Downloading to S7-400 Memory Card via STEP 7 Command Interface

1. Overview

Engineers who script project deployment for SIMATIC S7-400 CPUs in Visual Basic 6.0 typically attempt to drive the STEP 7 Command Interface (the Microsoft Component Object Model automation interface exposed by SIMATIC Manager) to push the user program onto a plug-in memory card. The question is well-formed: it is possible to enumerate blocks, connect online, and download to the CPU's load memory through the Command Interface, but the interface has a specific architectural boundary that prevents a direct write to a memory card installed in the S7-400 CPU slot over the online channel.

This technical reference documents that boundary, the objects that are actually available, the menu-driven function in SIMATIC Manager that achieves the goal, the path through the Command Interface that gets as close as possible, the role of the CPU's STOP state when the target is a Flash/EPROM card, and a step-by-step commissioning sequence that combines both paths. It is targeted at STEP 7 V5.3 SP3 environments but applies unchanged to STEP 7 V5.4 / V5.5 because the automation object model and the load-memory architecture are stable across the V5.x line.

2. The "COM Interface" Is Microsoft COM, Not a Serial Port

The phrase "COM-interface" in the context of STEP 7 5.x refers to Microsoft Component Object Model, not an RS-232 hardware COM port. SIMATIC Manager registers its automation objects as COM in-process and out-of-process servers that COM-aware languages (Visual Basic 6.0, VBA, VBScript, C++ via ATL, Delphi, and .NET via COM interop) can drive programmatically.

The two principal COM servers are:

• S7WINBM.DLL – the SIMATIC Manager automation server, which exposes the project tree, the offline block containers, and the memory-card object.
• S7ONLINE.DLL – the online services server, which exposes the connection-point abstraction used to reach a CPU over MPI, PROFIBUS, or Industrial Ethernet.

The automation object categories relevant to memory-card programming are:

3. S7-400 Load Memory Architecture

The S7-400 CPU uses two physical areas for the user program:

1. Work memory (RAM, integrated on the CPU module).
2. Load memory (a plug-in card in the CPU's memory card slot). Load memory is typically a RAM card or a Flash/EPROM card.

Operational rules that govern the rest of this article:

• Load memory holds all blocks of the user program: OBs, FBs, FCs, DBs, SFBs, SFCs, and SDBs (including hardware configuration).
• For non-volatile storage of the user program a Flash (FEPROM) or EPROM card is required. RAM cards retain their contents only while the CPU's battery / back-up is alive.
• The CPU must be in STOP to write to a Flash or EPROM card. The write operation performs block-level erase/program cycles that the running logic must not interfere with.
• RAM cards allow online modifications in RUN mode for most S7-400 CPU types; this is the path the Command Interface is designed to drive.
• The card slot is reached by the CPU's firmware via the parallel backplane interface; it is not exposed to external automation tools through the online (MPI/PROFIBUS/TCP) channel.

4. The Command Interface Boundary

The Command Interface (also documented as the SIMATIC Manager Automation Interface) is implemented as a COM in-process server bound to the local programming device's view of the project tree. Its download operations ultimately call the same internal S7Download API used by the SIMATIC Manager menu commands, but those internal functions route through the online channel to the CPU, not to the CPU's card slot.

The S7MemCard object – the only memory-card-specific object in the model – has the following contract:

• It represents a memory card mounted in the external memory card reader/writer connected to the PG/PC.
• It exposes methods to enumerate, read, write, and delete blocks: BlockList, Block, Format, CardType, Open, Close.
• It does not represent the card in the CPU. There is no API path that opens the CPU's card slot over MPI / PROFIBUS / Industrial Ethernet for the S7MemCard object's benefit.

Because of this, an Automation client cannot call S7MemCard.Download (or any equivalent) to push a program to the S7-400 card slot over the online channel. The two paths – online download to CPU load memory and direct write to a physical card in a local reader – are architecturally distinct in STEP 7 V5.x.

5. What the Command Interface Can Do

The Command Interface fully supports the following S7-400 operations:

The S7Block.Download method writes the block to the CPU's load memory – the card slot area. This is the supported COM path for "downloading the user program" via the Command Interface, and it is the only path that goes through the online connection. If a Flash card is mounted and configured as the load memory, the CPU's firmware commits the change to the card on the next STOP-RUN transition or after a memory reset, not as part of the online download itself.

6. Path 1 – SIMATIC Manager "PLC > Download User Program to Memory Card"

This is the menu-driven function referenced in the original question. It is implemented in the SIMATIC Manager, not in the Command Interface, and it is the canonical SIMATIC procedure for writing a user program to an S7-400 memory card.

1. The selected CPU must be online and in STOP.
2. Select the CPU in the SIMATIC Manager project tree.
3. Choose PLC > Download User Program to Memory Card from the SIMATIC Manager menu.
4. STEP 7 erases the card's relevant areas and writes all user-program blocks plus system data.
5. On the next CPU restart, the CPU loads from the new card contents.

7. Path 2 – Programmatic Equivalent via S7Block.Download

If the goal is to push the user program into the CPU's load memory (and let the CPU's firmware persist it to a Flash card if one is mounted and configured as load memory), the following Visual Basic 6.0 code illustrates the Command Interface path that works:

' References (Project > References):
'  - S7ONLINE.DLL     SIMATIC S7 Online
'  - S7WINBM.DLL      SIMATIC Manager Automation

Dim oProject  As Object   ' S7Project
Dim oPrograms As Object   ' S7Programs
Dim oProgram  As Object   ' S7Program
Dim oBlocks   As Object   ' S7BlockContainer
Dim oBlock    As Object   ' S7Block
Dim oConn     As Object   ' S7Connection
Dim sPath     As String

' --- Open the offline S7 project ---
Set oProject = CreateObject("S7Project")
oProject.Open "C:\\Projects\\MyPlant\\S7Proj"

' --- Enumerate the program container ---
Set oPrograms = oProject.Programs
Set oProgram  = oPrograms.Item(1)
Set oBlocks   = oProgram.Blocks

' --- Build the online connection via S7ONLINE ---
Set oConn = CreateObject("S7Connection")
oConn.AccessPoint = "S7ONLINE"
oConn.Interface   = "PC internal"      ' or CP name, e.g. "CP5611"
oConn.Online      = True

' --- Force CPU to STOP (required for Flash/EPROM target) ---
' Dim oCpu As Object : Set oCpu = oConn.S7CPU ' pseudo
' oCpu.Stop

' --- Download every block in the offline container ---
Dim i As Long
For i = 1 To oBlocks.Count
    Set oBlock = oBlocks.Item(i)
    oBlock.Download
    Debug.Print "Downloaded: " & oBlock.Name
Next i

The block-level download (Path 2) writes to the CPU's current load memory. If a Flash card is mounted and the user program is configured to be loaded from card, the CPU firmware performs the RAM-to-Flash commit at the next STOP-RUN transition. The Command Interface does not call the firmware commit itself; it only writes the running load memory image.

8. CPU STOP Requirement for Flash/EPROM

For S7-400 with a Flash/EPROM card inserted, the following conditions must be met to commit a user program to non-volatile storage:

• The CPU must be in STOP.
• No active process image update must be running.
• The card must be write-enabled. Some S7-400 Flash cards have a write-protect jumper; verify it is in the enabled position.
• Sufficient free space must exist on the card. STEP 7 reports the available bytes in the status line of the download dialog.

Attempting to write to a Flash card while the CPU is in RUN is rejected by the CPU's online services. The diagnostic buffer receives an entry of the form "Operation not permitted in current operating state" (event class 0x1Axx, depending on the firmware revision). The COM client's S7Block.Download call returns a runtime error or HRESULT that the VB6 caller must trap with On Error GoTo.

9. When a Local Card Reader Is Available

If the deployment scenario can be reworked to use an external memory card reader (PC-CARD, USB, or the S7-PROMMMC / S7 Card Reader) attached to the PG/PC, the S7MemCard object becomes useful. The card can be programmed offline, then physically moved to the CPU's memory card slot before the CPU powers up. This is a viable bulk-deployment workflow for production lines with limited online connectivity.

Dim oCard  As Object   ' S7MemCard
Set oCard = CreateObject("S7MemCard")

' Open the local reader (name depends on installed driver)
oCard.Open "USB"           ' or "PC Card" / "S7 Card Reader"

' Format the card if required
oCard.Format

' Write every block in the offline container to the card
Dim oBlock As Object
Dim i As Long
For i = 1 To oBlocks.Count
    Set oBlock = oBlocks.Item(i)
    oCard.Blocks.Add oBlock
Next i

oCard.Close

10. Step-by-Step Commissioning Sequence (Combined Path 1 + Path 2)

The following sequence uses the Command Interface to push the user program into CPU load memory, then uses the SIMATIC Manager menu to commit it to a Flash card. It is the recommended hybrid for STEP 7 5.3 SP3 deployments where the project must be deployable from a custom VB6 application but also persisted to non-volatile card media.

1. Configure the S7ONLINE access point (Set PG/PC Interface) for the physical interface used (PC internal for TCP, CP5611 for PROFIBUS, etc.).
2. Open the offline STEP 7 project from your VB6 client (S7Project.Open).
3. Enumerate the program and block container.
4. Build the online connection (S7Connection).
5. Force the CPU to STOP via S7CPU.Stop (or instruct the operator to do so from the SIMATIC Manager).
6. Iterate S7BlockContainer and call S7Block.Download on each block. Trap and log any failures.
7. Confirm the block list in the online view of the CPU matches the offline project.
8. Open SIMATIC Manager and choose PLC > Download User Program to Memory Card for the same online CPU. This step commits the program from CPU load memory to the Flash/EPROM card.
9. Perform a power cycle (OFF/ON) and confirm the CPU executes the "Reload from memory card" start sequence. The diagnostic buffer contains a corresponding entry.
10. Switch the CPU back to RUN and verify the application.

11. Verifying the Download

After either Path 1 or the hybrid sequence, perform the following checks:

1. Open the CPU's online block list (PLC > Display Accessible Nodes or the Online project tree).
2. Compare block timestamps and checksums between the offline (PG) and online (CPU) views. A mismatch indicates a partial download.
3. For a Flash card, perform a power cycle (OFF/ON) and confirm the CPU goes through the "Reload from memory card" start sequence. The diagnostic buffer shows the corresponding event.
4. Check the card type and free space reported in the CPU's module information (PLC > Module Information > Memory tab). The "Load memory" area must match the card capacity.
5. Read the diagnostic buffer programmatically with S7Diagnosis.Read and look for any error events recorded during the download or the next restart.

12. Troubleshooting Matrix

13. S7-400 vs. S7-1200/1500 Behavior

The S7-1200 and S7-1500 families use SIMATIC Memory Cards (SMC) as a mandatory program-card architecture. S7-300/400 use a plug-in RAM/Flash card that is essentially an option for non-volatile load memory. For S7-1200/1500, formatting the card is a separate online function documented in the S7-1200 manual collection (see the reference in the next section). The Command Interface behavior toward the SMC is also different: on S7-1500, card operations are exposed through the TIA Portal automation model, not the legacy SIMATIC Manager Command Interface. A VB6-based STEP 7 5.3 SP3 client cannot drive S7-1500 SMC operations at all; the migration path is to TIA Portal with the TIA Portal Openness API.

14. Safety and Operational Notes

• Forcing a CPU to STOP via the Command Interface (S7CPU.Stop) while the controlled process is in an undefined state is hazardous. Always coordinate STOP transitions with the operator station and the safety system; interlock the action with the process mode in the VB6 client.
• A failed write to a Flash card may leave the card in a partially programmed state. Have a known-good backup card available before initiating the download.
• Never remove a memory card from an S7-400 CPU while power is applied; this can corrupt the card and the CPU firmware.
• For F-CPU (fail-safe S7-400) targets, the safety program has its own download procedure and authorization checks. The Command Interface paths described in this article do not bypass F-CPU signature checks; the safety password and collective signature must be handled separately.

15. Related Field Notes

A few practical points that do not appear in the STEP 7 help but are common in the field:

• Late-bound COM (using CreateObject("S7Project")) is more portable across STEP 7 versions but offers no IntelliSense and limited compile-time checking. Early binding to the S7WINBM type library is faster and surfaces method signatures, but ties the client to a specific STEP 7 build.
• When the same VB6 application must target STEP 7 V5.3 SP3 and V5.5, gate the CreateObject calls with version detection in the registry under HKEY_CLASSES_ROOT\CLSID for the SIMATIC Manager automation server.
• The S7ONLINE access point name is a string the operating system resolves to a configured interface; the same access point can be reused across multiple S7Connection instances.
• If the VB6 client must run unattended, wrap the download loop in a top-level error trap that resets the CPU's operating mode (RUN/STOP) to its pre-download state on any error, so the next operator shift does not inherit a CPU stuck in STOP.

16. Documentation References

The following official Siemens documents are the primary references for the procedures and object model used in this article:

• Siemens KB 12068554 – How do you load projects on a memory card and back to a PG/PC?
• SIMATIC S7-1200 Manual Collection – Formatting a SIMATIC memory card from STEP 7
• STEP 7 V5.3 SP3 Online Help, "Working with the Command Interface" – object hierarchy and methods
• SIMATIC S7-400 Automation System (CPU 412/414/416/417) Manual – load memory and card handling

FAQ