Overview
Recovering a program from a password-protected SIMATIC S7-1200 CPU, transferring it to a replacement CPU, or updating the firmware while protection is active requires a SIMATIC Memory Card (SMC) — not a generic SD card. The S7-1200 distinguishes between three card operations (Program card, Transfer card, and Firmware update card) and the protection state of the CPU determines which operations are permitted. A standard SD card inserted into a running S7-1200 will not extract the project; the CPU interprets a Siemens-formatted card based on the file system structure (SIMATIC.S7S directory and S7_JOB.S7S job file).
This reference covers the three procedures most commonly requested in field service situations where the original TIA Portal project is unavailable, the CPU is password-protected, and only physical access to the PLC remains: (a) backing the project up to a memory card, (b) cloning the project onto a replacement S7-1200, and (c) updating or downgrading the firmware on the protected CPU. The scope is restricted to standard know-how protection and access protection; the stronger protection of confidential PLC configuration data (introduced with TIA Portal V15.1 and firmware 4.4) is treated as a separate boundary case because it uses certificate-based encryption tied to the configuration.
Prerequisites
| Item | Specification |
|---|---|
| Siemens SIMATIC Memory Card | 6ES7954-8LF02-0AA0 (4 MB), 6ES7954-8LE02-0AA0 (12 MB), or 6ES7954-8LL02-0AA0 (24 MB) for current generation; older S7-1200 firmware (≤ 3.0) accepts the legacy MMC 6ES7953-8LF00-0AA0 / 6ES7953-8LH00-0AA0 |
| Card format | Pre-formatted by Siemens (FAT16/32 with SIMATIC.S7S); do not reformat on a PC |
| TIA Portal | V11 SP2 minimum for FW 2.2 CPUs; V13 SP1 for FW 4.x; V15.1 for confidential PLC configuration data |
| CPU firmware | Determine via the Web server (if enabled) or the SIMATIC Automation Tool; FW 2.2 is the oldest field-realistic baseline for an installed unit configured in V11 SP2 |
| Power state | CPU must be in STOP for card operations involving writes to internal load memory; remove protective flaps and power the PLC down before card insertion per the S7-1200 System Manual section 4.5 |
| Password knowledge | Know-how protection password is required to read block code; backup to card as a transfer/clone operation does not require the password but produces a CPU-bound binary, not a re-editable project |
S7-1200 CPU Protection Model
Three protection mechanisms exist on the S7-1200 and each interacts differently with card operations:
| Protection type | Set in TIA Portal | Effect on card operation |
|---|---|---|
| Know-how protection (block-level) | Block properties → Protection | Block code is unreadable in the offline project; the card stores the same encrypted blocks, so even the backup is unreadable without the password |
| Access protection (CPU-level) | Device configuration → Protection & Security → Access level | Read/write access to the online CPU requires the password; clone-to-card operations are blocked unless HMI access or full access is granted |
| Protection of confidential PLC configuration data | Device configuration → Protection & Security → "Protect confidential configuration data" | Requires a CPU password to perform any card transfer; introduced with firmware 4.4 and TIA Portal V15.1, documented at TIA Portal help: confidential PLC configuration data |
Procedure A — Backup a Password-Protected S7-1200 to a SIMATIC Memory Card
- Verify the CPU is in STOP. Use the mode selector on the CPU, or issue a STOP command from a connected HMI/Panel that has the appropriate access level.
- Open the card slot cover on the CPU (top of the module, beneath the terminal covers).
- Insert a blank, Siemens-pre-formatted SIMATIC Memory Card. The CPU's
MAINTLED will blink while the card is being evaluated. - Power-cycle the CPU (OFF → ON). On startup the S7-1200 examines the card:
- If the card contains a valid
S7_JOB.S7Sjob file, the CPU executes the job and then stays in STOP with the job executed. - If the card is empty or contains a program backup (
SIMATIC.S7S\folder with the project), the CPU overwrites its internal load memory with the card contents (program transfer, not backup).
- If the card contains a valid
- For a true backup rather than a transfer, use the TIA Portal route: connect online to the CPU, enter the access/know-how password when prompted, then choose Project → Card Reader/USB memory → Write to memory card and select the SMC. This packages the project (including password-protected blocks in their encrypted form) onto the card and creates a re-loadable image.
When the CPU itself is the only accessible interface (no TIA Portal online connection, password unknown), a card-clone operation will still copy the encrypted blocks to the card, but the card image is bound to the original CPU's serial number and cannot be read as a TIA Portal project without the know-how password. The card is, however, usable as a Transfer card on another S7-1200 to replicate the program (see Procedure B).
Procedure B — Transferring the Card Image to a Replacement S7-1200
- On the source (or backup) SMC, confirm the presence of the directory
SIMATIC.S7Sand the fileS7_JOB.S7Swith a transfer directive, or use the empty-card transfer method. - Insert the card into the target S7-1200 CPU that must be in STOP or unpowered.
- Power on the target CPU. The CPU detects the program image, copies it into internal load memory, and enters STOP. The
RUN/STOPLED remains yellow. - Remove the card.
- Switch the mode selector from STOP to RUN (or use TIA Portal to start the CPU). The transferred program begins executing.
When a CPU is delivered from the factory it is configured as a transfer card simply by having a valid program in the SIMATIC.S7S folder. No additional configuration file is required for the basic clone operation. For repeated transfers to multiple CPUs of the same type, leave the card in the card slot; the CPU re-evaluates on every restart.
Procedure C — Firmware Update on a Password-Protected CPU via SD Card
Siemens distributes S7-1200 firmware updates as .upd files via the Siemens SiePortal entry "SIMATIC S7-1200 CPUs - Firmware updates". The SD card procedure is used when the CPU has no online connection to TIA Portal, or when the existing firmware is too old to communicate (e.g., after a botched online update).
- Download the appropriate firmware
.updfile for the exact CPU order number from Siemens Industry Online Support and place it in the root of a SIMATIC Memory Card. The CPU recognizes the file by theFWUPDATE.S7Sdirective. - Insert the card into the CPU while the PLC is powered off.
- Power on. The CPU detects the firmware update, the
MAINTLED flashes rapidly, and theRUN/STOPLED flashes yellow. Update duration is typically 30 s to 3 minutes depending on the jump (e.g., 4.2 → 4.5 takes longer than 4.4.1 → 4.4.2). - After the update the CPU performs an automatic restart. The card can be removed.
- Verify the new firmware version in TIA Portal via Online → Accessible devices or via the CPU's Web server (if enabled and the password is known).
The firmware update operation is not blocked by know-how protection or access protection. This is intentional: a service engineer must be able to reflash a locked CPU to recover from a corrupted firmware state. However, the firmware update does not clear passwords and does not reveal protected blocks. Resetting passwords to factory defaults requires the physical CPU password reset procedure described in the next section.
Password Reset to Factory Defaults
There is no software-only "master password" for the S7-1200. The S7-1200 System Manual describes a manual reset that requires physical access and erases the program:
- Insert a SIMATIC Memory Card that contains a valid program transfer image (or an empty card that will trigger the CPU to copy its internal program onto the card).
- Power on the CPU — the program is written to the card and the internal load memory is cleared. This is effectively a factory reset of the user program; the IP address, device name, and passwords are returned to their factory defaults (no password).
If the program in internal load memory is itself the only copy, this procedure destroys it. Always remove the card and back it up before the CPU restarts without it. Note that for CPUs with protection of confidential PLC configuration data (firmware 4.4+), a full reset additionally requires the certificate that was configured with the project, per the TIA Portal manual. Without the certificate the configuration data cannot be decrypted, even after a reset.
TIA Portal Version Compatibility Matrix
| CPU firmware | TIA Portal minimum | TIA Portal recommended | Notes |
|---|---|---|---|
| 2.2 | V11 | V13 SP1 | Typical baseline for legacy V11 SP2 projects |
| 3.0 | V12 | V13 SP1 | Web server default credentials hardened in 3.0 |
| 4.0 / 4.1 | V13 | V14 SP1 | OPC UA server capability introduced |
| 4.2 | V14 | V15 | Performance improvements; OPC UA Pub/Sub groundwork |
| 4.3 | V15 | V15.1 | Secure communication (TLS) defaults tightened |
| 4.4 | V15.1 | V16 | Confidential PLC configuration data introduced |
| 4.5 / 4.6 | V16 | V17 / V18 | Latest field-deployment firmware as of TIA V18 |
LED Status Codes During Card Operations
| MAINT | RUN/STOP | ERROR | Meaning |
|---|---|---|---|
| Off | Green | Off | Normal RUN, no card activity |
| Flashing | Yellow | Off | Card being read/written — do not remove |
| Flashing | Flashing yellow | Off | Firmware update in progress |
| Solid | Yellow | Off | Card transfer complete, CPU in STOP waiting for RUN |
| Solid | Off | Flashing red | Card not recognized / wrong file system — replace with Siemens SMC |
| Off | Flashing yellow | Flashing red | Firmware update failed; cycle power and retry with fresh .upd
|
Verification Procedure
- After any card operation, remove the card and cycle power. Confirm the CPU returns to the expected mode (RUN or STOP) without
ERRORLED activity. - In TIA Portal, choose Online → Accessible devices and verify the CPU's order number, firmware version, and serial number match the source.
- Compare the diagnostic buffer entries from before and after the operation; the buffer records every card access with a timestamp and event ID.
- For transfer-card verification, write a small non-critical tag (e.g., MB0) from the HMI and confirm the value echoes in TIA Portal's watch table.
Troubleshooting Matrix
| Symptom | Likely cause | Corrective action |
|---|---|---|
| CPU stays in STOP after card insertion, ERROR solid red | Generic SD card used (not Siemens SMC) | Replace with a Siemens-pre-formatted SMC; do not reformat a consumer SD card |
| MAINT LED flashes, then CPU returns to RUN with old program | Card contains a job file the CPU did not recognize | Re-create the card from TIA Portal or use the SIMATIC Automation Tool |
| Online connection possible but blocks are not visible | Know-how protection active, password not supplied | Enter the know-how password in Online & Diagnostics → Protection |
| Transfer to target CPU fails with "Firmware version not supported" | Source firmware newer than target | Downgrade source program to target firmware in TIA Portal, or update target firmware first |
| CPU cannot be reached online; web server disabled | IP address unknown or password locked out access | Use the SIMATIC Automation Tool to scan all Profinet nodes and assign a temporary IP |
| Firmware update aborts halfway; CPU in undefined state | Power loss during update | Re-insert the .upd card and cycle power; the bootloader retries the update automatically |
| Card write from TIA Portal fails with "Card write-protected" | The SMC's write-protect slider is engaged | Slide the lock on the card to the unlocked position (S7-1200 SMCs support the slider, unlike older MMCs) |
Field-Proven Caveats
- Always confirm the CPU's exact MLFB (e.g.,
6ES7214-1AG40-0XB0) before downloading a firmware.upd. Firmware is not interchangeable across CPU variants even within the same model number family. - Older CPUs (FW 2.x) may not accept 24 MB SMCs reliably; use a 4 MB SMC (6ES7954-8LF02-0AA0) for these units.
- Card operations do not require the PLC program password. They do require the access level password only if you go through TIA Portal's online "Write to memory card" command. Bypassing TIA Portal and using the card as a transfer medium does not need a password.
- For remote sites where the firmware version is unknown, the S7-1200 Web server (default port 80) is the fastest way to identify the CPU if it was enabled. The default URL is
http://<ip-address>/and shows order number, firmware, and serial number without authentication (unless explicitly password-protected). - The Siemens SiePortal entry for this exact support question is archived at Siemens SiePortal thread on S7-1200 password and SD card and contains the official response from Siemens Industry Customer Support.
FAQ
Can I use a regular SD card to back up a password-protected S7-1200?
No. The S7-1200 only recognizes a Siemens SIMATIC Memory Card with the proprietary SIMATIC.S7S file system. A consumer SD card will trigger an error and the CPU will not read or write to it. Use only Siemens MLFB 6ES7954-8x or 6ES7953-8x cards.
Will a card backup work on a different S7-1200 model?
Only if the target has the same order number (MLFB) and equal-or-newer firmware. A program compiled for CPU 1215C will not load on a 1212C because the hardware configuration is rejected. Use the same CPU variant and match or exceed the firmware major version.
Does the firmware update via SD card clear the password?
No. The firmware update refreshes the operating system only; user program, passwords, IP address, and device name are preserved. The only way to clear passwords is a factory reset, which deletes the user program.
What TIA Portal version is required for an FW 2.2 S7-1200 configured in V11 SP2?
TIA Portal V11 SP2 is sufficient to work with FW 2.2 CPUs, though newer Portal versions (V13 SP1 or later) are recommended for stable online diagnostics and Web server support. Always keep Portal and firmware matched to within the compatibility matrix above.
How do I find the firmware version if the CPU is password-locked and I have no online access?
Enable the Web server in TIA Portal (if the password is known) and browse to http://<ip> for the Diagnostics page. If the Web server is disabled, insert a SIMATIC Memory Card while the CPU is in STOP; the card clones the existing program and the S7_JOB.S7S log on the card can be read on a PC to extract the firmware metadata.