11 10 9 8 7 6 5 4 3 2 __________________________________________________________________________________________________________________________________________________________ 1

(1)

SIMATIC S7-400 S7-400 Automation System, CPU Specifications

______________

Introduction 1

Structure of a CPU 41x 2

Special functions of a

CPU 41x 3

Communication 4

PROFIBUS DP 5

PROFINET 6

Consistent Data 7

Memory concept 8

Cycle and Response Times

of the S7-400 9

Technical specifications 10

IF 964-DP interface module 11 SIMATIC

S7-400

S7-400 Automation System, CPU Specifications

Manual

This manual is part of the documentation package with the order number 6ES7498-8AA05-8BA0

长沙工控帮教育科技有限公司整理

(2)

This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger.

Danger

indicates that death or severe personal injury will result if proper precautions are not taken.

Warning

indicates that death or severe personal injury may result if proper precautions are not taken.

Caution

with a safety alert symbol, indicates that minor personal injury can result if proper precautions are not taken.

Caution

without a safety alert symbol, indicates that property damage can result if proper precautions are not taken.

Notice

indicates that an unintended result or situation can occur if the corresponding information is not taken into account.

If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage.

Qualified Personnel

The device/system may only be set up and used in conjunction with this documentation. Commissioning and operation of a device/system may only be performed by qualified personnel. Within the context of the safety notes in this documentation qualified persons are defined as persons who are authorized to commission, ground and label devices, systems and circuits in accordance with established safety practices and standards.

Prescribed Usage

Note the following:

Warning

This device may only be used for the applications described in the catalog or the technical description and only in connection with devices or components from other manufacturers which have been approved or recommended by Siemens. Correct, reliable operation of the product requires proper transport, storage, positioning and assembly as well as careful operation and maintenance.

Trademarks

All names identified by ® are registered trademarks of the Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.

Disclaimer of Liability

We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions.

Siemens AG Automation and Drives Postfach 48 48 90437 NÜRNBERG GERMANY

Order No.: A5E00850746-02

Technical data subject to change

(3)

1 Introduction... 1-1 2 Structure of a CPU 41x... 2-1 2.1 Control and display elements of the CPUs ... 2-1 2.2 Monitoring functions of the CPU ... 2-9 2.3 Status and error displays ... 2-12 2.4 Mode selector switch ... 2-15 2.5 Running a memory reset... 2-17 2.6 Cold start / Warm restart / Hot restart... 2-19 2.7 Structure and Functions of the Memory Cards... 2-20 2.8 Use of the Memory Cards... 2-22 2.9 Multipoint Interface (MPI)... 2-24 2.10 PROFIBUS DP Interface... 2-26 2.11 PROFINET interface ... 2-27 2.12 Overview of the parameters for the S7-400 CPUs ... 2-28 3 Special functions of a CPU 41x ... 3-1 3.1 Multicomputing... 3-1 3.1.1 Fundamentals ... 3-1 3.1.2 Special Features at Multicomputing... 3-2 3.1.3 Multicomputing interrupt... 3-4 3.1.4 Configuring and programming multicomputing mode... 3-4 3.2 System modifications during operation... 3-5 3.2.1 Basics... 3-5 3.2.2 Hardware requirements ... 3-6 3.2.3 Software requirements... 3-7 3.2.4 Permitted system modifications ... 3-7 3.3 Resetting the CPU to the factory state ... 3-9 3.4 Updating the firmware without a memory card ... 3-11 3.5 Reading out service data ... 3-12 4 Communication... 4-1 4.1 interfaces... 4-1 4.1.1 Multi-Point Interface (MPI) ... 4-1 4.1.2 PROFIBUS DP... 4-2 4.1.3 PROFINET... 4-4 4.2 Communication services... 4-6 4.2.1 Overview of communication services ... 4-6

(4)

Table of contents

S7-400 Automation System, CPU Specifications

iv Manual, 11/2006, A5E00850746-02

4.2.3 OP communication... 4-7 4.2.4 S7 basic communication ... 4-8 4.2.5 S7 communication... 4-9 4.2.6 Global data communication... 4-10 4.2.7 Routing... 4-12 4.2.8 Time synchronization ... 4-15 4.3 SNMP network protocol ... 4-17 4.4 Open Communication Via Industrial Ethernet... 4-18 4.5 S7 connections... 4-22 4.5.1 Communication path of an S7 connection ... 4-22 4.5.2 Assignment of S7 connections... 4-22 4.6 Communication performance... 4-25 4.7 Web server... 4-28 4.7.1 Properties of the web server ... 4-28 5 PROFIBUS DP ... 5-1 5.1 CPU 41x as DP master / DP slave ... 5-1 5.1.1 Overview ... 5-1 5.1.2 DP address areas of 41x CPUs ... 5-1 5.1.3 CPU 41x as PROFIBUS DP master ... 5-2 5.1.4 Diagnostics of the CPU 41x as DP master ... 5-6 5.1.5 CPU 41x as DP slave... 5-10 5.1.6 Diagnostics of the CPU 41x as DP slave... 5-15 5.1.7 CPU 41x as DP slave: Station statuses 1 to 3... 5-20 5.1.8 Direct Data Exchange ... 5-25 5.1.8.1 Principle of direct data exchange... 5-25 5.1.8.2 Diagnostics in direct data exchange ... 5-26 5.1.9 Isochrone mode ... 5-28 6 PROFINET ... 6-1 6.1 Introduction ... 6-1 6.2 PROFINET IO and PROFINET CBA ... 6-2 6.3 PROFINET IO Systems ... 6-4 6.4 Blocks in PROFINET IO... 6-6 6.5 System status lists for PROFINET IO ... 6-8 7 Consistent Data ... 7-1 7.1 Basics... 7-1 7.2 Consistency for communication blocks and functions ... 7-2 7.3 Consistent Reading and Writing of Data from and to DP Standard Slaves/IO Devices ... 7-2 8 Memory concept ... 8-1 8.1 Overview of the memory concept of S7-400 CPUs ... 8-1 9 Cycle and Response Times of the S7-400... 9-1 9.1 Cycle time... 9-1 9.2 Cycle Time Calculation ... 9-3 9.3 Different cycle times... 9-6

(5)

Table of contents

9.4 Communication Load ... 9-8 9.5 Reaction Time... 9-11 9.6 Calculating cycle and reaction times ... 9-17 9.7 Examples of Calculating the Cycle Time and Reaction Time... 9-18 9.8 Interrupt Reaction Time ... 9-21 9.9 Example: Calculating the Interrupt Reaction Time ... 9-23 9.10 Reproducibility of Time-Delay and Watchdog Interrupts ... 9-24 9.11 CBA response times ... 9-25 10 Technical specifications... 10-1 10.1 Technical Specifications of the CPU 412-1; (6ES7412-1XJ05-0AB0)... 10-1 10.2 Technical Specifications of the CPU 412-2; (6ES7412-2XJ05-0AB0)... 10-8 10.3 Technische Daten der CPU 414-2; (6ES7414-2XK05-0AB0) ... 10-16 10.4 Technical specifications of the CPU 414-3; (6ES7414-3XM05-0AB0)... 10-24 10.5 Technical Specification of the CPU 414-3 PN/DP; (6ES7414-3EM05-0AB0) ... 10-32 10.6 Technical Specifications for the CPU 416-2 (6ES7416-2XN05-0AB0) and CPU 416F-2

(6ES7416-2FN05-0AB0)... 10-42 10.7 Technical Specifications for the CPU 416-3 (6ES7416-3XR05-0AB0) and CPU 416F-3

(6ES7416-3FR05-0AB0)... 10-50 10.8 Technical Specifications for the CPU416-3 PN/DP; (6ES7416-3ER05-0AB0) and CPU

416F-3 PN/DP (6ES7416-3FR05-0AB0) ... 10-58 10.9 Technical Specifications for the CPU 417-4 (6ES7417-4XT05-0AB0)... 10-69 10.10 Technical specifications of the memory cards... 10-77 11 IF 964-DP interface module... 11-1 11.1 Using the IF 964-DP interface module... 11-1 11.2 Technical specifications ... 11-3 Index... Index-1

Tables

Table 2-1 LEDs on the CPUs... 2-6 Table 2-2 Faults/errors and the responses of the CPU ... 2-9 Table 2-3 Possible states of the RUN and STOP LEDs ... 2-12 Table 2-4 Possible states of the INTF, EXTF and FRCE LEDs... 2-12 Table 2-5 Possible states of the BUS1F, BUS2F and BUS5F LEDs... 2-13 Table 2-6 Possible states of the IFM1F and IFM2F LEDs... 2-13 Table 2-7 Possible states of the LINK and RX/TX LEDs ... 2-14 Table 2-8 Mode selector switch settings... 2-15 Table 2-9 Security classes of an S7-400 CPU... 2-16

(6)

Table of contents

vi Manual, 11/2006, A5E00850746-02

Table 2-10 MPI parameters and IP address following memory reset ... 2-18 Table 2-11 Types of Memory Card... 2-22 Table 3-1 CPU properties in the factory settings ... 3-9 Table 3-2 LED patterns ... 3-10 Table 4-1 Communication services of the CPUs ... 4-6 Table 4-2 Availability of connection resources... 4-7 Table 4-3 SFCs for S7 Basic Communication... 4-8 Table 4-4 SFBs for S7 Communication... 4-10 Table 4-5 SFCs for Global Data Communication... 4-11 Table 4-6 Message frame lengths and "local_device_id" parameter ... 4-20 Table 5-1 41x CPUs (MPI/DP interface as PROFIBUS DP)... 5-1 Table 5-2 41x CPUs (MPI/DP interface and DP module as PROFIBUS DP)... 5-2 Table 5-3 Meaning of the "BUSF" LED of the CPU 41x as DP master... 5-6 Table 5-4 Reading the diagnostic data with STEP 7... 5-7 Table 5-5 Diagnostic addresses for the DP master and DP slave... 5-9 Table 5-6 Event detection of the CPUs 41x as DP master ... 5-9 Table 5-7 Evaluation of RUN-STOP transitions of the DP slave in the DP master ... 5-10 Table 5-8 Configuration example for the address areas of the transfer memory ... 5-12 Table 5-9 Meaning of the "BUSF" LEDs of the CPU 41x as DP slave ... 5-15 Table 5-10 Reading the diagnostic data with STEP 5 and STEP 7 in the master system... 5-16 Table 5-11 STEP 5 User Program ... 5-17 Table 5-12 Diagnostic addresses for the DP master and DP slave... 5-18 Table 5-13 Event detection of the CPUs 41x as DP slave... 5-18 Table 5-14 Evaluating RUNSTOP transitions in the DP Master/DP Slave ... 5-19 Table 5-15 Structure of station status 1 (Byte 0)... 5-20 Table 5-16 Structure of station status 2 (Byte 1)... 5-21 Table 5-17 Structure of station status 3 (Byte 2)... 5-21 Table 5-18 Structure of the master PROFIBUS address (byte 3)... 5-21 Table 5-19 Diagnostic address for the recipient during direct data exchange... 5-26 Table 5-20 Event detection by the 41x CPUs as recipients during direct communication... 5-27 Table 5-21 Evaluation of the station failure in the sender during direct data exchange ... 5-27 Table 6-1 New System and Standard Functions/System and Standard Functions to be Replaced... 6-6 Table 6-2 System and Standard Functions in PROFIBUS DP that must be Implemented with

Different Functions in PROFINET IO ... 6-7 Table 6-3 OBs in PROFINET IO and PROFIBUS DP... 6-7 Table 6-4 Comparison of the System Status Lists of PROFINET IO and PROFIBUS DP ... 6-8 Table 8-1 Memory requirements ... 8-2

(7)

Table of contents

Table 9-1 Cyclic program processing... 9-2 Table 9-2 Factors that Influence the Cycle Time ... 9-3 Table 9-3 Portions of the process image transfer time ... 9-4 Table 9-4 Operating System Scan Time at the Scan Cycle Checkpoint ... 9-5 Table 9-5 Increase in cycle time by nesting interrupts... 9-5 Table 9-6 Reducing the Response Time... 9-16 Table 9-7 Example of Calculating the Response Time... 9-17 Table 9-8 Calculating the Interrupt Response Time ... 9-21 Table 9-9 Hardware Interrupt and Diagnostic Interrupt Response Times; Maximum Interrupt

Response Time Without Communication ... 9-21 Table 9-10 Reproducibility of Time-Delay and Watchdog Interrupts of the CPUs... 9-24 Table 9-11 Response time for acyclic interconnections... 9-27

(8)

Table of contents

viii Manual, 11/2006, A5E00850746-02

(9)

Introduction 1

Purpose of the manual

The information contained in this manual can be used as a reference for operating, for descriptions of the functions, and for the technical specifications of the CPUs of the S7-400.

Details of how to set up, assemble and wire these and other modules in an S7-400 system are described in the S7-400 Programmable Controller; Hardware and Installation manual.

Basic knowledge required

To understand this manual, you should have general experience in the field of automation engineering.

You should also have experience of working with computers or PC-type tools (for example programming devices) and the Windows 2000 or XP operating system. The S7-400 is configured with the STEP 7 basic software, so you should also have experience of working with the basic software. You can acquire this knowledge in the Programming with STEP 7 manual.

In particular when using an S7-400 in areas subject to safety regulations, note the information relating to the safety of electronic controllers in the Appendix of the S7-400 Programmable Controller; Hardware and Installation manual.

Range of Validity of This Manual

The manual applies to the CPUs listed below:

• CPU 412-1; 6ES7 412-1XJ05-0AB0

• CPU 412-2; 6ES7-412-2XJ05-0AB0

• CPU 414-2; 6ES7 414-2XK05-0AB0

• CPU 414-3; 6ES7 414-3XM05-0AB0

• CPU 414-3 PN/DP; 6ES7 414-3EM05-0AB0

• CPU 416-2; 6ES7 416-2XN05-0AB0

• CPU 416F-2; 6ES7 416-2FN05-0AB0

• CPU 416-3; 6ES7 416-3XR05-0AB0

• CPU 416-3 PN/DP; 6ES7 416-3ER05-0AB0

• CPU 416F-3 PN/DP; 6ES7 416-3FR05-0AB0

• CPU 417-4; 6ES7 417-4XT05-0AB0

(10)

Introduction

1-2 Manual, 11/2006, A5E00850746-02

General Technical Data

Information about approvals and standards can be found in the S7-400 Programmable Controller; Module Specifications manual.

Structure of a CPU 41x 2

2.1

^2.1

Control and display elements of the CPUs

Controls and displays on the 412-1 CPU

x

EXT.-BATT 5...15 V DC MAINT CPU 412-1

6ES7412-1XJ05-0AB0

SVPS317698

V5.0.1 INTF EXTF BUS1F

FRCE

RUN STOP

RUN STOP MRES

X1 MPI/DP

,PSULQWRIPRGXOHGHVLJQDWLRQSURGXFWYHUVLRQ

VKRUWRUGHUQXPEHUDQGILUPZDUHYHUVLRQ

/('V,17)(;7)%86)

)5&(0$,175816723

6ORWIRUPHPRU\FDUG

0RGHVHOHFWRUVZLWFK

%HQHDWKFRYHU

03,352),%86b'3

LQWHUIDFH

'DWDPDWUL[FRGH

6HULDOQXPEHU

3RZHUVXSSO\

H[WHUQDOEDFNXS

YROWDJH

Figure 2-1 Layout of the controls and displays on the CPU 412-1

(14)

Structure of a CPU 41x

2.1 Control and display elements of the CPUs

2-2 Manual, 11/2006, A5E00850746-02

Controls and displays on the CPU 41x-2

/('V,17)(;7)%86)

%86))5&(0$,17

5816723

6ORWIRUPHPRU\FDUG

0RGHVHOHFWRUVZLWFK

%HQHDWKFRYHU

03,352),%86b'3

LQWHUIDFH

'DWDPDWUL[FRGH 6HULDOQXPEHU

3RZHUVXSSO\

H[WHUQDOEDFNXS

YROWDJH

352),%86'3

,QWHUIDFH

EXT.-BATT 5...15 V DC CPU 414-2

6ES7414-2XK05-0AB0

SVPS317697

FRCE

RUN STOP

RUN STOP MRES

X1 MPI/DP

x

BUS2F

X2 DP MAINT

Figure 2-2 Layout of the control and displays on the CPU 41x-2

(15)

Structure of a CPU 41x 2.1 Control and display elements of the CPUs

Controls and displays on the CPU 41x-3

6ORWIRUPHPRU\FDUG

0RGHVHOHFWRUVZLWFK

%HQHDWKFRYHU

03,352),%86b'3

LQWHUIDFH

6HULDOQXPEHU

3RZHUVXSSO\

H[WHUQDOEDFNXS

YROWDJH

352),%86'3

,QWHUIDFH

6ORWIRU,)'3LQWHUIDFH

PRGXOH

'DWDPDWUL[FRGH /('V,17)(;7)

%86)%86),)0)

)5&(0$,17581

6723

x

6ES7416-3XR05-0AB0

SVPS317696

FRCE

RUN STOP

RUN STOP MRES

X1 MPI/DP BUS2F IFM1F

IF1

X2 DP MAINT

Figure 2-3 Layout of the control and displays on the CPU 41x-3

(16)

2-4 Manual, 11/2006, A5E00850746-02

Controls and displays on the CPU 41x-3PN/DP

6ORWIRUPHPRU\FDUG

0RGHVHOHFWRUVZLWFK

%HQHDWKFRYHU

03,352),%86b'3

LQWHUIDFH 6HULDOQXPEHU

3RZHUVXSSO\

H[WHUQDOEDFNXS

YROWDJH 31LQWHUIDFH 6ORWIRU,)'3LQWHUIDFH

PRGXOH

'DWDPDWUL[FRGH /('V,17)(;7)

%86)%86),)0)

)5&(0$,17581

6723

/('/,1.

/('5;7;

0$&DGGUHVV

x

EXT.-BAT T 5...15 V DC CPU 416-3 PN/DP

6ES7416-3ER05-0AB0

SVPS317696

FRCE

RUN STOP

RUN STOP MRES

X1 MPI/DP BUS5F IFM1F

IF1

X5 P1

X5 P2 MAINT

0$&$'';;;;;;

FOR LAN ONLY

Figure 2-4 Layout of the controls and displays on the CPU 41x-3PN/DP

(17)

Controls and displays on the CPU 417-4

6ORWIRUPHPRU\FDUG

0RGHVHOHFWRUVZLWFK

%HQHDWKFRYHU

03,352),%86b'3

LQWHUIDFH

6HULDOQXPEHU

3RZHUVXSSO\

H[WHUQDOEDFNXS

YROWDJH

352),%86'3

,QWHUIDFH 6ORWIRU,)'3LQWHUIDFH

PRGXOH

'DWDPDWUL[FRGH

6ORWIRU,)'3LQWHUIDFH

PRGXOH

/('V,17)(;7)%86)

%86),)0),)0))5&(

0$,175816723

x

6ES7417-4XT05-0AB0 V5.0.1

INTF EXTF BUS1F

FRCE

RUN STOP

RUN STOP MRES

X1 MPI/DP BUS2F IFM1F IFM2F

X2 IF1

IF2

SVPS317696

MAINT

Figure 2-5 Layout of the controls and displays on the CPU 417-4

(18)

2-6 Manual, 11/2006, A5E00850746-02

LEDs

The table below gives you an overview of the LEDs on the individual CPUs.

Table 2-1 LEDs on the CPUs

Exists on CPU LED Color Meaning

412-1 412-2 414-2 416-2 416F-2

414-3 416-3

414-3 PN/DP 416-3 PN/DP 416F-3 PN/DP

417-4

INTF Red Internal fault X X X X X

EXTF Red External fault X X X X X

FRCE Yellow Force job active X X X X X

MAINT Yellow No function X X X X X

RUN Green RUN mode X X X X X

STOP Yellow STOP mode X X X X X

BUS1F Red Bus fault at MPI/PROFIBUS DP interface 1 X X X X X

BUS2F Red Bus fault at PROFIBUS DP interface 2 - X X - X

BUS5F Red Bus fault at the PROFINET interface - - - X -

IFM1F Red Fault on interface module 1 - - X X X

IFM2F Red Fault on interface module 2 - - - - X

Mode selector switch

You can use the mode selector switch to set the current mode of the CPU. The mode selector is a three-position toggle switch.

Memory card slot

You can insert a memory card into this slot.

There are two types of memory card:

• RAM cards

You can expand the CPU loading memory with the RAM card.

• Flash cards

The flash card is non-volatile storage for storing your user program and data (no backup battery necessary). You can program the flash card either on the programming device or in the CPU. The flash card also expands the load memory of the CPU.

Slot for Interface Modules

You can insert one PROFIBUS DP module for the CPU 41x-3 and CPU 417-4 into this slot.

(19)

MPI/DP interface

You can connect various devices to the MPI interface of the CPU, for example:

• Programming devices

• Operator control and monitoring devices

• Other S7-400 or S7-300 controllers

Use the bus connection connector with tilted cable outlet, see the S7-400 Automation System, Hardware and Installation manual.

You can also configure the MPI interface as a DP master so that you can use it as a PROFIBUS DP interface with up to 32 DP slaves.

PROFIBUS DP Interface

You can connect the distributed I/O, programming devices/OPs and other DP master stations to the PROFIBUS DP interface.

PROFINET interface

You can connect PROFINET IO devices to the PROFINET interface. The PROFINET interface has 2 switched ports facing outwards (RJ 45). The PROFINET interface provides the connection to the Industrial Ethernet.

Caution

You can only connect to an Ethernet LAN with this interface. You cannot connect to the public telecommunication network, for example.

Incoming Supply, External Backup Voltage at the "EXT.-BATT." Jack

You can install one or two backup batteries in the S7-400 power supply modules, depending on the module type, to achieve the following result:

• Back up the user program stored in RAM.

• Retain the values of flags, timers, counters, system data and the data in dynamic DBs.

• Back up the internal clock.

The same backup function can be achieved by applying a voltage of between 5 V DC and 15 V DC to the "EXT.-BATT." jack of the CPU.

The "EXT.-BATT." input has the following features:

• Polarity reversal protection

• Short-circuit current limited to 20 mA

You need a cable with a 2.5 mm Ø jack plug to connect the power supply to the "EXT.- BATT" jack, as shown in the following illustration. Make sure the polarity of the jack plug is correct.

(20)

2-8 Manual, 11/2006, A5E00850746-02

3OXVSROH 0LQXVSROH

PPMDFNSOXJ

Figure 2-6 Connecting Cable with Jack Plug

You can order a jack plug with an assembled cable from the using order number A5E00728552A.

Note

You will need the external incoming supply to the "EXT.-BATT." jack when you replace a power supply module and want to backup the user program stored in RAM and the data mentioned above while you are replacing the module.

2.2

^2.2

Monitoring functions of the CPU

Monitoring Functions and Error Messages

The CPU hardware and the operating system monitoring functions ensure proper functioning of the system and a defined response to faults and errors. Certain error events also trigger a response from the user program. For intermittent errors, the LED goes out once more with the next incoming error.

The table below provides an overview of the possible errors, their causes and the responses of the CPU.

Table 2-2 Faults/errors and the responses of the CPU

Type of error Cause of error Response of the operating system Error LED Access error

(incoming) Module failure (SM, FM, CP) I/O read access error I/O write access error

The "EXTF" LED stays lit until the error is acknowledged.

For SMs:

• OB 122 call

• Entry in the diagnostic buffer

• For input modules: "NULL" entered as data in the accumulator or the process image

For other modules:

• OB 122 call

If the OB is not loaded: The CPU changes to STOP

EXTF

Timeout error (incoming)

• The user program run time (OB1 and all interrupt and error OBs) exceeds the specified maximum cycle time.

• OB request error

• Overflow of the startup information buffer

• Watchdog interrupt

• Resume RUN after CiR

The "INTF" LED stays lit until the error is acknowledged.

OB 80 call

INTF

Faulty power supply module(s), (not mains failure),

(incoming and outgoing)

In the central or expansion rack

• At least one backup battery in the power supply module has discharged

• No backup voltage

• The 24 V DC supply from the power supply module has failed

OB 81 call

If the OB is not loaded: The CPU remains in RUN.

EXTF

Diagnostic interrupt (incoming and outgoing)

An I/O module with interrupt capability

reports a diagnostic interrupt OB 82 call

EXTF

(22)

2.2 Monitoring functions of the CPU

2-10 Manual, 11/2006, A5E00850746-02

Type of error Cause of error Response of the operating system Error LED Remove/insert module

interrupt

(entering and exiting state)

Removal or insertion of an SM and insertion of the wrong module type. The EXTF LED does not light up if only one SM is inserted and then removed while the CPU is in STOP (default setting).

The LED lights up briefly when the SM is inserted again.

OB 83 call

EXTF

CPU hardware error

(incoming)

• A memory error was detected and

eliminated OB 84 call

If the OB is not loaded: The CPU remains in RUN.

INTF

Priority class error (Incoming only or incoming and outgoing, depending on OB85 mode)

• A priority class is called, but the corresponding OB is not present.

• For an SFB call: The instance DB is missing or bad.

• Error while updating the process image

OB 85 call

INTF

EXTF Rack / station failure

(incoming and outgoing)

• Power failure in an expansion rack

• PROFINET DP subnet failure

• PROFINET IO subsystem failure

• Failure of a coupling subnet: missing or defective IM, cable break)

OB 86 call

EXTF

Communication error (incoming)

• Unable to enter status information in the DB (shared data communication)

• Incorrect message frame ID (shared data communication)

• Incorrect message length (shared data communication)

• Error in structure of shared data frame (shared data communication)

• DB access error

OB 87 call INTF

Execution cancelled (incoming)

• Synchronising error nesting depth exceeded

• Too many nested block calls (B stack)

• Error when allocating local data

OB 88 call

INTF

Programming error (incoming)

Error in user program

• BCD conversion error

• Range length error

• Range error

• Alignment error

• Write error

• Timer number error

• Counter number error

• Block number error

• Block not loaded

OB 121 call

INTF

Code error (incoming)

Error in the compiled user program (for example, illegal OP code or a jump beyond block end)

The CPU changes to STOP Restart or CPU memory reset required.

INTF

(23)

Structure of a CPU 41x 2.2 Monitoring functions of the CPU

Type of error Cause of error Response of the operating system Error LED Loss of clock signal

(incoming)

When using isochrone mode: Clock pulses were lost either because OB61 ... 64 was not started due to higher priorities, or because additional

asynchronous bus loads suppressed the bus clock pulses.

OB 80 call

OB 61..64 called in the next pulse.

INTF

Further testing and information functions are available in each CPU and can be called in STEP 7.

(24)

Structure of a CPU 41x 2.3 Status and error displays

2-12 Manual, 11/2006, A5E00850746-02

2.3

^2.3

Status and error displays

Status LEDs

The RUN and STOP LEDs on the front panel of the CPU indicate the current CPU mode.

Table 2-3 Possible states of the RUN and STOP LEDs LED

RUN STOP

Meaning

H D CPU is in RUN mode.

D H CPU is in STOP mode. The user program is not executed. Cold restart, restart and warm restart/reboot are possible. If STOP was triggered by an error, the error LED (INTF or EXTF) is also set.

B 2 Hz

CPU is DEFECTIVE. The INTF, EXTF, FRCE, BUSF1, BUSF5 and IFM1F LEDs also flash.

B 0.5 Hz

H CPU HOLD was triggered by a test function.

B 2 Hz

H A warm restart / cold restart / hot restart was triggered. It can take a minute or more to execute these functions, depending on the length of the OB called. If the CPU still does not change to RUN, there may be an error in the system

configuration.

x B

0.5 Hz

The CPU requests a memory reset.

x B

2 Hz

Memory reset in progress or the CPU is currently being initialized following POWER ON.

D = LED is dark; H = LED is lit; B = LED flashes at the specified frequency; x = LED status has no relevance

Error and Fault Displays and Special Characteristics

The three LEDs INTF, EXTF and FRCE on the front panel of the CPU indicate errors and special features while the user program is running.

Table 2-4 Possible states of the INTF, EXTF and FRCE LEDs LED

INTF EXTF FRCE

Meaning

H x x An internal error was detected (programming or parameter assignment error) or the CPU is performing a CiR.

x H x An external error was detected (in other words, the cause of the error is not on the CPU module).

x x H A force job is active.

x x B

2 Hz

Node flash test function.

H = LED is lit; B = LED flashes with the specified frequency; x = LED status has no relevance

(25)

The LEDs BUS1F, BUS2F and BUS5F indicate errors associated with the MPI/DP, PROFIBUS DP and PROFINET IO interfaces.

Table 2-5 Possible states of the BUS1F, BUS2F and BUS5F LEDs LED

BUS1F BUS2F BUS5F

Meaning

H x x An error was detected at the MPI/DP interface.

x H x An error was detected at the PROFINET DP interface.

x x H An error was detected at the PROFINET IO interface.

x x B One of more devices at the PROFIBUS DP interface not responding.

CPU is DP

master: One or more slaves at PROFIBUS DP interface 1 not responding.

B x x

CPU is DP

slave: CPU is not addressed by the DP master.

CPU is DP

master: One or more slaves at PROFIBUS DP interface 2 not responding.

x B x

CPU is DP

H = LED is lit; B = LED flashes; x = LED status has no relevance

Error and Fault Displays and Special Characteristics

The CPU 41x-3 and CPU 417-4 also have IFM1F or IFM1F and IFM2F LEDs. These LEDs indicate problems relating to the memory submodule interface.

Table 2-6 Possible states of the IFM1F and IFM2F LEDs LED

IFM1F IFM2F

Meaning

H x An error was found at module interface 1.

x H An error was found at module interface 2.

CPU is DP

master: One or more slaves at the PROFIBUS DP interface module inserted in receptacle 1 not responding.

B x

CPU is DP

master: One or more slaves at the PROFIBUS DP interface module inserted in receptacle 2 not responding.

x B

CPU is DP

H = LED is lit; B = LED flashes; x = LED status has no relevance

(26)

2-14 Manual, 11/2006, A5E00850746-02

Error and Fault Displays and Special Characteristics of the CPU 41x-3 PN/DP

The CPUs 41x-3 PN/DP also have a LINK LED and an RX/TX LED These LEDs indicate the current state of the PROFINET interface.

Table 2-7 Possible states of the LINK and RX/TX LEDs LED

LINK RX/TX

Meaning

H x Connection at PROFINET interface is active

x B

6 Hz

Receiving or sending data at the PROFINET interface.

H = LED is lit; B = LED flashes with the specified frequency; x = LED status has no relevance

Note

The LINK and RX/TX LEDs are located beside the jacks of the PROFINET interface. They are not labeled.

LED MAINT

This LED currently has no function.

Diagnostic buffer

In STEP 7, you can select "PLC -> Module status" to read the cause of an error from the diagnostic buffer.

(27)

Structure of a CPU 41x 2.4 Mode selector switch

2.4

^2.4

Mode selector switch

Function of the Mode Selector Switch

The mode selector is used to switch the CPU from RUN to STOP or to reset the CPU memory. STEP 7 offers further mode selection options.

Positions

The mode selector is designed as a toggle switch. The following figure shows all the positions of the mode selector.

RUN

STOP

MRES

Figure 2-7 Mode selector switch settings

The following table explains the settings of the mode selector switch. In the event of an error or if there are problems preventing startup, the CPU switches to or remains in STOP mode, regardless of the position of the mode selector.

Table 2-8 Mode selector switch settings

Position Notes

RUN If there is no startup problem or error and the CPU was able to switch to RUN, the CPU either runs the user program or remains idle. The I/O can be accessed.

• You can upload programs from the CPU to the programming device (CPU -> Programming device)

• You can upload programs from the programming device to the CPU (Programming device ->

CPU).

STOP The CPU does not execute the user program. The digital signal modules are locked. The output modules are disabled in the default parameter settings.

• You can upload programs from the CPU to the programming device (CPU -> Programming device)

• You can upload programs from the programming device to the CPU (Programming device ->

CPU).

MRES (CPU memory reset; master reset)

Momentary-contact position of the toggle switch for CPU memory reset (see next pages).

Security Classes

A security class can be agreed for S7-400 CPUs in order to prevent unauthorized access to CPU programs. You can define a security class which allows users to access PG functions without particular authorization (password) on the CPU concerned. All PG functions can be accessed if a password is entered.

(28)

Structure of a CPU 41x 2.4 Mode selector switch

2-16 Manual, 11/2006, A5E00850746-02

Setting the Security Classes

You can set the security classes (1 to 3) for a CPU in STEP 7 -> HW Config.

You can delete the the security class set STEP 7 -> HW Config by means of a manual reset using the mode selector switch.

The following table lists the security classes of an S7-400 CPU.

Table 2-9 Security classes of an S7-400 CPU

CPU function Security class 1 Security class 2 Security class 3 Block list displays Access allowed Access allowed Access allowed Monitoring Variables Access allowed Access allowed Access allowed STACKS module status Access allowed Access allowed Access allowed Operator control and monitoring

functions Access allowed Access allowed Access allowed

S7 communication Access allowed Access allowed Access allowed Read time of day Access allowed Access allowed Access allowed Set time of day Access allowed Access allowed Access allowed Block status Access allowed Access allowed Password required Download to programming device Access allowed Access allowed Password required Download to CPU Access allowed Password required Password required Delete blocks Access allowed Password required Password required Compress memory Access allowed Password required Password required Download user program to memory

card Access allowed Password required Password required

Control selection Access allowed Password required Password required Control variable Access allowed Password required Password required Breakpoint Access allowed Password required Password required Exit break Access allowed Password required Password required Memory reset Access allowed Password required Password required

Force Access allowed Password required Password required

Setting the security class with SFC 109 "PROTECT"

SFC 109 "PROTECT" is used to switch between security classes 1 and 2.

(29)

Structure of a CPU 41x 2.5 Running a memory reset

2.5

^2.5

Running a memory reset

Operating Sequence at Memory Reset

Case A: You want to transfer a new, complete user program to the CPU.

1. Set the mode selector switch to STOP.

Result: The STOP LED is lit.

2. Set the selector to MRES and hold it there.

Result: The STOP LED is switched off for one second, on for one second, off for one second and then remains on.

3. Turn the switch back to the STOP setting, then to the MRES setting again within the next 3 seconds, and back to STOP.

Result: The STOP LED flashes for at least 3 seconds at 2 Hz (memory being reset) and then remains lit.

Running a Memory Reset following a Request

Case B: The CPU requests memory reset, indicated by the flashing STOP LED at 0.5 Hz.

The system requests a CPU memory reset, for example, after a memory card was removed or inserted.

1. Set the mode selector switch to MRES and then back to STOP.

Result: The STOP LED flashes for at least 3 seconds at 2 Hz (memory being reset) and then remains lit.

For detailed information on CPU memory reset refer to the manual S7-400 Automation System, Hardware and Installation.

What happens in the CPU during a memory reset

When you run a memory reset, the following process occurs on the CPU:

• The CPU deletes the entire user program from main memory and load memory (integrated RAM and, if applicable, RAM card).

• The CPU clears all counters, bit memory, and timers (except for the time of day).

• The CPU tests its hardware.

• The CPU initializes its hardware and system program parameters (internal default settings in the CPU). Some default settings selected by the user will be taken into account.

• If a flash card is inserted, the CPU copies the user program and the system parameters stored on the flash card into main memory after the memory reset.

(30)

Structure of a CPU 41x 2.5 Running a memory reset

2-18 Manual, 11/2006, A5E00850746-02

Values Retained After a Memory Reset

After the CPU has been reset, the following values remain:

• The content of the diagnostic buffer

The content can be read out with the programming device using STEP 7.

• Parameters of the MPI (MPI address and highest MPI address). Note the special features shown in the table below.

• The IP address of the CPU

• The subnet mask

• The SNMP parameters

• The time of day

• The status and value of the operating hours counter

Special Features MPI parameters and IP address

A special situation is presented for the MPI parameters and IP address when a CPU memory reset is preformed. The following table shows which MPI parameters and IP address remain valid after a CPU memory reset.

Table 2-10 MPI parameters and IP address following memory reset

Memory reset .. MPI parameters and IP address ...

With inserted FLASH card ..., stored on the FLASH card are valid Without plugged FLASH card ...are retained in the CPU and valid

(31)

Structure of a CPU 41x 2.6 Cold start / Warm restart / Hot restart

2.6

^2.6

Cold start / Warm restart / Hot restart

Cold start

• During a cold restart, all data (process image, bit memory, timers, counters and data blocks) is reset to the start values stored in the program (load memory), irrespective of whether they were configured as retentive or non-retentive.

• The associated startup OB is OB 102

• Program execution is restarted from the beginning (OB 102 or OB 1).

Reboot (warm restart)

• A reboot resets the process image and the non-retentive flags, timers, times and counters.

Retentive flags, times and counters retain their last valid value.

All data blocks assigned the "Non Retain" attribute are reset to the downloaded values.

The other data blocks retain their last valid value.

• Program execution is restarted from the beginning (OB 100 or OB 1).

• If the power supply is interrupted, the warm restart function is only available in backup mode.

Hot restart

• When a hot restart is performed, all data and the process image retain their last valid value.

• Program execution is resumed from the breakpoint.

• The outputs do not change their status until the current cycle is completed.

• If the power supply is interrupted, the hot restart function is only available in backup mode.

Operating sequence for reboot (warm restart) 1. Set the mode selector to STOP.

Result: The STOP LED lights up.

2. Set the switch to RUN.

Operating sequence for hot restart

1. Select the "hot restart" startup type on the PG.

The button can only be selected if this type of restart is possible on the specific CPU.

(32)

2.7 Structure and Functions of the Memory Cards

2-20 Manual, 11/2006, A5E00850746-02

Operating sequence for cold restart

A manual cold restart can only be triggered from the programming device.

2.7

^2.7

Structure and Functions of the Memory Cards

Order numbers

The order numbers for memory cards are listed in the technical specifications.

Structure

The memory card is slightly larger than a credit card and is protected by a strong metal casing. It is inserted into one of the slot on the front of the CPU. The memory card casing is encoded so it can only be inserted one way round.

Front view Side view

Rating plate

Grip Name of the Memory Card Order number

Figure 2-8 Structure of the Memory Card

Function

The memory card and an integrated memory area on the CPU together form the load memory of the CPU. At runtime, the load memory contains the complete user program including comments, symbols and special additional information that allows the user program to be decompiled and all module parameters.

What Is Stored on the Memory Card

The following data can be stored on memory cards:

• User program, in other words, blocks (OBs, FBs, FCs, DBs) and system data

• Parameters which determine the behavior of the CPU

• Parameters which determine the behavior of the I/O modules.

• In STEP 7 V5.1 or later, all project files on suitable memory cards.

(33)

Structure of a CPU 41x 2.7 Structure and Functions of the Memory Cards

Serial Number

In version 5 or later, all memory cards have a serial number. This serial number is listed in INDEX 8 of the SZL Parts List W#16#xy1C. The parts list can be read using SFC 51

"RDSYSST".

You can determine the following when you read the serial number into your user program:

The user program can only be started when a specific memory card is inserted in the CPU.

This protects against unauthorized copying of the user program, similar to a dongle.

2.8

^2.8

Use of the Memory Cards

Types of Memory Cards for S7-400

Two types of memory card are used in the S7-400:

• RAM cards

• Flash cards (FEPROM cards)

Note

Non-Siemens memory cards cannot be used in the S7-400.

Which Type of Memory Card Should Be Used?

Whether you use a RAM card or a flash card depends on how you intend to use the memory card.

Table 2-11 Types of Memory Card

If you ... Then ...

Want to store the data in RAM and edit your

program in RUN, Use a RAM card

Want to store your user program permanently on the memory card, even with power removed (without backup or outside the CPU),

Use a Flash card

RAM card

To use a RAM card and load the user program, you must insert it into the CPU slot. The user program is loaded with the help of the programming device (PG).

You can load the entire user program or individual elements such as FBs, FCs, OBs, DBs, or SDBs to the load memory when the CPU is in STOP or RUN mode.

All data on the RAM card is lost when you remove it from the CPU. The RAM card does not have a built-in backup battery.

If the power supply is equipped with an operational backup battery, or the CPU is supplied with an external backup voltage at the "EXT. BATT." input, the RAM card contents are retained when power is switched off, provided the RAM card remains inserted in the CPU and the CPU remains inserted in the rack.

FLASH card

There are two ways to download the user program if you are using a FLASH card:

(35)

Structure of a CPU 41x 2.8 Use of the Memory Cards

Option 1:

1. Set the CPU mode to STOP with the mode selector switch.

2. Insert the FLASH card into the CPU.

3. Perform a memory reset.

4. Download the user program with the STEP 7 command "PLC -> Download User Program to Memory Card".

Option 2:

1. Download the user program to the FLASH card when the programming device / programming adapter is offline.

2. Insert the FLASH card into the CPU.

You can only reload the full user program using the FLASH card. You can download smaller program sections to the integrated load memory on the CPU using the programming device.

For significant program changes, you must always download the complete user program to the FLASH card.

The FLASH card does not require a backup voltage, that is, the information stored on it is retained even when you remove the Flash card from the CPU or if you operate your S7-400 system without a buffering function (without backup battery in the power supply module or

"EXT. BATT." socket of the CPU).

Which Memory Card Capacity Should Be Used?

The capacity of the required memory card is based on the size of the user program and amount of system data.

To optimize utilization of work memory (code and data) on your CPU, you should expand the load memory of the CPU with a memory card which has at least the same capacity as the work memory.

Changing the Memory Card

To change the memory card:

1. Set the CPU to STOP.

2. Remove the memory card.

Note

If you remove the memory card, STOP LED flashes at 3-second intervals to indicate that the CPU requires a memory reset. This sequence cannot be influenced by error OBs.

3. Insert the "new" memory card in the CPU.

4. Reset the CPU memory.

(36)

Structure of a CPU 41x 2.9 Multipoint Interface (MPI)

2-24 Manual, 11/2006, A5E00850746-02

2.9

^2.9

Multipoint Interface (MPI)

Availability

All the CPUs of the S7-400 feature an MPI interface.

Connectable Devices

You can connect the following nodes to the MPI, for example:

• Programming devices (PG/PC)

• Control and monitoring devices (OPs and TDs)

• Additional SIMATIC S7 PLCs

Some devices use the 24 VDC power supply of the interface. This voltage is provided at the MPI interface connected to a reference potential

PG/OP ->CPU Communication

A CPU is capable of maintaining several simultaneous online connections. Only one of these connections is reserved as default connection for a programming device, and a second for the OP/ control and monitoring device.

For CPU-specific information on the number of connection resources of connectable OPs, refer to the Technical Specifications.

Time Synchronization using MPI

Time synchronization is possible by using the MPI interface of the CPU. The CPU can be the master or slave.

Reference

You can find information about planning time synchronization in the manual Process Control System PCS7; Safety Concept.

CPU-CPU communication

There are three types of CPU-CPU communication:

• Data transfer by means of S7 basic communication

• Data transfer by means of S7 communication

• Data transfer by means of global data communication

For further information, refer to the Programming with STEP 7 manual.

(37)

Structure of a CPU 41x 2.9 Multipoint Interface (MPI)

Connectors

Always use bus connectors with the oblique cable outlet for PROFIBUS DP or PG cables used to connect devices to the MPI (see the S7-400 Automation System, Hardware and Installation manual).

MPI interface as a PROFIBUS DP interface

You can also configure the MPI interface for operation as a PROFIBUS DP interface. To do so, you can reconfigure the MPI interface under STEP 7 in HW Config. You can use this to set up a DP line consisting of up to 32 slaves.