SFC90 H_CTRL in S7-412-3H: Resolving W#16#8090 "Mode Incorrect" During Master/Standby Switchover

The SIMATIC S7-412-3H is an entry-level H-CPU in the S7-400H redundant system family and supports the same redundancy control mechanism as the larger 414-4H and 417-4H. The system function block SFC90 "H_CTRL" is the primary user-programmatic interface to influence the behavior of the two redundant CPUs, including disabling/enabling the self-test, controlling the update sequence, and — in later firmware versions — initiating a master/standby switchover.

This reference explains why the SFC90 returns w#16#8090 on an S7-412-3H when called with MODE = 30 or MODE = 31 for a master/standby change, how the Mode range maps to actual H-CPU features, and the correct procedures to use for switching the master programmatically.

1. SFC90 "H_CTRL" — Functional Overview

SFC90 "H_CTRL" lets the user program control specific H-system features of the local CPU. The block operates asynchronously; the call is non-blocking and uses the REQ, BUSY, and RET_VAL mechanism familiar from other asynchronous SFCs.

1.1 Standard H_CTRL Mode Range (S7-400H Documentation)

The Mode numbers originally documented for S7-400H CPUs in the STEP 7 V5.4 help are summarized in the SIMATIC H manual F0153:

The 412-3H only implements the core B#16#0 (self-test enable) and B#16#1 (self-test disable) jobs. All higher Mode values (including 3, 5, 30, 31) are accepted only by 414-3H / 414-4H / 417-4H, with the master-switchover Modes 30 and 31 requiring firmware V4.5.x or later on the higher CPUs.

2. Why the S7-412-3H Returns W#16#8090

The error code w#16#8090 is one of the SFC90-specific error codes that the H-CPU returns through RET_VAL:

On an S7-412-3H, calling SFC90 with MODE = 5, 30, or 31 will always return w#16#8090 because the 412-3H firmware does not implement the master-switchover jobs. This is by design: the 412-3H is positioned as a low-cost entry point and inherits only the H_CTRL subset that was available at its initial firmware release.

3. Verification: Confirming the SFC90 Mode Set Available on the 412-3H

Before debugging further, verify the SFC90 implementation on the actual CPU. Two diagnostic paths are recommended:

3.1 Read the SFC90 source from the CPU

1. In STEP 7 V5.4 / V5.5, open the program editor and right-click Libraries > Standard Library > System Function Blocks > SFC90.
2. Select Open > Read from CPU after selecting the target CPU.
3. Open the block interface and inspect the comment lines for MODE — Siemens embeds the supported Mode list directly in the SFC90 source comments on the CPU.

3.2 Use the H Diagnostics

Open SIMATIC Manager > Options > H System > H Diagnostics and check the H-CPU firmware version (read from the PLC > Module Information > Identification). Confirm the firmware matches a release that supports the requested Mode.

4. Workaround: Master/Standby Switchover on S7-412-3H

Because the 412-3H does not support the master-switchover Modes of SFC90, two alternative mechanisms are used in production systems:

4.1 Operator-initiated switchover via HMI / PCS 7

The standard mechanism is a user-action (button) on the HMI that triggers the Master switchover from the H-system view. This is the recommended path for any H system and is what PCS 7 OS pictures and the SIMATIC WinCC H-system faceplate implement by default. The corresponding SFC is called internally by the H-system standard blocks and is not exposed as a public API.

4.2 Programmatic switchover using the H-system standard blocks

On the 414-4H / 417-4H from firmware V4.5.x, the call below performs a master switchover to the standby CPU. The same call fails with 8090 on the 412-3H.

// ST - Master switchover to standby CPU (H_CTRL Mode = B#16#1E)
// CPU: 414-4H / 417-4H, Firmware V4.5.x or higher
// For S7-412-3H this call will return RET_VAL = W#16#8090.

// Input bits
//   bStartSwitch   : BOOL  - rising edge starts the job
//   bAckReset      : BOOL  - acknowledged reset of last job
// Output
//   iRetVal        : INT   - SFC90 RET_VAL
//   bBusy          : BOOL  - SFC90 BUSY

IF bStartSwitch AND NOT bBusy THEN
    iRetVal := 0;
    bBusy := TRUE;
END_IF;

IF bBusy THEN
    SFC90(
        REQ     := bStartSwitch,
        MODE    := B#16#1E,            // 30 dec = switch master to rack 0
        SUBMODE := W#16#0,
        RET_VAL := iRetVal,
        BUSY    := bBusy
    );
END_IF;

IF NOT bBusy AND (iRetVal <> 0) THEN
    // Handle error codes 8090, 8091, 8092 specifically
    // 8090 -> MODE not supported (typically 412-3H or wrong FW)
    // 8091 -> SUBMODE wrong
    // 8092 -> H system not in redundant state
    CASE iRetVal OF
        W#16#8090: // Mode invalid for this CPU/FW
            ;
        W#16#8091: ; // Submode invalid
        W#16#8092: ; // System state not OK
        ELSE
            ;
    END_CASE;
END_IF;

4.3 Alternative for S7-412-3H — using the H-system job list

If the application must perform a programmatic switchover, the S7-412-3H does not expose this capability through SFC90. The recommended path is to issue the switchover through the WinCC / PCS 7 faceplate, which calls the same internal mechanism used by SFC90 Mode 3 on the higher CPUs. The following steps replicate that mechanism in a user-friendly form:

1. Place a standard Master switchover button on the WinCC OS picture bound to the corresponding standard faceplate tag.
2. Configure the standard faceplate's Operation right to the same authorization level as the rest of the H-system commands (typically level 6 — Maintenance).
3. Wire the standard faceplate to the H system block SS_W (or the equivalent SFC inside the H standard library) so the actual H-system job is generated.
4. Test the switchover in solo mode first to verify the H system has completed link-up and update of all DP/PN slaves, then perform the switchover under the simulated redundant state.

5. H_CTRL Mode Reference for S7-400H CPUs

The table below consolidates the supported Modes by CPU type. The 412-3H column reflects the implementation shipped with the first firmware; later firmware updates (currently up to V4.5.x for the 412-3H) have not added master-switchover support.

6. Step-by-Step: Replacing SFC90 Master Switchover on 412-3H

6.1 Prerequisites

• STEP 7 V5.4 or V5.5 with the H-CPU service pack installed.
• S7-412-3H redundant pair running the same firmware version (V4.5 or higher recommended).
• Authorized WinCC/PCS 7 OS operator with the H-system Operation right.
• H system in redundant (not solo) state.

6.2 Procedure

1. Open the redundant S7 program and remove any SFC90 calls that use MODE = 5, 30, or 31 from the 412-3H side. Replace them with the call below that only addresses the supported Modes.
2. Insert a WinCC / PCS 7 faceplate button on the relevant OS picture to trigger the Master switchover for the 412-3H pair. The faceplate calls the H-system standard block that issues the equivalent of SFC90 MODE = 3 internally.
3. Compile and download the OS server project, then test the button in Offline mode and in Online with the redundant pair.
4. Verify the switchover completes within the configured time-out (default 3 s) and the new master takes over the process image update of all DP / PN slaves.
5. Capture the H-system event log from the H Diagnostics viewer; a successful switchover produces the events H: change of master by operator and H: link-up completed.

6.3 Verification

• Open H Diagnostics > System state and confirm both racks report redundant and the new master is on the expected rack.
• Check the H status word (status of the H system) in the user program. The relevant bit assignments appear in the SIMATIC H manual F0153, page 81.
• Force a process tag update on the standby and verify it appears at the new master within one OB1 cycle.

7. SFC90 Bit-Level Reference for H Status

For each supported Mode, SFC90 reads/writes bits in the H status word. The bit positions follow the convention in the SIMATIC H manual:

These bits reflect the H-system-wide state and cannot be written independently. SFC90 MODE = 3 is the user-programmatic interface to these flags on CPUs that support it.

8. Common Mistakes and Field Cautions

1. Using W#16#1E as input to SUBMODE: For Modes 30 and 31 the Submode must be W#16#0. Setting Submode to a non-zero value returns w#16#8091.
2. Calling SFC90 in OB1 with the wrong Mode data type: Use B#16#1E or decimal 30 — not W#16#1E — for the MODE input. A WORD-typed constant in MODE returns 8090 on some firmware versions because the upper byte is non-zero.
3. Calling SFC90 during startup (OB100): The H system is not yet in the redundant state. SFC90 returns w#16#8092. Move the call to OB35 or a cyclic user-program section that starts after the H system has completed link-up.
4. Using SFC90 in a safety program (S7 F/FH): Forbidden. The safety program shuts down within 24 hours if SFC90 disables the self-test.
5. Mixing H_CTRL Modes on a redundant pair with different firmware versions: The H system requires both CPUs to run the same firmware. If one runs V4.5 and the other V4.3, the new H_CTRL jobs are rejected with 8090 from the older CPU's firmware.

9. Alternative: Performing a Forced Master Switchover via the H System

For test purposes the operator can force a master switchover using one of three mechanisms that do not require SFC90 at all:

1. Power-down the current master and let the standby take over. The H system performs an automatic switchover in approximately 100–500 ms depending on the DP/PN slave count.
2. Stop the current master via the programming device. Use only in test mode; it is not recommended in production.
3. Use the H-system operator panel (HMI button) as described in section 4.3.

For automated test sequences in a factory acceptance test (FAT), wiring the SFC90 call to a 414-4H or 417-4H pair is the cleanest approach. The 412-3H must use the HMI-driven path.

10. Summary

The w#16#8090 error returned by SFC90 "H_CTRL" on an S7-412-3H for Modes 5, 30, or 31 is not a configuration error but a documented limitation of the 412-3H firmware. The Modes B#16#1E and B#16#1F (decimal 30 and 31) are only implemented on the S7-414-4H and S7-417-4H from firmware V4.5.x.

For a 412-3H system, a programmatic master/standby switchover from the user program is not available. Use the operator-driven HMI / WinCC path (PCS 7 faceplate) or perform the switchover manually for test purposes. The Modes 0 and 1 of SFC90 (self-test enable/disable) remain valid on the 412-3H, subject to the S7 F/FH safety exclusion.