Preventing CFC from Overwriting Recipe DBs in S7-400 with STEP 7

1. Problem Overview

On a multi-CPU SIMATIC S7-400 station built with five CPU 416-2 or CPU 416-3 controllers and programmed with STEP 7 V5.4 plus the SIMATIC CFC optional package, recipe data (setpoint values, board counts, and process parameters — typically 1000 bytes per recipe) is stored in dedicated Data Blocks (DBs) located in the S7 program of each CPU. The reported fault is that whenever the engineer performs a full CFC compile, or even a partial chart compile, the resulting Download to Target System operation overwrites the actual values inside the recipe DBs in the online PLC, corrupting production state and causing the line to trip.

The behavior is reproducible across the five controllers in the project, and is independent of whether the engineer triggers the download from SIMATIC Manager (Menu: PLC > Download) or from the CFC editor itself (Chart > Compile and Download). Operators report that the DBs revert to the offline image stored on the engineering station rather than the live values accumulated during the running batch.

2. Affected Hardware and Software Stack

The fault is not limited to the S7-416 — the same symptom occurs on S7-414 and S7-417 controllers whenever the same code pattern is used. The CPU 416 is simply the most common platform for recipe-heavy process cells in the SIMATIC S7-400 range.

3. Root Cause: Why CFC Re-downloads the Recipe DBs

The CFC compiler does not treat the S7 program's Blocks folder as read-only. When the engineer runs Chart > Compile > Charts as Program (or the equivalent in the SIMATIC Manager context menu), the compiler performs the following sequence:

1. Walks the entire Charts folder of the S7 program and resolves every block reference, including FB/FC calls embedded in CFC sheets.
2. Generates or updates instance DBs for every FB used in a chart, including multi-instance hierarchies.
3. Generates the CFC runtime OB (typically OB1 and any priority-class OBs that contain chart-in-chart or cyclic tasks) and the associated system data blocks (SDBs).
4. Produces a download delta that the Download to Target System dialog uses to update the CPU.

The crucial detail: when the engineer selects the option “Download all blocks” (or the default action after a full compile, which pre-selects everything), the download includes any DB that exists in the Blocks folder of the program — not only the instance DBs that CFC owns. The offline image on the engineering station was created from the most recent project save, so any setpoint or counter value that the operator modified online is wiped when the offline image is written back to the PLC.

CFC's behavior in this respect is documented in the SIMATIC CFC for S7 manual: the compiler does not differentiate between instance DBs it generated and pre-existing DBs sitting in the S7 program's Blocks folder. The download is governed by STEP 7's general block-download logic, not by CFC's chart logic.

4. Restart Types and Their Effect on Recipe Data

S7-400 supports four restart classes. The restart type determines whether the CPU retains or re-initializes DB contents after a stop/run transition:

For the reported fault, the actual restart class is largely irrelevant — the corruption happens at the download step, not at the restart step. However, if the project team also performs cold restarts as part of commissioning, recipe data can be lost twice: once at the download and once at the cold restart initialization.

5. Solution 1 — Isolate Recipe DBs from the CFC Download Scope

The cleanest engineering answer is to make sure the recipe DBs are never included in a CFC-driven download. Three implementation patterns work in STEP 7 V5.4:

5.1 Place recipe DBs in a separate S7 sub-program

STEP 7 V5.4 supports S7 Programs as containers inside an S7 project. Create a child program called, for example, Recipes, that sits beside the CFC chart program:

• Open SIMATIC Manager, right-click the S7-400 station, choose Insert New Object > S7 Program.
• Name it Recipes and place all recipe-related DBs inside it.
• In the CFC chart program, do not reference these DBs directly with absolute addresses. Instead, create a thin FC interface (e.g., FC1050 "RecipeRead", FC1051 "RecipeWrite") that lives in the chart program and exchanges data with the recipe DBs via any-pointers or block-to-block parameter passing.
• Mark the Recipes program as “S7 Program not assigned to a CFC chart” (set the program property CFC-Integration: No).

With this layout, the CFC compiler walks only the ChartProgram subtree, the download delta never lists the recipe DBs, and the engineer can recompile any chart without overwriting recipe actual values.

5.2 Move the recipe DBs out of the Blocks folder referenced by the chart

If the project is not refactored to use a child program, an alternative is to keep the recipe DBs in the same S7 program but ensure that:

1. The recipe DBs are not generated as instance DBs of any FB referenced from a CFC sheet.
2. Each recipe DB is opened in the LAD/FBD/STL editor and its object properties → “Block is write-protected in PLC” flag is set, then the DB is downloaded once to seed initial values. After that, the DB is excluded from subsequent downloads via the download dialog.

5.3 Use the “Skip blocks on download” option in CFC download dialog

The CFC-specific download dialog offers a “Skip user blocks” / “Only download CFC-generated blocks” toggle in the Options menu. Enable it permanently in the project settings:

1. In the SIMATIC Manager, choose Options > Settings > Download.
2. Check “CFC: only download chart-related blocks” (the wording varies slightly between CFC V6.1 and V7.0).
3. Apply project-wide. Verify the option is sticky across engineers by editing the S7proj registry hive or by re-applying on each engineering station.

6. Solution 2 — Use Persistent Instance DBs

If the recipe data must live inside an FB instance DB (because the application calls the recipe through a typed block interface), the FB and its instance DB can be declared persistent in CFC. Persistent instance DBs are not re-initialized by the CFC compiler on download.

The procedure is documented in the SIMATIC CFC for S7 manual under “Persistent data”:

1. Open the CFC chart and select the block instance that owns the recipe data.
2. Open Instance Properties > Special Object Properties.
3. Enable “Persistent data” (attribute S7_persist := true). For multi-instance FBs, enable the flag on the parent FB so the persistence is inherited.
4. Compile the chart. The generated instance DB now carries the S7_persist attribute, and STEP 7's runtime preserves its actual values across downloads and warm restarts.

7. Solution 3 — External Recipe Server Architecture

For plants where recipes change frequently (multiple recipes per shift, per product family, per customer), keeping the data inside the PLC is the wrong abstraction. Move the recipes to an external store and let the PLC act only as a cache:

For the reported project (5 x CPU 416, 1000-byte recipes, frequent changes), the recipe-server approach is the most defensible long-term answer. The PLC retains only the active recipe (the one currently driving the process) in a small 1000-byte DB, fetched from the server on every job start and written back on job end. Historical versions are kept on the server with timestamps.

8. Solution 4 — Recipe Management via HMI (WinCC flexible / TIA Portal)

WinCC flexible and TIA Portal both ship a Recipe object type that stores recipe data as CSV files on the HMI panel or on a network share. The PLC receives the active recipe through a structured tag interface, and the HMI handles all versioning. The relevant STEP 7 side is to keep the PLC's runtime recipe DB small (just the active values) and to add a handshake area (e.g., DB900 "RecipeHMI") for Load / Save requests. Because this DB is not referenced from any CFC chart, it is invisible to the CFC download delta.

9. Step-by-Step Implementation: Isolating Recipe DBs from CFC

The following procedure is the lowest-risk migration path and assumes the recipes are currently sitting in DBs inside the CFC chart program.

9.1 Prerequisites

• STEP 7 V5.4 SP5/SP6 installed and licensed (Floating License or Trial License).
• SIMATIC CFC optional package installed; verify in SIMATIC Manager > Help > About that CFC version matches the STEP 7 version.
• Online backup of all five CPUs taken with PLC > Upload Station to PG for every CPU (stop, upload, repeat per CPU).
• Offline backup of the S7 project folder on a network share (VOB or project archive).
• Maintenance window for the plant, because the migration includes a full download of the chart program.

9.2 Procedure

1. Inventory recipe DBs. Use Options > Reference Data > Display in SIMATIC Manager to find every DB that is referenced by the chart program but not generated as an instance DB by CFC. Mark them in a project document.
2. Create the Recipes sub-program. Right-click the S7 station, Insert New Object > S7 Program, name it Recipes. Do not assign it to a CFC chart.
3. Move the recipe DBs. Drag-and-drop the recipe DBs from the chart program's Blocks folder to the Recipes program's Blocks folder. STEP 7 V5.4 will warn about symbol table links — re-associate the symbols in the new program's symbol table, or update the symbol table to point to the new DB numbers (STEP 7 renumbers DBs in the order they appear in the program if the slot is free).
4. Refactor the chart-side access. Replace every direct DB access in CFC (via the “Data block” element on a sheet) with an FC call that points to the DB in the Recipes program. Use the any-pointer pattern:
   p#DB100.DBX0.0 BYTE 1000 passed as ANY input to FC1050 for read access, and WORD return for status.
5. Compile the chart. Chart > Compile > Charts as Program. Verify in the message log that no errors reference the recipe DBs.
6. Open the download dialog and un-check the Recipes program. From PLC > Download, select the chart program only, and ensure the Recipes program is unchecked. (In STEP 7 V5.4 this is done by right-clicking the program and choosing Do not download on the context menu of the program object.)
7. Enable “Skip user blocks” in CFC options (Section 5.3) so future engineers cannot accidentally include the recipe DBs in a quick download.
8. For the first download after the migration: perform a full download of the chart program. The recipe DBs in the Recipes program remain untouched in the CPU's online image, but the engineer must verify the data using PLC > Monitor/Modify and compare the actual values against the values that were online before the download.

9.3 Verification

• In SIMATIC Manager, open PLC > Online > Compare Blocks. The result must show the recipe DBs as identical (green check) between offline and online.
• In CFC, perform a Chart > Compile followed by Download to Target System with the default options. The message log must report “0 user blocks downloaded”.
• Trigger a recipe change at runtime (operator selects Recipe 14). Read back the recipe DB with Monitor/Modify after the change and confirm the new values are present.
• Cycle the CPU to STOP and back to RUN with the selector. Verify the recipe DB actual values are preserved (warm restart behavior).

10. Defensive Settings to Apply Project-Wide

11. Troubleshooting Matrix

12. Long-Term Recommendations

For a plant with five CPU 416 controllers and recipe-driven production, the engineering process should be changed, not only the project. Recommended practices:

• Establish a download checklist that requires the engineer to (a) upload the active recipe DBs from every CPU, (b) save the upload to a timestamped folder, (c) perform the chart compile and download, (d) verify the recipe DBs are still identical to the upload.
• Move recipes out of the PLC on a multi-year roadmap. The 1000-byte recipe fits comfortably in a WinCC recipe object, a PCS 7 batch server, or a small SQL-backed custom service. Keeping recipes in PLCs couples control software to product engineering and is a known driver of unplanned downtime.
• Upgrade to STEP 7 V5.5 / V5.6 if the project is still in maintenance. The download dialog in those versions separates user blocks from chart-generated blocks more cleanly than V5.4. Alternatively, plan a move to PORTAL / TIA Portal with the corresponding CFC and S7-400 migration package, but only after a controlled production gap.
• Use know-how protection on the FB that owns the recipe structure so a casual engineer cannot remove the S7_persist flag while editing the FB.

13. FAQ