Siemens S5 CPU 948R Redundancy: Version Check & CPU Replacement

Overview

The SIMATIC S5-155H is Siemens' hot-standby redundant programmable controller built around the CPU 948R. Unlike a single-CPU S5-155U, the -155H chassis holds two CPU 948R modules that run in lockstep, with one acting as the master and the other as the reserve. Because the system transfers I/O state and process image at every cycle boundary, both CPUs must execute identical firmware (the same operating system release) and identical user program state at all times.

This reference covers:

• Identifying the CPU 948R variant (MLFB and revision level) installed in the system.
• Reading the operating system / firmware version using a PG (programming device) and STEP 5.
• Understanding the difference between an OS update and a revision level.
• Replacing a faulty CPU 948R in a redundant pair without causing a system stop.
• Resolving the common SI1 / SI2 interface faults that appear after a CPU swap.

Identifying Your CPU 948R

MLFB (Order Number) Variants

Siemens shipped the CPU 948R under several MLFBs over its production life. The operating system release is tied to the MLFB, but the revision level is the field-marked suffix that determines whether two CPUs are interchangeable in a redundant pair.

The MLFB is printed on the front label of the module and is read by STEP 5 during a PLC » Module Information request.

Reading the Revision Level

The revision level is not a part of the OS. It is a hardware/build identifier that Siemens etched or affixed on the module label and is denoted by an "X" in a specific field of the number label. In the field, you will typically see a string similar to:

6ES5 948-3UR13     X = 04

When ordering a replacement CPU, the matching MLFB is not sufficient: the revision level must equal that of the partner CPU, otherwise the redundancy handshake fails on the first cold restart. Siemens documents each revision level increment in the "Updates" entry for the specific MLFB on the Siemens support portal.

Memory Submodules

The user program and certain system data are stored on a plug-in memory submodule. The flash EPROM variant commonly cited in S5-155H documentation is:

• 6ES5 374-2KK21 — Flash EPROM submodule, 32 KB usable, with battery-buffered RAM area for retentive flags/timers/counters. Inserted in the front-panel submodule slot of the CPU 948R.

How to Check the Operating System / Firmware Version

Two independent methods are available, and field engineers should always cross-check one against the other.

Method 1 — STEP 5 Online » System Parameters

1. Connect the PG to the CPU 948R via the serial interface on the front panel (PG port, typically a 15-pin sub-D).
2. Start STEP 5 (S5-DOS / STEP 5 V7.x) and call PLC » Online » Module Information (German: Zielsystem » Baugruppeninformation).
3. Select the CPU slot. The dialog returns the operating system release string (for example, "EPR 02", "EPR 03", or a numeric code such as "948-3UR13 / FW 1.x").

The release string printed in this dialog corresponds to the OS burned into the firmware EPROM at the factory. It is fixed for the life of the module — the 948R has no user-loadable OS area (see the section on firmware upgrades below).

Method 2 » PLC Status Word via System Data

1. From the PG, call PLC » System Parameters or read system data word RS 0 / RS 1 from the system program area.
2. Compare the reported release to the value printed on the front-panel label of the CPU 948R.

Both CPUs of a redundant pair should report identical release strings. Any mismatch is logged in the CPU diagnostic buffer as a redundancy handshake fault.

Method 3 » Siemens Product Support Documents

1. Open Siemens Industrial Online Support.
2. Enter the full MLFB (for example, 6ES5948-3UR13) in the "Product Support / Enter search term" field and select the matching entry from the predictive dropdown.
3. Open the product page and select the Entries tab.
4. Set the Filter » Entry types dropdown to Updates.
5. Open the relevant Update entry. The document lists every firmware revision that has been issued for the MLFB, together with the corresponding revision-level marking.

The guided tour and online help icons (lower-right of every Siemens support page) walk through the same workflow with screenshots.

Why Revision Levels Must Match

The CPU 948R exchange protocol uses a challenge/response handshake at every standby cycle. The handshake contains the partner's release identifier and a small set of internal capability bits. If one CPU's revision level exposes a feature (for example, an extended diagnostic buffer or a new redundancy telegram) that the partner CPU does not implement, the system reacts in one of two ways:

• Soft refusal: the reserve CPU remains in STOP with a redundancy-link fault in the diagnostic buffer. The master CPU continues to run, but the system is no longer redundant.
• Hard refusal: both CPUs revert to STOP and a cold restart is forced. This is the failure mode that field engineers see as "never went to RUN" after a CPU swap.

Siemens documents several cases where mixed revision levels have run successfully, but these are exceptions, not the rule. Treat the matching rule as absolute unless Siemens has explicitly released a co-existence note for the combination in question.

Firmware Upgrade vs. Revision-Level Matching

This distinction is the source of most field confusion. For the S5 family:

Concretely, you cannot "downgrade" or "upgrade" the OS of a 948R in the field. The only available remedies when the partners do not match are:

1. Replace the mismatched CPU with one that has the same MLFB and the same revision level as its partner.
2. Replace both CPUs with a matched pair at a higher revision level, provided Siemens has released co-existence notes covering the existing memory submodules and I/O.

CPU Replacement Procedure in an S5-155H

The exact sequence is documented in the S5-155H Programmable Controller (CPU 948R) manual set, Volume 1/2 (especially Part I, Chapter 9) and Volume 2/2. The condensed field procedure is as follows:

1. Verify the failure. Read the diagnostic buffer of the suspect CPU. Note all fault codes and the redundancy state word.
2. Confirm redundancy state. From the PG, read the system state word to confirm the partner CPU is in RUN and is the active master. Never pull a CPU that is currently the master without first forcing a switchover.
3. Force a switchover (if necessary). Use PLC » Redundancy » Switchover in STEP 5, or set the corresponding force bit in the redundancy control word. Verify the partner takes over as master.
4. Power down the reserve slot. On a -155H chassis, only the slot containing the failed CPU is normally powered through the redundant power segment. Open the segment breaker.
5. Remove the failed CPU. Lift the module straight out. Preserve any plug-in memory submodules if they are to be migrated to the new CPU.
6. Insert the replacement CPU. Verify that the new CPU's MLFB and revision level match the partner. Insert the same memory submodules (or a freshly programmed pair).
7. Power the slot back up. The new CPU should perform a cold restart, read the user program from the submodule, and then enter the redundancy handshake.
8. Confirm handshake. From the PG, read the redundancy status. The reserve CPU should transition from START-UP → LINK-UP → REDUNDANT within one or two scan cycles.

Resolving SI1 and SI2 Interface Faults

The SI1 and SI2 LEDs on the CPU 948R front panel report the state of the two serial interfaces. SI1 is the default PG port; SI2 is the second (often unused) port. After a CPU replacement, one or both LEDs can show a fault condition.

Resolution steps:

1. Read the diagnostic buffer of the CPU. The fault code for an SI fault typically appears as "IF fault" in system data area RS 10-12.
2. If SI2 is unused, clear or disable the SI2 port assignment in the relevant STEP 5 DB (typically DB 1 / DX 0). Re-load the modified block.
3. For SI1, confirm the PG cable is connected to the master CPU and the baud rate / protocol parameters in PLC » Interface Parameters match the new CPU's physical port.
4. Cycle the PG connection: disconnect, wait 5 s, reconnect. Clear the fault in the diagnostic buffer.

If both SI1 and SI2 faults clear once the reserve CPU has been online for one full scan, the replacement was successful and the LED states will revert to normal automatically. If the LEDs remain lit after the reserve has been in REDUNDANT state, the residual DB configuration is the cause.

Working with Siemens Product Support

For any non-trivial replacement, file a Service Request via the Siemens support portal. The minimum information that Siemens requires is:

• MLFB of both CPUs (and the revision-level suffix if marked).
• MLFB and capacity of the memory submodules.
• CPU diagnostic buffer export (binary or text).
• Power supply and chassis type (for example, 6ES5 155-7LH or similar).
• Recent operator actions (last switchover, last modification, last fault).

Siemens will return either a written procedure, a hardware exchange order, or both. The exchange card carries the matching revision level and is shipped with a pre-programmed memory submodule if the original submodule is no longer available.

Troubleshooting Matrix

Comparison with Modern Redundant Controllers

For engineers transitioning from S5-155H to S7-400H, S7-1500R/H, or a third-party redundant platform, the workflow is similar in spirit but mechanically different. Modern controllers (for example, SIMATIC S7-400H with the H-CPU 417-4H, or the Allen-Bradley ControlLogix 5570 redundancy bundle) typically use field-loadable firmware kits (a "redundancy bundle" in ControlLogix terminology) that bundle matching firmware revisions for the controller, the redundancy module (RM), and the Ethernet modules. The principle is the same: always operate the redundant pair on a matched firmware bundle, and verify the bundle version via the controller's diagnostic or the vendor's compatibility tool rather than trusting the front-panel label alone.

Field-Proven Caveats

• Always read both CPUs' diagnostic buffers before any swap. A single fault entry is often the key to the entire replacement.
• Do not assume identical MLFBs imply identical revision levels. Siemens sometimes ships the same MLFB with a different revision during the production run.
• Memory submodules and CPUs age independently. A new CPU paired with a worn flash EPROM can fail to bring the partner into REDUNDANT state even when the revision levels match.
• Keep a cold-spare pair: a single 948R plus a pre-programmed memory submodule in a labelled, ESD-safe bag, ready to deploy.
• Document the revision level of the spare. When the spare is finally installed (sometimes years later), Siemens may have revised the matching rules; verify against the current Update entry on the support portal.

Verification Checklist After a CPU Replacement

1. Reserve CPU transitions through START-UP → LINK-UP → REDUNDANT within two scan cycles.
2. Diagnostic buffer of both CPUs is free of new fault entries for at least 10 minutes of operation.
3. PG connection to the master CPU is stable at the configured baud rate.
4. PG connection to the reserve CPU is reachable in STOP state (this confirms SI1 / port parameters).
5. Forced switchover (master ↔ reserve) succeeds without disturbing the process.
6. Second forced switchover (back to the original master) succeeds.
7. Process I/O update continues without glitches on both transitions.

FAQ