Resolving 'Security Expansion Card Not Inserted' Errors in SIMIT Virtual Controller CPU 410 Simulation

In SIMATIC PCS 7 and SIMIT virtual commissioning environments, downloading CFC charts from older engineering versions (such as PCS 7 V8.0 SP2) into a SIMIT Virtual Controller (VC) simulating a CPU 410-5H frequently fails with the error 'Security Expansion Card not inserted or defective. Download aborted' (F: Security Expansion Card nicht gesteckt oder defekt). This occurs because older CFC compilers lack the cryptographic validation drivers required by the SIMIT CPU 410 Virtual Controller. Resolving this issue requires applying the SIMIT legacy CPU emulation workaround by renaming CPU data configuration files, allowing the virtual controller to report as an S7-417 to support unrestricted online changes downloads.

Virtual Controller Emulation Architecture in SIMIT

SIMATIC SIMIT provides real-time virtual commissioning by emulating automation hardware, field instrumentation, and process dynamics. Central to this simulation is the SIMIT Virtual Controller (VC), a software-based execution engine that emulates the behavior of SIMATIC S7-400 and CPU 410-5H controllers without requiring physical controller hardware.

When simulating a CPU 410-5H, the Virtual Controller emulates both the central microprocessor and the physical System Expansion Card (SEC). During program compilation and download, the PCS 7 CFC compiler queries the controller's system identification and SEC authorization state to verify Process Object licensing compliance before transferring executable blocks into memory.

Root Cause of the Security Expansion Card Download Abort

The error F: Security Expansion Card nicht gesteckt oder defekt. Ladevorgang abgebrochen occurs when an engineering station running a PCS 7 version older than V8.2 Update 1 (such as PCS 7 V8.0 SP2 or V8.1) attempts to download CFC changes to a SIMIT V9.x CPU 410 Virtual Controller:
- Compiler Incompatibility: Modern SIMIT V9.0 releases emulate the strict SEC verification protocols of CPU 410 firmware V8.2. Older CFC compilers (pre-CFC V8.2 Upd 1) do not recognize the virtualized cryptographic signature returned by the modern SIMIT VC.
- Download Behavior: While an Entire download in STOP mode might occasionally succeed, performing Changes-only download from CFC immediately aborts with the SEC error dialog, rendering iterative testing and virtual commissioning impractically slow.

Step-by-Step File Renaming Workaround for Legacy PCS 7 Versions

To bypass the SEC validation mismatch on PCs hosting SIMIT Virtual Controller, execute the official Siemens legacy emulation procedure:

Terminate Active Simulation: Stop the SIMIT simulation and close the SIMIT software and Virtual Controller application.
Navigate to the SIMIT VC Data Directory: In Windows Explorer, open:
C:\Program Files (x86)\Siemens\Automation\SIMIT\SIMIT VC\data\CPU\
Backup Active CPU 410 Emulation Files: Rename the modern CPU 410 descriptor files:
- Rename 6ES7410-5HN08-0AB0 to 6ES7410-5HN08-0AB0_CPU410
- Rename 6ES7410-5HX08-0AB0 to 6ES7410-5HX08-0AB0_CPU410
Activate Legacy S7-417 Emulation Files: Rename the pre-configured legacy descriptor files:
- Rename 6ES7410-5HN08-0AB0_LEGACY to 6ES7410-5HN08-0AB0
- Rename 6ES7410-5HX08-0AB0_LEGACY to 6ES7410-5HX08-0AB0
Restart SIMIT Simulation: Launch SIMIT and start the virtual controller. With these files modified, the Virtual Controller identifies itself to the CFC compiler with S7-417 compatibility flags, enabling immediate, unrestricted online changes downloads without SEC checks.

SIMIT Virtual Controller CPU Compatibility Matrix

The following table details compatibility and required configurations for simulating CPU 410 controllers in SIMIT:

PCS 7 / CFC VersionSIMIT VC VersionVirtual Controller CPU 410 BehaviorRequired ActionPCS 7 V8.0 SP2 (CFC V8.0)SIMIT V9.0 / V9.1Aborts changes download with SEC errorApply Legacy File Renaming WorkaroundPCS 7 V8.1 (CFC V8.1)SIMIT V9.0 / V9.1Aborts changes download with SEC errorApply Legacy File Renaming WorkaroundPCS 7 V8.2 RTM (Base)SIMIT V9.0 SP1Intermittent SEC validation errorsUpgrade to CFC V8.2 Update 1 or higherPCS 7 V8.2 Upd 1 (or higher)SIMIT V9.0 SP1+Fully Supported (Native SEC emulation)Use standard unmodifed SIMIT filesPCS 7 V9.0 / V9.1SIMIT V10.x / V11.xFully Supported (Native SEC emulation)Standard operation out-of-the-box

Note: If upgrading the engineering station to CFC V8.2 Update 1 or higher later, restore the original _CPU410 file names.

Verification

Verify that CFC downloads complete successfully to SIMIT VC:
1. Start the virtual controller in SIMIT and verify it transitions to RUN mode with simulated I/O active.
2. In SIMATIC Manager on the ES, open a CFC chart and add a test logic gate or modify a parameter.
3. Execute PLC > Download > Changes only.
4. Confirm that the download dialog advances through system data block validation and code transfer without SEC error pop-ups.
5. In SIMIT, observe that the modified signals update in the simulation view immediately.

Limitations and Operational Precautions

Key precautions when applying SIMIT legacy workarounds:
- The legacy file renaming workaround applies only to the simulated SIMIT environment; it does not alter physical PLC hardware configurations or real controller downloads.
- When applying this workaround, the Virtual Controller bypasses SEC capacity limits, allowing simulation of programs that may exceed the physical SEC card limits of the real target hardware. Ensure PO sizing is checked independently.
- Administrator rights in Windows are required to modify files within the Program Files (x86) directory.

Engineer FAQ

Why does the error mention 'Security Expansion Card' instead of 'System Expansion Card'?

In early German-to-English software translations of the CPU 410 firmware and SIMIT manuals, 'System Expansion Card' (SEC) was occasionally rendered as 'Security Expansion Card'.

Can I just upgrade CFC instead of renaming SIMIT files?

Yes. If your plant engineering environment permits updating engineering tools, installing CFC V8.2 Update 1 (or higher) permanently resolves the SEC validation defect without modifying SIMIT files.

Does this file renaming workaround affect S7-300 or S7-400 simulation?

No. The modified files only affect the Virtual Controller descriptor mapping for the CPU 410-5H (6ES7410-5HN08-0AB0). Other controller emulations are unaffected.