUs exchanging data across fiber-optic or electrical sync modules. Redundancy extends from the CPU pair outward to the fieldbus, the I/O stations, and the network. The PROFIBUS DP interface on each H-CPU is treated as a redundant I/O bus, and the IM 153-2 (active backplane) supports swapped-out modules while the partner continues to read process data. The firmware of the H-CPU binds the I/O subsystem to PROFIBUS DP; PROFINET IO controllers are not instantiated on the H-CPU image table in the same way.

The PROFINET port on H-CPUs is therefore usable for S7 communication, Open User Communication, OPC UA, and TCP/IP, but not for a redundant PROFINET I/O stack. The platform constraint drives the four mitigation paths examined below.

S7-400H Redundancy Architecture Constraints

An H-system is a duplicated set of resources. Each component is doubled, and both halves are kept deterministic through continuous event synchronization:

• CPU pair: 412-3H, 414-3H, 416-3H, 417-4H, or 410-8H (process automation). Mixed pairs of different H-CPU types are not permitted.
• Sync modules: 6ES7960-1AA04-0XA0 (electrical, 10 m) or 6ES7960-1AB04-0XA0 (fiber-optic, up to 10 km).
• Sync cables: ordered separately; fiber-optic version supports up to 10 km between two H-stations.
• Redundant power supplies: PS 405/PS 407 sized for the H-station.
• Redundant PROFIBUS DP segments: two physically isolated DP segments, one terminated at the master interface of CPU A and the other at CPU B; the partner master and a Y-link (IM 153-2BA10) join the two segments to a single I/O device.
• Redundant CPs: CP 443-1 (6GK7443-1EX30-0XE0 or later) can be inserted in pairs; PROFINET is not configured on the H-CPU image.

STEP 7 (V5.5 SP4 and later, or TIA Portal V13 SP1 and later with the S7-400H option package) enforces these rules at compile time. The error message PN IO cannot be created on a CPU in an H-station is the canonical diagnostic if a CP 443-1 with PROFINET is added to the H-rack.

Why PROFINET Is Not Supported on S7-400H as a Redundant Fieldbus

Three architectural reasons make PROFINET incompatible with H-station redundancy in the role of I/O fieldbus:

1. Image table ownership. The H-CPU owns an input image built from the redundant PROFIBUS DP cyclic exchange. PROFINET IO is owned by the PN IO Controller firmware running on the PROFINET interface of the H-CPU; a parallel, redundant ownership model for two PROFINET controllers sharing the same I/O device has never been instantiated in the S7-400H firmware.
2. Failover semantics. PROFIBUS DP redundancy on H-stations uses a deterministic slot/list approach defined in the IM 153-2BA02 active backplane. PROFINET S2 (System Redundancy) requires the IO device to support a primary/backup controller relationship with shared AR (Application Relationship) state. No S7-400H firmware has been released that adds S2-capable AR ownership of distributed I/O.
3. Certifications and product lifecycle. The S7-400H line is in product phase "classic" since 2018; PROFINET-based redundancy was scoped for the S7-1500R/H family, not the S7-400H. As a result, no S7-400H firmware version will gain PROFINET IO redundancy.

PROFIBUS DP as the Standard Redundant Fieldbus for S7-400H

PROFIBUS DP remains the only redundant I/O fieldbus available on the S7-400H. The configuration recipe is stable across STEP 7 V5.x and TIA Portal V13+:

1. In the device view of the H-station, add a DP master on each H-CPU (both halves already have integrated DP ports on 414-3H, 414F-3H, 416-3H, 416F-3H, 417-4H).
2. Configure each DP master as a "DP master (redundant)" in the DP properties dialog. The wizard generates the necessary system data blocks (SDB) and reserves the diagnostic address range.
3. Insert an IM 153-2BA02 (6ES7153-2BA02-0XB0) on the ET200M rack. The active backplane (6ES7195-7HD10-0XA0) is required so that the IM can be pulled and replaced while the partner is active.
4. Wire the DP segment from CPU A and the segment from CPU B to a Y-link (IM 153-2BA10 in Y-link mode) and from the Y-link to the IM 153-2BA02 of the ET200M. Two Y-links may be cascaded to obtain a four-channel redundant segment, but the standard configuration uses one Y-link per redundant ET200M.
5. Add the I/O modules to the ET200M. Hot-swap modules during runtime: the active backplane guarantees that a removed module does not interrupt the bus, and the partner CPU continues scanning.

Relevant diagnostic addresses are exposed in the H-CPU diagnostic buffer; OB70 (I/O redundancy loss) and OB72 (CPU redundancy loss) handle the failure cases automatically.

PROFINET System Redundancy Modes: S2, R, and R1

For projects that require PROFINET redundancy, the relevant mechanisms are defined in the PROFINET specification (IEC 61784-2) and apply to S7-400 standard CPUs, S7-1500, ET200SP, ET200MP, and ET200pro. The three modes engineers encounter in the field are:

S2 is the most common mode in standard (non-H) PROFINET installations. The Cisco IE9300 documentation on PROFINET System Redundancy covers the underlying failover between IO controllers and IO devices at the managed-switch level, including ring management: PROFINET System Redundancy - Cisco IE9300 Configuration Guide. The Siemens support entry on PROFINET S2 with an RSTP ring documents a real S2 topology using two PLCs as IO controllers in a managed L2 ring: PROFINET S2 with an Ethernet Ring Protected by RSTP - Siemens Support.

The behavioral difference versus PROFIBUS DP redundancy on S7-400H is important: PROFINET S2 requires the IO device to support S2 mode, and the controllers share configuration via TIA Portal "Shared Device" or "System Redundancy" properties. Failover time is bounded by the PROFINET real-time stack (typically 200-500 ms) but does not match the sub-100 ms failover of PROFIBUS DP on the H-station.

Alternative Path 1 - S7 Connections over Standard Ethernet

If full PROFINET IO performance is not required, the simplest path is to leave PROFINET out of the design and use S7-connections on the standard Ethernet interface of the H-CPU. The trade-offs must be understood before committing:

• Latency: an S7 put/get cycle is in the 30-100 ms range versus ~1 ms cyclic update for PROFINET IO. Drive motion loops cannot use S7-connections; only supervisory, slow, or visualization data is suitable.
• Programming effort: the application must instantiate PUT/GET blocks (FB14/FB15) on both H-CPUs and switch the active connection on CPU failover. OB72 is the typical trigger to flip the connection ownership.
• Throughput: a single S7-connection saturates at ~8-12 kB per PUT; multiple parallel connections are needed for high-volume data.

Configuration sequence in STEP 7 V5.5:

1. Open NetPro and select the H-CPU. Right-click the integrated Ethernet port and add a new S7-connection.
2. Define the partner (e.g., a WinCC station or another PLC); mark the connection as "active connection establishment" on both ends.
3. Compile and download both H-CPUs. Verify in the diagnostic buffer that the connection reaches status 0008h (fully established).

For switchover logic, place the following pattern in OB1 or a cyclic OB:

// Sample ST logic for connection ownership flip
// S7-Put on a redundant H-station
IF "H-CPU-A"._isMaster THEN
    FB14_DB.PUT_REQ := TRUE;
    FB14_DB.PUT_ID  := 1;            // S7-connection ID 1 to partner A
ELSE
    FB14_DB.PUT_REQ := TRUE;
    FB14_DB.PUT_ID  := 2;            // S7-connection ID 2 to partner B
END_IF;

Alternative Path 2 - ET200M with IM 153-2BA02 on Active Backplane

For low-latency I/O on an H-station without PROFINET, the most consistent choice is to retain PROFIBUS DP and use the active bus module. The two integration options are:

Order codes for the active-bus-module path:

• IM 153-2BA02: 6ES7153-2BA02-0XB0 (PROFIBUS DP slave, redundant, supports active backplane).
• Active bus module: 6ES7195-7HD10-0XA0 (2-slot) or 6ES7195-7HD50-0XA0 (1-slot).
• BM PS/IM (for power segment): 6ES7195-7HA00-0XA0.
• BM IM/DO (for digital output segments): 6ES7195-7HB00-0XA0.

The active backplane approach preserves the failover timing that engineers expect from PROFIBUS DP on S7-400H. A module can be removed and replaced without disrupting the partner CPU's read cycle; the active backplane continues to bridge the bus while the slot is empty.

Migration Path - PROFINET S2 on Standard S7-400 CPUs

If the project can drop the S7-400H requirement, a standard S7-400 CPU (e.g., CPU 414-3 PN/DP, 6ES7414-3EM07-0AB0) supports PROFINET S2. The setup uses two S7-400 standard CPUs and one S2-capable PROFINET device:

1. Insert the first CPU 414-3 PN/DP in rack 0, slot 3, and the second CPU 414-3 PN/DP in rack 1, slot 3. Wire the integrated PROFINET interface of each to a managed L2 switch that supports PROFINET Class 2 (e.g., SCALANCE XC-208, 6GK5208-0BA00-2AC2).
2. In the device view, right-click the PROFINET interface of CPU A and select "Properties > PROFINET IO > System Redundancy > S2". Repeat for CPU B; the S2 assignment is set to "primary + backup".
3. Assign the IO device (e.g., IM 155-6 PN ST 6ES7155-6AU00-0BN0 with firmware 4.2 or higher) to the same PROFINET network. Set its redundancy role to "S2".
4. Compile and download. Verify the S2 AR state with PRONETA's "Topology" view or by reading the IO device's record index 0xF80C (S2 status). The diagnostic block reports the active AR (primary or backup).

Software Redundancy with S7-300 and ET200S PN

For cost-sensitive installations that need a degree of redundancy but cannot deploy S7-400H, Siemens offers a software redundancy package for the S7-300/400 standard CPUs. The relevant order numbers and behaviors are:

The redundant pair is configured as "master" and "reserve" in the SW Redundancy wizard. The reserve CPU scans its I/O and writes the resulting process image to the master on a cyclic basis. When the master fails, the reserve takes over the role and writes the last-known outputs to its own PROFINET devices. Because ET200S PN (IM 151-3 PN, 6ES7151-3BA23-0AB0) is a standard PROFINET IO device, it is supported on the reserve side without further configuration beyond the standard PROFINET network setup.

Key configuration steps in STEP 7 V5.5 (with the SW Redundancy package installed):

1. Insert two S7-300 CPUs (e.g., 315-2 PN/DP, 6ES7315-2EH14-0AB0) in the same STEP 7 project. Both must support the SW Redundancy firmware extension (firmware V3.2 or higher for the 315-2 PN/DP).
2. Install the SW Redundancy package and open its configuration dialog. Mark CPU A as "Master" and CPU B as "Reserve". Specify the redundancy connection (UDP multicast on a defined port, default 2000) and the role switchover triggers (e.g., loss of keep-alive, OB82, OB86).
3. Assign the ET200S PN stations to the same PROFINET network. The same ET200S is configured on both CPUs as a shared PROFINET IO device; the package synchronizes ownership.
4. Compile and download both CPUs. Verify with the SW Redundancy status block (FB101 in the package) that the role is "Master active" and the partner status is "Reserve".

Limitations of the SW Redundancy approach: failover is non-deterministic (1-3 s typical), PROFINET device ownership transitions are not glitch-free, and drive motion applications are not appropriate for this layer of redundancy. Use it for process control, building automation, and supervisory applications only.

Configuration Example - S7-414-3 PN/DP Topology with Software Redundancy

The following topology satisfies the original question when the engineer drops the S7-400H constraint and adopts the S7-300 + ET200S PN approach. Hardware list:

• 2 x CPU 315-2 PN/DP (6ES7315-2EH14-0AB0, FW V3.3).
• 2 x PS 307 (6ES7307-1KA02-0AA0).
• 2 x IM 365 for rack expansion (only if more than one rack is needed per CPU).
• 1 x ET200S PN station per drive / RIO group: IM 151-3 PN (6ES7151-3BA23-0AB0) + power module + I/O modules.
• 1 x SCALANCE XC-208 (6GK5208-0BA00-2AC2) for the PROFINET ring with MRP.
• 1 x SW Redundancy V3.x (6ES7862-0AC01-0YA0) per CPU.

Configuration of the absolute encoder on the PROFIBUS port of the S7-300 (where the original PROFINET question specified a single DP port): on the S7-300 315-2 PN/DP, the integrated DP port is the X2 interface. Configure it as a DP master and add the absolute encoder as a DP slave. The PROFINET port (X1) is then free for the redundant ET200S PN stations.

// OB1 of the S7-300 - role handover logic
// FB101 from SW Redundancy V3.x
CALL FB101, DB101
    TIMEOUT  := T#1S;          // 1-second keep-alive loss triggers failover
    SYNC_PORT := 2000;         // UDP multicast port
    MASTER_REQ:= TRUE;         // this CPU is master

Diagnostic and Verification Procedures

Verification differs by topology; the following matrix is used in commissioning and FAT:

Recommended FAT steps:

1. Power up the redundant pair; confirm both CPUs reach RUN.
2. Force a CPU stop on the master; confirm that the reserve takes over within the documented switchover time and that PROFINET devices remain reachable to the application.
3. Disconnect a PROFINET cable between the SCALANCE switch and an ET200S PN; confirm MRP reconfiguration (typically 200 ms) and continuous PROFINET traffic on the ring.
4. Restore all conditions; confirm the master resumes its role and the partner returns to "Reserve" without disturbing the process.

Fault Matrix

Comparison of Available Topologies

Recommendations and Field Notes

Engineers specifying redundancy on a Siemens platform should follow these guidelines:

1. Keep S7-400H on PROFIBUS DP for any new high-availability project. The platform is in classic product phase; do not design new features that depend on PROFINET redundancy on the H-CPU.
2. If PROFINET is mandatory, the platform choice is the S7-1500R/H (separate S7-1500 redundant family), not S7-400H. The S7-1500R/H implements PROFINET S2 natively on the integrated PN interface.
3. For the specific case in the original question (S7-300 + ET200S PN + drives), software redundancy is acceptable when the application tolerates 1-3 s failover and the drives have their own safety stop category.
4. When migrating from PROFIBUS DP, run a PROFINET network planning pass with SINEC NMS or PRONETA before commissioning. Validate that the ring supports MRP, that all PROFINET devices carry S2 or R capability, and that the wiring follows the PROFINET cabling guidelines (max 100 m per segment with copper).