Uploading S7-300 CPU 315F Program via Ethernet: Complete Guide

Overview

The Siemens SIMATIC S7-300 CPU 315F-2 PN/DP (order number 6ES7315-2FJ14-0AB0 and related variants) is a fail-safe (F-) controller that combines standard PLC operation with safety-integrated functions certified for use up to SIL 3 per IEC 61508 and PL e / Cat. 4 per EN ISO 13849-1. When a 315F must be replaced in the field and the original STEP 7 project archive is unavailable, the only practical recovery path is to upload the active project from the running controller and write it to a fresh Micro Memory Card (MMC).

Because the 315F-2 PN/DP variant ships with an integrated PROFINET interface (X1 P1/P2 RJ45) in addition to the MPI/DP port (X2), and an MPI/DP cable is often not on hand, an Ethernet LAN cable (CAT 5e or CAT 6) is the most reliable link to the engineering station. The PG (programming device) must be on the same IP subnet as the CPU, and the PG/PC interface must be assigned to the correct TCP/IP driver. This guide walks through the complete upload/download workflow, the four real-world faults that surface during the procedure (upload error 2000, F-password prompt, missing Sinamics hardware, missing MP270 panel configuration), and the corrective steps for each.

Prerequisites

Identifying the Hardware

Confirm the exact MLFB of the CPU before you start. Open the front door of the 315F and read the order number on the rating label. Common variants and their integrated interfaces:

Check the LED pattern on the X1 PROFINET port. The Link LED (green, left) must be solid ON, and the RX/TX LED (yellow, right) must flicker when traffic is present. If the X1 Link LED is OFF, the port is administratively down, the cable is bad, or the CPU is in DEFECT mode (SF/DIAG red, BF red).

Direct Ethernet Connection: PC to CPU 315F

The cleanest path is a point-to-point connection between the PG and the CPU. No switch or hub is required.

1. Insert a 1:1 wired CAT 6 patch cable between the PG's Ethernet NIC and port X1 P1 on the CPU 315F. Port X1 P2 remains free.
2. Power up the CPU; the Link LED on X1 P1 should turn solid green within 5 seconds.
3. On the PG, open Control Panel > Network and Sharing Center > Ethernet > Properties > Internet Protocol Version 4 (TCP/IPv4).
4. Assign a static IP in the same /24 subnet as the CPU. If the CPU is at 192.168.0.1 (the Siemens PROFINET default for unconfigured devices) use:

IP address:        192.168.0.10
Subnet mask:        255.255.255.0
Default gateway:    (leave blank)

If the CPU already has a project IP (look at a connected HMI or read it from a label on the front door sticker), match the PG's IP to that subnet instead. For example, if the CPU is 10.20.30.40/24, set the PG to 10.20.30.41/24.

Configuring the PG/PC Interface

The PG/PC interface must point to the NIC and the S7ONLINE access point.

1. Open Start > SIMATIC > STEP 7 > Set PG/PC Interface (or in TIA Portal: Options > Set PG/PC Interface).
2. In the Interface Parameter Assignment Used list, select TCP/IP -> <Your NIC>. Do not select the Auto-detect variant if multiple NICs are active, because Windows will pick the wrong one.
3. Click Properties and confirm that the NIC's TCP/IP address is the static IP you just assigned. The MAC address must match the PG's physical NIC.
4. Click OK and restart SIMATIC Manager to commit the assignment.

Verify the S7ONLINE access point is mapped to TCP/IP: open Control Panel > Set PG/PC Interface > Access Points tab. The default S7ONLINE (STEP 7) -> TCP/IP mapping is correct for 315F-2 PN/DP uploads.

Discovering the CPU with Accessible Nodes

1. Open SIMATIC Manager and choose PLC > Accessible Nodes (or Online > Accessible Nodes in TIA Portal).
2. The right pane will populate within 3-10 seconds. A direct DCP (Discovery and Configuration Protocol) multicast from STEP 7 will list every PROFINET device on the link, even if it sits on a different subnet.
3. Expand the entry. You should see the CPU's MAC address, IP, device name, and module type, e.g. CPU 315F-2 PN/DP, 6ES7 315-2FJ14-0AB0, V3.3.
4. Double-click the entry. SIMATIC Manager will open the Accessible Nodes project view with the CPU listed under Online.

If the CPU is missing from the list, common causes are: firewall on the PG, the CPU is in STOP/DEFECT, the cable is bad, the X1 port LED is OFF, or another PROFINET controller on the link is suppressing DCP frames. Isolate the PG and CPU on a dedicated switch port and re-run.

Uploading the Program from the CPU

1. In the Accessible Nodes view, select the CPU and choose PLC > Upload Station to PG (German: Station in PG laden).
2. STEP 7 will read the project from the CPU's flash and reconstruct the S7 program, hardware configuration, and symbol table. For an F-CPU it will also recover the standard and safety program blocks.
3. Click OK when prompted to save the project. Choose a folder that does not contain an existing project of the same name.
4. After upload, expand SIMATIC 300 Station > CPU 315F-2 PN/DP > S7 Program > Blocks to verify that OB1, OB35, the FB/FCs, DBs, and the safety blocks (FB 215 F_FB, FB 219 F_ESTOP1, or user-defined F-blocks) are all present.

Resolving Error (2000) During Upload

Message: (2000) Error while uploading the configuration to the programming device (PG). Do you want to continue?

This is a STEP 7 internal warning, not a fatal fault. It indicates that one or more hardware components referenced in the online configuration could not be reconstructed offline because the matching GSD/GSDML file or HSP (Hardware Support Package) is missing on the PG. The S7 program and standard blocks are still uploaded, and continuing is safe.

Best practice: answer Yes to "Do you want to continue?" to get the S7 program on the PG, then install the missing components and re-upload only the hardware configuration via PLC > Upload Hardware Configuration.

Handling the F-Password for the Safety Program

When you try to open, modify, or download the safety-related portion of the F-CPU, STEP 7 raises:

Set Up Access Rights - A password is required to change or delete the safety-related program on the module CPU 315F-2 PN/DP.

For the 315F, the safety program is written to a separately password-protected container (F-Container) inside the MMC. The default password at first startup is S7300F (case-sensitive). The OEM or system integrator is expected to change it during commissioning. If the password has been changed and lost, the safety program is unrecoverable without the original project.

Missing Sinamics Hardware Configuration

After upload, the S7 project shows the CPU and the ET200S PN stations correctly, but the Sinamics drive appears as an empty slot or with a yellow question mark. The fix is to install the matching STARTER support package:

1. Identify the Sinamics type (e.g. S120 CU320-2 DP, G120 with CU240E-2 PN, G130). Read the part number from the drive's rating plate.
2. Install STARTER V5.4 SP1 (or the matching version for your drive firmware) from the Siemens Support download portal.
3. In STARTER, run Options > Install Support Packages and load the SSP for the exact firmware version reported by the drive (e.g. V4.7 for a CU320-2 with firmware 4.7.6). The SSP file is named *.zip and contains the device descriptions.
4. Re-open the uploaded STEP 7 project. The Sinamics slot should now resolve. If it does not, run PLC > Upload Station to PG again with STARTER installed; the second upload will pick up the new device catalog.

For a S120 with multiple Line/CU/Motor modules, the missing component is often a CX32 controller extension or a TM31 terminal module - both are added to the project via the STARTER device library, not via STEP 7.

MP270 Touch Panel Configuration

MP270 panels (6AV6 542-0CA10-0AX0 and related) use ProTool/ProSave for backup and restore. The uploaded STEP 7 project contains the WinCC flexible or ProTool integration, but the runtime image and recipe data live on the panel itself.

1. Install ProSave V12 (bundled with WinCC flexible 2008 SP5) on the PG.
2. Connect the PG to the MP270's Ethernet port (or use the MPI/DP port if the original wiring supports it).
3. Open ProSave, select Device: MP270, Connection: Ethernet, and enter the panel's IP (often 192.168.0.50 on a default MP270). Set the PG's IP to the same subnet.
4. Click Restore > Backup to download the panel image, recipe DBs, and alarm logs from the MP270 to the PG. The backup file is a *.psb archive that can be restored onto a replacement panel later.

To push the integrated configuration into STEP 7, open WinCC flexible 2008 SP5, choose Project > Transfer > Transfer to PG, and select Ethernet. The integration tags, screens, and area pointers will be merged into the HMI station inside the STEP 7 project.

Downloading to the New MMC and CPU

1. Insert the new MMC into the programming device's Prommer (external prommer such as the Field PG's internal slot, or a USB prommer like the SIMATIC USB Prommer 6ES7792-0AA00-0XA0).
2. In SIMATIC Manager, open the uploaded project, expand SIMATIC 300 Station > CPU 315F-2 PN/DP, and right-click the station. Choose PLC > Download to Memory Card (German: Zielsystem > Memory Card laden).
3. Select the target drive (the prommer's path). STEP 7 will write the system data, S7 program, and F-Container. The MMC is locked to the source CPU's serial number for the F-program.
4. Insert the programmed MMC into the replacement CPU 315F-2 PN/DP, power up, and verify the SF/DIAG LED remains OFF.
5. Use PLC > Download (online) to push any hardware configuration changes that the MMC alone does not cover (e.g. IP address reassignment if the new CPU is at a different IP).

Verification

1. Open PLC > Accessible Nodes and confirm the replacement CPU is reachable.
2. Open PLC > Diagnostic > Module Information and check the diagnostic buffer for OB start events (OB100, OB101, OB102) and F-initialization events (OB82, OB85 with F-Container OK). No SF events should be present.
3. Open PLC > Monitor/Modify and verify the inputs read the same as the old CPU. Force a known output to confirm program flow.
4. Trigger each safety function (E-stop, light curtain, guard door) and confirm the F-program reacts with the expected shut-down signature in the diagnostic buffer.
5. Compare the cyclic time, OB1 execution, and the F-runtime (under Safety > F-Runtime in the safety administration editor) to the values captured on the original CPU. A delta larger than 10 percent suggests a hardware mismatch (different module revision) that should be investigated before the line is released to production.

Troubleshooting Matrix

FAQ