Siemens SIMATIC S7-400H System Manual page 107

The monitoring start times are indicated in the highlighted boxes in Figure 9-2. These times
expire when the system enters the redundant state or on a master/standby changeover, i.e.
on the transition of the new master to RUN when the update is completed.
The figure below provides an overview of the relevant update times.
Figure 9-4
Reaction to timeouts
If one of the times monitored exceeds the configured maximum, the following procedure is
started:
1. Cancel update
2. Fault-tolerant system remains in single mode, with the previous master CPU in RUN
3. Enter cause of cancelation in diagnostic buffer
4. Call OB 72 (with corresponding start information)
The standby CPU then evaluates its system data blocks again.
Then, but after at least one minute, the CPU tries again to perform the link-up and update. If
still unsuccessful after a total of 10 retries, the CPU abandons the attempt. You yourself will
then need to start the link-up and update again.
A monitoring timeout can be caused by:
● High interrupt load (for example from I/O modules)
● high communication load causing prolonged execution times for active functions
● In the final update phase, the system needs to copy large amounts of data to the
S7-400H
System Manual, 09/2007, A5E00267695-03
Meanings of the times relevant for updates
standby CPU.
Link-up and update
9.4 Time monitoring
107