S7-300F MMC Program Transfer: Loading Emailed Safety Code

The Siemens SIMATIC S7-300F CPU family (fail-safe) is widely deployed in vendor-supplied machinery, process skids, and safety instrumented functions. A recurring field scenario is the need to apply a vendor's revised safety program to an installed CPU 315F-2DP without receiving a freshly programmed Micro Memory Card (MMC). This article documents the engineering options, the integrity controls specific to F-programs, and a step-by-step procedure to load an emailed project onto the existing MMC, plus a verification matrix and best-practice checklist for vendor program updates.

Overview of the F-CPU and MMC Architecture

S7-300F Fail-Safe Architecture

The CPU 315F-2DP belongs to the S7-300F range, which is differentiated from the standard S7-300 line by:

• A separate work-memory partition for the safety program (the F-program).
• A mandatory F-signature produced at compile time and a collective F-signature produced at the moment the F-CPU transitions from PASSIVE to ACTIVE safety mode.
• PROFIsafe communication over PROFIBUS-DP (and on PN-interface F-CPUs, over PROFINET).
• Mandatory use of the F-Library (S7 F Configuration Pack or S7 F Systems) when compiling F-blocks.
• F-password protection that prevents on-line modification of the safety program while the F-CPU is in RUN.
• An acceptance-test obligation under IEC 61508 / IEC 62061 / ISO 13849 before the F-program is allowed to control real I/O.

The 315F-2DP part-number family (MLFB 6ES7 315-6FFxx-0AB0 across its hardware index revisions) is sold for SIL 1-3 applications per IEC 61508 and up to PL e per ISO 13849-1. The achievable SIL/PL is a function of the F-CPU variant, the F-Library version, and the F-I/O configuration - always cross-check the SIL/PL claim in the vendor's safety file against the configuration pack release notes.

MMC Hardware Notes

The MMC is the only load memory for S7-300 CPUs in current production (the older 16-/32-KB integrated EPROM was removed long before the F-CPU generation). The supported SIMATIC Micro Memory Cards for the 315F-2DP are 4 MB, 8 MB, and 16 MB. The card must match the CPU's firmware release - combinations are documented in the CPU 31xF manual. A mismatch is rejected at start-up with the SF LED on and a diagnostic-buffer entry.

Email Transfer: Acceptance and Integrity Controls

In principle, yes - a STEP 7 / TIA Portal project archive is a standard ZIP file and there is no Siemens-imposed restriction on transmitting it over standard email channels. The engineering question is not "is the file transferable" but "is the transmission channel acceptable for a safety-relevant update." Email introduces three concerns specific to safety systems.

1. Tampering in transit. A safety program update is a controlled document. Request a SHA-256 hash of the vendor-supplied ZIP through a separate channel (phone, signed letter, vendor portal, signed PDF) and verify the hash after download.
2. Version identification. The vendor must supply the program's collective F-signature, the F-source signature, and the F-runtime signature so the receiving engineer can confirm bit-for-bit equivalence after loading.
3. Archival continuity. Retain the previous MMC image (or its block archive) on the receiving engineer's PG/PC so that a roll-back is possible if the acceptance test fails.

Email is acceptable when these three controls are in place. The vendor's "best" practice in the strict sense is still to ship a pre-programmed MMC, because this avoids any chance of file corruption during transfer, ensures the MMC is correctly formatted, and provides a physical handover document for the safety file. Email is the accepted fallback when the delivery window is too short for a postal MMC.

Program Transfer Options from Email to MMC

Once the ZIP is on a PG/PC, there are three viable paths to the MMC.

For the 315F-2DP installed at an end-user site, Option 2 (STEP 7 or TIA Portal load onto the existing MMC) is the typical field path when the vendor emails the code. Option 3 is the fallback for sites without a licensed Siemens engineering toolchain.

Prerequisites

Confirm every item below before scheduling the cut-over.

• PG/PC environment. STEP 7 V5.5 or later with the S7 F Systems V6.x add-on for classic projects, or TIA Portal V13 SP1 / V14 / V15 / V16 / V17 with the matching F-Configuration Pack. The project cannot be loaded with a tool version older than the version that compiled it.
• CPU identification. Open the online diagnostic buffer and read the order number (MLFB) and firmware version of the 315F-2DP. The vendor's project must be compiled against the same or compatible firmware. A mismatch is rejected at download with error 0x0E1F and an SF LED.
• MMC type. Use only Siemens SIMATIC MMC. Third-party SD-to-MMC adapters have caused write failures in field reports; Siemens does not support them.
• MMC free space. The vendor's archive is typically 200-800 KB for a small F-skid. Confirm the MMC has at least 2x the unzipped project size free.
• Backup. Create a complete backup of the existing MMC contents with STEP 7 (PLC > Memory Card File > New, then copy all blocks) or with TIA Portal's "Backup as project" feature. Save to a network share, not the PG's local desktop.
• Vendor-supplied artefacts. ZIP archive, password (if blocks are know-how protected), collective F-signature, F-source and F-runtime signatures, and the project CRC.
• Plant safety plan. A documented Site Acceptance Test (SAT) covering every safety function affected by the new program. The SAT must be in paper or signed-PDF form before power-down.

Step-by-Step: Loading the Emailed Program to the Existing MMC

Step 1 - Verify the Archive

1. Save the vendor's ZIP to a known directory, e.g. C:\VendorUpdates\S7300F_Rev17\.
2. Open a PowerShell prompt and compute the hash:

   Get-FileHash .\S7300F_Rev17.zip -Algorithm SHA256

3. Compare the hash to the value provided by the vendor through a separate channel. If they do not match, stop and contact the vendor - never load an unverified archive.

Step 2 - Extract and Open the Project

1. Extract the ZIP to a working folder.
2. In STEP 7 (SIMATIC Manager): open the project, accept any re-target dialogs (PG/PC interface selection) and let STEP 7 perform an offline consistency check.
3. In TIA Portal: open the project, navigate to the safety administration editor, and confirm no compile errors before connecting to hardware.

Step 3 - Review the F-Signatures

Before any download, navigate to the F-signature overview.

• STEP 7 + F-Configuration Pack: open the safety program and select "F-Signatures" from the safety administration editor. Record the collective F-signature, the F-source signature, and the F-runtime signature.
• TIA Portal: in the safety administration editor, switch to the "F-signatures" tab. The same three values are shown.

Compare all three values to the values sent by the vendor. Any mismatch means the project on disk has been modified - do not load it. Re-request the archive.

Step 4 - Insert the MMC in the PG

1. Power down the PG if the Field PG manual requires it for MMC insertion.
2. Insert the existing MMC into the PG's PCMCIA / MMC slot, or use an externally supported MMC reader.
3. In Windows Explorer, verify the MMC is recognised as a removable device. Do not format the card from Windows - Siemens MMCs use a Siemens-specific file system that the OS shows as "raw" or unrecognised. Use STEP 7 / TIA Portal to handle the card.

Step 5 - Delete the Old Project (Optional but Recommended)

For a clean handover, wipe the existing program first.

• STEP 7: PLC > Memory Card File > Delete.
• TIA Portal: Project tree > Card Reader / USB memory > right-click the card > "Format".

Step 6 - Download the New Program to the MMC

STEP 7 (SIMATIC Manager):

1. Select the S7-300 station > CPU 315F-2DP.
2. PLC > Download to Memory Card.
3. Choose "Download user program to Memory Card".
4. When prompted, select "Replace" for the system data and "Overwrite" for blocks.
5. Wait for the dialog "Download to Memory Card completed successfully".
6. Eject the MMC from Windows (or use the PG's hardware eject).

TIA Portal:

1. Project tree > the CPU device.
2. Online > "Card Reader / USB memory".
3. Select the MMC in the device list.
4. Drag the software (all blocks including safety blocks) to the card, or use the "Transfer" wizard.
5. Confirm the collective F-signature is shown in the transfer summary.

Step 7 - F-CPU Passivation and Acceptance Test

A safety program cannot be live until the F-CPU has been put through an acceptance test. The procedure is documented in the S7-300F / S7-400F manuals and the IEC 61508 / IEC 62061 lifecycle you are working under.

1. Power down the F-CPU, insert the MMC, power up.
2. The CPU boots into PASSIVE safety mode (SF LED off, but F-program not active). This is the expected state.
3. The receiving engineer must re-enter the F-password, then explicitly "Approve" the safety program in the safety administration editor.
4. The collective F-signature is re-computed and stored in the F-CPU.
5. Execute the vendor's SAT document. Every safety function (E-stop, light curtain, guard door, valve, etc.) must be tested and recorded.
6. Sign the SAT and update the safety file.

Program Transfer Without a Programming Device

It is technically possible to write the MMC with a standalone MMC prommer that supports the Siemens MMC filesystem. The prommer writes a card image that is bit-identical to what STEP 7 would write. The receiving engineer still has to:

• Verify the card image hash against the vendor's published value (typically published as a separate SHA-256 next to the ZIP).
• Physically install the card.
• Re-approve the F-program on first boot by entering the F-password and accepting the safety program in the F-CPU's safety administration editor.

This option is mainly used when the customer does not own STEP 7 / TIA Portal, or when loading must happen on a plant network with no PG access. The cost and rarity of supported prommer hardware in 2024+ has reduced this path to a niche scenario.

Vendor-Side Workflow for Emailed Program Updates

If the vendor is going to email program updates, the vendor should also:

• Publish a controlled "update package" with a version number, release date, and a SHA-256 of the ZIP.
• Include the collective, source, and runtime F-signatures in the covering email or in a separate document.
• Provide a delta SAT (what safety functions changed, what must be re-tested).
• State the STEP 7 / TIA Portal version (and the F-Configuration Pack version) that the project was compiled with.
• State the target firmware version of the 315F-2DP.

The receiving engineer's responsibility is to verify all five items before scheduling a plant shutdown for the cut-over. Items that do not match the installed CPU's firmware or the site's engineering toolchain version are stop-the-line conditions, not warnings.

Verification After the Load

After the load, before handing the line back to operations, run the following checks.

A failed check is a stop-the-line condition. Do not bypass F-functions to "get the plant running" - a bypassed F-function is a reportable safety incident in most jurisdictions.

Troubleshooting Matrix

Best-Practice Checklist for Vendor Program Updates on S7-300F

• Treat every F-program update as a controlled safety change - not as a routine software update.
• Demand a SHA-256 of the archive and the F-signatures before opening the ZIP. Verify by a separate channel (phone, signed letter, vendor portal).
• Always back up the previous MMC image to a network share with a date-stamped name before any write.
• Schedule the cut-over to a planned downtime. Never load an F-program on a running line.
• Re-execute the SAT in full. A delta test is only acceptable when the vendor provides a documented change-impact analysis and your plant's safety lifecycle allows it.
• Update the plant's safety file (F-document) with the new collective F-signature, the new revision number, the SAT signature, and the date.
• Keep the vendor's email (with the hash) in the project archive for the lifetime of the installed CPU. Most regulatory frameworks require the safety file to be retained for 10-25 years.
• Restrict STEP 7 / TIA Portal install rights and the F-password to a small named group. The F-password is a controlled item under most plant security policies.
• Lock the S7 F Configuration Pack / S7 F Systems version in your engineering tool. Mixing pack versions between projects is a common cause of unexplained signature mismatches at load time.

Standards and Safety Lifecycle References

The S7-300F platform is designed for use in IEC 61508 SIL 1-3 and ISO 13849 PL a-e applications. The exact SIL/PL achievable depends on the F-CPU variant, the F-Library version, and the I/O configuration - always consult the SIMATIC S7-300F System Manual and the F-Configuration Pack release notes for the firmware you are running. Key external references to verify against:

• Siemens Industry Online Support - the single source of truth for the latest manuals, firmware updates, and F-Configuration Pack downloads. Search the portal for the order number of your specific 315F-2DP variant to retrieve the matching manual bundle.
• SIMATIC S7-300 product page - product family overview, links to datasheets and current firmware.
• SIMATIC Safety Integrated - the umbrella technology page for fail-safe SIMATIC controllers, with white papers on F-technology lifecycle.
• TIA Portal - the current engineering framework for new F-projects; legacy projects may still be in STEP 7 V5.5 / SIMATIC Manager.

For the IEC 61508 / IEC 62061 / ISO 13849-1 lifecycle requirements that govern how an F-program update is justified, performed, and recorded, refer to the current edition of the relevant standard. The standards are documents to verify against, not guarantees - the actual achievable SIL/PL must be confirmed by calculation for the specific F-CPU, F-Library, and F-I/O combination in use.

FAQ