S7-400 CPU Memory Card Download STOP Requirement and FlashPROM

Overview: S7-400 Memory Architecture and the FlashPROM Question

The SIMATIC S7-400 series uses a distinct memory architecture compared to the S7-300 line. Whereas S7-300 CPUs (up to the CPU 317) store the user program on a Micro Memory Card (MMC) that can be written while the CPU is in RUN, the S7-400 family relies on a Flash EPROM memory card combined with a battery-backed RAM load memory. This architectural choice has direct operational consequences: downloading the user program to a Flash memory card on an S7-400 CPU always requires the CPU to be in STOP mode. There is no legitimate workflow that lets a STEP 7 or TIA Portal engineering station write a Flash card while the controller continues executing the user program.

This guide consolidates the field-proven practices for engineers who must preserve the S7-400 user program without forcing an unscheduled plant stop, including RAM download procedures, OB 81 battery diagnostics, runtime data retention, UPS sizing considerations, and F-CPU specific download rules.

Why FlashPROM Download Requires STOP Mode on S7-400

The S7-400 Flash card is an EEPROM-based, word-by-word programmable memory. To prevent partial or corrupted writes during a download, Siemens hardware design mandates a controlled environment with all outputs in a defined safe state, all process interrupts masked, and the scan cycle halted. The only state that satisfies these conditions is STOP. According to the SIMATIC S7-400 Automation System, CPU Specifications manual, the documented sequence is:

1. Set the CPU mode selector to STOP.
2. Insert the FLASH card into the CPU slot.
3. Perform a memory reset.
4. Download the user program to the CPU/Flash card.
5. Switch the mode selector back to RUN or RUN-P.

The same constraint applies when the Flash card is already inserted but the project requires re-flashing: the CPU must drop to STOP first because the load memory region mapped to the Flash is write-protected during RUN. STEP 7 Classic and TIA Portal V20 both enforce this rule at the programming device; the "Download to Memory Card" target selector is greyed out or returns an error unless STOP is detected.

S7-400 Flash vs S7-300 MMC: Architectural Comparison

The S7-300 MMC was designed around the principle that the card itself is the load memory. The S7-400 treats the Flash card as a backup image of what already lives in RAM; runtime changes in DB values, timers, counters, and markers exist only in RAM and depend on the backup battery or external UPS to survive power loss.

Prerequisites Before Any S7-400 Download Operation

Before initiating any download procedure, verify the following:

• Battery health: Check BATF LED on the CPU front panel. Use OB 81 evaluation for remote health monitoring (covered in detail below).
• Flash card compatibility: Use only Siemens-approved FLASH cards (6ES7 952-1Ax00-0AA0, 6ES7 952-1KK00-0AA0, or 6ES7 952-1KL00-0AA0 depending on CPU generation). Reference the CPU's operating instructions for the correct order number.
• Project consistency: Compile the STEP 7 / TIA Portal project before going online; inconsistent blocks cause download abortion and leave the CPU in a degraded state.
• Plant coordination: For STOP-required downloads, schedule a maintenance window. For RAM-only downloads, document the change in the plant logbook.
• Backup archive: Use "Download user program to memory card" or STEP 7 Archive to create a *.wld / *.zip archive on the engineering station before any modification.

Procedure A: Download to RAM Load Memory Without Stopping the CPU

RAM load memory is volatile on battery loss but accepts downloads while the CPU is in RUN. This is the recommended approach for incremental code patches on running plants.

1. Open the project in STEP 7 V5.x or TIA Portal and connect online via PROFIBUS / PROFINET / Industrial Ethernet.
2. In the project tree, select the target CPU and choose "Download to device" (TIA Portal) or "PLC > Download to Target System" (STEP 7 Classic).
3. In the download dialog, set the target location to "RAM" (not "Flash Card").
4. Confirm the online/offline comparison. The dialog lists modified blocks (FCs, FBs, DBs, OBs, SDBs, SFBs, SFCs).
5. Select "Download" — the CPU remains in RUN throughout. OB 100 / OB 101 restart code does NOT execute because the CPU does not restart.
6. Verify in the online view that all blocks show the green "consistent" check mark and timestamps match the offline project.

Procedure B: Download User Program to Flash Memory Card (STOP Required)

Use this procedure when the plant can tolerate a brief CPU stoppage or during scheduled shutdowns.

1. Set the mode selector switch on the CPU front panel to STOP. Confirm the STOP LED is solid amber.
2. If a Flash card is already inserted, leave it in place. If not, insert the Siemens FLASH card into the slot at the top of the CPU.
3. Perform a memory reset using the mode selector: turn to MRES and hold for 3 seconds until the STOP LED blinks, then release and turn again to MRES within 3 seconds.
4. In STEP 7 / TIA Portal, select the CPU target and choose "PLC > Download User Program to Memory Card" (or "Download to Memory Card" in TIA Portal's Card Reader/USB card view).
5. Browse to the path of the project archive (*.wld for STEP 7 V5, *.zip / *.s7zip for TIA Portal) and confirm.
6. The CPU writes the Flash card. Progress is indicated by the STATUS / FRCE LED or the diagnostic buffer entry.
7. After completion, verify by reading the Flash card: in TIA Portal, right-click the CPU > "Card Reader/USB > Read from Memory Card".
8. Set the mode selector to RUN. The CPU performs an OB 100 / OB 101 / OB 102 restart depending on the mode switch position and the type of stop.

Step-by-Step S7-400 Flash Card Replacement on a Live Plant

When the Flash card is being replaced (end-of-life, capacity upgrade, corrupted image), the workflow is:

1. Force the CPU to STOP via mode switch.
2. Eject the existing FLASH card. The card slot on S7-400 CPUs is spring-loaded; depress the ejector to release.
3. Insert the new FLASH card.
4. Memory reset as described above (MRES twice).
5. Download the user program from the engineering station: "Download to device > PC/PG > Flash Card (target location)".
6. Optionally, archive the old card before disposal using a Siemens Field PG or PG with the appropriate card adapter.

OB 81 Battery Failure Monitoring Implementation

The S7-400 raises OB 81 whenever the backup battery voltage drops below threshold or the battery is missing. This OB executes in the priority class immediately below OB 1, allowing the application to react before a complete power loss wipes retentive data.

Sample STL implementation for an OB 81 diagnostic block:

FUNCTION_BLOCK FB_BatteryMonitor
VAR
  LastBatteryFault : BOOL;
  FaultCount : DWORD;
END_VAR
BEGIN
  // OB81_FLT_ID bits identify the fault subtype
  // B#16#21 = Battery exhausted, B#16#22 = No battery fitted
  IF OB81_FLT_ID = B#16#21 OR OB81_FLT_ID = B#16#22 THEN
    LastBatteryFault := TRUE;
    FaultCount := FaultCount + 1;
    // Set HMI alarm, send email via CP, trigger UPS load test
    "db_alarms".battery_fault := TRUE;
    "db_alarms".battery_fault_id := OB81_FLT_ID;
    "db_alarms".battery_fault_time := OB81_DATE_TIME;
    // Force a controlled shutdown sequence if critical process
    IF "process_criticality".battery_response = "SHUTDOWN_NOW" THEN
      // Trigger graceful stop with output ramp-down
      "shutdown_seq".request := TRUE;
    END_IF;
  END_IF;
END_FUNCTION_BLOCK

Wire this FB into OB 81 to capture every battery event. The temporary local data of OB 81 contains OB81_FLT_ID, OB81_DATE_TIME, and other diagnostic fields per the STEP 7 reference manual.

Securing Runtime Data: DBs, Timers, Counters, and Markers

The Flash card only stores the program code (OBs, FBs, FCs, DBs structure). The actual values inside DBs, the elapsed time on timers, counts on counters, and the state of markers exist only in RAM. To preserve runtime values across a power loss, the S7-400 CPU requires either:

1. Battery backup: Insert 1 or 2 AA lithium backup batteries (per CPU variant) into the battery compartment. Expected life 2-5 years depending on CPU and ambient temperature.
2. External UPS: Provide 24 VDC auxiliary supply to the CPU's PS module via a buffered DC bus, or supply 120/230 VAC to a SITOP UPS module with USB/Ethernet signaling to the PLC.
3. Retentive marker configuration: In HW Config > CPU Properties > Retentivity, define the number of retentive MBs, timers, counters, and DB areas. Retentive areas survive power cycles when the battery or UPS is functioning.

UPS Sizing for S7-400 Runtime Continuity

To bridge the gap between mains loss and battery replacement, a UPS is the only practical option for plants without a UPS on the entire line. Sizing formula for a SITOP UPS500S or DC-UPS module:

Required UPS capacity (Wh) = CPU_load_W × buffer_time_h + Σ(IO_module_load_W × buffer_time_h)

Typical S7-400 CPU draw (CPU 416-3 PN/DP example): 4 W active, 6 W with all CPs loaded. A 24 VDC, 2.5 Ah UPS module provides roughly:

buffer_time_h = (2.5 Ah × 24 V) / (4 W + sum_IO_load_W)

For a CPU 416-3 with 5 W of I/O total: buffer_time_h = 60 Wh / 9 W ≈ 6.7 hours. Always oversize by 30% to account for battery aging and temperature derating.

F-CPU Specifics: Safety Program Download Without Flash Card

S7-400 F-CPUs (CPU 416F, CPU 417F) require additional procedures when the safety program is downloaded without a flash card inserted. Per TIA Portal V20 SIMATIC Safety documentation:

1. Perform a memory reset of the F-CPU using the mode switch or via the PG/PC.
2. Download the safety-related project data to the F-CPU.
3. Perform a program identification / safety signature verification.
4. Insert the Flash card (if required by site policy) and perform the standard STOP-based download to write the safety program to the card.

The F-CPU's safety signature is calculated from the safety program blocks (F-FB, F-FC, F-DB, F-SFC). Any change to the safety program invalidates the signature and triggers a collective F-stop until the signature is re-acknowledged with the safety password.

Troubleshooting Matrix: Common Download Errors and Resolutions

Verification Checklist After Any S7-400 Download

• Compare online/offline block timestamps — must match.
• Read the diagnostic buffer via "PLC > Diagnostic Buffer" — look for entries indicating successful download and any new faults.
• Check module status in HW Config online view — all green.
• Force-clear any persistent fault bits using the "Clear/Reset" function only after confirming the process is in a safe state.
• Monitor CPU status LEDs: RUN green, STOP off, BATF off, SF off, BF off.
• Sign off the change in the plant logbook with project version, date, and engineer initials.

Best Practice Summary: Securing S7-400 PLC Code Without Unscheduled Stops

1. Always maintain a hot spare FLASH card archived with the current validated project.
2. Use RAM downloads for live code patches during normal operation, then schedule Flash card writes during planned shutdowns.
3. Implement OB 81 monitoring with HMI alarming and email/notification integration.
4. Provide battery backup or UPS for the CPU's 24 VDC or 120/230 VAC supply, sized for the plant's maximum tolerated power outage.
5. Configure retentive marker and DB ranges in HW Config to match process requirements — do not over-allocate as this shortens battery life.
6. Document the change management workflow so operators know which steps require STOP and which can run live.
7. Use STEP 7 / TIA Portal project archives (*.wld, *.zip) for long-term storage in version control (e.g., Git LFS or document management system).