Siemens SIMATIC S7-400H User manual

Important Notes, Contents
Fault-Tolerant Systems in
Automation Engineering 1
S7-400H Installation Options 2
Getting Started 3
System and Operating Modes of
the S7-400H 4
Link-up and Update 5
Using I/O on the S7-400H 6
Communications 7
Configuring with STEP 7 8
Failure and Replacement of
Components During Operation 9
Modifications to the System while
in Operation 10
Appendices
Characteristic Values of
Redundant Programmable Logic
Controllers A
Separate Operation B
Converting from S5-H to S7-400H C
Differences between
Fault-Tolerant Systems and
Standard Systems D
Function Modules and
Communication Processors Used
on the S7-400H E
Glossary, Index
Edition 07/2000
A5E00068197-04
S7-400H Programmable
Controller
Fault-Tolerant Systems
Manual
This manual has the order number:
6ES7988-8HA10-8BA0
SIMATIC

Index-2 S7-400HProgrammable Controller Fault-Tolerant Systems
07/2000
!Danger
indicates that death, severe personal injury or substantial property damage will result if proper precau-
tions are not taken.
!Warning
indicates that death, severe personal injury or substantial property damage can result if proper precau-
tions are not taken.
!Caution
indicates that minor personal injury or property damage can result if proper precautions are not taken.
Note
draws your attention to particularly important information on the product, handling the product, or to a
particular part of the documentation.
Qualified Personnel
Only qualified personnel should be allowed to install and work on this equipment. Qualified persons are
defined as persons who are authorized to commission, to ground, and to tag circuits, equipment, and sys-
tems in accordance with established safety practices and standards.
Correct Usage
Note the following:
!Warning
This device and its components may only be used for the applications described in the catalog or the
technical descriptions, and only in connection with devices or components from other manufacturers
which have been approved or recommended by Siemens.
This product can only function correctly and safely if it is transported, stored, set up, and installed cor-
rectly, and operated and maintained as recommended.
Trademarks SIMATIC, SIMATIC HMIand SIMATIC NETare registered trademarks of SIEMENS AG.
Some of other designations used in these documents are also registered trademarks; the owner’s rights
may be violated if they are used by third parties for their own purposes.
Safety Guidelines
This manual contains notices which you should observe to ensure your own personal safety, as well as to
protect the product and connected equipment. These notices are highlighted in the manual by a warning
triangle and are marked as follows according to the level of danger:
We have checked the contents of this manual for agreement with the
hardwareand software described. Since deviations cannot be pre-
cluded entirely, we cannot guarantee full agreement. However, the
data in this manual are reviewed regularly and any necessary cor-
rections included in subsequent editions. Suggestions for improve-
ment are welcomed.
Disclaimer of Liability
Copyright Siemens AG 1998 All rights reserved
The reproduction, transmission or use of this document or its
contents is not permitted without express written authority.
Offenders will be liable for damages. All rights, including rights
createdby patent grant or registration of a utility model or design, are
reserved.
SiemensAG
Bereich Automatisierungs- und Antriebstechnik
Geschaeftsgebiet Industrie-Automatisierungssysteme
Postfach 4848, D- 90327 Nuernberg SiemensAG 1998
Technical data subject to change.
Siemens Aktiengesellschaft A5E00068197

iii
S7-400H Programmable Controllers, Fault-Tolerant Systems
A5E00068197-04
Important Notes
Purpose of the manual
The present manual is intended for persons involved in the areas of configuration,
commissioning and servicing of programmable logic control systems.
To help you get familiar with the product, we recommend that you start with the
example in Chapter 3. It shows you an easy method of getting started on the subject
of fault-tolerant systems.
Basic knowledge required
In order to understand the manual, you will need to be familiar with the general
principles of automation technology.
Knowledge of S7 programs is also a prerequisite; you can read more about S7
programs in the Programming with STEP 7 manual. As you need the STEP 7
standard software while you are configuring, you should also be familiar with running
the standard software, as explained in the STEP 7 User Manual.
Validity of the manual
The manual is valid for CPU 417-4H firmware version V2.1.0 or higher and option
package S7 H Systems, version V5.1 or higher.

Important Notes
iv S7-400HProgrammable Controllers, Fault-Tolerant Systems
A5E00068197-04
Online Help
In addition to the manual, detailed support on how to use the software is provided by
the online Help system integrated in the software.
The Help system can be accessed using a number of interfaces:
In the Help menu are a number of commands: Contents opens the Help index.
You will find help on fault-tolerant systems at Call Help on options packages,
configuring fault-tolerant systems.
How to Use Help provides detailed instructions on how to use online Help.
Context-sensitive Help provides information on the current context – for
example, on an open dialog box or an active window. It is accessed by means
of the “Help” button or F1.
Another form of context-sensitive Help is the status bar. A brief explanation of
each menu command is displayed here when you point the mouse pointer at
the menu command.
A brief explanation of the toolbar buttons is also shown when the mouse pointer
comes to rest for a short time on the buttons.
If you would like to read information from online Help in printed form, you can print
individual topics, books or the entire Help.
Feedback on documentation
We need your help to enable us to provide you and future users with optimum
documentation. Should you have any remarks on this manual or online Help , please
fill out the remarks form at the end of the manual and return it to the address shown
on the form. Please also indicate your personal opinion of the manual.
SIMATIC Training Center
We offer a number of courses to help you become familiar with the SIMATIC S7
programmable logic controller. Please contact your regional training center or the
central training center in D-90327 Nuremberg.
Phone: [phone].
Further support
The Nuremberg H/F Competence Center holds a special workshop on fault-tolerant
SIMATIC S7 programmable logic controllers. In addition, the H/F Competence Center
will provide on-site assistance with configuration, commissioning and other problems.
Further information can be obtained as follows:
Phone: [phone]
Fax: [phone]

Important Notes
v
S7-400HProgrammable Controllers, Fault-Tolerant Systems
A5E00068197-04
SIMATIC Customer Support Hotline
Available 24 hours a day, worldwide:
Johnson City
Nuremberg
Singapore
SIMATIC Hotline
Worldwide (Nuremberg)
Technical Support
(FreeContact)
Local time: Mon. through
Fri. 7.00 a.m. to 5.00 p.m.
Phone: [phone]
Fax: [phone]
E-mail: techsupport@
ad.siemens.de
GMT: +1:00
Worldwide (Nuremberg)
Technical Support
(subject to charge, with SIMATIC Card
only)
Local time: Mon. through
Fri. 0.00 a.m. to 12.00 p.m.
Phone: [phone]
Fax: [phone]
GMT: +01.00
Europe / Africa (Nuremberg)
Authorization
Local time: Mon. through
Fri. 7.00 a.m. to 5.00 p.m.
Phone: [phone]
Fax: [phone]
E-mail: authorization@
nbgm.siemens.de
GMT: +1:00
America (Johnson City)
Technical Support and
Authorization
Local time: Mon. through
Fri. 8 a.m. to 5.00 p.m.
Phone: [phone]
Fax: [phone]
E-mail: simatic.hotline@
sea.siemens.com
GMT: –5:00
Asia/Australia (Singapore)
Technical Support and
Authorization
Local time: Mon. through
Fri. 8.30 a.m. to 5.30 p.m.
Phone: [phone]
Fax: [phone]
E-mail: simatic.hotline@
sae.siemens.com.sg
GMT: +8:00
The SIMATIC Hotline languages are normally German and English; French, Italian and Spanish are also spoken on
the Authorization Hotline.

Important Notes
vi S7-400HProgrammable Controllers, Fault-Tolerant Systems
A5E00068197-04
SIMATIC Customer Support Online Services
SIMATIC Customer Support provides you with comprehensive additional information
in SIMATIC products by means of its online services:
You can obtain up–to–date information
– on the Internet at http://www.ad.siemens.de/simatic
Current product information leaflets and downloads which you may find useful
for your product:
– on the Internet at http://www.ad.siemens.de/simatic–cs
– From our Bulletin Board System (BBS) in Nuremberg ( SIMATIC Customer
Support Mailbox) by dialing [phone].
To dial the mailbox, use a modem having up to V.34 (28.8 kbps) and set its
parameters as follows: 8, N, 1, ANSI, or dial in using ISDN (x.75, 64 kbps).
You can find your local point–of–contact for Automation & Drives in our contacts
database
– on the Internet at
http://www3.ad.siemens.de/partner/search.asp

vii
S7-400H Programmable Controller Fault-Tolerant Systems
A5E00068197-04
Contents
1 Fault-Tolerant Systems in Automation Engineering 1-1. . . . . . . . . . . . . . . . . . . . . . .
1.1 Redundant Programmable Logic Controllers in the SIMATIC Series 1-2. . . .
1.2 Increasing System Availability 1-4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2 S7-400H Installation Options 2-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1 Base System of the S7-400H 2-3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 I/O for the S7-400H 2-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3 Communication 2-6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.4 Configuration and Programming Applications 2-7. . . . . . . . . . . . . . . . . . . . . . . .
2.5 User Program 2-8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.6 Documentation 2-9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3 Getting Started 3-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1 Requirements 3-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 Configuring Hardware and Starting Up the S7-400H 3-3. . . . . . . . . . . . . . . . . .
3.3 Examples of Fault-Tolerant System Response in the Event of Faults 3-5. . .
4 System and Operating Modes of the S7-400H 4-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1 Introduction 4-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2 System Modes of the S7-400H 4-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3 Operating Modes of the CPUs 4-6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.1 STOP Operating Mode 4-7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.2 STARTUP Operating Mode 4-8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.3 LINK-UP and UPDATE Operating Modes 4-8. . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.4 RUN Operating Mode 4-9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.5 HOLD Operating Mode 4-10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.6 ERROR-SEARCH Operating mode 4-11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.4 Time Response 4-12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5 Link-up and Update 5-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.1 Effects of Link-up and Update 5-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2 Functional Sequence of Link-up and Update 5-3. . . . . . . . . . . . . . . . . . . . . . . .
5.2.1 Process of Link-up 5-7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2.2 Process of Updating 5-9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2.3 Switch to CPU with modified configuration 5-12. . . . . . . . . . . . . . . . . . . . . . . . . .
5.2.4 Block Link-up and Update 5-13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3 Time Monitoring 5-15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.1 Time Behavior 5-17. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2 Determination of the Monitoring Times 5-18. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.3 Influences on the Time Behavior 5-26. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.4 Performance Values for Link-up and Update 5-26. . . . . . . . . . . . . . . . . . . . . . . .

Contents
viii S7-400H Programmable Controller Fault-Tolerant Systems
A5E00068197-04
5.4 Special Features during Link-up and Update 5-28. . . . . . . . . . . . . . . . . . . . . . . .
6 Using I/O on the S7-400H 6-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1 Introduction 6-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.2 Using a Single-Channel, One-Sided I/O 6-3. . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.3 Using Single-Channel, Switched I/O 6-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.4 Connecting a Redundant I/O 6-10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7 Communications 7-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.1 Fundamentals and Basic Concepts 7-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2 Suitable Networks 7-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.1 Industrial Ethernet 7-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.2 PROFIBUS 7-6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.3 Supported Communication Services 7-7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.4 Communications via Fault-Tolerant S7 Connections 7-7. . . . . . . . . . . . . . . . . .
7.4.1 Communications between Fault-Tolerant Systems 7-9. . . . . . . . . . . . . . . . . . .
7.4.2 Communications between Fault-Tolerant Systems and a
Fault-Tolerant CPU 7-11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.4.3 Communications between Fault-Tolerant Systems and PCs 7-12. . . . . . . . . . .
7.5 Communications via S7 Connections 7-13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.5.1 Communications via S7 Connections – One-Sided Mode 7-13. . . . . . . . . . . . .
7.5.2 Communications over Redundant S7 Connections 7-15. . . . . . . . . . . . . . . . . . .
7.5.3 Communications via a Point-to-Point CP on the ET200M 7-16. . . . . . . . . . . . .
7.5.4 Random Connection with Single-channel Systems 7-17. . . . . . . . . . . . . . . . . . .
8 Configuring with STEP 7 8-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.1 Installing the Options Package 8-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.2 Configuring with STEP 7 8-3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.2.1 Rules for H Station Equipment 8-3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.2.2 Configuring Hardware 8-4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.2.3 Configuring Networks 8-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.3 Programming Device Functions in STEP 7 8-6. . . . . . . . . . . . . . . . . . . . . . . . . .
9 Failure and Replacement of Components During Operation 9-1. . . . . . . . . . . . . . .
9.1 Failure and Replacement of Components in Central Racks
and Expansion Racks 9-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.1.1 Failure and Replacement of a Central Processing Unit CPU 417-4H 9-3. . . .
9.1.2 Failure and Replacement of a Power Supply Module 9-5. . . . . . . . . . . . . . . . .
9.1.3 Failure and Replacement of an Input/Output or Function Module 9-6. . . . . . .
9.1.4 Failure and Replacement of a Communication Processor 9-7. . . . . . . . . . . . .
9.1.5 Failure and Replacement of a Synchronization Submodule
or Fiber-Optic Cable 9-8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.1.6 Failure and Replacement of an IM 460 and IM 461 Interface Module 9-11. . .
9.2 Failure and Replacement of Components of the Distributed I/O 9-12. . . . . . . .
9.2.1 Failure and Replacement of a PROFIBUS-DP Master 9-13. . . . . . . . . . . . . . . .
9.2.2 Failure and Replacement of a redundant PROFIBUS-DP
Interface Module 9-14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents
ix
S7-400H Programmable Controller Fault-Tolerant Systems
A5E00068197-04
9.2.3 Failure and Replacement of a PROFIBUS-DP Slave 9-15. . . . . . . . . . . . . . . . .
9.2.4 Failure and Replacement of PROFIBUS-DP Cables 9-16. . . . . . . . . . . . . . . . . .
10 Modifications to the System while in Operation 10-1. . . . . . . . . . . . . . . . . . . . . . . . . . .
10.1 Possible Hardware Modifications 10-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.2 Adding Components in PCS7 10-6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.2.1 PCS7, Step 1: Modification of Hardware 10-7. . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.2.2 PCS7, Step 2: Offline Modification of the Hardware Configuration 10-8. . . . . .
10.2.3 PCS7, Step 3: Stopping the Standby CPU 10-9. . . . . . . . . . . . . . . . . . . . . . . . . .
10.2.4 PCS7, Step 4: Loading new Hardware Configuration in
the Standby CPU 10-10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.2.5 PCS7, Step 5: Switch to CPU with modified configuration 10-11. . . . . . . . . . . . .
10.2.6 PCS7, Step 6: Transition to the Redundant System Mode 10-13. . . . . . . . . . . . .
10.2.7 PCS7, Step 7: Changing and Loading User Program 10-14. . . . . . . . . . . . . . . . .
10.2.8 Use of free channels on an existing module 10-15. . . . . . . . . . . . . . . . . . . . . . . . .
10.3 Removing Components in PCS7 10-16. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.3.1 PCS7, Step I: Offline Modification of the Hardware Configuration 10-17. . . . . .
10.3.2 PCS7, Step II: Changing and Loading User Program 10-18. . . . . . . . . . . . . . . . .
10.3.3 PCS7, Step III: Stopping the Standby CPU 10-19. . . . . . . . . . . . . . . . . . . . . . . . .
10.3.4 PCS7, Step IV: Loading new Hardware Configuration in
the Standby CPU 10-19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.3.5 PCS7, Step V: Switch to CPU with modified configuration 10-20. . . . . . . . . . . . .
10.3.6 PCS7, Step VI: Transition to the Redundant System Mode 10-22. . . . . . . . . . . .
10.3.7 PCS7, Step VII: Modification of Hardware 10-23. . . . . . . . . . . . . . . . . . . . . . . . . .
10.4 Adding Components in STEP 7 10-24. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.4.1 STEP 7, Step 1: Modification of Hardware 10-25. . . . . . . . . . . . . . . . . . . . . . . . . .
10.4.2 STEP 7, Step 2: Offline Modification of the Hardware Configuration 10-26. . . .
10.4.3 STEP 7, Step 3: Expanding and Loading Organization Blocks 10-26. . . . . . . . .
10.4.4 STEP 7, Step 4: Stopping the Standby CPU 10-27. . . . . . . . . . . . . . . . . . . . . . . .
10.4.5 STEP 7, Step 5: Loading new Hardware Configuration in
the Standby CPU 10-27. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.4.6 STEP 7, Step 6: Switch to CPU with modified configuration 10-28. . . . . . . . . . .
10.4.7 STEP 7, Step 7: Transition to the Redundant System Mode 10-30. . . . . . . . . . .
10.4.8 STEP 7, Step 8: Changing and Loading User Program 10-31. . . . . . . . . . . . . . .
10.4.9 Use of free channels on an existing module 10-32. . . . . . . . . . . . . . . . . . . . . . . . .
10.5 Removing Components in STEP 7 10-33. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.5.1 STEP 7, Step I: Offline Modification of the Hardware Configuration 10-34. . . . .
10.5.2 STEP 7, Step II: Changing and Loading User Program 10-35. . . . . . . . . . . . . . .
10.5.3 STEP 7, Step III: Stopping the Standby CPU 10-36. . . . . . . . . . . . . . . . . . . . . . . .
10.5.4 STEP 7, Step IV: Loading new Hardware Configuration
in the Standby CPU 10-36. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.5.5 STEP 7, Step V: Switch to CPU with modified configuration 10-37. . . . . . . . . . .
10.5.6 STEP 7, Step VI: Transition to the Redundant System Mode 10-39. . . . . . . . . .
10.5.7 STEP 7, Step VII: Modification of Hardware 10-40. . . . . . . . . . . . . . . . . . . . . . . . .
10.5.8 STEP 7, Step VIII: Modifying and loading organization blocks 10-41. . . . . . . . .
10.6 Changing the CPU Parameters 10-42. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.6.1 Step A: Changing the CPU Parameters Offline 10-43. . . . . . . . . . . . . . . . . . . . . .
10.6.2 Step B: Stopping the Standby CPU 10-43. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.6.3 Step C: Loading new Hardware Configuration in the Standby CPU 10-44. . . . .
10.6.4 Step D: Switch to CPU with modified configuration 10-45. . . . . . . . . . . . . . . . . . .

Contents
xS7-400H Programmable Controller Fault-Tolerant Systems
A5E00068197-04
10.6.5 Step E: Transition to the Redundant System Mode 10-46. . . . . . . . . . . . . . . . . . .
10.7 Changing the Memory Components of the CPU 10-47. . . . . . . . . . . . . . . . . . . . .
10.7.1 Expand the main and/or load memory 10-47. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.7.2 Changing the type of load memory 10-49. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.8 Perform operating system update 10-51. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A Characteristic Values of Redundant Programmable Logic Controllers A-1. . . . . .
A.1 Basic Concepts A-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2 Comparison of MTBFs for Selected Configurations A-4. . . . . . . . . . . . . . . . . .
A.2.1 System Configurations With Central I/O A-4. . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.2 System Configurations With Distributed I/O A-6. . . . . . . . . . . . . . . . . . . . . . . . .
A.2.3 Comparison of System Configurations With Standard and
Fault-Tolerant Communications A-8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B Separate Operation B-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C Converting from S5-H to S7-400H C-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.1 General Information C-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.2 Configuration, Programming and Diagnostics C-2. . . . . . . . . . . . . . . . . . . . . . .
D Differences between Fault-Tolerant Systems and Standard Systems D-1. . . . . . .
E Function Modules and Communication Processors Used on the S7-400H E-1. .
Glossary Glossary-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Index Index-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1-1
S7-400H Programmable Controller Fault-Tolerant Systems
A5E00068197-04
Fault-Tolerant Systems in Automation
Engineering
This chapter contains an introduction to redundant and fault-tolerant programmable
logic controllers.
In Section You Will Find On Page
1.1 Redundant Programmable Logic Controllers in the SIMATIC
Series 1-2
1.2 Increasing System Availability 1-4
1

Fault-Tolerant Systems in Automation Engineering
1-2 S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
1.1 Redundant Programmable Logic Controllers in the SIMATIC
Series
Economic, and thus resource-sparing and low-pollution production can be
achieved nowadays in all branches of industry only by employing a high degree of
automation. At the same time there is a demand for fail-safe programmable logic
controllers with the greatest degree of distribution possible.
Redundant programmable logic controllers from Siemens have proved themselves
in operation and thousands are in service.
Perhaps you are already familiar with one of the fault-tolerant systems such as the
SIMATIC S5-115H and S5-155H, or the fail-safe S5-95F and S5-115F systems.
The S7-400H is the latest fault-tolerant PLC and we will be presenting it on the
pages that follow. It is a member of the SIMATIC S7 system family, meaning that
you can fully avail yourself of all the advantages of the SIMATIC S7.
Operating objectives of Redundant PLCs
Redundant programmable logic controllers are used in practice with the aim of
achieving a higher degree of availability or fault tolerance.
Redundant programmable logic
controllers, for example:
Fault-tolerant 1-out-of-2 systems
Objective:
Reduce the probability of losses of
production by switching to a standby
system
Fail-safe 2-out-of-2-systems
Objective:
Protect life, the environment and
investments by safely
disconnecting to a secure ”off”
position
Figure 1-1 Operating Objectives of Redundant Programmable Logic Controllers
Note the difference between fault-tolerant systems and fail-safe systems. The
S7-400H is a fault-tolerant programmable logic controller that can be used only
with additional means for controlling processes relevant to safety.

Fault-Tolerant Systems in Automation Engineering
1-3
S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
Why do we have fault-tolerant programmable logic controllers?
The objective of using high-availabilty programmable logic controllers is a reduction
of losses of production. It does not matter whether the losses are caused by an
error or as a result of maintenance work.
The higher the costs of a stoppage, the more worthwhile it is to use a fault-tolerant
system. The generally higher investment costs of fault-tolerant systems are quickly
compensated by the avoidance of losses of production.
Software redundancy
In a large number of applications, requirements in respect of the quality of
redundancy or the number of system sections that necessitate redundant PLCs
are not high enough to warrant the use of a specific fault-tolerant system.
Frequently, simple software mechanisms are sufficient to allow continuation of a
failed control task on a substitute system in the event of an error.
The “SIMATIC S7 Software Redundancy” options software can run on S7-300 and
S7-400 standard systems to control processes that tolerate transfer times to a
substitute system within seconds, such as water works, water treatment systems
or traffic flows.

Fault-Tolerant Systems in Automation Engineering
1-4 S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
1.2 Increasing System Availability
The S7-400H programmable logic controller meets these high requirements for
availability, intelligence and distribution that are required of state-of-the-art
programmable logic controllers. Further, it features all the functions for acquiring
and preparing process data and for controlling, regulating and monitoring units and
systems.
System-wide universality
The S7-400H programmable logic controller and all other SIMATIC components,
such as the SIMATIC PCS7 control system, are harmonized. Total system
universality, from the supervisory console to the sensors and actuators, is a matter
of course and guarantees maximum system performance.
Supervisory console
Programmable logic
controllers
Distributed I/O
Sensors/
actuators
S7-400
S7-400H
system
S7-300
ET 200M
ET 200B ET 200L ET 200X
Single-user
OS Report printer
Server Server
S7-400 with
CPU 417-4H *)
Client Client Engineering
system
Bus link DP/PA
*) not possible with firmware version 2.0.0
LAN (redundant)
PROFIBUS DP (redundant)
Figure 1-2 Universal Automation Solutions with SIMATIC
Graduated availability by duplicating components
The S7-400H is designed with redundancy so that it remains available at all
events. This means that all major components are duplicated.
The components that are duplicated as a matter of policy are the central
processing unit (CPU), the power supply and the hardware for interconnecting the
two central processing units.
You can decide for yourself whether you wish to duplicate more components for
the process you are going to automate and thus enhance their availability.

Fault-Tolerant Systems in Automation Engineering
1-5
S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
Redundant nodes
Redundant nodes represent the fault tolerance of systems with redundant
components. The independence of a redundant node is given when the failure of a
component within the node does not result in reliability constraints in other nodes
or in the entire system.
The availability of the entire system can be illustrated in a simple manner by
means of a block diagram. With a 1-out-of-2 system, one component of the
redundant node may fail without impairing the operability of the overall system. The
weakest link in the chain of redundant nodes determines the availability of the
overall system.
Without malfunction (Figure 1-3).
PS
PS CPU IM 153-2
Bus
Bus
Redundant nodes with 1-out-of-2 redundancy
CPU IM 153-2 SM
Figure 1-3 Example of Redundancy in a Network without Malfunction
With malfunction
In Figure 1-4, one component may fail per redundant node without the functionality
of the overall system being impaired.
CPU CP
CP
CPU
CPUCPU CP
CP
Bus
Bus
Figure 1-4 Example of Redundancy in a 1-out-of-2 System with Malfunction
Failure of a redundant node (total failure)
In Figure 1-5, the entire system is no longer operable since both subcomponents
have failed in a 1-out-of-2 redundant node (total failure).
PS
PS CPU IM 153-2
Bus
Bus
Redundant nodes with 1-out-of-2 redundancy
CPU IM 153-2 SM
Figure 1-5 Example of Redundancy in a 1-out-of-2 System with Total Failure

Fault-Tolerant Systems in Automation Engineering
1-6 S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04

2-1
S7-400H Programmable Controller Fault-Tolerant Systems
A5E00068197-04
S7-400H Installation Options
The first part of the description starts with the basic configuration of the
fault-tolerant S7-400H programmable controller and the components making up
the S7-400H base system. We then describe the hardware components with which
you can expand this base system.
The second part describes the software applications with which you can configure
and program the S7-400H. In addition, a description is given of the additions and
extensions, compared to the S7-400 standard system, that you will require for
programming your user program in order to be able to react specifically to the
properties of the S7-400H that enhance availability.
In Section You Will Find On Page
2.1 Base System of the S7-400H 2-3
2.2 I/O for the S7-400H 2-5
2.3 Communications 2-6
2.4 Configuration and Programming Applications 2-7
2.5 User Program 2-8
2.6 Documentation 2-9
2

S7-400H Installation Options
2-2 S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
Figure 2-1 shows an example of the configuration of an S7-400H with common
distributed I/O and a connection to a redundant system bus. On the next few
pages we will describe step by step the hardware and software components
necessary for configuring and operating the S7-400H.
ET 200M distributed I/O
S7-400H PLC
redundant system bus (PROFIBUS or Ethernet)
Operator station
(system visualization)
ET 200M distributed I/O
redundant PROFIBUS-DP
Figure 2-1 Overview
Further information
The components of the S7-400 standard system are also used in the fault-tolerant
S7-400H programmable logic controller. A detailed description of all the hardware
components of the S7-400 and S7-400H may be found in the Reference Manual
S7-400, M7-400 Programmable Controllers, Module Specifications .
The same rules as for a standard S7-400 system apply to designing the user
program and the usage of blocks for the fault-tolerant S7-400H programmable
logic controller. Please take note of the descriptions in the Programming with
STEP 7 manual and in the System Software for S7-300/400, System and Standard
Functions Reference Manual.

S7-400H Installation Options
2-3
S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
2.1 Base System of the S7-400H
Hardware of the Base System
By base system of the S7-400H we mean the minimum configuration of the
S7-400H. The base system consists of all the requisite hardware components that
make up the fault-tolerant control system. Figure 2-2 shows the components in the
installation.
You can upgrade the base system by means of standard modules from the
S7-400. There are restrictions in the case of the function and communication
processors (see appendix E).
4 synchro-
nization
submodules
2 PS 2 CPUs 2 fiber-optic cables
Rack UR2H S7-400H base system
Rack 0 Rack 1
Figure 2-2 Hardware of the S7-400H Base System
CPU 417-4 H central processing unit
At the heart of the S7-400H are the two central processing units CPU 417-4H.
Setting of the synchronization submodules, which have to be plugged into the
CPU, defines the rack numbers. In the following we will refer to the CPU in rack 0
as CPU 0,and to the CPU in rack 1 as CPU 1.

S7-400H Installation Options
2-4 S7-400HProgrammable Controller Fault-Tolerant Systems
A5E00068197-04
Mounting rack for S7-400H
We recommend you the UR2-H mounting rack for the S7-400H. The mounting rack
makes it possible to configure two separate subsystems, each containing nine
slots, and is suitable for installation in 19” cabinets.
Alternatively, you can also configure the S7-400H on two separate mounting racks.
Two mounting racks, the UR1 and UR2, are available for this purpose.
Power supply
As a power supply, you will require for each CPU 417-4 H – or, to be more precise,
for each of the two subsystems of the S7-400H – a power supply module from the
standard range of the S7-400.
Power supply modules for rated input voltages of 24 V DC and 120/230 V AC are
available with input powers of 4, 10 and 20 A.
To enhance the availability of the power supply, you can also use two redundant
power supplies in each subsystem. In this case you should use the PS 407 10 A R
power supply module for rated voltages of 120/230 V AC with an output power of
10 A.
Synchronization submodules
The synchronization submodules are used to connect the two central processing
units. They are installed in the central processing units and interconnected by
means of fiber-optic cables.
Two synchronization submodules have to be inserted in each CPU.
Fiber-optic cables
The fiber-optic cables are inserted into the synchronization submodules and form
the physical connection (redundant link) between the two central processing units.
You will find further information on handling and adjusting the synchronization
submodules and the fiber-optic cables in the S7-400, M7-400 Programmable
Controllers, Module Specifications Reference Manual and in the S7-400, M7-400
Programmable Controllers, Hardware and Installation Manual.