Erasing S7-400 Flash Memory Cards When the CPU Password Is

Overview: S7-400 Flash Memory Cards and Password Protection

The SIMATIC S7-400 family stores its user program on removable Flash memory cards (F-Cards). The 5 V Flash card 6ES7952-1KM00-0AA0 is a 16 MB card used with S7-400 CPUs to retain the user program, system data, and configuration across power cycles. The block-level password protection that Siemens STEP 7 / SIMATIC Manager offers is bound to the CPU protection level (CPU password) and the know-how protection at the FB/FC/DB block level. These are independent of the memory card itself.

When a field engineer is handed a card that contains a password-protected program, two distinct questions arise:

1. Can the password itself be removed?
2. Can the card be erased so the CPU boots with an empty project?

For the S7-400, the technical reality is that the password cannot be reverse-engineered from a Flash card without the original STEP 7 project or the original programmer. Siemens does not provide a password-recovery utility for S7-400 Flash cards, and the on-card password store uses a hash that is not exposed through any public STEP 7 / TIA Portal interface. The supported workflow is therefore erasure of the entire card via the field programmer (PG) interface. Erasure is destructive: all user blocks, system data, comments, symbols, and configuration are lost. The CPU must then be recommissioned from a fresh STEP 7 / TIA Portal project, or loaded from a known-good backup.

Memory Card Hardware: 6ES7952-1KM00-0AA0 and S7-400 Card Family

The card referenced in the source thread is the 5 V Flash card with Siemens order number 6ES7952-1KM00-0AA0. The 6ES7952 series is the S7-400 Flash card family. The catalog breakdown is summarized in the table below.

Key hardware notes:

• These cards are 5 V parallel Flash cards, not the 3.3 V F-Cards used by S7-300 / S7-1200 / S7-1500. The pinout and erase logic differ; an S7-300 card reader will not accept an S7-400 card.
• The card slots into the S7-400 CPU's battery-buffered card slot or into a Field PG M (such as 6ES7712-.....) equipped with the external programming device adapter for S7-400 cards.
• The card has a mechanical dot indicating pin-1 orientation. The dot must align with the corresponding marking in the PG slot. Forcing a card the wrong way will damage the card and the slot.

What "Password" Actually Means on an S7-400 Card

STEP 7 / SIMATIC Manager (and TIA Portal) implement several distinct protection mechanisms. Confusion between them is the most common cause of "I lost the password" tickets.

For a card extracted from a CPU, the on-card artifacts are the CPU password hash, the encrypted know-how-protection headers, and the bound serial numbers. The TIA Portal "Configuration data password" is a project-side encryption and does not apply to a card pulled out of an S7-400 — it is listed here only because it is a frequent point of confusion when technicians read Siemens documentation across product generations.

Prerequisites for Erasing an S7-400 Flash Card

Carry out the following before any erase operation. Each prerequisite has a specific failure mode if skipped.

1. Backup of any usable data. If you do not yet own the source project, use SIMATIC Manager > File > S7 Memory Card > Read from Memory Card while the card is still accessible. This extracts the offline blocks as they sit on the card. Know-how-protected blocks will still be encrypted, but unencrypted blocks (OB, SFB, SFC) are recoverable.
2. Field PG with S7-400 card adapter. A SIMATIC Field PG M (6ES7712-... variants) or any PG with the external S7-400 Flash card programming device is required. Standard USB SD card readers cannot read these cards.
3. STEP 7 V5.x or TIA Portal with S7-400 support package. SIMATIC Manager (STEP 7 V5.5 / V5.6 / V5.7) is the recommended tool for S7-400 work; TIA Portal can also manage S7-400 cards with the appropriate HSP.
4. PG/PC interface set to PC Adapter (MPI) (Auto) or, when working directly through the card slot, the local programming device interface set to Internal.
5. Physical access to the card with the slot orientation identified. The dot on the card label must face the same direction as the dot/arrow molded into the PG's card slot.
6. Documented authorization. Erase operations are non-recoverable. Have the work order, machine ID, and customer sign-off recorded before pressing Delete.

Step-by-Step: Deleting the S7-400 Flash Card via Field PG

The procedure below uses SIMATIC Manager (STEP 7 V5.x) because it remains the most widely deployed tool for S7-400 service. The TIA Portal equivalent path is described in the next section.

1. Power down the Field PG and insert the 6ES7952-1KM00-0AA0 card into the external programming device slot. Confirm the dot on the card faces the same direction as the marking on the slot. A misoriented card will not seat fully and can be damaged on insertion.
2. Power on the Field PG and allow Windows to enumerate the device. If the card is recognized, the SIMATIC Manager Accessible Nodes view will show a node under the local interface.
3. Launch SIMATIC Manager and close any offline project that might lock the same interface. Open File > S7 Memory Card > Delete... from the menu bar. The exact menu path in localized versions is Datei > S7-Speicherkarte > Löschen... in German STEP 7.
4. Select the target card from the drop-down list of detected S7 memory cards. The dialog displays the card's serial number, capacity, and the project that is currently stored on it. Verify the part number 6ES7952-1KM00-0AA0 matches the card in your hand.
5. Confirm the prompt stating that all data on the card will be erased. The dialog will warn that the operation is irreversible. Click OK.
6. Wait for the format/erase to complete. For a 16 MB card the operation typically takes 20-60 seconds. The progress bar must reach 100% before the card is removed.
7. Remove the card only after SIMATIC Manager reports the operation as complete. Power down the PG before ejecting the card to avoid mid-write corruption.
8. Verify by re-inserting the card and re-opening File > S7 Memory Card > Display.... The card should now show zero blocks and zero bytes used. If the card still shows the previous project, repeat steps 3-6 and verify the dialog was set to Delete rather than Read.

Step-by-Step: Erasing an S7-400 Card via TIA Portal

TIA Portal (V15.1 and later with S7-400 HSP, including V20) supports the same delete operation through the project tree and the card reader view.

1. Open the TIA Portal project or create an empty one with the correct S7-400 CPU device.
2. From the project tree, right-click the S7-400 CPU and choose Online & Diagnostics.
3. Select the Memory group, then Format Memory Card. This action requires a live online connection to the CPU; if the card is in the Field PG, the operation acts on the card through the local programming interface.
4. Confirm the prompt. TIA Portal performs a logical format of the card file system and then a verification read.
5. After formatting, the card is empty. Re-download the new project or insert the card into the S7-400 CPU to start with a clean boot.

For project-side password management (such as the "Password to protect the PLC configuration data" function), refer to the official Siemens TIA Portal V20 documentation: Deleting passwords for protecting confidential PLC configuration data. This document covers the project-encryption password that is set in the TIA Portal project tree, not the CPU password stored on the Flash card; clearing it requires either the current password or full re-creation of the project.

Alternative: MRES on the S7-400 CPU

If the card can be reinserted into the same S7-400 CPU it came from, a CPU memory reset (MRES) clears the CPU's working memory and the password stored in retentive system data. The MRES procedure is:

1. Set the mode switch to STOP.
2. Hold the MRES button and rotate the mode switch through MRES and back to STOP. The CPU's STOP, RUN, and SF LEDs cycle; release the button when only STOP remains lit.
3. After MRES, the CPU is in a clean state. If the card is still installed, the CPU will re-read it on the next power-up; if the card still contains a password-protected program, the CPU will again prompt for the password on the next online attempt. MRES therefore solves the on-CPU password, not the on-card password.

The combination that fully clears a system is: (a) erase the card via the Field PG as described above, (b) perform MRES on the CPU, and (c) reload a new project from STEP 7 or TIA Portal. Only then is the system in a known-clean state with no residual password binding.

Why S7-400 Differs from S7-300 on Card Passwords

The S7-300 series uses a different Flash card format (MMC, 3.3 V, 6ES7953-....) and historically has had third-party utilities published that attempt to clear the CPU password by manipulating the MMC file system. S7-300 cards do not store the same protection headers, and the CPU performs less strict validation of the system data blocks at boot.

S7-400 is fundamentally different:

• The CPU validates the system data blocks (SDBs) against a checksum that includes the protection fields. A corrupted SDB causes the CPU to refuse to enter RUN.
• The 5 V parallel Flash interface does not present itself as a standard block device to the host, so generic Flash utilities cannot be used to bypass the file system.
• Siemens does not document a public tool that can read or write the SDBs on an S7-400 card outside the STEP 7 / TIA Portal software stack.

The practical consequence is that "remove password from S7-400 card" is not a supported workflow. The supported workflow is "erase the card and reload from a project you have authorization to use."

Verification Procedures After Card Deletion

Before reinstalling a freshly erased card into a production S7-400 CPU, run the following checks:

1. Card contents check. Re-insert the card in the Field PG, open SIMATIC Manager > File > S7 Memory Card > Display.... The dialog should show zero user blocks and zero system blocks. If any blocks appear, the erase did not complete and the card must be re-erased.
2. Card capacity check. The display should still report the full nominal capacity of the card (16 MB for 6ES7952-1KM00-0AA0). A reduced capacity indicates that the Flash Translation Layer has flagged bad blocks — the card is at end of life and should be replaced.
3. CPU boot test. Insert the card into the target CPU, power up, and observe the LED pattern. Expected: STOP solid, no SF, no BF. If the CPU shows SF, the system data on the card is inconsistent and the card must be re-erased.
4. Project download test. With the empty card in place, download a known-good test project (a single OB1 with no I/O references) to confirm the CPU-to-card write path is functional before re-installing in the running process.

Troubleshooting Matrix

Best-Practice Recommendations for S7-400 Card Lifecycle

1. Treat every Flash card as the only copy of the program. Maintain a current STEP 7 / TIA Portal project archive on a network share or version control system, with a copy offline. The card is the runtime copy; the archive is the source of truth.
2. Store the CPU password in a password manager tied to the asset. Loss of the password is functionally equivalent to loss of the source code for know-how-protected blocks.
3. Document the card orientation in the maintenance procedure. The "dot" mark is the only visual indicator on 5 V cards and is easy to misread in poor lighting.
4. Audit card age. 5 V Flash cards have a limited write endurance. For applications with frequent online changes, replace cards every 5-7 years as preventive maintenance. Use the next-larger capacity variant when scaling up to reduce write amplification.
5. Label cards with the asset tag and the date of last program change. This avoids the situation in which an unknown card is pulled from a drawer and nobody knows which machine it belongs to.

FAQ