Siemens S7-300/400 CPU Stop Mode: Upload/Download, SDB, Pointer

1. Overview

Siemens SIMATIC S7-300 and S7-400 controllers distinguish between online (running program in the CPU) and offline (program on the programming device/PG) project states. The most common operator doubt is whether the CPU must be placed in STOP before any upload or download operation. The answer is conditional: routine program-block transfers do not require STOP on S7-300/400, but several specific operations do, most notably hardware configuration (HW Config) changes, full memory resets, and certain DB re-initializations.

This reference consolidates the rules for CPU operating modes, the role of System Data Blocks (SDB), the block-type taxonomy (OB, FB, FC, DB, SFB, SFC, SDB), the correct usage of the POINTER and ANY pointer data types in STL versus LAD/FBD, and the workflow for online editing with STEP 7 V5.x and TIA Portal.

2. CPU Operating Modes on S7-300 and S7-400

Three operating modes are defined for S7 CPUs:

The physical mode selector on S7-300 CPUs (CPU 312 through CPU 319) has three positions: RUN, STOP, and MRES (memory reset, spring-return). S7-400 CPUs use a four-position key switch: RUN, RUN-P, STOP, and MRES. The RUN-P position on S7-400 is what unlocks online programming while the process continues to run.

3. Upload and Download Without STOP

For the following operations the CPU can remain in RUN-P on S7-300 or in RUN-P on S7-400:

• Downloading modified FB, FC, OB, DB, UDT, or VAT blocks (single-block download).
• Uploading blocks from the CPU to the PG.
• Online > Download (incremental compile + transfer).
• Modifying tag values in the monitor / VAT table.
• Performing online > Modify (force) operations on inputs/outputs.

The STEP 7 V5.5/V5.6 menu path used to switch operating modes from the PG without touching the hardware switch is:

1. Establish an online connection: PLC > Display Accessible Nodes or PLC > Connect to Target System.
2. Open PLC > Diagnostic/Setting > Operating Mode.
3. Select the desired state (STOP, RUN, RUN-P) and confirm.

In TIA Portal the equivalent path is: project tree > right-click the PLC > Online & Diagnostics > Operating Mode. The CPU must have access level Full access (no protection) or a configured HMI/PG password matching the CPU's protection level to permit remote mode change.

4. Operations That Require STOP

The following list summarizes the operations for which the CPU must be in STOP. This is the core answer to the original operator question:

The original Siemens reply — "The only time you need to put in stop mode is you are changing the hardware configuration" — is correct for routine program edits but is conservative. The complete rule set above is what a commissioning engineer should apply.

5. System Data Blocks (SDB) Explained

System Data Blocks are not user-written blocks. They are generated automatically by the STEP 7 Hardware Configuration editor (HW Config) when you compile the station. SDBs contain:

• Module parameter records (input filter times, diagnostic enables, substitute values).
• CPU parameters (scan time monitoring, OB priority assignments, interrupt configuration).
• PROFIBUS / PROFINET node addresses and bus timing parameters.
• Symbolic I/O assignments (P, I, Q, M addressing derived from slot addresses).
• Communication connection data for S7 connections, TCP/UDP, ISO-on-TCP, FDL.

SDB numbers are allocated by the system starting at SDB 0 upward. They are downloaded with the HW Config download action. Reading SDBs back is performed with PLC > Upload Station to PG; this rebuilds the HW Config on the engineering station. On the CPU's load memory, SDBs can be inspected with PLC > Diagnostic/Setting > Module Information > SDB Container in STEP 7 V5.x, or via the online & diagnostics buffer in TIA Portal.

If SDBs become corrupt (diagnostic buffer entry "SDB error / parameter assignment error" with event IDs 0x80C4, 0x80C5), the recovery procedure is: bring CPU to STOP > re-download HW Config > perform cold restart. The corresponding Siemens S7-300/400 parameter assignment error FAQ lists all parameter-error event IDs.

6. Block Type Reference (S7-300/400)

STEP 7 distinguishes seven block kinds. Each occupies a number range allocated by the CPU firmware:

Common SFB/SFC catalog excerpts (firmware-dependent; see STEP 7 List of SFBs/SFCs Reference):

7. Pointer Data Type Usage in STL vs LAD/FBD

The POINTER and ANY data types are defined for S7-300/400 and are used in two contexts:

1. Formal parameter declarations of system blocks (e.g. SFC20 BLKMOV takes ANY; SFC59 RD_REC takes ANY).
2. Indirect memory addressing in STL programs.

POINTER occupies 6 bytes: two bytes for the DB number (0 for non-DB areas), and four bytes formatted as a byte address (24-bit value, bit offset 0 only). Example:

ANY occupies 10 bytes: data type ID, repetition factor, DB number, byte address. The standard STL pattern for an ANY source variable is:

In LAD and FBD the same blocks are inserted graphically; the ANY input on SFC20 BLKMOV is filled by entering a label or memory area, and STEP 7 generates the underlying POINTER/ANY automatically. The operator can remain in LAD/FBD and never see the literal P# syntax. Consequently the "pointer data type is only for STL" answer is incorrect — the data type is used internally in both editors, but only STL exposes it directly in source code.

Indirect addressing in STL uses three register pairs:

// STL example: indirect addressing via AR1
      L     P##SOURCE       // Load pointer to SOURCE
      LAR1                     // Load into AR1
      L     W [AR1,P#2.0]   // Load word at offset 2 from AR1

On S7-1200 and S7-1500 the equivalent pattern is the AT view of a data block slice or the Variant data type. The POINTER type is retained only for legacy compatibility.

8. The Control Unit in HW Config

The "control unit" mentioned in the original post refers to the CPU object inside the S7 station. In HW Config, dragging a CPU (e.g. CPU 315-2 PN/DP, 6ES7315-2EH14-0AB0) into slot 2 of a rack inserts a control unit object that owns:

• The MPI/PROFIBUS interface (X1) properties.
• The PROFINET interface (X2) on PN-capable CPUs.
• The OB configuration (cycle monitoring, OB1 scan time, OB priority assignments).
• The time-of-day, runtime meters, and diagnostic buffer settings.
• The protection/access-level password assignments.

Changes to any of these objects trigger SDB regeneration and therefore require STOP on S7-300/400. CPU objects in TIA Portal's Device Configuration expose the same parameters and follow the same rule.

9. Online Editing Workflow (STEP 7 V5.x)

The recommended sequence to modify a running program block without stopping the process is:

1. Open the project online: View > Online (or press Ctrl+F10 on the editor).
2. Open the FB/FC to be edited. The editor shows the online version against a yellow background.
3. Make the modification offline (white background). STEP 7 tracks the difference.
4. Compile with Program > Compile (or Ctrl+B).
5. Download with PLC > Download or the toolbar icon. The dialog will list the modified blocks.
6. Confirm. The CPU stays in RUN-P; the new code activates on the next OB1 scan.

If the dialog displays "CPU must be in STOP" the most common causes are:

• The CPU mode selector is set to RUN instead of RUN-P.
• The protection level prevents write access from this PG.
• The block was generated from HW Config (SDB or system block).
• The interface (signature) of a multi-instance FB has changed and forces a download to all instance DBs.

10. Hardware Configuration Download Procedure

When a hardware change is unavoidable, the standard commissioning procedure is:

1. Bring the affected CPU to STOP via the key switch or PLC > Operating Mode.
2. In HW Config, perform the rack/module change.
3. Save and compile (Station > Save and Compile, Ctrl+F7).
4. Download to the target (PLC > Download to Target Station, Ctrl+L).
5. Verify the SDBs in the diagnostic buffer: PLC > Module Information > Diagnostic Buffer. Look for event ID 0x1155 / 0x1156 (module parameter assignment OK) and absence of 0x80C4 / 0x80C5 (parameter errors).
6. Switch the key switch from STOP to RUN (or RUN-P). The CPU performs an OB100 warm restart (default) or OB102 cold restart depending on configuration.
7. Confirm outputs via VAT and check process state.

11. Verification Checklist

12. Troubleshooting Matrix

FAQ