Recovering S7-300 Program from MMC Without Original CPU

1. Problem Statement

An S7-300 MMC (Micro Memory Card) contains the entire project state of a CPU 31x, including the user program, system data (HW Config), and—for CPUs with FW ≥ V2.0—firmware updates. When the original CPU is missing, damaged, or unavailable, engineers are frequently asked to extract the project from a standalone MMC using only a different S7-300 CPU from stock, a Field PG, or a third-party prommer.

This article documents the engineering-proven procedure to:

• Read MMC contents without the matching CPU
• Recover the HW Config (station configuration, bus parameters, module parameters)
• Validate that the recovered project will download into a substitute CPU
• Clone a working MMC for backup or migration

2. S7-300 MMC Card Fundamentals

The MMC is a serial NAND flash card (not an SD card in older form factors) that plugs into the slot on the front of every CPU 31x. Siemens MMC catalog numbers include 6ES7 953-8LFxx-0AA0 (64 KB) through 6ES7 953-8LMxx-0AA0 (8 MB). The card is a passive storage medium: the CPU's loader firmware reads it during startup and writes to it during project download/online edits.

The card is divided into three logical partitions visible only through the Siemens loader:

1. System data partition – HW Config, CPU parameters, bus parameters for MPI/DP/PN interfaces, module parameter records
2. User blocks partition – OB, FB, FC, DB, SFB, SFC, SDB containers (incl. SDB 0, SDB 1000–1099 for PG/PC assignment)
3. Optional firmware partition – present on CPU 31x with FW ≥ V2.0 when FW updates were loaded to flash

3. Prerequisites

Before attempting MMC recovery, verify the following items are available:

4. Reading the MMC with a Field PG Internal Prommer

The Field PG family (M2, M3, M4, M5) ships with a built-in MMC/SD prommer slot on the right side of the chassis, accessible after opening the protective cover. STEP 7 V5.x and TIA Portal both detect the slot as a standard S7 prommer and expose the contents through the file system browser.

4.1 Procedure

1. Power off the Field PG.
2. Insert the source MMC into the prommer slot. The label faces up, contacts face down.
3. Power on the Field PG and launch STEP 7 Manager (or TIA Portal).
4. From the menu select PLC → Memory Card File Browser (STEP 7 V5.x) or Online → Card Reader/USB Prommer (TIA Portal).
5. The browser shows two folders: \S7_JOB and \SIMATIC. The user blocks and HW Config are stored under \SIMATIC\S7.
6. Right-click the project root and select Upload to PG. STEP 7 will reconstruct a project from the SDBs and blocks.

4.2 Expected Result

The recovered project will contain:

• S7 Program folder with all blocks
• Source code comments (if symbol export was enabled)
• System data blocks (SDB) covering CPU parameters, MPI/DP/PN interface configuration, and module parameter records

5. Reading the MMC with an External Prommer

When no Field PG is available, a standalone MMC prommer (e.g., Siemens 6ES7 792-0AA00-0XA0 PCMCIA adapter, or the discontinued Siemens Prommer for S7 MMC) can be used. Third-party prommer vendors that support S7 MMC include:

• Softing S7/S5 Prommer
• IBH Softec S7-SoftPLC reader
• Helmholz S7-MMC USB Prommer (part number 700-972-0AA01)

5.1 Procedure

1. Connect the prommer to the PC via USB or parallel port (driver installation per vendor manual).
2. Launch STEP 7 and open PLC → Memory Card File Browser.
3. Select the external prommer as the device.
4. Browse to \SIMATIC\S7 and select the project root.
5. Choose Upload Station to PG to perform a full station upload, or Upload Blocks Only for a partial recovery.

5.2 Binary Image Capture

For forensic recovery when STEP 7 cannot parse the card (corrupted SDB, mismatched FW), capture the raw binary image:

1. Use a vendor utility (e.g., Helmholz PrommerTool) to read the entire MMC to a .bin file.
2. Open the image in a hex editor and look for the SDB signatures: 0A 00 70 00 at the start of the system data partition.
3. Decode the SDBs manually using the SDB layout in the STEP 7 Online Help (Help → S7 Reference Help → System Data Blocks).

6. HW Config Recovery Procedure

Recovering the station configuration is the most failure-prone step. The forum discussion confirms that the system data blocks must accompany the user blocks for the substitute CPU to accept the download.

6.1 When Original HW Config Is Available

1. Open the original STEP 7 project (offline archive).
2. Open HW Config and verify the station matches the source CPU's MLFB.
3. If the substitute CPU has a different MLFB (e.g., 6ES7 315-2EH14 instead of 6ES7 315-2AH14), right-click the CPU and select Replace Object → choose the new MLFB.
4. Compile and save (Station → Save and Compile).
5. Download only the HW Config to the substitute CPU: select the CPU in HW Config → PLC → Download to Target System.

6.2 When HW Config Is Not Available

Reconstruct the station by inspecting the SDBs extracted from the MMC:

1. Open STEP 7 → PLC → Upload Station to PG against a powered substitute CPU that contains the source MMC.
2. If upload succeeds, STEP 7 will reconstruct HW Config from the SDBs on the MMC.
3. If upload fails with SF (System Fault) LED lit, clear the CPU first: PLC → Clear/Reset. Then reinsert the source MMC and attempt upload again.

When neither path works, manually reconstruct the station by examining the physical hardware: rack (UR/ER), CPU slot, IM, signal modules, function modules, and CP/IM interfaces. Use the device labels (MLFB stickers) to match modules in the STEP 7 hardware catalog.

7. Cloning an MMC for Backup or Migration

The simplest case is producing a backup MMC from a working card. The forum confirms that this can be done with a bit-for-bit copy when the destination card has equal or greater capacity.

7.1 Step-by-Step Cloning Procedure

1. Insert the source MMC into the Field PG's prommer slot.
2. Open Start → Programs → STEP 7 → Memory Card File Browser.
3. Select the source MMC. Note the project name and size.
4. Insert a destination MMC of equal or greater capacity.
5. From the menu, select Card → Copy MMC to MMC (or use the right-click context menu on the source card).
6. Confirm the operation. STEP 7 reads the source, formats the destination, and writes the image.
7. Verify by reading the destination MMC back and comparing block checksums.

8. Uploading to a Substitute CPU

Once the project is recovered and HW Config is reconstructed, download to the substitute CPU:

1. Connect the Field PG to the substitute CPU's MPI/DP/PN port (MPI for first download, PN/DP if MPI is configured for a different subnet).
2. Set the PG/PC interface to PC Adapter (MPI) → Local (or appropriate interface).
3. Open SIMATIC Manager and the recovered project.
4. Select the CPU in the project tree → PLC → Download to Target System.
5. If STEP 7 prompts "Do you want to overwrite the existing system data?", click Yes to load the recovered HW Config.
6. Wait for the download to complete. The CPU will perform an overall reset and enter STOP.

8.1 Common Download Errors

9. STEP 7 V5.x vs TIA Portal Considerations

The project format on the MMC is the same regardless of which tool generated it. However, blocks generated in TIA Portal V15+ use SCL source format that STEP 7 V5.4 cannot parse. If the project was last saved in TIA Portal, you must use TIA Portal to upload from the MMC. The reverse is generally not true—V5.x projects upload cleanly into TIA Portal as legacy V5 projects.

10. Verification Procedure

After download to the substitute CPU, perform the following verification steps before placing the system in RUN:

1. Diagnostic buffer: Open PLC → Diagnostics/Settings → Diagnostic Buffer. Confirm no SDC errors or SDB generation errors.
2. Module status: Right-click the CPU → PLC → Module Information. Verify all configured modules are detected and report OK.
3. Force table: If the original project used force values, reapply them via PLC → Force only after confirming safe I/O states.
4. Watch table: Open the original watch table and verify tag values match the original process state.
5. Cross-reference: Run Options → Reference Data → Display and confirm all symbols resolve to the same addresses.
6. Run/stop test: Switch the CPU to RUN. Monitor the BR LED and OB1 cycle time. Cycle time should match the original within ±5%.

11. Troubleshooting Matrix

12. Field-Proven Caveats

Engineers who routinely recover S7-300 MMC projects should keep the following facts in mind:

• Bus parameters are not always inside the system data block set that the Field PG extracts. PROFIBUS bus parameters, in particular, are calculated at download time and are stored in SDB 1000–1099. If the upload tool fails to parse these, the substitute CPU will fall back to default DP bus parameters, which may not match the timing of the original network.
• Symbolic names are stored in the offline project, not on the MMC. The uploaded blocks reference absolute addresses only. To restore the symbol table, the offline project archive must be available.
• Password protection for the CPU (CPU password, not block know-how protection) must be removed before the substitute CPU will accept a download. Default password is CPU 300 if not customized.
• MMC wear: Siemens MMC cards have a write-cycle limit of approximately 100,000 cycles per block. Recovery operations that involve multiple read/write passes should use a sacrificial card, not the production card.
• Firmware updates stored on MMC: CPU 31x with FW ≥ V2.0 may have a firmware image in the \FIRMWARE directory. If the substitute CPU has older FW and the project expects features of the newer FW, the CPU will fault. Strip the firmware directory before download or update the substitute CPU's FW first.

FAQ