Overview of Siemens S7 CPU Firmware Versioning
Siemens SIMATIC S7 CPUs (S7-1200, S7-1500, ET 200SP, ET 200pro, and older S7-300/400 families still under support) expose their internal firmware through a three-component version identifier of the form V X.Y.Z. The first digit (X) is the major revision, the second digit (Y) is the minor revision, and the third digit (Z) is the patch level. This structure follows the well-known semantic-versioning pattern used across the broader software industry and is documented in the firmware release notes that accompany every Siemens firmware update package delivered through the Siemens Industry Online Support portal.
The major component signals a generation of the CPU where functional, electrical, or instruction-set changes can break the API surface. The minor component introduces feature additions, expanded instructions, or new diagnostic blocks that remain source-compatible with earlier minor revisions of the same major release. The patch component contains bug fixes, internal stability improvements, security hardening, and corrections to internal timers or interrupt latency that are not visible to the STEP 7 engineering tool through any tag, register, or block interface.
The full version is exposed inside the CPU's diagnostic buffer and can be read from the online diagnostics view of TIA Portal. The online > online & diagnostics > diagnostics buffer screen displays the exact Firmware version: V X.Y.Z string for the connected CPU. The same string appears on the SD card (when present) under SIMATIC.S7S directory metadata and on the CPU's web server's identification page.
Major, Minor, and Patch: Practical Definitions
The three components map to specific engineering boundaries inside the SIMATIC environment:
| Component | Position | Engineering Meaning | Visibility in TIA Portal HW Catalog |
|---|---|---|---|
| Major | X | Hardware platform generation. New CPU type, new instruction set baseline, new ASIC revision. Breaks API surface. | Always visible. Listed as the catalog entry itself. |
| Minor | Y | Functional extension level. New OPC UA methods, expanded motion blocks, new diagnostic events. Source-compatible with earlier Y values of the same X. | Always visible. Drives the catalog version selector. |
| Patch | Z | Internal bug fix, security fix, internal state machine correction. STEP 7 treats Z as opaque. | Hidden. TIA Portal displays V X.Y.* in the HW catalog; the wildcard covers any patch level installed on the physical module. |
The patch digit is intentionally treated as opaque by STEP 7 and the TIA Portal HW catalog. There is no engineering workflow, no compiler option, and no project setting that depends on the patch digit. From the perspective of the configuration tool, the catalog entry CPU 1515-2 PN / V X.Y.* covers every firmware from V X.Y.0 through V X.Y.n on the physical module.
Why the Patch Digit Is Not Listed in the TIA Portal Hardware Catalog
The HW catalog inside TIA Portal ships with a finite set of catalog entries per CPU type. Each entry is anchored to a specific Major.Minor pair and advertises a wildcard for the patch component. When TIA Portal opens a project whose target CPU has firmware V 2.9.7, the catalog displays a compatible entry for V 2.9.* if the project was originally configured against V 2.9 or any earlier V 2.9.z. The catalog does not enumerate V 2.9.0, V 2.9.1, ..., V 2.9.7 as separate rows because every one of them would present an identical set of hardware-visible properties, I/O slots, diagnostics events, and block interfaces to the engineering tool.
This design choice has three concrete benefits:
- Catalog compactness. The HW catalog would otherwise grow by tens of entries per CPU as patch releases accumulate. Siemens releases firmware patches for the S7-1500 family several times per year, and a CPU in the field for ten years could accumulate more than 30 patch revisions per minor release.
- Spare-parts interchangeability. A spare CPU from inventory carries a higher patch number than the running CPU. Both are compatible with the same project because the catalog entry is wildcarded.
- Internal-to-Siemens patch stream. The patch digit carries bug fixes that are internal to the firmware state machine. Making the patch digit a load-bearing element of the project would force engineers to recompile and re-download projects whenever Siemens releases a patch that has no externally observable behavior change.
Inside the project, the configured firmware version is stored in the device configuration under Properties > General > Catalog information > Firmware version. The entry displays as X.Y (without the patch digit). The actual patch level of the online CPU appears in the online diagnostics view and in the Online & Diagnostics > Diagnostics status pane as a separate read-only field.
Hardware Support Packages (HSP) and Their Role
Beginning with STEP 7 V13 SP2 and continuing through every subsequent release including TIA Portal V20, Siemens ships new CPU firmware releases and newly released module types through Hardware Support Packages (HSPs). An HSP is a signed, versioned installation package that updates the TIA Portal HW catalog with new module types and with the latest Major.Minor firmware metadata.
The HSP installation procedure for TIA Portal is documented in the official installation manual. According to Siemens' installation documentation, the portal checks automatically whether new software updates or support packages are available, including Hardware Support Packages (HSPs). The full procedure is described at Checking availability of updates and support packages in the TIA Portal V20 documentation.
Key facts about HSPs:
- An HSP can be installed into a running TIA Portal installation without restarting the operating system. After installation, the new catalog entries appear the next time the HW catalog is opened.
- HSPs are not firmware updaters. They update the catalog metadata inside the engineering tool, not the firmware inside the CPU. Firmware updates are a separate procedure that uses the SIMATIC Automation Tool, the TIA Portal online & diagnostics "Update firmware" button, or a physical SIMATIC memory card reset.
- HSPs are cumulative. Installing HSP N+1 means HSP N is already integrated. There is no requirement to install intermediate HSPs.
- HSPs are major-version-specific. An HSP compiled for TIA Portal V17 cannot be installed into a V16 installation. Use only the HSP distribution that matches the installed TIA Portal major release.
TIA Portal V20 and the Update Stream
The current release stream at the time of writing is TIA Portal V20. The Siemens Industry Online Support entry TIA Portal V20 Updates (ID 109963851) lists every update released for STEP 7 Basic/Professional V20, WinCC Basic/Comfort/Professional/Unified V20, and the Safety, PLCSIM, and ODK components delivered in the same media package.
When a TIA Portal V20 update is applied, the bundled catalog entries for S7-1200, S7-1500, ET 200SP, and ET 200pro CPUs are refreshed to the latest Major.Minor that exists at the time of the update cut-off. The patch digit is again treated as a wildcard. A project opened in TIA Portal V20 Update 4 against a CPU configured at firmware V 2.9 will still compile and download to a physical CPU running V 2.9.7 as long as the online CPU's major.minor combination matches.
Upload and Download Compatibility Rules
The compatibility rules for download and online operations are governed entirely by the major.minor pair. The patch digit is irrelevant to the toolchain. The following rules apply:
| Direction | Project Version | Online CPU Version | Result |
|---|---|---|---|
| Download | V X.Y | V X.Y (any Z) | Allowed. The project downloads, and the runtime blocks execute against the on-CPU firmware regardless of patch level. |
| Download | V X.Y | V X.Y+1 | Allowed. The project downloads because the major matches. The runtime will use any new instructions that the Y+1 firmware adds, but the project itself does not depend on them. |
| Download | V X.Y | V X.Y-1 | Blocked with the diagnostic "Firmware version on the device is older than required". The project uses constructs that did not exist in the older firmware. |
| Download | V X.Y | V X+1.Y | Blocked. Major mismatch. |
| Upload | V X.Y (project) | V X.Y (CPU, any Z) | Allowed. The online blocks are read into the project; the project keeps its configured X.Y. |
| Upload | V X.Y (project) | V X.Y+1 (CPU, any Z) | Allowed with a confirmation dialog. The project is migrated forward. Blocks are brought into the new firmware context; any new firmware-side objects are reported for review. |
| Upload | V X.Y (project) | V X.Y-1 (CPU, any Z) | Blocked. The online firmware cannot run the newer project structure. |
The fourth column is the one that produces most of the "missing firmware" dialogs reported by engineers. When TIA Portal displays "The firmware version V X.Y is not in the catalog", the remedy is one of two actions: install the matching HSP that introduces the X.Y catalog entry, or change the configured firmware on the project side to an entry that is already in the catalog.
How to Display the Full X.Y.Z Version Online
Even though the HW catalog hides the patch digit, the full version is readable through three different paths in TIA Portal V17 and later.
Path A — Online Diagnostics Buffer
- Connect to the target CPU and select Online & Diagnostics.
- Open Diagnostics buffer.
- The first entry reads
Firmware version: V X.Y.Zwith the patch digit fully resolved.
Path B — Online Identification
- From the project tree, right-click the CPU and choose Online & Diagnostics.
- Select the Identification pane.
- The fields Module name, Firmware, and Hardware revision each display the full string as reported by the module's electronic nameplate.
Path C — CPU Web Server
- Enable the web server on the CPU under Properties > Web server > Activate web server on this module.
- Navigate to the CPU's IP address from a browser.
- The Module Information page lists Firmware version as
V X.Y.Zexactly as stored on the module.
Path D — Programmatic Read from SFB
For runtime applications that need to act on the patch digit, the SSL block RD_SINFO and the RDREC/SFB52 access to index 0 (electronic nameplate) return the module identification in the IM0 / IM1 data structure. The substring "V X.Y.Z" can be parsed out of the returned USINT array at offset 16 of the nameplate record. This is rarely needed because STEP 7 does not branch on patch level.
Firmware Update Procedure in TIA Portal
The firmware inside the CPU is updated through a separate procedure from project download. Patch-level updates typically happen in one of three ways.
-
Online update via TIA Portal. Select the CPU in the project tree and choose Online & Diagnostics > Functions > Update firmware. Browse to the firmware update file (typically
*.upd) downloaded from Siemens Industry Online Support. Confirm and wait for the CPU to reset automatically. -
SIMATIC Automation Tool. Mass-update many CPUs across a plant. Selects target devices by IP or PROFINET name and pushes the
*.updfile. Recommended for rollouts across a fleet. - SIMATIC memory card reset. Create a card image with the new firmware using the "Reset to factory settings" workflow from a programming device, then physically insert the card into the target CPU and power-cycle. Used when the CPU is unreachable over the network.
Edge Cases and Field-Proven Caveats
Spare CPU Has Higher Patch Level
The most common field scenario: a CPU fails and is replaced with a spare from the warehouse. The spare carries a higher patch digit than the original. TIA Portal will report the online firmware as V X.Y.H where H is higher than the configured V X.Y. The project still downloads successfully because the catalog entry is wildcarded. No project change is required.
F-CPU After Firmware Update
An F-CPU (e.g., CPU 1515F-2 PN, CPU 1518F-4 PN/DP) requires a re-signature of the safety program after a firmware update if the safety-related firmware portion changes. The TIA Portal safety administration logs the signature under Safety Administration > Print logs. The safety signature must be re-confirmed by the responsible safety engineer before the F-CPU can leave STOP mode into RUN-Safe.
Know-How-Protection and Patch Migration
Blocks protected with Know-How-Protection are tied to the Major.Minor pair of the CPU. Migrating from V 2.8 to V 2.9 breaks know-how-protected block bindings. The block must be re-bound to the new catalog entry after migration. Patch-level migration (same Major.Minor, different Z) does not break know-how protection.
PLCSIM and Patch Level
PLCSIM simulates a specific Major.Minor pair regardless of the patch level of the simulation host or the physical target. The PLCSIM instance does not enforce a patch digit. Programs validated in PLCSIM against V 2.9 will run on a physical CPU carrying any patch of V 2.9.z.
Summary of Practical Rules
| Rule | Applies To | Mechanism |
|---|---|---|
| Major change breaks project structure. | Catalog selection, block interface layout, instruction set baseline. | CPU selection in HW catalog. |
| Minor change adds features without breaking projects. | New instructions, OPC UA methods, expanded diagnostics. | HSP installation; project re-targeting dialog. |
| Patch change is invisible to TIA Portal projects. | Bug fixes, security hardening, internal state machine. | None — wildcarded in the catalog. |
| HSP updates the catalog metadata only. | The engineering tool, not the CPU firmware. | See official HSP installation documentation. |
| Update stream follows TIA Portal major release. | Updates apply to V20 only; V19 requires V19 updates. | See TIA Portal V20 Updates (109963851). |
Troubleshooting Matrix for "Missing Firmware" Dialogs
| Symptom in TIA Portal | Likely Cause | Remedy |
|---|---|---|
| "Firmware V X.Y is not in the catalog" during open of a migrated project. | The project came from a newer TIA Portal major release or from an installation that included an HSP that the local installation lacks. | Install the corresponding HSP from Siemens Industry Online Support, or change the project-side firmware to a catalog entry that exists locally. |
| Download blocked with "Firmware version on device is older than required." | Configured firmware in project uses constructs only present in a later minor release than what is installed on the CPU. | Update the CPU firmware, or re-target the project to the older minor release. |
| Online CPU shows a different major.minor than the configured project. | Spare-parts interchange, or CPU was updated in the field without re-targeting the project. | Re-target the project: right-click CPU > Properties > General > Change device / version. |
| Patch digit not visible anywhere in TIA Portal offline view. | By design. Patch digit is online-only and is read from the module's nameplate. | None needed. Use the online diagnostics buffer for the full X.Y.Z string. |
| Compatibility mode deprecation warnings after minor upgrade. | Project uses legacy block types whose new behavior in the upgraded firmware may differ. | Review warnings under Project tree > Common data > Compatibility. Migrate blocks where required. |
What does the third digit (Z) in an S7 CPU firmware version like V 2.9.7 represent?
The third digit is the patch level. It contains bug fixes, security hardening, and internal state-machine corrections that STEP 7 and TIA Portal treat as opaque. The HW catalog displays the version as V X.Y.* (a wildcard for the patch digit), so a project compiled against V 2.9 works against every patch of V 2.9 (e.g., V 2.9.0 through V 2.9.7).
Why does the TIA Portal hardware catalog not list every patch release separately?
Catalog compactness, spare-part interchangeability, and the fact that patch-level changes have no externally observable behavior. Listing every patch as a separate entry would multiply catalog rows without adding engineering value, and would force projects to be recompiled every time Siemens releases a patch.
Can a project compiled against V 2.9 download to a CPU running V 2.9.7?
Yes. Download rules are governed by the major.minor pair, not by the patch digit. The same project downloads to a CPU carrying V 2.9.0, V 2.9.3, V 2.9.7, or any patch of V 2.9 without modification.
Does an HSP update the firmware inside the CPU?
No. An HSP updates the catalog metadata inside the engineering tool. The firmware inside the CPU is updated separately via the online & diagnostics "Update firmware" function, the SIMATIC Automation Tool, or a memory-card reset. See the official installation manual entry on checking availability of updates and support packages.
Where can I find the latest updates for TIA Portal V20?
The official entry on Siemens Industry Online Support is TIA Portal V20 Updates (ID 109963851). Updates are released as numbered cumulative packages (e.g., Update 1, Update 2, Update 3) and apply to STEP 7 Basic/Professional V20, WinCC Basic/Comfort/Professional/Unified V20, and the bundled Safety, PLCSIM, and ODK components.
How do I read the full X.Y.Z version from a connected CPU?
Connect to the CPU in TIA Portal and open Online & Diagnostics > Diagnostics buffer. The first entry displays the complete "Firmware version: V X.Y.Z" string with the patch digit resolved. The same string is available in Online & Diagnostics > Identification, and on the CPU's web server module information page.