S7-1200 Data Logging to MMC: Removable Storage Methods

S7-1200 Data Logging to MMC: Removable Storage Methods

The SIMATIC Memory Card (SMC) used by every S7-1200 CPU from firmware V2.0 onward is not a generic removable storage device. It is a mandatory part of the load-memory path, and removing it from a running CPU transitions the PLC to STOP. Engineers who need to archive process values, send logs over a modem, or hand data to operators on a physical medium must therefore adopt one of several proven workarounds documented by Siemens rather than treating the SMC as a hot-swappable USB stick.

1. S7-1200 Load-Memory Architecture

The S7-1200 CPU integrates work memory (code + data) and a small amount of retentive memory. Load memory, however, resides on the front-mounted SIMATIC Memory Card. The CPU boots from the card, executes code from internal work memory, and reads any non-volatile retained data from the same card.

Three operating modes are selectable in TIA Portal under PLC > Properties > Protection & Security or via WRREC on the system data block:

• Transfer: the card is empty after transfer; the CPU copies the project into internal flash on first run. The card can be removed after a power cycle only when the project is internal.
• Program card (load memory on card): all load-memory objects reside on the SMC. Removing the card with the CPU in RUN trips the OB100 diagnostic and the CPU transitions to STOP.
• External load memory + work memory split: configurable on firmware V4.4+ where a portion of the project resides on the card and a portion in internal flash.

2. Why Standard DataLog Removal Stops the CPU

The DataLog instruction set (DataLogCreate, DataLogOpen, DataLogWrite, DataLogClose, DataLogNewFile, DataLogDelete) writes CSV records into a sub-directory of \Datalog\ on the SMC. The files are visible to the integrated Web Server (CPU firmware V4.0+), which exposes them under Data Logs > Download. Each file is a UTF-8 CSV with header row plus an optional timestamp column.

Because the directory sits on the load-memory SMC, card ejection during a write transaction has three consequences:

1. The CPU loses its program reference and enters STOP with diagnostic buffer entry SF and event ID 0x00F1 "System action due to missing load memory".
2. Any unwritten DataLog record buffer is lost.
3. Existing CSV files become read-only on Windows but file system metadata may be inconsistent.

Siemens documentation explicitly forbids hot-removal of the SMC for this reason; the only safe path to copy files is the Web Server, S7 file-access protocols, or a paired HMI panel.

3. Method 1 - Web Server File Download

The integrated Web Server is the lowest-overhead method for retrieving logged data without touching the SMC. Configuration steps:

1. In the TIA Portal project tree, open Devices & Networks > CPU > Properties > Web server and tick Enable web server on this module.
2. Set the user permissions so that at least one account has Read files rights.
3. Activate the option Permit access only via HTTPS for production deployments.
4. Compile and download the project.
5. Open a browser and navigate to https://<CPU-IP>/. Log in, choose Data Logs, and click Download on the desired CSV.

The Web Server delivers the file directly from the SMC file system over the same Ethernet used for HMI traffic. It works while the CPU is in RUN. The maximum CSV size depends on the SMC allocation but is effectively limited by the DataLogCreate MAXLEN parameter (up to 65 534 records per file). When that limit is reached the application logic can call DataLogNewFile to roll over to a new file.

4. Method 2 - Persistent DB with WRIT_DBL / READ_DBL

If data must be retrievable on remote request via modem, GSM router, or any IP-based protocol, write to a non-retain DB and pull it programmatically using WRIT_DBL and READ_DBL. The block pair stores the entire DB image to the SMC's recipe directory (\Recipes\) without engaging the DataLog subsystem. Because the recipe slot is allocated on the same SMC but is independent of the program partition, the project mode can be set to Transfer so the card remains removable after the internal mirror has been built.

4.1 Defining the unlinked DB

Create a global DB and disable the Optimized block access option so that absolute addresses are accessible for legacy FTP-style transfers. Add fields for each value to log:

DATA_BLOCK "dbProcessLog"
{ S7_Optimize_Access := 'FALSE' }
AUTHOR : Eng
FAMILY : Log
VERSION : 0.1
  STRUCT
    SampleCnt : DINT;        // total samples written
    Timestamp : DATE_AND_TIME; // 8-byte BCD timestamp
    Pressure  : REAL;
    Flow      : REAL;
    Temp      : REAL;
    Spare     : ARRAY[0..15] OF BYTE;
  END_STRUCT;
END_DATA_BLOCK

4.2 Triggering a write

// STL excerpt or SCL - pseudo code
IF bWriteRequest THEN
    // Increment sample counter
    "dbProcessLog".SampleCnt := "dbProcessLog".SampleCnt + 1;
    "dbProcessLog".Timestamp := RD_SYS_T;
    // Stamp process values
    "dbProcessLog".Pressure  := rPressureIn;
    "dbProcessLog".Flow      := rFlowIn;
    "dbProcessLog".Temp      := rTempIn;
    // Persist entire DB image to SMC
    WRIT_DBL(REQ := TRUE,
             DB := "dbProcessLog",
             SRCBLK := "dbProcessLog",
             DSTBLK := "LOG_$curr.tsv",
             FILEMODE := APPEND,
             WREC := 1);
    NOP 0;
    bWriteRequest := FALSE;
END_IF;

The function writes a tab-separated line per call into a single SMC file named after the runtime variable. FILEMODE := APPEND keeps history. A scheduled OB1 poll, an OB35 cyclic interrupt, or an event-driven edge on a process input can drive the trigger.

4.3 Pulling data back over modem

On the remote host, a TCP/IP client opens a PUT/GET session (CPU firmware V4.0+ requires the Permit access with PUT/GET communication partner option to be enabled in the CPU properties). The host then issues an OPN_DB followed by READ_DBL to fetch the latest DB image.

// SCL on the SCADA side, executing via OPC UA > S7 method
READ_DBL(REQ := TRUE,
         DB := "dbProcessLog",
         SRCBLK := "LOG_2024_05_12.tsv",
         DSTBLK := "dbProcessLog",
         WREC := 1,
         BUSY => busy);\code>

This pattern keeps the CPU in RUN and does not require the operator to insert or remove any card. Combined with the Web Server fallback, it covers both scheduled push and ad-hoc retrieval.

5. Method 3 - SIMATIC HMI Comfort Panel USB Export

Comfort Panels (TP700 Comfort, KP1200 Comfort, TP1500 Comfort, TP2200 Comfort, TP1900 Comfort, and the second-generation TP700 / TP900 / TP1200 / TP1500 Comfort panels from firmware V14) have a dedicated service USB-A port on the rear. Operators can plug in any FAT32-formatted USB stick and trigger an export from the HMI screen. The HMI script runs on the panel CPU, not on the S7-1200, so the SMC stays seated.

1. Configure a Comfort Panel project in TIA Portal. Add the panel as a device and create tags that reference the same DBs the PLC uses.
2. Open HMI tags > Connections and confirm the S7-1200 connection is established (no PC link).
3. Create a screen button with event Press > Execute system function > ExportDataRecords or, on V14+, the script call HMIRuntime.FileSystem.Copy.
4. Target path: \Storage Card USB\Logs\. The folder is created automatically the first time the operator uses the button.
5. On the operator side: insert the USB stick, press the button, wait for the progress bar, remove the stick.

File naming follows the HMI project settings. CSV, TSV, TXT, and XLSX are supported via the HMI Recipe View export.

6. Method 4 - HMI Script-Based Logging (CSV / XLSX)

Comfort Panels can also log directly to the front SD slot without going through the PLC. Use a VBScript or the WinCC Unified JavaScript API:

' VBScript example for Comfort Panel (WinCC Advanced V14+)
Dim fso, ts, filePath
Set fso = CreateObject("Scripting.FileSystemObject")
filePath = "\Storage Card SD\Datalog_" & Year(Now) & "_" _
           & Right("0" & Month(Now),2) & "_" _
           & Right("0" & Day(Now),2) & ".csv"
If Not fso.FileExists(filePath) Then
    Set ts = fso.CreateTextFile(filePath, True)
    ts.WriteLine "Time,Pressure,Flow,Temp"
else
    Set ts = fso.OpenTextFile(filePath, 8, False)
End If
ts.WriteLine Time & "," _
             & SmartTags("rPressureIn") & "," _
             & SmartTags("rFlowIn")     & "," _
             & SmartTags("rTempIn")
ts.Close

This pattern keeps the SMC in the S7-1200 untouched and lets operators swap the panel's SD card. Pair the script with a scheduled trigger (1 s, 10 s, 1 min) on the HMI side. The maximum file size before the panel refuses to append is 4 GB on most firmware V14 builds; WinCC Unified raises this to 16 GB on TP1500 Comfort with firmware V16.

7. Method Comparison Matrix

8. Commissioning Workflow

1. In TIA Portal, right-click the CPU, choose Properties > Protection & Security, and verify Transfer mode is selected. This ensures the project is mirrored into the internal flash on first download so the SMC can later be removed without program loss.
2. Insert the SMC, perform a full download, and power-cycle the CPU once. Confirm the diagnostic buffer contains no 0x00F1 entries.
3. Enable the Web Server, create a read-only user, and test the login from a browser.
4. Build the dbProcessLog DB unlinked, add the WRIT_DBL / READ_DBL calls in OB1 or OB35, and verify a sample file appears in \Recipes\LOG_*.tsv on the SMC.
5. Configure the Comfort Panel export or HMI script. Connect the panel, transfer the project, and trigger a manual export.
6. Document the export path and recovery procedure in the operator manual.

9. Verification Checklist

• Open the Web Server and confirm the latest DataLog CSV lists every expected variable in the header row.
• Trigger a WRIT_DBL cycle, then read the recipe file back with READ_DBL from a remote client. The record count must increment.
• Insert an empty USB stick into the Comfort Panel and run the export. The progress dialog must reach 100 % without a File system error 13 event.
• Force the CPU into STOP via the operator panel, simulate SMC removal (project already mirrored internally), and confirm the CPU returns to RUN on the next warm restart.
• Check the diagnostic buffer for event 0x00F1 or 0x0109. Either event signals an inconsistent SMC state and warrants a re-transfer.

10. Troubleshooting Matrix

11. Field-Proven Caveats

• Avoid naming DataLog files with a leading underscore. The S7-1200 firmware reserves files beginning with _ for internal use and silently refuses the open.
• When the S7-1200 is paired with an S7-1500 in the same TIA Portal project, drag-and-drop file browsers do not expose the S7-1200 recipe directory. Use the Web Server or the FileBrowser utility from the SIMATIC Automation Tool.
• Firmware V4.2 introduced secure PG/HMI communication. With TLS active, the Web Server file-download URL changes to /Portal/Default.htm after authentication.
• The S7-1200 G1 variant (article numbers ending in -0XB0) does not support DataLog instructions at all. Use Modbus logging or migrate to a G2 CPU.
• For ATEX or hazardous-area installations, only SMC part numbers carrying the Ex marking may be used. Standard MMC cards from the consumer market are not rated for the operating temperature range.

12. FAQ