Siemens S5-155H CPU 948R: EEPROM Card Cold Restart and Backup

System Overview

The SIMATIC S5-155H is a high-availability (H) controller from the Siemens SIMATIC S5 family, designed for process applications where unplanned downtime is unacceptable. The "H" suffix denotes a fully redundant, hot-standby architecture in which two identical CPUs run in lock-step and a non-redundant master assumes control if the active partner fails. The system is typically deployed in power generation, water/wastewater, petrochemical, and continuous-process plants where the controller must survive CPU, power supply, and backplane faults without interrupting the controlled process.

The CPU 948R is the processor module most commonly paired with the 155H backplane. It replaced the older CPU 946/947R modules and is the recommended migration target for installed 155H bases. The 948R offers substantially more on-board memory and faster instruction execution than its predecessors, which directly affects cold-start time, program download throughput, and the size of memory card that can be addressed.

CPU 948R Specifications Relevant to Memory Card Handling

From the Siemens support article on the CPU 948R:

The expanded 1.6-Mbyte on-board RAM option is required when the application exceeds approximately 640 KB of code, or when the project uses extensive DB, DX, or FY data areas that would otherwise be swapped to memory card at runtime.

Memory Card Form Factor: 6ES5 374 2KK21

The program carrier in a 155H system is a plug-in memory card seated in a dedicated slot on the CPU front panel. The most common type encountered in the field is the 6ES5 374 2KK21 EEPROM card, a 256-Kbyte (or larger, depending on variant) electrically erasable module that retains its contents without battery backup. The card is keyed so it can only be inserted in the correct orientation; forced insertion in the wrong direction will damage the connector.

The card is treated by STEP 5 and COM155H as a logical "program number 500" (PBN 500). This is a fixed identifier and is the same value that appears in the Program Status screen of STEP 5 when a flash/EEPROM module is read or written. The number does not change with card capacity.

Cold Restart from the EEPROM Card on a Redundant CPU

The 155H redundancy protocol is designed to permit one-sided maintenance: the operator can withdraw the standby CPU, perform work on it, and reinsert it without affecting the running master. A cold restart is the deepest form of restart and reloads the entire program, all DBs to their initial values, and resets all timers, counters, flags, and process-image tables.

Step-by-Step Procedure

1. Confirm the partner CPU is healthy and in RUN. Read the REDUN status word on the AG 155H diagnostics screen; both CPUs must report REDUN = EH (each CPU considers the other error-free) before proceeding. If the partner is already in error, do not pull the second CPU — the rack will go into solo mode and a cold restart of the remaining CPU will halt the process.
2. Set the mode selector of the standby CPU to STOP. This decouples it from the redundancy link cleanly without generating a partner-loss event on the master.
3. Physically remove the standby CPU. The master continues to run unaffected. The process I/O scan is handled solely by the master during the intervention window.
4. Insert or replace the EEPROM memory card in the CPU's memory card slot. Verify the card is fully seated and the ejector is latched.
5. Reinsert the standby CPU into its slot and tighten the front-screw retainers.
6. Set the mode selector to COLD RESTART and hold for the required duration (typically 3 seconds on a 948R, until the BASP LED extinguishes and the RUN LED begins to flash).
7. Observe the LED sequence. The cold restart first erases RAM, then loads the program from PBN 500 (the EEPROM card) into user memory, then initializes all data blocks, then performs a self-test. A successful cold restart ends with steady RUN on the standby CPU and a synchronisation handshake with the master.
8. Verify synchronisation. Both CPUs should show RUN with the REDUN LED steady. Toggle the redundancy status in STEP 5 to confirm both partners hold identical code and data.

Behaviour if the EEPROM Program Is Invalid

If the program on the inserted EEPROM is syntactically or semantically wrong, or is incompatible with the current hardware configuration of the rack, the standby CPU will fail its self-test. The 948R will report one of the following stack-error indications:

Critically, a failed cold restart on the standby CPU does not propagate to the master. The master continues to run the process in solo mode. The faulty standby will simply remain in error and not contribute to the redundancy pair. This is the intended fail-safe behaviour of the 155H: the system tolerates a defective backup and continues to operate, degraded but live. The fault must still be cleared (a correct EEPROM card inserted, or the faulty CPU replaced) before full H-redundancy is restored.

Backing Up the EEPROM Card with a PG

When the EEPROM is the only source of the application program, the operator must produce a backup file on the programming device (PG) before any further intervention. The procedure differs from a standard S7 download.

Prerequisites

• A Siemens PG (or compatible PC with the Siemens MPI/serial adapter) running STEP 5 version 7.x or later.
• The COM155H software package, installed in addition to STEP 5. COM155H provides the redundancy-aware diagnostics, the redundancy-control blocks (FB 192, FB 193, FB 194, FB 195, FB 196), and the routines required for reading and writing memory cards on 155H CPUs. STEP 5 alone is not sufficient for 155H-specific operations.
• The internal PROMmer of the PG must be activated. With STEP 5 V7.x and later, the PROMmer is enabled from within STEP 5 itself; with earlier versions, the enable routine is launched from the Windows Start menu under the Siemens SIMATIC program group.
• The EEPROM card must be physically present in the PG's memory card slot, not in the CPU. The card type must match the slot (EEPROM vs. EPROM vs. Flash EPROM — the 6ES5 374 2KK21 is EEPROM and uses the EEPROM socket on the PG).

Backup Procedure

1. Launch STEP 5 and verify the Online view shows the correct AG 155H. If the AG is not visible, check the MPI/AS511 interface address (default is 2 for an S5 MPI node).
2. Open the Memory Card submenu (under File → Memory Card in STEP 5 V7.x) and select Read to PG (German: PG lesen).
3. In the Program Number field, enter 500. This is the fixed program number that STEP 5 and COM155H use to identify the flash/EEPROM module. Do not enter a project-specific number; the PBN 500 designation is reserved for the card image.
4. Select the source slot (EEPROM) and the destination path on the PG hard disk. Use a project-name folder, not the root directory.
5. Initiate the read. The internal PROMmer LED on the PG will illuminate during the transfer; do not remove the card while the LED is on.
6. When the read completes, verify the byte count matches the card's nominal capacity (e.g., 262 144 bytes for a 256-KB card, 524 288 bytes for 512 KB).
7. Open the resulting .S5D file in STEP 5 and cross-check the FB, FC, OB, DB, DX, PB, and SB blocks against the rack's known inventory. Any checksum mismatch indicates a card-read error and the operation must be repeated.

Restoring (Writing Back) to a Blank Card

1. Insert a blank or fully erased 6ES5 374 card of equal or greater capacity. Larger cards are supported by the 948R; smaller cards will reject a too-large image at write time.
2. From STEP 5, select File → Memory Card → Write from PG to Card.
3. Enter program number 500, choose the saved .S5D file, and start the write. The PG will first verify the card is erasable (EEPROM) or, for EPROM, will require a pre-erased card and external UV eraser.
4. After the write, perform a verification read and compare the buffer against the source file. A verification mismatch indicates a defective card and the write must be repeated on a known-good card.

STEP 5 Version Compatibility Matrix

Redundancy State Transitions During Card Swap

Understanding the state machine helps the operator predict what the master's HMI will show during the swap:

1. Both CPUs RUN, REDUN = EH — fully redundant, single-fault tolerant.
2. Standby pulled — master transitions to solo state, typically reported as REDUN = E1 or master with no standby. Process is uninterrupted.
3. Standby reinserted with valid card, cold restart in progress — master remains solo; standby shows STOP with RUN LED flashing during the load.
4. Standby reaches RUN, handshakes master — system reverts to full redundancy (REDUN = EH) after a synchronisation interval (typically 1–2 redundancy cycles).

If step 4 does not complete, the standby is reporting a checksum or version mismatch. The operator must check the card content against the master using COM155H's Compare function before re-attempting synchronisation.

Troubleshooting Matrix

Verification Checklist After Card Swap

1. Both CPUs display steady RUN LED and steady REDUN LED.
2. STEP 5 AG Status shows REDUN = EH and identical cycle times on both CPUs within 5%.
3. COM155H Compare function reports zero differences between the two CPUs' code and data images.
4. Process I/O is responding; no Process Interrupt Lost events in the diagnostic buffer.
5. The original EEPROM card is stored in an ESD bag in a labelled enclosure, not left loose on the rack.
6. The PG backup file is stored on at least two physical media (PG hard disk and a network share or USB stick), with a date-stamped folder name.

Long-Term Storage and Migration Notes

EEPROM cards have a finite data-retention rating (typically 10 years for the 6ES5 374 family) and a limited write-cycle endurance (typically 10 000 cycles per sector). For long-term archival of a 155H program, the PG backup is the primary record; the EEPROM card is the in-rack operational copy and should be refreshed whenever the application is modified.

For migration off the 155H platform, Siemens documentation recommends a stepwise port to a SIMATIC S7-400H (e.g., CPU 412H or CPU 414H/417H) using the S5 to S7 converter tool, with the EEPROM image as the starting point. The S5 image must first be downloaded to a PG and converted to STEP 7 source/STL before it can be loaded into the S7-H system. The 948R's larger on-board memory simplifies this process because the entire program can be loaded into RAM for conversion without splitting the project across multiple memory cards.

Safety and Operational Caveats

• Always confirm the live master is healthy and the process is in a safe state before any card intervention.
• Never perform a cold restart on the active master of a live process — the cold restart drops outputs to zero and resets all DB initial values.
• Always maintain a verified PG backup of the EEPROM image before any field work.
• Label every card with the project name, date, and revision. A card left in a spare CPU without identification is a known cause of misapplication incidents.
• When replacing the standby CPU hardware, verify the new CPU's firmware revision is compatible with the COM155H version installed on the PG; firmware/code mismatches can prevent synchronisation even with a correct EEPROM image.