Resolving S7-400FH F-CPU Download Failure with FLASH EPROM Memory

Problem Overview

The SIMATIC S7-400FH (fault-tolerant, fail-safe) automation system rejects program downloads to its F-CPU when the load memory is implemented as a FLASH EPROM card. The user observes the diagnostic message "For module with memory cards, the safety related program can't be reloaded" in STEP 7 / SIMATIC Manager immediately after selecting PLC > Download to Target System, or while attempting PLC > Download User Program to Memory Card. The same restriction blocks incremental reloads of any F-runtime group, F-FB/F-FC, or F-DB that has changed since the last cold restart.

This error is reported on H-CPUs of the SIMATIC S7-400H / S7-400FH family — most commonly the CPU 412-3H (order number 6ES7 412-3HJ14-0AB0) — and on F-CPUs of the S7-400F family (CPU 416F-2, CPU 417F-4) when the F-system is built with CFC charts as required for S7 F-systems. It is not a fault of the application program: it is a hard architectural constraint imposed by the F-runtime signature and consistency verification that the F-CPU performs against load memory on every STOP-to-RUN transition.

Affected Hardware Configuration

The original report identifies the load-memory card as 6ES7 952-1KL00-0AA0. That MLFB is a 1 MB FLASH EPROM (FEPROM) — not a RAM card, despite the operator's description as "2 MB RAM". Identifying the actual card type is the first troubleshooting step, because the F-CPU rejection behavior differs significantly between the two media.

Root Cause: Why F-Blocks Cannot Reload from FLASH EPROM

S7 F-systems (S7 F/FH) enforce three architectural invariants that FLASH EPROM load memory cannot satisfy:

1. Online accessibility of every F-block. The F-CPU must read each F-FB, F-FC, F-DB, and F-runtime group member at runtime to verify its CRC signature, the F-collective signature, and the safety program version. A FLASH EPROM exposes a write-only programming interface to the CPU — it cannot be re-read with updated signatures after a partial block change.
2. Incremental F-block replacement. After a safety program change, STEP 7 must overwrite only the modified F-blocks and re-evaluate the F-collective signature. FEPROM requires a full card erasure and reprogramming cycle, which is incompatible with online modification of an F-system.
3. CFC chart re-interpretation. S7 F-systems built with CFC generate chart blocks whose compilation result is bound to the F-runtime group signature. The CFC online view (required for fail-safe diagnosis per the S7 F manual) cannot attach to F-blocks stored on FEPROM, so the F-CPU refuses the download outright.

STEP 7 raises the diagnostic event with W#16#5371 / W#16#5372 in the diagnostic buffer to surface this rejection. The same W#16# class also covers the second observed failure mode — work-memory exhaustion — which compounds the symptom if the F-runtime group has grown.

Memory Card Type Comparison

The Siemens S7-400 Automation System manual states explicitly that F-blocks must reside in the load memory area that the F-CPU can read with random-access semantics. In practical terms, that means a RAM card.

Step-by-Step Recovery Procedure

Use this procedure to migrate an S7-400FH station from FEPROM to RAM load memory without losing the existing safety program.

Prerequisites

• STEP 7 V5.5 or earlier with the S7 F Systems V5 / V6 option package installed (CFC V5.x or higher).
• A compatible RAM memory card of equal or greater capacity than the FEPROM card. Recommended: 6ES7 952-1AP00-0AA0 (2 MB RAM) or 6ES7 952-1AS00-0AA0 (4 MB RAM).
• Verified CPU backup batteries (green status LED on the PS 407 / PS 405 power supply; BATTF LED off).
• Current project archive (.zip or .s7p) saved on the engineering station.
• Physical access to both CPUs in the H-pair for the 412-3H redundant configuration.

Procedure

1. Stop both CPUs. Bring the H-pair to STOP. Confirm via the mode selector and the MSTR / RED / SF LEDs on the CPU front panel. For a 412-3H redundant pair, stop the master, wait for the standby to take over (only relevant during live maintenance), then stop the standby.
2. De-energize the rack and remove the FEPROM. Power down, open the CPU door, and pull the FEPROM card from the slot. Insert the RAM card. The card slot is keyed; verify orientation before insertion.
3. Restore battery-backed voltage. Re-energize the rack with the new RAM card inserted. Confirm the BATTF LED remains off.
4. Reset the CPU to factory defaults. Turn the mode selector to MRES and hold until the STOP LED flashes slowly, then release, then turn to MRES again within 3 seconds. The CPU performs a full reset; the F-collective signature is cleared.
5. Open the project in STEP 7 and re-establish the online connection. Use PLC > Download to Target System with the option "Download to target device / entire project". The F-CPU will accept the download because the new load memory is a writable RAM card.
6. Download the safety program. When STEP 7 prompts for the F-password, enter the F-CPU password defined in the safety program properties. The download proceeds in two stages: standard blocks first, then F-blocks with F-collective signature regeneration.
7. Verify CFC online view. Open the F-runtime group in CFC and confirm Chart > Online shows the current chart state. This is the definitive test that F-blocks reside in writable load memory.
8. Restart the H-pair. Perform a warm restart on both CPUs. Confirm the F-collective signature matches the offline project.

Verification

After migration to the RAM card, run the following verification checks:

1. Diagnostic buffer scan. Open PLC > Diagnostics/Settings > Diagnostic Buffer and confirm no entries with W#16#5371, W#16#5372, or W#16#5373. The latest entry should be the cold-restart event from the MRES reset.
2. F-collective signature match. In Safety > F-Collective Signature, compare the online signature with the offline signature in the STEP 7 safety program summary. They must be identical.
3. CFC chart online test. Open each chart in the F-runtime group, right-click Chart > Test Mode, and confirm that input/output values update at the configured sampling rate.
4. Work-memory utilization. In PLC > Diagnostics/Settings > Memory, confirm work-memory utilization is below 80%. Values above 98% trigger W#16#5373 and re-introduce the download restriction.
5. H-sync check (412-3H redundant pair). From the redundancy engineering tool (H-system option), confirm both CPUs report the same F-collective signature and the same safety program version.

Diagnostic Buffer Reference

Work-Memory Pressure — The Second Failure Mode

If the work memory is at or above 98% utilization, the F-CPU will also refuse downloads, but with a different diagnostic message. The S7-400F/FH manual specifies that the F-runtime group is reserved a fixed partition of the work memory, and any incremental F-block load that would exceed that partition is rejected. Monitor work-memory utilization through PLC > Diagnostics/Settings > Memory in STEP 7 before any download attempt.

Remediation options for work-memory pressure:

• Optimize the F-runtime group: split large F-charts into multiple smaller charts assigned to the same OB35 / OB10 cycle.
• Delete obsolete F-blocks (F-FBs, F-DBs) from the offline project and re-download.
• For sustained growth, migrate from the 412-3H (which has the smallest work memory of the S7-400FH family) to a CPU 414-4H or 417-4H with larger work-memory partitions.

Alternative Workflows and Field-Proven Practices

Experienced S7 F/FH engineers adopt the following patterns to avoid the FEPROM trap:

1. Develop on RAM, freeze on RAM. Even finalized production systems are typically deployed on RAM cards with healthy backup batteries. The FLASH EPROM is reserved for archival copies, never for runtime.
2. Maintain dual CPU battery health. A S7-400H redundant pair relies on battery-backed RAM on both CPUs. The 412-3H retains RAM contents for a defined backup time per the power-supply manual — verify the backup time on the PS 407 / PS 405 used in the rack.
3. Use the EPROM programming tool for archival only. When the safety program is frozen and will not change for the life of the system, an FEPROM copy can be written using PLC > Save to Memory Card in STEP 7 with the FEPROM card inserted in the programming device's prommer slot. This is an archive operation, not a runtime replacement.
4. Track F-collective signature across change orders. Every F-program modification increments the F-collective signature. Document the new signature in the safety lifecycle file so that acceptance test procedures can verify the correct signature after every change.
5. Always pull a complete project archive before MRES. A factory reset clears all RAM-resident blocks. The STEP 7 project on the engineering station is the only authoritative recovery source.

Commissioning Checklist for S7-400FH Load Memory

• [ ] Load-memory card type verified as RAM (not FEPROM) before first download.
• [ ] Backup batteries installed, BATTF LED off on every power supply in the rack.
• [ ] CPU mode selector set to RUN-P with the keyswitch in the appropriate position.
• [ ] F-CPU password recorded in the safety lifecycle file.
• [ ] Work-memory utilization below 80% after first F-runtime group download.
• [ ] F-collective signature recorded in the safety acceptance test report.
• [ ] CFC online view verified for every chart in every F-runtime group.
• [ ] H-sync verified across the 412-3H redundant pair (where applicable).

Reference Documentation

The constraints above are formalized in the SIMATIC Safety Configuring and Programming manual (TIA Portal V20 edition), specifically the Downloading project data to an F-CPU section. See the official Siemens documentation portal at Downloading project data to an F-CPU for the full procedure, password handling, and STOP-mode prerequisites for safety-program downloads. Cross-reference the S7-400 Automation System manual (entry ID 1117740 on Siemens Industry Online Support) for memory-card specifications and the S7 F Systems option package manual for F-collective signature handling.