S7-400H Redundancy Setup Guide: S7-414-4H, CP 443-1, Y-Link

1. S7-400H vs Software Redundancy (SWR): Choosing the Right Path

Before any hardware list is finalized, the first design decision on a Siemens redundancy project is the redundancy mechanism. Siemens offers two technically distinct families, and the component list in the field report — S7-414-4H CPUs, CP 443-1, PS 407-4A, Y-Link, ET200M — narrows that decision immediately. The S7-414-4H is a member of the S7-400H fault-tolerant family, which means the project is targeting hot redundancy, not SWR.

2. S7-400H System Architecture Overview

An S7-400H station consists of two electrically isolated sub-racks (UR1/UR2 or one UR split into two logical halves), each populated with a CPU 414-4H, a power supply (PS 407-4A or PS 405-4A), and an optional CP 443-1 for plant Ethernet. The two CPUs are connected through synchronization modules mounted on the back of each CPU and joined by fiber-optic patch cords. Up to four sync modules can be cascaded per CPU to extend the maximum distance.

Process I/O is typically placed on redundant PROFIBUS-DP segments that lead to ET200M stations or to switched DP/PA couplers. Where single-channel (non-redundant) I/O must remain on the existing bus — for example, third-party DP slaves or older ET200M that cannot be paired — a Y-Link (6ES7 197-1LA02 or later) is inserted in front of the segment, presenting a redundant interface to the H-system and a single interface to the legacy devices.

3. Required Hardware Components and Catalog Numbers

4. Synchronization Modules and Fiber-Optic Cabling

The synchronization modules plug into the rear of each CPU 414-4H. Two slots are provided, allowing the link to be split across up to four FO cables (for longer distances or to traverse cabinet partitions). At each cycle the primary CPU transmits the process image, the active DBs, and configuration data to the standby. On any of the following events the standby becomes primary within milliseconds:

• Primary CPU STOP / hardware fault / power loss
• Sync module failure or FO cable break
• PROFIBUS-DP master failure on one sub-rack
• Triggered by OB 70 / OB 72 fault OBs

Maximum FO length between two sync modules is 10 m with the standard plastic cable; with the glass-fiber variant (6ES7 960-1AC04) distances up to 10 km can be achieved using two pairs of sync modules per CPU.

5. Y-Link Integration for Single-Channel I/O

Not every DP slave in a brown-field plant is redundant. Y-Link (6ES7 197-1LA02) is a Siemens DP/DP coupler with a "redundant DP master system" port on one side and a "single DP master system" port on the other. Configure the redundant side as follows:

1. In HW Config, drag Y-Link from the catalog (path: PROFIBUS-DP > Network components > Y-Link) onto the redundant DP master system of CPU0.
2. Assign a unique PROFIBUS address (default 33) to the Y-Link.
3. On the lower (single-channel) side, drag the legacy DP slaves that must remain single-channel — older ET200M with IM 153-1, third-party drives, etc.
4. Set the Y-Link operating mode to DPM1+DPM2 = active if both masters must drive it; otherwise leave the default where the active master is selected automatically by the H-system.

6. ET200M Distributed I/O Configuration

Redundant ET200M stations use the IM 153-2 (6ES7 153-2BA10-0XB0 or -2BA70). Each ET200M contains two IM 153-2 modules and a single backplane. To make the station redundant, both IMs must be assigned separate PROFIBUS addresses and connected to the two redundant DP master interfaces (one to CPU0, one to CPU1). All signal modules (SM 321, SM 322, SM 331, SM 332) are read by both IMs; the H-system selects the active IM.

Configure the redundant ET200M by selecting DP slave properties > "Redundant operation" in HW Config. STEP 7 will then automatically assign two PROFIBUS addresses (e.g., 4 and 5) and generate the relevant diagnostic blocks.

7. STEP 7 / TIA Portal Project Setup

The S7-400H can be configured in either SIMATIC Manager STEP 7 V5.5 SP4+ or TIA Portal V14 SP1+. The procedure differs slightly:

7.1 STEP 7 V5.5 path

1. Create a new project: File > New > User Project.
2. Insert an S7-400H station (not an S7-400 station — the wizard explicitly offers "S7-400H").
3. HW Config opens automatically with both sub-racks. Slot 1: PS 407-4A; Slot 3: CPU 414-4H; Slot 4: CP 443-1.
4. Insert the sync module under the CPU properties ("Synchronization" tab).
5. Configure the PROFIBUS-DP master system on each CPU and add Y-Link and ET200M stations.

7.2 TIA Portal path

1. Create a new project and add a "Device" of type SIMATIC S7-400H with two RACK-0 / RACK-1 racks.
2. Drag the CPU 414-4H into each rack; TIA Portal automatically proposes the H-system structure.
3. Configure PROFINET / PROFIBUS interfaces from the device view.
4. Use "Redundancy" properties on the CPU to enable hot redundancy.

8. Hardware Configuration in HW Config

After the mechanical build, HW Config is the single source of truth for the rack layout. The following parameters must be set identically on both sub-racks; STEP 7 does not enforce symmetry, but mismatches cause an "Rack fault" (SF LED on, diagnostic buffer entry Rack 0/1 configuration difference):

• Slot assignment and module type per slot
• PROFIBUS / PROFINET addresses and baud rate (DP master system: 1.5 Mbit/s default)
• IP addresses for CP 443-1 (CPU0: 192.168.0.10, CPU1: 192.168.0.11 typical)
• Subnet mask and router (if applicable)
• Synchronization module assignment (ports 1 and 2)

Compile and download to both CPUs in the order CPU0 first, then CPU1. After download each CPU will report "Standby" or "Active" in the diagnostic buffer; the operator panel on the CPU face displays the current role.

9. Communication Setup with CP 443-1

CP 443-1 (firmware V2.x or V3.x depending on catalog number) is the Ethernet gateway. In an H-system, the two CPs must run in redundant mode, meaning only one CP is logically "active" while the other is "passive" but continuously updates its connection list.

1. In HW Config, open the CP 443-1 properties and select "Redundant operation with partner CP".
2. Set the partner CP's MAC address (read from the face of the second CP).
3. Configure an S7 connection for each CP using NetPro.
4. For HMI / SCADA, use the S7-REDCONNECT function block (FB 405) so the client automatically fails over from CP0 to CP1 within ~3 s.

10. Programming Considerations and OB1 Execution

Hot redundancy means one user program is loaded into both CPUs. There is no master/standby branch in the application code; the active CPU simply executes OB 1 while the standby runs but is inhibited from writing outputs. The following OBs are critical for fault handling:

The standard library "S7HCOM" provides FB 405 (S7-REDCONNECT) for redundant S7 connections and FB 458 (S7-F-REDCONNECT) for fail-safe variants. These blocks are not the same as the SWR library and are not interchangeable.

11. Commissioning and Verification

1. Pre-power checks. Verify that all backplane screws are torqued, PS 407 input is wired to a redundant 24 V source, and FO cables have clean connectors. A single contaminated FO end-face can prevent sync startup.
2. Power-on sequence. Energize PS 407-4A on rack 0; wait until CPU 0 reaches "RUN/Active". Then energize rack 1; CPU 1 will boot, sync, and report "RUN/Standby".
3. Diagnostic verification. On each CPU, open SIMATIC Manager > CPU > Module Information > Diagnostic Buffer. Confirm Event ID 16#4949 "H-system synchronized" is present on both.
4. Switchover test. With the process in a safe state, stop CPU 0 (toggle the mode switch to STOP). CPU 1 must transition to "Active" within 100 ms (typical) without any OB 85 / OB 122 being called.
5. PROFIBUS redundancy test. Pull the DP connector on CPU 0's PROFIBUS interface. All redundant ET200M stations must continue to communicate via CPU 1. Verify in the diagnostic buffer that the affected DP slave reports 16#394A "Master changed".
6. CP 443-1 failover test. From an HMI / SCADA client, ping CPU 0's CP; the connection should reroute to CPU 1 within ~3 s when the CP 443-1 on rack 0 is unplugged.
7. Y-Link test. Force a switch on Y-Link (PROFIBUS diagnostics > "Slot 0") and verify that single-channel slaves downstream remain accessible.

12. Troubleshooting Matrix

13. Field-Proven Caveats

• Hot-standby timing. A scan-time of 20 ms with full sync each cycle means roughly 5–8 % of CPU throughput is consumed by redundancy housekeeping. On a CPU 414-4H, do not budget above 80 % program execution.
• Programming tool choice. Newer projects benefit from TIA Portal V16+ for unified engineering, but STEP 7 V5.5 SP4 still offers the most mature set of redundancy diagnostic faceplates and is the de-facto standard in brown-field plants.
• Documentation set. Reference the SIMATIC S7-400H Fault-Tolerant Systems manual (entry ID 1186523 on Siemens Industry Online Support) and the S7-400H Programmable Controller system manual (entry ID 1109502) for hardware specifications.
• Spare-parts strategy. Always stock two spare sync modules and two spare CP 443-1 modules; a swap requires both racks to be powered down only if the active CP fails simultaneously.

14. Related Documentation on Siemens Industry Online Support

For ordering data, firmware updates, GSD files, and application examples refer to the Siemens Industry Online Support portal at support.industry.siemens.com. Common entry IDs relevant to S7-400H are 1186523 (Fault-Tolerant Systems manual), 1109502 (S7-400 system manual), 16818709 (S7-400H configuration example), and 77377611 (CP 443-1 firmware). Search by these IDs if direct navigation is not available.