S7-400H Redundant I/O Passivation: RED_STATUS 16#FFFF Fix

1. S7-400H Redundant I/O Passivation Overview

On a Siemens SIMATIC S7-400H high-availability station (CPU 417H or CPU 414H paired in rack 0 and rack 1), redundant I/O modules of the SM 326 family are designed to keep a process running when a single channel, module, or subrack fails. When the controller cannot resolve the redundant partner address, the RED_STATUS (FB 453) block reports HIGH_ADD = 16#FFFF, every CH_DI / CH_DO driver connected to the pair enters passivation, and downstream signal quality turns BAD. The plant shows loss of feedback, drives drop to safe state, and the operator station displays quality code 0x00 ("bad") rather than 0xC0 ("good-cascade") or 0xD0 ("good-local override").

This article documents the field-proven root cause and the exact sequence that restores redundant operation. It is written against the PCS 7 V8.2 / V9.0 / V9.1 automation library and is also valid for STEP 7 V5.6 + S7-H Add-On deployments that use the same redundancy blocks (FB 450, FB 451, FB 452, FB 453, FC 451).

2. Affected Hardware, Modules, and Firmware

Symptom reproduction concentrates on the following configuration envelope. The values are the most widely deployed revisions; a similar passivation path is reported on newer versions.

Functional state suffixes (1BL, 7BL, etc.) are the Siemens "Ausgabestand" codes printed on the front panel after the MLFB; they identify internal hardware revisions and must be present in both racks.

3. Symptom Matrix: Identifying the RED_STATUS 16#FFFF Fault

The fault signature is consistent across all recent firmware releases. Use this matrix to confirm the diagnosis before changing configuration.

Diagnostic entry read path. In STEP 7 open the online AS, navigate to PLC > Diagnostics/Settings > Diagnostic Buffer, and search for event IDs 16#73A0, 16#73A1, 16#73A2, and 16#73A3 (I/O redundancy lost / passivation). In PCS 7 the same events are mirrored in the Maintenance Station alarm log.

4. Root Cause: Missing RED_DEPA and Asymmetric Configuration

The defect is almost always one of the following, in descending order of frequency:

1. FC 451 "RED_DEPA" is not called in OB 83. PCS 7's Generate Module Drivers should drop a call to FC 451 inside OB 83 (subrack fault OB), but it does not always do so when the project was imported from an older PCS 7 version, when the CFC chart is opened in SIMATIC Manager rather than the PCS 7 Engineering tool, or when OB 83 is locked for editing. Without FC 451 the controller never publishes the active partner address; FB 453 consequently returns 16#FFFF on the high address.
2. HW Config pairing is set only on rack 0. The user must right-click each SM 326 module in HW Config, open Object Properties > Redundancy, and tick the partner slot. If the partner is left blank or points to the same slot in the same subrack, the high address is unresolved.
3. The CFCs that contain FB 450/451/453 sit in @0 only, with no equivalent in @1. When the rack-1 CFC is missing, the partner side has no driver. The controller reports the master as passivated from the partner's perspective.
4. HW Config of rack 1 was not downloaded or contains a different address gap. Both racks must have identical I/O layout and identical start addresses. If rack 1 has been edited, even slightly, the redundancy consistency check inside the H-CPU fails.
5. Firmware mismatch on the two SM 326 modules. The diagnostic buffer entry "Module functional state differs" indicates a 1BL vs. 1BN functional-state mismatch; the H-CPU refuses to bind the redundancy pair.
6. The CH_DI block is connected to the wrong process image partition (PIP). The driver PIP must match the one configured in HW Config (default PIP 1 for the default OB1 process image). A mismatch leaves the high address permanently "not found".

5. Required Redundancy Library Blocks

PCS 7 / S7-H Add-On ships the following FBs. All are in the "Redundancy V6" library ("PCS 7 Library V90" or "PCS 7 APL V8.2") and must be present in the S7 program container of the AS.

Generate Module Drivers normally instantiates FB 450/451/453 and CH_DI/CH_DO in the @0 master chart, places the partner instances in @1, and creates the FC 451 call inside OB 83. If the call is missing the symptom described in Section 3 appears immediately after download.

6. Step-by-Step Resolution Procedure

Apply the following sequence. Steps 1-3 are mandatory; steps 4-8 cover every documented variation. The full procedure is rated engineering time 30-90 minutes plus a 60-90 minute AS compile / download cycle on a large project.

Prerequisites

• PCS 7 V8.2 SP1 or later with the S7-H Add-On installed; or STEP 7 V5.6 SP2 + S7-H Add-On V6.0.
• Active project license for the affected AS (redundancy blocks consume additional runtime license counters).
• Step 7 ES with the affected S7 program open online to the master CPU.
• Authority to perform a download (full or delta) and to switch the OS if needed.

Step 1 - Verify FC 451 is inside OB 83

1. In SIMATIC Manager, expand the S7 program of the affected AS, open Blocks > OB 83.
2. Open the OB 83 in FBD or STL view. Confirm that segment 1 contains a call to CALL FC 451.
3. If the call is missing, open the @1 CFC (the redundancy partner chart) and add the call manually: CALL FC 451 (no parameters) in the first network of OB 83.
4. Recompile and download the changed blocks (delta download is sufficient).

Step 2 - Verify HW Config pairing in both racks

1. Open HW Config, select the SM 326 module in rack 0 (slot X), right-click and choose Object Properties > Redundancy.
2. Tick "Operate in redundant mode" and select the partner slot (rack 1, same slot number). Click OK.
3. Repeat for the partner module in rack 1 and verify that it points back to rack 0, slot X.
4. Save and recompile HW Config. Download the new hardware configuration to both CPUs (rack 0 first, then rack 1) so the operating system images are identical.

Step 3 - Verify CFC presence on both racks

1. Switch the chart view to Plant View > AS x > CFC > @0 and @1.
2. Open the chart that owns the redundant I/O driver. Confirm that FB 450 / FB 451 / FB 453 are present.
3. In @1, confirm the partner instance exists. If the @1 chart is empty, copy the chart from @0 with Chart > Copy > To rack 1 and recompile.

Step 4 - Re-run Generate Module Drivers

1. In the CFC editor, choose Options > Chart > Generate Module Drivers.
2. Select the affected signal modules; click OK.
3. After generation, open OB 83 and confirm that FC 451 was re-inserted.

Step 5 - Force a complete OB 83 / FC 451 reload

If FC 451 was present in the offline program but the controller still reports passivation, perform a full block rebuild of the S7 program:

1. Mark the Blocks container, choose Edit > Delete > All blocks in offline container.
2. Right-click the S7 program and choose Compile > All (rebuild). This step regenerates OB 83, OB 70, OB 72, FC 451, and the system data from the S7-H Add-On templates.
3. Perform a full download to both CPUs (Halt > Download > Run).

Step 6 - Check that OB 70 and OB 72 also call FC 451

While OB 83 is the most important, depassivation should be issued from any redundancy-failure OB. Add the same CALL FC 451 to the first network of OB 70 and OB 72 to ensure consistent recovery. OB 72 is generated automatically with an FC 451 callout; OB 70 is sometimes missing it on imported projects.

Step 7 - Validate the redundancy I/O addresses

Open the S7 program, choose PLC > Redundancy > I/O Redundancy, and inspect the active address list. The "High address" column should now show the partner's logical byte address (for example, the SM 326 DI at I 256.0 in rack 1 reports HIGH_ADD = 16#0100). If the partner address still shows 16#FFFF, repeat step 2 with attention to slot numbering.

Step 8 - Recompile OS and run an operator-level test

1. Trigger an OS compile to push the new status to the WinCC faceplates.
2. On the Maintenance Station, navigate to the redundant I/O faceplate and verify the quality stamp is now 16#C0 (good-cascade).
3. Simulate a module removal (with the station in single-channel) to confirm passivation/depassivation behaves correctly before returning to redundant mode.

7. Verification and Commissioning Checks

Use the following checks before signing off the fix. Each check is fast and can be run on a live plant if the appropriate operator protections are in place.

1. RED_STATUS inspection. In a CFC test view on the master chart, look at FB 453 outputs: LOW_ADD and HIGH_ADD must be non-zero, equal, and equal to the I/O area of the SM 326 modules (for example, both = 16#0100 for an I 256-257 address). MODE_00 = 1 indicates the master side is selected.
2. Diagnostic buffer scan. The buffer should show no passivation events after FC 451 was inserted. Filter for event ID 16#73A3 ("redundancy restored") to confirm that the system acknowledges the fix.
3. Forced channel test. Force the input from a digital test sensor; confirm the value arrives on CH_DI on both rack 0 and rack 1 faceplates. Switch the redundancy link status (SF LED on the standby CPU); the active channel should swap from master to standby without process interruption.
4. OB 83 stack. Induce a controlled subrack fault (for example, pull the partner module) and confirm OB 83 runs without CPU STOP and FC 451 issues a depassivation on the way out.
5. OS faceplate quality. The WinCC quality code on the I/O faceplate must display 0xC0 (good-cascade) for redundant variables; 0xC0 indicates that the driver selected a value from a non-passivated channel.

8. Field-Proven Configuration Tips and Pitfalls

Lessons learned from multiple field interventions on PCS 7 V8.x and V9.x redundant plants.

• Address gap rule. Always reserve a contiguous I/O address range (for example, I 256-I 287, Q 256-Q 287) for SM 326 modules. PCS 7's CFC needs at least 4 bytes of headroom for the redundancy housekeeping, so leave a 16-byte gap above the highest redundant address.
• PIP consistency. If the process image partition is anything other than the default PIP 0 / OB 1, verify that the partner I/O PIP matches. A common mistake is to put rack-0 modules in PIP 1 and rack-1 modules in PIP 0; the H-CPU treats that as a logical mismatch.
• FC 451 as the single depassivation call. Avoid calling FC 451 from a cyclic OB 1 interrupt (time-of-day OB or cyclic interrupt OB); this can cause depassivation storms after planned maintenance. The official call sites are OB 70, OB 72, and OB 83.
• Manual depassivation button. Many plants add a manual "Reset redundancy" button that calls FC 451 in a single-instance background OB (for example, OB 100 start-up). Use this only as a manual recovery tool, not as the primary depassivation path.
• Hardware revision ("Ausgabestand"). Mixing 1BL and 1BN functional states inside one redundant pair is the most common hardware-side cause of passivation that survives a clean software fix. Always store the partner module's functional state in your asset record.
• Compile-time order. Compile CFC charts before HW Config, not after. Generating module drivers after HW Config sometimes overwrites OB 83 and removes the FC 451 call.
• Importing projects from older PCS 7. When migrating from PCS 7 V7.x to V8.x, the OB 83 template changes. Use Update block templates from the S7-H Add-On, then re-run Generate Module Drivers, then verify the FC 451 call survived.

9. Quick Diagnostic Script (Optional)

Add a small SCL block to your diagnostics CFC to log RED_STATUS values on each redundancy loss event. The block can be written to a data block and pulled into WinCC via a status tag, so a maintenance engineer can see the last known LOW_ADD / HIGH_ADD without going online.

// RED_STATUS monitor (SCL, run in OB1 or a 100 ms cyclic OB)
FUNCTION "FB_RED_STAT_MON" : VOID
VAR_INPUT
  iRedStatBlock : BLOCK_FB;        // instance of FB 453
END_VAR
VAR_TEMP
  tLow  : WORD;
  tHigh : WORD;
END_VAR
BEGIN
  tLow  := WORD_TO_INT(iRedStatBlock.LOW_ADD);
  tHigh := WORD_TO_INT(iRedStatBlock.HIGH_ADD);
  IF tHigh = 16#FFFF THEN
    "DB_RED_LOG".LastEvent   := 16#0001;          // passivation active
    "DB_RED_LOG".HighAddLast := tHigh;
  END_IF;
  "DB_RED_LOG".LowAdd  := tLow;
  "DB_RED_LOG".HighAdd := tHigh;
END_FUNCTION

The SCL block is provided for reference; the equivalent logic in STL is also acceptable.

10. Related Standards and Documentation References

The fix is fully described in the official Siemens manuals. The most relevant documents are:

• SIMATIC S7-400H High Availability Systems, System Manual (Siemens, edition 2017, A5E00271259).
• PCS 7 Process Control System, Operator Station Manual (Siemens, edition 2019, A5E31741202).
• SIMATIC PCS 7 APL Library V8.2 / V9.0, Function Manual (Siemens, A5E35150060).
• S7-H Add-On for SIMATIC S7-400H, Installation and Configuration Manual (Siemens, A5E00799952).

Frequently Asked Questions