Troubleshooting S7-400 CPU Program Loss After Power Failure

1. Problem Overview

An S7-400 CPU (typical example 6ES7412-2XK05-0AB0 / S7-412-2 DP, but the same symptoms apply to S7-414, S7-416, S7-417, and the H/F variants) returns from a mains event with the user program gone, the hardware configuration missing, or both. The fault is intermittent, frequently observed after thunderstorm activity, and persists even when a three-phase 6 kVA UPS is in the line. The most common misdiagnosis is flash memory corruption; in the field, the actual root cause is almost always a depleted, missing, or reversed backup battery on the PS 405 / PS 407 power supply module combined with a UPS topology that does not mask short-duration sags.

2. S7-400 Memory Architecture and Backup Concept

Understanding where the program physically lives is mandatory before you can interpret the symptoms.

STEP 7 downloads the project from the engineering station into load memory. On every restart the CPU copies blocks from load memory into work memory. If work memory loses its content (battery dead, PS module pulled), the CPU cannot rebuild the project and the diagnostic buffer logs Stop by power failure with no successful warm restart. The project is still in load memory and can be re-copied once the battery is restored and a Reset (MRES) or a Cold restart is executed.

For the retentive area to survive a power outage, two things must be true: the battery must be present and healthy, and the engineer must have explicitly marked the M/T/C/DB bytes as retentive in HW Config → CPU properties → Retentive Memory. The default is zero bytes retentive, so production data often disappears even on healthy hardware.

3. Root Cause Matrix

4. Diagnostic Buffer Deep-Dive

Open the diagnostic buffer first — before touching hardware. In STEP 7 / TIA Portal: Online → Diagnostics → Diagnostic Buffer. The most relevant event IDs for a power-loss scenario are:

The smoking-gun signature is a 16#4301 "Power OFF" followed within seconds by 16#4940 "Battery exhausted" and 16#4915 "STOP due to power failure without battery". Whenever 16#4940 appears, the root cause is the backup cell, not the program.

5. Battery Hardware Inspection

With the rack de-energized at the upstream breaker but the PS module still inserted, remove the battery holder cover on the front of the PS 405 / PS 407.

5.1 Visual inspection

• Check for white lithium salt deposits around the holder — sign of venting.
• Inspect the spring contact and the +/− pads for green oxidation.
• Confirm the cable strain relief is intact and the connector is fully seated.

5.2 Open-circuit voltage measurement

5.3 Load test

A cell that reads 3.3 V unloaded but collapses below 2.0 V under the PS module's bias current has high internal resistance and is unfit for service. Apply a 1 mA load and re-measure; voltage must remain above 2.9 V for 60 s.

5.4 Replacement part numbers

6. Power Supply Module Diagnostics

The PS 405 (24 V DC input) and PS 407 (120/230 V AC; 120/230 V DC input) each contain three subsystems: AC/DC conversion, +5 V / +24 V regulator, and battery floating-charge circuit. Only the first two are protected by the UPS; the third is internal and can fail independently.

6.1 LED status

6.2 STEP 7 diagnostic flags

Under HW Config → PS module properties → Diagnostics, enable the following diagnostic interrupts:

• Primary voltage failure
• Battery backup failed
• 5 V / 24 V output failed

When enabled, these generate OB82 diagnostic-interrupt calls and write a 16#494x event to the diagnostic buffer the moment the fault occurs — well before the next mains dip causes a STOP.

7. UPS Topology and AC Power Quality

A 6 kVA three-phase UPS is a typical installation for a control cabinet, but only one topology actually masks sags and short interruptions: online double-conversion (VFI per IEC 62040-3). The other common topologies either pass the mains straight through or switch too slowly to be useful.

7.1 Topology comparison

7.2 AC sag duration reference

A standby UPS allows a 4-10 ms gap; the PS module can ride through it on its internal capacitor. A line-interactive UPS does the same. A storm-driven sag of 200 ms will, however, exhaust the PS capacitor long before the inverter picks up. For an S7-400 installation, only an online double-conversion UPS guarantees no interruption at the PS module input.

8. Load Memory and Flash Considerations

The symptom of "the program and HW config are gone" is often reported even when the load memory is intact. The reason: the work memory copy is empty (battery dead), so STEP 7 cannot find any blocks when it goes online. The load memory is non-volatile; the work memory is not.

8.1 Verify load memory is intact

1. Power the rack on a known-good feed with a fresh battery inserted.
2. From STEP 7, connect online and select PLC → Download User Program to Memory Card — if the menu is greyed out, the load memory is already populated.
3. Read the diagnostic buffer; if you see 16#4915 and 16#4301 but not 16#4920, the load memory survived and the issue is exclusively battery / RAM loss.

8.2 Verify the FEPROM end-of-life

Flash memory has a finite write endurance (typically 100k to 1M cycles per sector). A site that performs frequent online edits ("test changes") and writes the project to the CPU via Download to Target System can wear the FEPROM. The diagnostic buffer will eventually emit 16#49A0 ("FEPROM fault detected and corrected"), and from that point on you must assume the load memory is unreliable.

9. Step-by-Step Recovery Procedure

1. Verify and de-energize. Open the upstream breaker (the UPS keeps the socket alive, so this is mandatory). Confirm zero voltage with a CAT III multimeter.
2. Remove and inspect the backup battery. Measure the open-circuit voltage. Anything below 2.8 V is the failure point.
3. Clean the battery holder with isopropyl alcohol and a non-metallic brush. Re-tension the spring contact if it is loose.
4. Install a fresh 6ES7971-0BA00 (or 6ES7971-0BA01 for 20 A PS 407). Observe polarity: red lead to +, black lead to −.
5. Re-energize the rack. The BATTF LED must extinguish within 30 seconds. If it stays lit, the cable is reversed or the PS module's charge circuit is faulty.
6. Perform an MRES reset on the CPU: turn the mode switch to MRES, hold for 3 s, release, then turn back to MRES for another 3 s. The STOP LED flashes, then goes solid. This wipes work memory and forces a clean cold restart.
7. Reload the project from STEP 7: PLC → Download to Target System. Tick both User program and Hardware configuration.
8. Verify with PLC → Verify Project. STEP 7 compares the on-line blocks against the off-line project; any mismatch is flagged.
9. Switch the CPU to RUN and observe the diagnostic buffer. The first restart after a battery replacement is logged with 16#4302 "Power ON with backup" instead of 16#4303 "Power ON with backup failure".
10. Configure the diagnostic OBs (OB82, OB83, OB86, OB121, OB122) so that any future module, battery, or programming error is reported to the HMI instead of leaving the CPU silently in STOP.

10. Verification Checklist

• BATTF LED on PS 405 / PS 407 is OFF.
• BATF LED on the CPU is OFF.
• Diagnostic buffer contains no 16#4940 or 16#4915 after a forced 10-second outage test.
• Retentive M, T, C, and DB areas retain their last value through the same 10-second outage test.
• Online → Operating Mode shows RUN immediately after power return (warm restart, OB100).
• HW Config matches the physical rack — no 16#4921 "module not consistent" entries.
• No 16#49A0 "FEPROM fault detected and corrected" entries are accumulating over time.
• STEP 7 → Verify Project reports no differences.

11. Preventive Maintenance Program

• Annual battery replacement in any environment where the ambient exceeds 30 °C, or where the cabinet is near vibration sources. Service life halves roughly every 10 °C above 25 °C.
• Quarterly discharge test on the UPS batteries. A UPS that has never been loaded cannot prove that it will pick up during a real sag.
• Annual thermal imaging of the PS module. A hot-spot on the battery holder indicates rising contact resistance.
• Surge protective device (SPD) inspection after every named thunderstorm. IEC 61643-11 Type 2 SPDs have a mechanical flag that changes color when the MOV is end-of-life.
• Document the retentive memory map in the project folder. In a recovery scenario, the operator must know exactly which DBs hold recipe data, which M bits hold machine state, and which timers are critical for the warm restart sequence.
• Enable SITOP UPS1600 + BAT monitoring in front of the PS module if the site is exposed to chronic mains instability. The UPS1600 closes the gap that the PS 407 hold-up capacitor cannot — typically 5-15 minutes of CPU runtime on battery — long enough to ride out almost any storm.
• Restrict online edits on FEPROAM-burdened CPUs. Use the off-line / on-line compare workflow and limit Download to Target System to scheduled maintenance windows. This extends FEPROM endurance from years to decades.

12. Standards and Reference

• Retentive behavior after loss of power — S7-300 / S7-400 (Siemens)
• IEC 62040-3 — Uninterruptible power systems: method of specifying the performance and test requirements.
• IEC 61000-4-11 / -4-34 — Voltage dips, short interruptions and voltage variations immunity tests.
• IEC 61643-11 — Low-voltage surge protective devices.
• Siemens S7-400 CPU 412-2 DP manual, order number 6ES7412-2XK05-0AB0 — chapter on backup battery and retentive behavior.
• Siemens PS 405 / PS 407 power supply module manual — chapter on battery holder, BATTF LED, and floating-charge circuit.

Frequently Asked Questions