Uploading CFC Blocks from Simatic S7-400H Flash Memory: Recovery Steps

When the only artifact of a SIMATIC S7-400H (or standard S7-400) controller project is the flash memory card in the CPU's slot, recovering the controller's runtime program is possible, but the operation is not a single "upload CFCs" command. The CFC (Continuous Function Chart) editor in SIMATIC PCS 7 stores its charts as source files inside the STEP 7 project on the engineering station; what the CPU executes is the compiled machine code packed inside standard STEP 7 blocks (FB, DB, OB, SFB, SFC, SDB). Those compiled blocks are what physically reside on the flash card, so the recovery procedure copies blocks, not charts, and recreates the chart view from the compiled artifacts.

This reference walks through the complete recovery workflow for an S7-400H CPU whose flash card is intact but whose original STEP 7/PCS 7 project archive has been lost. The procedure covers block extraction, hardware configuration reconstruction, password/know-how protection handling, CFC source re-creation, and H-system (fault-tolerant) considerations such as the requirement that both CPUs carry the same program image.

1. CFC Compilation Model and Why Direct Upload Is Impossible

CFC is a graphical configuration language in the SIMATIC PCS 7 toolbox that sits on top of STEP 7. A CFC chart is, in concept, a network of function block instances wired together with signal flows. From the engineer's perspective the chart is the source of truth; from the CPU's perspective, the chart never exists. When you compile a CFC chart, the compiler generates:

• One or more Function Blocks (FB) that contain the run sequence and instance references.
• Instance Data Blocks (DB) that hold the runtime data of each block instance (CTRL_PID instance, MOT_SPEED instance, VLV instance, etc.).
• Modifications to OB1 (and OB35 / OB100 / OB121 for cyclic tasks and error handling).
• Possibly System Blocks (SFB/SFC) when standard PCS 7 libraries call them.

These blocks are then downloaded to the CPU along with the rest of the STEP 7 program. The compiled blocks are also the only thing written to the flash card. The CFC source representation lives in the offline project only; the CPU has no knowledge of "CFC" as a concept, it only knows the resulting FBs and DBs. This is why the recovery operation extracts blocks, not charts.

The implication is that even a perfect block recovery yields a CFC program whose chart names, comments, and signal names are stripped down to whatever is in the block headers and instance DB comments. Names like FC1001_PID_TIC_101 often survive because the CFC compiler writes them into the FB/DB name fields, but descriptive text, signal comments, and operator text from WinCC are unrecoverable without the original ES project.

2. Prerequisites: Hardware, Software, and Authorization

To extract blocks from an S7-400H flash card you need the following hardware and software on the engineering station:

1. A PG/PC with STEP 7 V5.5 SPx or SIMATIC PCS 7 V8.x/V9.x installed. Use the same major version that originally compiled the project when possible. A project compiled with PCS 7 V8.0 cannot be cleanly re-opened in PCS 7 V7.1 because the CFC runtime version field and the chart DB layout have changed across major versions. STEP 7 "TIA Portal" cannot read classic S7-400 blocks; this procedure applies to the classic STEP 7 / PCS 7 toolchain only.
2. The CPU's external flash card reader/programmer (S7-400 FEPROM card in a Field PG, or a Prommer with a 5 V slot). The card is 5 V FEPROM and is not readable by a generic USB card reader; the Siemens SIMATIC Field PG has a built-in 5 V slot. Alternatively, the card can be read while seated in the CPU via an online connection (TCP/IP or MPI).
3. The original passwords for any know-how-protected blocks (see Section 6). Without the password, the CPU refuses to read the protected FBs/DBs and the operation aborts with a protection violation event in the diagnostic buffer.
4. An empty STEP 7 project created with the same station template (S7-400H station), with the rack and slot count matching the original H-station (UR2-H, two CPUs, sync modules, sync cables).
5. Authorization for CFC/SFC if the project is to be edited in the CFC editor (license required, not just for read).

3. S7-400H Memory Architecture and Flash Card Layout

The S7-400H is a fault-tolerant station with two CPUs running in synchronous mode. Each CPU has its own load memory (FEPROM flash card) and its own work memory (RAM). The program is identical on both cards. The flash card contains:

• Block container with all S7 blocks (OB, FB, FC, DB, SFB, SFC, SDB).
• System data blocks (SDB) that encode the hardware configuration, network configuration, and the H-station link parameters.
• The diagnostic buffer content is not on the flash; it is in RAM, so it is lost on a hard power-down if RAM is not buffered by a backup battery.
• Optionally, recipe data or user data if the application stores them in the load memory (rare for PCS 7).

STEP 7's "Memory Card" icon in the SIMATIC Manager opens a window that shows the block list and the SDB list side by side. Cards are formatted with the Siemens proprietary filesystem; a Windows PC cannot read them. Note: a 5 V FEPROM card is different from a SIMATIC MMC (MultiMediaCard) used on S7-300/S7-1500. The S7-400H series does not accept MMC.

4. Hardware Configuration Recovery

Recovering blocks without recovering the hardware configuration is futile, because the CPU will reject blocks whose SDB references point to non-existent slot addresses. The HW Config is stored in the SDB container on the flash card. To recover it:

1. Open the empty S7-400H station project in SIMATIC Manager.
2. Right-click the S7-400H station and select Station > Open with HW Config.
3. In HW Config, select Station > Save and Compile with a placeholder configuration (a UR2-H rack with two CPU slots). This creates a baseline SDB that the CPU can compare against.
4. Connect the PG to the active CPU via Ethernet (or MPI as fallback) using TCP/IP at the CPU's IP address (default 192.168.0.1 for the first H-CPU, 192.168.0.2 for the second, on subnet 255.255.255.0).
5. Right-click the S7-400H station and select Target System > Download to Target System for the SDB part. STEP 7 will offer to "Upload Station to PG"; choose this if offered. The upload reads the SDBs from the CPU and replaces the placeholder HW Config in your project.

After HW Config is recovered, verify the following elements match the original plant:

• Central rack type (UR2-H, UR2-H with I/O, or a remote ET200M ring),
• CPU order numbers, firmware versions, and slot positions,
• Sync module types and link addresses,
• PROFIBUS DP master and slave addresses,
• PROFINET IO device names and IP addresses,
• CP443-1 / CP443-5 / CP1623 modules and their slot locations,
• HMI/WinCC connection points.

5. Block Recovery Procedure (Step-by-Step)

The canonical procedure is "Upload Station to PG", but if that fails (e.g., password locked, CP failure, network unreachable) the manual block-by-block fallback applies. The fallback is also useful when the goal is to read individual blocks rather than the whole station.

1. Establish online connection. Set the PG/PC interface to TCP/IP > Network card with the CPU on the same subnet, or use MPI for a CPU that is still in factory state. Open the project in SIMATIC Manager, expand the S7-400H station, then right-click the station and choose Accessible Nodes. The CPU should appear with its IP and MAC.
2. Open the online view. Right-click the connected CPU and choose Online & Diagnostics, or select PLC > Online & Diagnostics from the menu. Switch to the Block Folder tab. The online view will list all blocks on the flash card with their S7 timestamps and CRC.
3. Upload all blocks. Use PLC > Upload Station to PG. This creates a new S7-400H station in the current project with the recovered HW Config and blocks. If the project has an existing station, STEP 7 may prompt to overwrite; choose Yes only if the existing station is a placeholder.
4. Verify block integrity. After upload, open the block folder and check the columns Author, Family, Name (header). For each FB, open it offline and confirm the code is present. For each DB, confirm the structure is non-empty (initial values appear in the declaration view).
5. Resolve compile-time references. If the project was compiled with CFC, the FBs will reference standard PCS 7 library blocks (CTRL_PID, MOT_SPEED, VLV, and similar function blocks from the PCS 7 Master Data Library). These libraries must be installed in your STEP 7/PCS 7 installation or the project will not recompile. Install the matching PCS 7 library DVD or the version-matched Master Data Library for the PCS 7 version used originally.
6. Re-open the project in CFC editor. From SIMATIC Manager, double-click the Charts folder. The CFC editor will attempt to reverse-engineer the run sequence and chart structure from the FBs. In PCS 7 V8.x and later, a "Create CFCs from S7 Program" function is available under Options > Charts > Import that uses the FBs' compile-time metadata to recreate the chart topology.
7. Save the project to a permanent archive. Use File > Archive and save the *.s7p or *.pcx file to a network share. The S7-400H CPU's flash card is not a long-term backup; it is a working copy.

6. Password Protection and Know-How Protection Handling

STEP 7 supports two layers of protection that block recovery:

• CPU password (also called "Password for the CPU" or "Connection password"): set in HW Config under CPU > Protection. This password is required to read or write any data to the CPU. Without it, the online connection is denied and the diagnostic buffer logs an authorization failure event.
• Know-How-Protect (KHP) on individual blocks: set in the LAD/FBD/STL editor under File > Know-How-Protect. The block's code section is replaced with a stub; the interface and comments remain visible but the code cannot be viewed or modified. KHP-protected blocks can still be executed by the CPU and can still be downloaded, but they cannot be read back to a PG without the password.

Recovering KHP-protected blocks requires the password that was set on the original PG. If the password is lost, there is no Siemens-supported mechanism to recover the protected code. The CPU will run the program, but the engineering station cannot display, recompile, or modify it. Attempts to bypass the KHP password by editing the S7-400 firmware are not supported and will void any service contract.

7. Restoring the CFC Source View (Reverse Engineering)

Once the blocks are on the ES, recreating the CFC source is the next step. The exact path depends on the PCS 7 version:

7.1 PCS 7 V8.0 and later — "Generate CFCs from S7 Program"

The CFC editor's Options > Charts > Generate CFCs from S7 Program function reads the run sequence FB and the instance DBs, then reconstructs chart pages with one block per page. The function is available with the CFC license activated. The recovered charts are not identical to the original: instance block names and signal names are recovered from the FB/DB headers, but layout, page breaks, and comments are not. The charts are immediately editable and compilable.

7.2 PCS 7 V7.1 and earlier — manual chart reconstruction

Older PCS 7 versions did not have the auto-generate function. The recovery was manual:

1. Open the run sequence FB (typically in the 1000-1999 range in the CFC naming scheme) and identify the run groups and run sequence.
2. For each instance DB, open it in the DB editor and read the block type and the parameter values.
3. Create a new CFC chart manually, place a block of the matching type, and copy the parameter values from the instance DB into the block I/Os.
4. Reconnect the signal flow using the interconnections visible in the instance DBs and in the run sequence FB.

This is labor-intensive but can be partially automated with the CFC COM interface (CFC API) or with custom STEP 7 scripts. There is no off-the-shelf tool that recovers the original chart layout.

7.3 Recovering SFC Source

Sequential Function Charts (SFC) compile to FB 200 and the transitions compile to FB 300 to FB 500 series in standard PCS 7 practice. The same auto-generate path as CFC applies, with the source view regenerated from the FBs. The SFC transition logic (Boolean expressions) is recovered but the graphical layout is lost.

8. Commissioning and Verification

After the project is on the ES, the recovered program must be verified before it is downloaded to the CPU. The verification checklist is:

For S7-400H, the download procedure is critical:

1. Stop both CPUs (or stop only the standby; PCS 7 H-system allows download of program changes during a hot sync, but only for non-HW-Config changes).
2. Download the program to the standby first.
3. Run the standby; verify it synchronizes and goes into redundant standby.
4. Switch the master/standby roles (via PLC > H-Operations > Switch Master).
5. Download the same program to the new standby.
6. Switch back if desired, or leave the role as is.

9. Troubleshooting Matrix

The most common recovery failure modes and their fixes are summarized below.

For deeper fault diagnosis, the diagnostic buffer text can be looked up against the Siemens S7-400H Diagnostic Functions manual. The relevant event IDs for H-station operation are in the 0x4Exx range; the relevant event IDs for memory card errors are in the 0x02xx and 0x03xx range. For the full list of diagnostic events, refer to the S7-400H Fault-Tolerant Systems manual on Siemens Industry Online Support.

10. Preventive Practice for Future Recovery

A flash card is not a backup. The recommended procedure for any PCS 7 / S7-400H project is:

1. Maintain a versioned archive of the STEP 7 / PCS 7 project (*.s7p or *.pcx) on a network share with read-only access for the engineering team.
2. Store the project password list (CPU password, KHP passwords, archive encryption password) in a controlled password vault separate from the project archive.
3. Document the H-station configuration (rack, slot, CPU order number, firmware version) in a separate inventory document.
4. Run "Upload Station to PG" periodically (e.g., once per year) to capture a fresh offline copy of the live program.
5. After any change, re-archive the project; do not rely on "the program is on the flash card" as a long-term record.

With this practice, the recovery procedure described in this reference is a fallback, not the primary path. The primary path is to load the latest project archive into STEP 7 and download it to the CPU. The fallback only activates when the archive itself is lost. The cost of the fallback is hours to days of engineering time; the cost of prevention is a few minutes per project release.

11. Frequently Asked Questions