Loading S7-300 Programs to MMC Without CPU Available

Overview

A frequent field scenario: an S7-300 PLC (typically an S7-315-2PN/DP) is already installed at a customer site, often overseas, and a program change is required. The integrator who wrote the project no longer has a spare CPU on the bench, no programming device (PG), and the standard PLC > Download workflow is not directly available. The question is whether the updated project can simply be written to a SIMATIC Micro Memory Card (MMC) on a desk PC and shipped to the customer for plug-in installation.

The short answer: yes, but only with Siemens-specific tooling. The SIMATIC MMC is a proprietary NAND-flash module with a Siemens file system. It cannot be written using a consumer SD/MMC card reader or by copying files from a Windows desktop. There are exactly two sanctioned ways to write a STEP 7 project to an MMC, and both are detailed below.

Why the SIMATIC MMC Is Not a Standard Flash Card

The SIMATIC Micro Memory Card used by the S7-300 looks similar in size to a standard MMC card, but it is not interchangeable with consumer flash media. The differences are deliberate and load-bearing.

• Connector and form factor: SIMATIC MMCs use a specific connector pinout and a custom plastic shell. The card mates with a push-push socket on the CPU's front panel. Standard MMC adapters for USB readers do not seat correctly and do not expose the write-protect signaling Siemens uses for block-level protection.
• File system: The MMC is pre-formatted with a Siemens-specific file system that holds the S7 system data blocks (SDBs), the user blocks (OB, FB, FC, DB, SFB, SFC), the project tree, and the CPU's identification and serial data. A FAT-format consumer reader cannot see or place these files in the order the CPU expects.
• Block alignment: STEP 7 places blocks in a specific on-card order (system data first, then user program) and embeds checksums the CPU validates on startup. Manually copying a file from a Windows explorer window fails the validation and leaves the CPU in STOP with a diagnostic buffer entry pointing to a corrupt SDB.
• Voltage and signaling: SIMATIC MMCs operate at 3.3 V logic levels with Siemens-specific bus protocol. A standard USB card reader cannot produce this signaling and will not enumerate the card as a storage device.

MMC as the S7-300 Load Memory

Per the Siemens S7-300 functional description, the MMC is the load memory of every current S7-300 CPU. The system memory and work memory are integrated on the CPU itself, but the load memory is non-volatile storage on the removable MMC. A current S7-300 CPU will not enter RUN without an MMC inserted, and the project must be downloaded to the MMC for the PLC to operate.

For the S7-315-2PN/DP this means:

• Removing the MMC stops the CPU from running user code on the next power cycle.
• Inserting a different MMC with a different program re-loads the CPU on the next start (cold or warm restart, depending on the configured startup mode).
• The CPU retains retentive data in its internal battery-backed RAM only while power is maintained; on power loss without the MMC, the CPU has no program to restart from and any retentive state is lost.

The MMC can be written in two CPU states: the CPU supports writing to the MMC in both RUN and STOP modes, subject to the active protection and password settings. The PC tools described in the next sections can write the MMC regardless of CPU state because they bypass the CPU entirely.

Prerequisites

Before choosing a write method, confirm the following items are available on the engineering bench.

Hardware

• Updated STEP 7 project (a .s7p SIMATIC Manager project, or a compiled archive in .zip / .arc format) with the target hardware configuration matching the installed CPU.
• SIMATIC MMC of sufficient size for the project. A 2 MB MMC covers the vast majority of S7-315-2PN/DP programs; 4 MB or 8 MB is recommended for projects with many SDBs, large DBs, or extensive HW Config data. Newer S7-300 CPUs with recent firmware accept cards up to 8 MB; older 3.3 V MMCs are orderable in the 6ES7953-8L range.
• One of the following tools:
  • Siemens S7-PROM USB programming device for direct MMC programming on a desk PC. The S7-PROM USB accepts both classic EPROM memory modules (S7-400 and older S7-300) and the SIMATIC Flash MMC (S7-300, ET 200S, ET 200pro).
  • A spare S7-300 CPU of the same or compatible type, with a working MMC slot, plus a 24 V DC power supply (SITOP or equivalent) sized for the CPU and any inserted signal modules, and a programming cable (MPI USB or PROFINET) to a PG/PC.

Software

• STEP 7 V5.5 (with the latest Service Pack) for the S7-PROM USB workflow. The S7-PROM USB tool installs as part of the standard STEP 7 V5.5 setup and appears as a separate entry under SIMATIC > STEP 7 > S7-PROM USB.
• If the project was edited in TIA Portal, recompile and re-archive the project to STEP 7 V5.5 compatibility, or use TIA Portal's own MMC write function on a connected CPU or TIA-supported prommer. (See the TIA Portal section below for the workflow differences.)
• The project must be consistent and compile cleanly. Open the project offline and run Station > Consistency Check before any write.

Comparison of the Two Approved Methods

Method 1: Siemens S7-PROM USB Prommer

The S7-PROM USB is a USB programmer that accepts SIMATIC memory cards and writes STEP 7 projects to them from a desk PC. It is the only Siemens-sanctioned method that does not require a CPU on the bench. The prommer is recognized by STEP 7 as a programming device and presents the inserted card to the engineering PC as a Siemens-proprietary target.

Setup

1. Install the S7-PROM USB driver from the STEP 7 V5.5 installation media. The driver registers a USB-HID device on the engineering PC; no virtual COM port is required on current firmware.
2. Connect the S7-PROM USB directly to a USB 2.0 or USB 3.x port on the engineering PC. Avoid unpowered USB hubs; the prommer draws up to 500 mA and some hubs do not enumerate it correctly, leading to intermittent write failures.
3. Insert the SIMATIC MMC into the prommer's slot, label side up. The slot is keyed; do not force the card. The prommer LED should change from red to green within 2 seconds, indicating the card is recognized.

Writing the project

1. Open the updated STEP 7 project in SIMATIC Manager.
2. Select the S7 station in the component view and double-click the Hardware object once to load HW Config into memory.
3. Right-click the CPU (e.g., CPU 315-2 PN/DP) and choose PLC > Save to Memory Card (German: PLC > Auf Memory-Card speichern). The same function is available from the menu bar.
4. In the dialog that opens, choose the S7-PROM USB as the target device. STEP 7 will list the prommer and the inserted card with its size in bytes.
5. Confirm the target card size matches the MMC inserted in the prommer. STEP 7 will warn and refuse to proceed if the project footprint exceeds the card's free space.
6. Click Save or OK. STEP 7 erases the card (if it contains data), formats it, and writes the system data blocks, user blocks, and project metadata in the Siemens order expected by the CPU.
7. Wait for the Save completed status in the STEP 7 status bar. The prommer's LED will flash during the write and return to solid green on completion. Do not remove the card or the prommer before the operation reports success; an interrupted write leaves the card in a partially formatted state.

Verification on the bench

1. With the MMC still in the prommer, use the S7-PROM USB tool to read back the card's directory. The tool lists the SDBs, user blocks, and their on-card checksums.
2. Confirm the system data blocks (SDBs) and the user blocks (OB 1, FB/FC/DB as required) appear in the card's directory listing. A missing SDB is the most common fault after a corrupted write.
3. Compare the block checksums. Open each block in the offline project, select Block > Properties, and note the checksum. Re-open the same block in the card's directory and compare. Any mismatch indicates a write fault and the card must be rewritten.
4. Record the block count and the Save completed timestamp on a sticker attached to the card. This becomes the project's hash for the field engineer to confirm against on site.

MMC write time reference

A 2 MB MMC takes roughly 30 to 90 seconds to program, depending on the prommer firmware revision, the USB port, and the project's SDB count. Larger cards (4 MB, 8 MB) and projects with several hundred SDBs can take several minutes. Do not interrupt the write; a powered-down PC mid-write produces an unusable card.

Method 2: Program the MMC in a Spare S7-300 CPU

If an S7-PROM USB is not available, the second sanctioned method is to program the MMC in a similar S7-300 CPU, then move the card to the target CPU on site. This is a common path in plants that keep a spare CPU on the maintenance shelf.

Hardware needed

• Spare S7-300 CPU of the same family. A 315-2 PN/DP is ideal, but a 314 or 317 in the same family can also host a project for a 315-2 PN/DP, provided the receiving CPU supports the SDBs in the project and the spare CPU outranks or equals the receiving CPU's instruction set.
• SIMATIC MMC of the same type and size used on site. Mixing 3.3 V and 5 V MMCs across CPUs from different generations is a common source of "MMC not recognized" faults on first power-up.
• 24 V DC power supply (a Siemens SITOP or equivalent) sized for the CPU and any inserted signal modules (SMs). A bench-top supply at 2 to 5 A is sufficient for a CPU-only setup.
• Programming cable: MPI USB adapter (PC Adapter USB A2) for MPI/PROFIBUS, or a standard Ethernet cable for PROFINET on the 315-2 PN/DP.
• PG/PC running STEP 7 V5.5 with the updated project.

Procedure

1. Power up the spare CPU with the MMC inserted. Set the mode switch to STOP for the download; the write is not destructive to the project, but STOP prevents the CPU from running a partial program during the download.
2. Connect the PG to the CPU. Use PROFINET for the 315-2 PN/DP via the CPU's integrated port (X1), or MPI for older CPUs.
3. Set the PG/PC interface in STEP 7 to match: PC Adapter (MPI) for MPI/PROFIBUS, or TCP/IP > <network card> with the CPU's PROFINET IP for the 315-2 PN/DP. The CPU's default PROFINET IP is 0.0.0.0; assign a temporary IP via the Accessible Nodes wizard if the project does not carry a fixed IP.
4. Open the updated project, right-click the CPU in the component view, and choose PLC > Download to Target Device, or use the toolbar Download button. Confirm any prompt about overwriting the existing program on the card.
5. STEP 7 will write the system data and user blocks to the MMC. The CPU's SF and STOP LEDs will flash during the write; RUN will remain off while in STOP mode.
6. After the download completes, choose PLC > Online > Compare Blocks to verify the online image on the card matches the offline project. Resolve any timestamp mismatch or object differences before extracting the card. A timestamp mismatch typically means the project on the card is from a prior compile; re-do the download.
7. Power down the spare CPU, remove the MMC, and place it in an anti-static bag. The card now holds the updated program ready for shipment.

STEP 7 Project Preparation Before the Write

Whether the prommer or a spare CPU is used, the project must be cleaned up before the MMC is written. Field engineers often skip this step and ship a card that fails the CPU's startup check at the receiving site.

Checklist

1. Hardware configuration matches the site. Open HW Config and confirm the rack layout, the CPU order number (for example, 6ES7 315-2EH14-0AB0 for a 315-2 PN/DP), and the slot assignments of every SM/FM/CP. The order number must match the receiving CPU's MLFB exactly. Different order numbers for the same model (e.g., 6ES7 315-2EH13 vs 6ES7 315-2EH14) carry different firmware and feature sets.
2. SDB consistency. Run Station > Consistency Check in SIMATIC Manager. Resolve all reported errors. Common issues are leftover SDBs from old hardware, orphan system connections, and stale PROFIBUS/PROFINET device entries.
3. Block compile. Right-click the S7 program and choose Compile > All (with SDB generation). This regenerates the system data blocks and embeds the latest HW Config parameters.
4. Passwords and know-how protection. If the program has block passwords, the customer must have them on site, or the project must be re-saved with the protection removed for the duration of the field update. The CPU will request a password on every cold restart if the blocks are protected.
5. Retentive and non-retentive data layout. Confirm the retentive bit memory, retentive DB areas, and the remanence of timers and counters are correctly set for the receiving CPU. Some S7-300 CPUs reset retentive areas after a memory reset or MMC swap.
6. Project size vs. card size. The compiled project's footprint must be less than the card's free space. STEP 7 reports a capacity error before writing; do not override it.

Quick parameter reference

Preparing the MMC and Writing the Project

Before the card is inserted in the prommer or the spare CPU, prepare it physically.

1. Inspect the connector edge of the MMC. Bent or oxidized contacts cause write errors or boot failures on the receiving CPU. Replace the card if the edge is damaged; do not attempt to straighten pins on a SIMATIC MMC.
2. If the MMC is a recovered card from a prior project, use the prommer's Format function (or the CPU's PLC > Format Memory Card function in STEP 7) to wipe it. STEP 7 will format the card automatically on a Save to Memory Card operation, but pre-formatting speeds up the write and prevents stale SDBs from contaminating the new project.
3. Label the card with the project name, project version, and the date. Use a paper label on the plastic shell, never a sticker over the contacts.
4. Write the project using one of the two methods above. Record the block count and the Save completed timestamp on the label.

Using TIA Portal as the source

If the project lives in TIA Portal (STEP 7 Professional), the path to a STEP 7 V5.5 MMC is to recompile and re-archive to .zip format and import into SIMATIC Manager. TIA Portal's own card write functions require either a connected CPU or a TIA-supported prommer (functionally similar to the S7-PROM USB, but installed as part of the TIA Portal setup). For S7-300 projects that are still maintained in classic STEP 7, the S7-PROM USB workflow is the most direct path. For S7-300 projects that live in TIA Portal, write through the TIA Portal card reader workflow and verify the same way.

Field Procedure: Shipping the MMC to a Remote Site

For an overseas shipment (the original scenario referenced an S7-300 shipped to China), the following packaging and chain-of-custody steps reduce the risk of a card arrived but won't boot outcome.

1. Place the MMC in an anti-static shielded bag. Standard pink anti-static bags are not ESD-shielded; use a metallized (silver) bag for shipping.
2. Wrap the card in foam and place it in a rigid box. SIMATIC MMCs are mechanically robust, but the connector edge is the only seating feature and a bent edge means the card will not insert on site.
3. Ship the card with a printed project hash list: a one-page table listing the block number, block type, and checksum for every block on the card. The on-site engineer can re-compute the checksums and confirm the card is intact before powering the CPU.
4. Include a one-page reset procedure: power down, remove the existing MMC, insert the new MMC, power up, observe the CPU's diagnostic LEDs (SF, BF, RUN, STOP) and record the state for the first 30 seconds. If the CPU stays in STOP with a steady SF LED, the card is incompatible and the original card must be re-inserted before further action.
5. Provide remote support. Have the receiving engineer on a voice or video call with the integrator during the swap. The integrator can read the diagnostic buffer over a remote PROFINET connection if the customer's network allows it.

On-Site Verification and Commissioning

Once the new MMC is inserted, the receiving CPU performs a startup that loads the program from the card. The exact behavior depends on the configured startup mode and the integrity of the SDBs on the card.

LED sequence expectations

On-line checks via PROFINET

1. From the engineering PC, connect to the CPU's PROFINET interface (use the same TCP/IP interface as the original bench setup). Confirm the PC and the CPU are on the same subnet or that a route exists between them.
2. Open STEP 7 V5.5 and choose PLC > Online > Accessible Nodes. Confirm the CPU is reachable and reports the correct order number and firmware.
3. Open PLC > Online > Compare Blocks and confirm the online image matches the offline project. If a timestamp mismatch appears, the online program is from a different compile; verify the customer is running the expected revision.
4. Open PLC > Diagnostic Buffer and scan the recent entries. A clean warm restart shows a single Restart (warm) event. A fault entry with SDB loading error or Module parameter assignment error points to a hardware/configuration mismatch that must be resolved before commissioning.

Functional verification

1. With the CPU in RUN, exercise the modified code paths. If the change was in a function block, force the inputs and observe the outputs (or use a VAT table to step through the logic).
2. Check the retentive data on the receiving CPU against the commissioning sheet. A different retentive layout can scramble machine state after a swap.
3. Document the as-built configuration: which MMC is in the CPU, its order number, the project hash, and the diagnostic buffer state at handover.

Common Errors, Limits, and Recovery

Card capacity exceeded

STEP 7 reports a capacity error if the project footprint exceeds the free space on the MMC. The error message includes the project size in bytes and the free space. The remedy is to use a larger MMC (the S7-300 supports cards up to 8 MB on current firmware; some newer CPU firmware revisions support larger cards) or to compress the project by removing unused blocks. Block compression in STEP 7 (Options > Block Layout) will reduce on-card size, but the project still needs to fit on the card as compiled.

SDB version mismatch

The receiving CPU reports a diagnostic buffer entry such as System data block SDB 1000 has an invalid version if the SDB was generated against a newer CPU firmware than the receiving CPU supports. The remedy is to rebuild the project against the older firmware or to upgrade the receiving CPU's firmware. The latter requires the customer to have the firmware file and a means to load it; field firmware upgrades typically use the S7-PROM USB or a web-based PROFINET update.

Card write interrupted

If the prommer's USB cable is disconnected or the PC sleeps mid-write, the MMC is left in a partially formatted state. Re-insert the card into the prommer and run the Format MMC function before re-attempting the write. If the prommer reports a write error after the format, the card is damaged and must be replaced.

Card inserted, CPU stays in STOP with SF on

Most common cause: the SDBs in the project do not match the actual hardware at the receiving site. The customer's cabinet may have been re-wired, a module may have been swapped, or a module may be in a different slot than the project assumes. Open the diagnostic buffer from online, identify the SDB number that failed, and re-compare the project against the actual rack layout. If the site hardware has changed, an on-site PG is required to update the HW Config and re-generate the SDBs.

PROFINET devices not coming up

If the original site has a PROFINET topology (315-2 PN/DP with distributed I/O on PROFINET), the project must carry the device names of every PROFINET device. The MMC write does not assign device names; the PROFINET devices retain their names from their internal storage. If a new device has been added or an existing device's name has been cleared, the CPU will report a PROFINET IO controller: device failure in the diagnostic buffer. The on-site engineer must use PRONETA or the PG's Assign PROFINET device name function to re-name the devices.

Password-protected blocks and missing passwords

If the project has block passwords or S7-300 CPU access protection, the customer must have the password on site. A CPU in Complete protection mode will not allow the new program to start without the password. The remedy is to either re-save the project with the protection removed for the field update, or to ensure the on-site engineer has the password and the time to enter it during the cold restart.

Alternative Strategies When the CPU Is Already Installed

If a spare CPU or an S7-PROM USB is not available on the integrator's side, the only fully sanctioned alternative is to bring a programming tool to the site. The following options keep the project update within Siemens-approved workflows.

• Send a PG with the installation team. A SIMATIC Field PG (or any ruggedized laptop with STEP 7 V5.5 installed) is the most reliable path. The PG connects to the CPU via MPI, PROFIBUS, or PROFINET and performs a standard online download. This is the recommended method when the receiving site has restricted or no internet access.
• Remote access via a VPN and a remote PG. A PG connected to the customer's network via a secure VPN can access the CPU over PROFINET. This requires the customer's network team to open a route to the CPU's IP and the integrator to be reachable during the change window.
• Third-party programming service on site. A local Siemens Solution Partner or system integrator in the destination country can perform the download. The partner uses its own PG and the project's archive file (.zip of the S7 project) shared over a secure channel. The integrator reviews the change remotely over a video call.
• Tele-service via the S7-300's web server. The S7-315-2 PN/DP exposes a diagnostic web server on PROFINET. While the web server cannot write a new program, it can read the diagnostic buffer and the CPU's online state, which is enough to triage a failed MMC swap remotely.

None of these methods is preferred over the S7-PROM USB for a remote-update scenario, but they are the right fallback when the on-bench tooling is missing. The MMC-write methods remain the cleanest path for a single, well-defined program change that must be deployed without a field engineer present.

Troubleshooting Matrix

FAQ