Resolving S7-400 F-CPU F-Block Download Errors in CFC

S7-400 F-CPU engineers working with STEP 7 CFC and the S7 F/FH Systems optional package frequently encounter download errors when transferring safety blocks to a failsafe controller. The most common chain begins with "The download of F-blocks is not allowed with online CPU connection" and can escalate to firmware-level diagnostic code D081 Function not permitted in current mode or a Windows Code generator for S7 has stopped working exception. This article provides the complete diagnostic tree, the correct STOP-mode procedure, and the safety-mode pitfalls that produce each failure on a CPU 412-5H or any other S7-400F / S7-400FH controller.

1. Problem Definition and Error Chain

The download error chain reported on a CPU 412-5H (S7-400F/FH) follows a deterministic sequence when an engineer attempts to push a modified CFC safety chart from the SIMATIC Manager to a live F-CPU:

1. Initial online download attempt in RUN — STEP 7 raises "The download of F-blocks is not allowed with online CPU connection".
2. Operator places the CPU in STOP from the SIMATIC Manager toolbar — subsequent download of the safety program aborts with the same error because the F-CPU still holds the safety program in enabled state.
3. Operator attempts to deactivate safety mode from the wrong dialog — the F-CPU raises a diagnostic buffer entry (D081) Function not permitted in current mode.
4. Re-compiling the safety program under heavy load or on a STEP 7 V5.5 SP3 or earlier install crashes the S7CodeGen.exe host with a Windows Application Error: "Code generator for S7 has stopped working".

Each error has a different cause and a different resolution. The naive response (place the CPU in STOP, try again) does not clear the chain because the F-CPU is governed by a hardened state machine that distinguishes the CPU operating mode from the F-CPU safety operating mode. The following sections dissect each error and document the exact sequence required to bring the F-CPU to a state where the F-block download is accepted.

2. Why the F-CPU Rejects Online Download of F-Blocks

SIMATIC F-CPUs enforce a hardened security model for the safety program. F-blocks are part of the F-runtime signature and are protected by two independent mechanisms: the F-CPU's collective F-signature (a CRC across the entire safety program) and the F-software's individual F-block signatures (CRC + version stamp). Both signatures are checked on every cold restart and on every safety-relevant operation, and they are bound to the CPU's safety operating mode.

According to the SIMATIC S7 F/FH Systems manual (Configuring and Programming, chapter 10), the safety program can only be modified when the F-CPU is in STOP with safety mode disabled. The CPU will not accept an F-block download in any of the following conditions:

The error message "The download of F-blocks is not allowed with online CPU connection" is a guard, not a malfunction. STEP 7 is informing the engineer that the live connection cannot be used for safety-program modifications because the F-runtime would have to rewrite its own F-signature database while still protecting the active process. The proper pathway forces a transition to STOP + safety mode disabled before any F-block payload is sent. This is documented in the official SIMATIC Safety — Configuring and Programming — Downloading Individual F-Blocks to an S7-300/400 F-CPU page.

3. Affected Hardware and Firmware

The procedure in this article applies to the S7-400F / S7-400FH family. Engineers should match the firmware version to the F-optional package version before scheduling a download to avoid signature mismatches.

4. Prerequisites

Before attempting the resolution procedure, confirm the following items are in place. Missing prerequisites account for the majority of failed retries in the field.

• STEP 7 V5.5 SP4 or later (SP4 closes the S7CodeGen.exe crash on Windows 7 SP1 / Server 2008 R2) installed on the engineering station.
• S7 F/FH Systems optional package, version matching the STEP 7 release. Verify with Start > SIMATIC > STEP 7 > Information — the F-optional package version appears under installed products.
• CFC editor, version matching STEP 7 (CFC V8.x for STEP 7 V5.5).
• Offline S7 project whose safety program compiles cleanly (no warnings in the CFC log).
• Online connection to the F-CPU via MPI, PROFIBUS, or PROFINET (depending on the CPU's interface configuration). Verify the connection with PLC > Accessible Nodes in SIMATIC Manager.
• The current safety program F-password. Without it, the safety program cannot be opened for edit, and the password prompt will time out after 60 seconds.
• Sufficient free work memory on the F-CPU: at least 256 KB for the F-runtime and an additional 32 KB per chart. The current load is reported under PLC > Module Information > Memory.

5. Step-by-Step F-Block Download Procedure

The correct sequence differs from the standard non-safety download. The download of F-blocks must be initiated from the Edit Safety Program dialog, not from the CFC editor's normal Chart > Download menu, and the F-CPU must be transitioned to STOP + safety mode disabled by the dialog itself.

5.1 Open the Safety Program

1. In SIMATIC Manager, right-click the S7 program node of the F-CPU.
2. Select Options > Edit Safety Program.
3. Enter the F-password when prompted. The dialog window Edit Safety Program opens. If the prompt times out, restart SIMATIC Manager and try again — the F-password is stored encrypted in GS7Prot.cfg and will be invalidated after three failed attempts.

5.2 Compile the Safety Program

1. In the Edit Safety Program dialog, click Compile.
2. Inspect the log: the entry "No errors, no warnings" is required before the download button activates.
3. If S7CodeGen.exe crashes during compile, jump to section 7 of this article before continuing.

5.3 Disable Safety Mode and Place the CPU in STOP

1. Within the Edit Safety Program dialog, click Stop. The F-CPU is commanded to STOP.
2. Confirm the F-CPU diagnostic buffer reports "Mode transition: RUN -> STOP" with no faults.
3. Click Disable Safety Mode. The dialog transitions the F-CPU's safety state to disabled. The CPU stays in STOP.

5.4 Trigger the Download

1. In the Edit Safety Program dialog, click Download. This button is only visible when the F-CPU is in STOP + safety mode disabled and the program compiled cleanly.
2. STEP 7 prompts for confirmation that the F-CPU is in STOP — confirm.
3. The download progress window appears. Wait for the message "Download of safety program to CPU ... completed without errors". Typical download duration is 8–25 seconds for a 200-block safety program over MPI/PROFIBUS at 1.5 Mbit/s, and 4–12 seconds over PROFINET at 100 Mbit/s.

According to the official SIMATIC Safety documentation, F-blocks and standard blocks can be downloaded simultaneously to the F-CPU via the project tree when the F-CPU is in the correct state. The collective download is initiated from the Edit Safety Program dialog rather than from the CFC editor.

5.5 Verify the New F-Signature

1. Re-enable safety mode by clicking Enable Safety Mode in the Edit Safety Program dialog.
2. Switch the F-CPU to RUN with Start.
3. Open PLC > Safety > Display F-Signature. Compare the new collective F-signature with the one recorded in the safety log book; they must match the planned value byte-for-byte.
4. Inspect the F-CPU diagnostic buffer. The new entry should read "F-Signature check passed: OK" with a timestamp matching the download.

6. Resolving the D081 Diagnostic Buffer Entry

The diagnostic buffer entry (D081) Function not permitted in current mode is a S7-400 firmware error class. It is raised when the engineering station sends an F-block download command to an F-CPU whose safety state does not permit the operation. The most common trigger is the engineer clicking Stop in the wrong context: the F-CPU transitions to STOP, but its safety mode remains enabled, and the next download request is rejected at firmware level rather than at STEP 7 level.

Resolution is to back out of the partial state before re-issuing the command:

1. Close the online connection to the F-CPU (PLC > Disconnect or close the project tree node). Do not skip this step — keeping the connection open allows STEP 7 to retry the failed command in a loop and refresh the D081 entry.
2. Re-open the Edit Safety Program dialog (Options > Edit Safety Program) and re-enter the F-password.
3. Use the dialog's Stop + Disable Safety Mode sequence (section 5.3) — never the SIMATIC Manager toolbar.
4. Re-issue the download from the dialog.

If D081 persists after the procedure, inspect the F-CPU diagnostic buffer (PLC > Diagnostic Buffer) for a preceding error. Typical precursors are SF (system fault), BF (bus fault), or OB85 (OB not loaded). Those faults lock the F-CPU's safety state machine and must be cleared first. The relevant diagnostic event IDs are listed in the table below.

7. Resolving the S7CodeGen.exe Windows Application Error

The Windows error "Code generator for S7 has stopped working" is generated by WerFault.exe (Windows Error Reporting) when the S7CodeGen.exe process terminates unexpectedly. The F-code generator is a 32-bit process that compiles F-blocks into the loadable binary; it runs in parallel to the CFC compiler and can crash on:

• STEP 7 V5.5 SP3 or earlier running on Windows 7 SP1 / Windows Server 2008 R2 (heap corruption bug, fixed in SP4 patch 1).
• 32-bit STEP 7 running on a 64-bit OS without the WoW64 hotfix KB2464828 / KB2565063.
• Engineering station with less than 4 GB RAM and a project of more than 1,000 F-blocks (memory exhaustion).
• Antivirus software (Symantec Endpoint Protection, McAfee Endpoint Security) intercepting S7CodeGen.exe on F-block compile.
• Two engineering stations opening the same S7 project across an inconsistent network share — file-lock contention corrupts the temporary *.tmp intermediate.

Apply the following corrective actions in order:

1. Update STEP 7 to V5.5 SP4 HF7 or later. Apply the latest hotfix package from the Siemens Industry Online Support portal.
2. Add S7CodeGen.exe, S7wincfx.exe, and CCWIN.EXE to the antivirus exclusion list. The processes are located in C:\Program Files\Siemens\Automation\S7-CFC\bin.
3. Disable Data Execution Prevention (DEP) for the STEP 7 process tree: System > Advanced System Settings > Performance > Data Execution Prevention > Turn on DEP for essential Windows programs and services only. Restart the engineering station.
4. Set the engineering station's User Account Control to the lowest level and run SIMATIC Manager as Administrator.
5. Close the open CFC chart, reopen it, and re-run compile from the Edit Safety Program dialog (not from the CFC editor).
6. If the error repeats, generate a S7CodeGen.dmp using procdump.exe -ma S7CodeGen.exe and forward it to Siemens Technical Support with the project hash.

8. F-Block Types and Their Download Constraints

Not all F-blocks share the same download behavior. The table below summarizes the constraints of each block type in the safety program.

The download rules above also govern passivation behavior: when the safety program is reloaded, all F-channel drivers are passivated briefly. iPAM (input process image) and oPAM (output process image) for the failsafe I/O modules default to 0 during the passivation window, which the F-program treats as a safe state. The passivation window is typically 50–200 ms depending on the I/O count and the CPU load.

9. State Machine Reference (F-CPU Safety Mode Transitions)

The following SVG diagram captures the F-CPU state transitions that govern F-block download acceptance. The shaded path is the only sequence under which a F-block download is accepted.

10. Troubleshooting Matrix

The matrix below maps each symptom to its likely root cause and the corrective action documented in this article. Use it as a fast triage before running the full procedure.

11. Verification Checklist

After a successful F-block download, perform the following verification before returning the F-CPU to production service.

• Collective F-signature in the F-CPU matches the value recorded in the safety log book.
• Individual F-block signatures match the printout of the F-Compiler log (compare CRC + Version for each F-FB, F-FC, and F-DB).
• Safety mode is re-enabled before the F-CPU returns to RUN (the SAFETY LED on the CPU front panel is solid green, not flashing).
• The F-CPU's diagnostic buffer contains no entry more severe than Information for the time window between the download and the verification.
• The process-specific safety acceptance test has been executed and signed by the safety officer.
• All F-channel I/O modules report OK status (no passivated or faulted channels).
• The redundancy link (for H-CPUs) reports OK on both CPUs.

12. Related Configuration Notes

Engineers migrating from S7-400 F-CPUs to S7-1500F will notice that the F-block download procedure in TIA Portal is structured differently: the equivalent of the Edit Safety Program dialog is the Safety Administration editor, and the operating mode transition is automated by the portal. The CPU 412-5H remains in scope for legacy plants where STEP 7 V5.x is the only supported tool chain; the procedure above applies unchanged to CPU 414-4H, CPU 416-3F, and the CPU 417-4H variants of the S7-400F / S7-400FH family.

For S7-300F CPUs (CPU 315F-2 DP, CPU 317F-2 DP), the same Edit Safety Program dialog is used, but the F-CPU does not support the "disable safety mode" intermediate state in firmware older than V3.2. Verify the firmware level on the S7-300F before scheduling a download. The S7-300F procedure also requires the F-CPU to be in STOP and SF LED off before the Edit Safety Program dialog will accept the request; on S7-400F the SF LED is allowed to be on if the fault is not safety-related.

For PROFIsafe I/O on PROFINET, the S7-400F F-CPU uses the PN/DP interface for both standard PROFINET and PROFIsafe traffic. The PROFIsafe slot index in HW Config must match the F-DB configuration in the safety program; a mismatch raises a download-time error "PROFIsafe slot configuration does not match F-DB layout" that the F-CPU will report with diagnostic event ID D102. The correct slot assignment is verified with HW Config > PROFIsafe > Slot Assignment Check.

FAQ