S7-200 CPU 226 Program Upload via PC/PPI Cable (6ES7216-2AD23)

1. Overview

The SIMATIC S7-200 CPU 226 with order number 6ES7216-2AD23-0XB0 is a compact PLC from the legacy S7-200 family, featuring two RS-485 communication ports (Port 0 and Port 1), 24 digital inputs, 16 digital outputs, and a removable EEPROM cartridge under a hinged access cover. This reference documents the field procedure used when a non-PLC engineer (a software consultant with no prior SIMATIC experience) must connect to a CPU 226 in a production environment, upload the user program, modify two constant values that were left incorrect by the original integrator, and download the corrected program back to the PLC. The two reported defects are:

• Defect 1: A speed-related limit is loaded as 50 instead of 500. The user is asked to set a speed in mm/s; the normal operating speed is 150–200 mm/s, but the PLC clamps the output to 50 mm/s. A single zero is missing in the high limit constant.
• Defect 2: The encoder input register holds raw pulse counts but is being displayed and used as millimetres. The integrator forgot to insert the divide-by-pulses_per_mm scaling instruction.

Both issues are pure constant or scaling defects, not logic defects, so the program can be corrected by an engineer who has never written ladder logic before, provided the upload/download workflow is followed exactly. The S7-200 is officially retired by Siemens and replaced by the S7-1200, but several hundred thousand units are still in service worldwide. The S7-200 System Manual, the CPU 226 data sheet, and STEP 7-Micro/WIN V4.0 SP9 remain the canonical references and are still available on the Siemens support portal.

2. Hardware Identification: CPU 226 6ES7216-2AD23-0XB0

Before any cable is connected, confirm the exact module variant. The S7-200 family has many CPU revisions and the cable, firmware, and software version constraints differ between them.

3. Prerequisites

1. A PC running Windows XP SP3, Windows 7 (32-bit), Windows 10 (32-bit) or a 32-bit Windows virtual machine. STEP 7-Micro/WIN V4.0 is a 16-bit application and does not run natively on 64-bit Windows without compatibility settings; a VM is the cleanest path on modern hardware.
2. STEP 7-Micro/WIN V4.0 SP9 installed. Siemens distributed the final V4.0 SP9 build (released 2015, build 4.0.9.25) as a free update to existing license holders.
3. A valid PPI protocol license. Micro/WIN ships with a 14-day demo license. For permanent use, a license key transferred from the licence stick to the PC is required. Without a key, the project can be uploaded, viewed, and re-downloaded, but it cannot be compiled and downloaded as a new project.
4. A PC/PPI cable. Two official options exist:
   • USB version: 6ES7901-3DB30-0XA0 (USB-to-RS485, isolated, powered from the PLC). This is the strongly recommended cable for any engineer without an RS-232 port on the PC.
   • RS-232 version: 6ES7901-3CB30-0XA0 (DB9 RS-232 to RS-485, with a DIP switch bank for baud rate and PPI/freeport mode). Requires a real RS-232 port or a USB-to-RS-232 adapter.
5. An identical, empty CPU 226 module to use as a test bed. This is non-negotiable. A "clean" module lets you practice the upload/download cycle and validates the cable and software installation before you ever touch the production PLC.
6. A project folder on the laptop with date-stamped subfolders (e.g. 2024-11-22_line1_upload_original and 2024-11-22_line1_upload_after_fix) for binary backups.

4. Communication Port Identification

The CPU 226 has three physical connectors on its lower face. Knowing which is which is the single most common source of confusion for first-time users.

The two DB9 connectors on the left side of the module are functionally identical RS-485 ports. Either can be used for programming. The third connector, hidden under the small plastic cover on the right side, is the expansion port. It carries the backplane signals (5 V, GND, ribbon data) used by the EM (digital/analog expansion) modules and CP (communication processor) modules, but it is not a programming interface. Connecting a PC/PPI cable to the expansion port will not establish communication and in some cases may short the 5 V rail. This is the most common field error on first contact with the S7-200.

5. RS-485 Port Pinout (DB9 Male on the CPU)

The CPU 226 uses a male DB9 with the Siemens PPI pinout. The PC/PPI cable is keyed to fit only one way; if you are building a non-Siemens cable, follow this table exactly.

The bus must be terminated at the two end nodes only with 120 Ω between pins 3 and 8. The CPU 226 has no built-in termination; the PC/PPI cable provides termination internally. If a multi-drop PPI network is in place, the chain ends are terminated and the PC/PPI cable must be removed or its termination disabled (DIP switch on the RS-232 version).

6. Cable Selection and Wiring

6.1 PC/PPI USB Cable (6ES7901-3DB30-0XA0) — recommended

The USB version is the easiest to obtain and the most reliable. It draws its 5 V from pin 6 of the PLC port, contains an isolated DC/DC converter, and presents itself to the PC as a virtual COM port. Driver: Siemens PC/PPI USB driver (S7USBXP.INF and friends), supplied on the CD that ships with the cable. Windows 10 and Windows 11 will accept the driver once the INF is pointed to manually through Device Manager. The cable enumerates as USB Serial Port (COMx) in Device Manager.

6.2 PC/PPI RS-232 Cable (6ES7901-3CB30-0XA0)

The RS-232 version is set with five DIP switches on the housing. The factory default (all OFF) is PPI master, 9.6 kbaud, address 0, local echo off. For a one-to-one connection to a CPU 226 set the DIPs as follows:

6.3 Third-party USB-to-RS485 adapters

Generic USB-to-RS485 adapters (FTDI FT232 + MAX485, CH340 + MAX485) can be made to work, but two caveats apply:

1. Most adapters tie A and B across a 120 Ω resistor and have no isolated 5 V. They are not hot-pluggable and can latch the PLC bus if the ground potential differs. Power down the PLC before inserting or removing the adapter.
2. The adapter must be set to half-duplex, auto-direction mode. The S7-200 does not toggle RTS; the cable has to switch on the differential edge. If the adapter has an RTS pin, tie it high to enable TX.

For a one-off production rescue, buy the Siemens USB cable. The price difference is small compared with the cost of a corrupted upload.

7. STEP 7-Micro/WIN Installation and PG/PC Interface Setup

1. Install Micro/WIN V4.0 SP9. Accept the default installation path. Restart when prompted.
2. Launch Micro/WIN. The first-run wizard asks for the language, the CPU family (S7-200), and the communication interface. Select PC/PPI cable (PPI).
3. Open the Set PG/PC Interface dialog (left navigation pane, "Communications" or via Tools > Options > Set PG/PC Interface). For the USB cable, select PC/PPI cable (PPI) > USB and the COM port assigned by the driver.
4. Click Properties > PPI tab. Set:
   • Transmission rate: 9.6 kbaud (default, robust on a noisy factory floor). If communication fails, drop to this even if the project normally runs at 19.2 kbaud.
   • Highest station address: 31 (default PPI range).
   • Multiple master network: OFF for a one-to-one link.
5. Click OK twice. The interface is now bound to the project.

8. Establishing Communication with the CPU

1. Power the CPU 226. Mode switch should be in STOP for the first upload. The SF/DIAG LED may be red; this is normal until the program is verified.
2. Plug the PC/PPI cable into Port 0 (the lower DB9) of the CPU. The PC/PPI cable LED should illuminate.
3. In Micro/WIN, click the Communications icon (the top icon in the navigation bar, two PCs with a waveform).
4. Double-click the Double-click to refresh field on the right. Micro/WIN broadcasts a PPI search frame and lists all CPUs it finds. The CPU 226 should appear as 192.168.0.1… no, sorry, S7-200 uses PPI addresses, not IP. It will appear as PPI address 2 (Port 0 default) or PPI address 1 (Port 1 default).
5. Select the address and click OK. The status bar should show Connected.

9. Program Upload — the Safe, Read-Only Operation

In Siemens Micro/WIN terminology:

The terms are easy to confuse. Always treat Upload as the safe, non-destructive operation, and Download as the destructive operation that overwrites the live PLC.

1. With the CPU connected and in STOP, click File > Upload from PLC (or the up-arrow icon in the toolbar). Micro/WIN shows a progress bar.
2. When the upload completes, the project tree populates with the program blocks: Main (OB1), SBR_0..n (subroutines), INT_0..n (interrupts), and the Data Block.
3. Immediately choose File > Save As, change the project name to line1_original_2024-11-22.mwp, and store it in the date-stamped backup folder. Also export the project to a read-only archive copy.
4. Use File > Export to write a portable copy (ASCII or .awl STL export) for offline review on a machine that does not have Micro/WIN installed.

Repeat steps 1–4 for the second CPU 226. Store each program in a separate, clearly labelled subfolder.

10. Inspecting the Uploaded Program — Locating the Two Bugs

Open Main (OB1). The CPU 226 default view is ladder logic (LAD), which is the most readable view for a software engineer. The two defects manifest as follows:

10.1 Speed limit constant (50 instead of 500)

Scan the network that loads the speed setpoint into a comparison. A typical Siemens pattern is:

Network 4 — Clamp speed to high limit
LD     SM0.0
MOVW   VW200, VW300        // copy setpoint to work register
<I     VW300, +50          // compare to high limit (BUG: should be 500)
MOVW   +50, VW300          // replace with limit (BUG: should be 500)
<I     +150, VW300         // compare to low limit
NOT
…

The integer literal +50 appears in at least two instructions in this network. Change both occurrences to +500. Do not change the low-limit comparison; that is a different constant.

10.2 Encoder scaling

Find the network that handles the HSC (high-speed counter) value. A common buggy pattern is:

Network 7 — Display position in mm
LD     SM0.0
MOVW   HC0, VW400          // copy HSC0 raw count to position register
…                       // (BUG: missing division by pulses_per_mm)

The fix is to insert a divide block. For a 1000-pulse-per-revolution encoder driving a 10 mm/rev leadscrew, pulses_per_mm = 100. The correct pattern is:

Network 7 — Display position in mm
LD     SM0.0
MOVW   HC0, VW400          // copy HSC0 raw count
DIV    +100, VW400         // scale to mm (NEW LINE)

Drag a Divide instruction from the Math Functions toolbox into the network. Type the literal in the IN2 box. Confirm that the destination is the same word used downstream (here VW400).

11. Compile and Download the Corrected Program

1. Click PLC > Compile (or Ctrl+F9). Micro/WIN performs a syntax check. The status bar must show Compile successful (0 errors, 0 warnings). If a warning appears about an unused network, leave it — the original integrator may have left it intentionally.
2. Save the corrected project as line1_fixed_2024-11-22.mwp. Keep the original file untouched in the backup folder.
3. Verify the CPU is in STOP mode. Confirm by looking at the mode switch LED: green RUN = RUN, yellow = STOP, red SF/DIAG = fault.
4. Click File > Download to PLC. Micro/WIN prompts whether to overwrite the existing program — click Yes only if the upload backup is confirmed on disk.
5. The download progress bar should complete without error. Micro/WIN will then prompt whether to place the CPU in RUN. Click No — put the machine in RUN from the HMI or via the mode switch after the operator has acknowledged.
6. Power-cycle the CPU to clear the SF/DIAG LED and confirm the new constants take effect.

12. Verification

After the download, perform these verification steps before handing the line back to production:

1. Program identity check: From Micro/WIN, click PLC > Compare. The on-line project must match the offline project. Any difference must be reconciled.
2. Force check: Open Debug > Program Status. Toggle the setpoint register to 300 mm/s; the clamped work register should equal 300 (within the new 500 limit), not 50.
3. Encoder scaling check: Move the axis by exactly 100 mm. Read VW400 in the status chart. It should equal 100. If it equals 10 000, the divider is missing or wrong; if it equals 1, the divisor is too large.
4. Retentive range: Open System Block > Retentive Ranges and confirm that the integrator's retentive data area has not been altered. The 6ES7216-2AD23-0XB0 has 10 Kbytes of data memory; V memory retentive range is configured here.
5. Operator HMI check: Run the line for one full production cycle. Monitor the HMI for the previously-misreported values.

13. Common Errors and Troubleshooting Matrix

14. Commissioning Notes and Field-Proven Caveats

• The S7-200 was officially withdrawn from new sales in 2017. Siemens support is still active for spare parts and the existing installed base, and downloads of STEP 7-Micro/WIN V4.0 SP9 are still served from the support portal for licence-holders. Refer to the original S7-200 System Manual at Siemens S7-200 System Manual entry for the complete instruction set and wiring diagrams.
• The CPU 226 is a 24 V sink/source input device. Inputs are grouped in three banks of eight; each bank can be wired as PNP (sourcing) or NPN (sinking) by tying the M or 1M terminal to 24 V or 0 V respectively. Mixing the wiring per bank is allowed; mixing within a bank is not.
• Two HSCs can be assigned to the same physical input pair, but only one can be active. The CPU 226 does not support user-defined interrupts on every transition of every input — the interrupt logic is bound to the HSC and pulse-train system.
• STEP 7-Micro/WIN projects are not forward-compatible with TIA Portal. TIA Portal does not import .mwp files. If the line is ever upgraded to an S7-1200, the project must be rewritten from scratch or hand-translated.
• On a Windows 10 or 11 64-bit host, run Micro/WIN inside a Windows 7 32-bit VM. Micro/WIN 4.0 SP9 will install but will not start reliably on 64-bit Windows even with compatibility flags.
• The PC/PPI USB cable enumerates as a virtual COM port. If a previous run of Micro/WIN was crashed, the COM port can stay locked. Open Device Manager, disable and re-enable the USB Serial Port, then restart Micro/WIN.
• Always confirm password protection before assuming a free upload. Micro/WIN will prompt for the four-level password ladder. If the original integrator left a level-4 password, the upload will succeed but the source view will be empty; only the binary project block is restored. In that case the only fix is to obtain a backup from the EEPROM cartridge or to rebuild the logic from the I/O list.
• For the specific case of pulling a program from a CPU 226 (6ES7216-2AD23-0XB0) to a laptop, the community-recommended procedure is documented in the Siemens support thread "I want to know how to connect S7-226 PLC with my laptop" at SiePortal CPU 226 laptop connection thread. The same thread also confirms that the official PC/PPI USB cable (6ES7901-3DB30-0XA0) is the simplest path when no RS-232 port is available.

15. Safety and Documentation

Before downloading to a live production PLC, confirm with the responsible electrical engineer and the line operator that:

• The machine is in a safe state to enter STOP (e.g. no workpieces in motion, no hazardous energy).
• A risk assessment has been performed for the temporary loss of the program during the upload/download cycle.
• The upload backup is stored on at least two independent media (laptop + USB stick or network share).
• The corrected project is documented in a change log: what was changed, why, by whom, and the project hash.