Uploading and Monitoring Standard STEP 7 Programs vs PCS 7 CFC Charts in SIMATIC Manager

In SIMATIC PCS 7, an Engineering Station can upload and monitor programs from S7-300 and S7-400 controllers written in standard STEP 7 (LAD, FBD, STL) using 'PLC > Upload Station to PG', because PCS 7 installs the full STEP 7 Classic software package. However, if the controller was originally programmed using Continuous Function Charts (CFC) or Sequential Function Charts (SFC), uploading the station retrieves only raw compiled MC7 machine blocks (DBs, FCs) without graphical chart layouts, block names, or signal interconnections. Graphical CFC logic cannot be uploaded from the controller and requires the original offline project database.

Architecture of the PCS 7 Engineering Station and Embedded STEP 7

In SIMATIC PCS 7, the engineering environment centers on SIMATIC Manager. Behind the process control system extensions (CFC, SFC, WinCC OS compiler), a standard PCS 7 Engineering Station installs the full underlying suite of SIMATIC STEP 7 Classic (e.g., STEP 7 V5.5 SP4 or STEP 7 V5.6):
* Dual Engineering Capabilities:
The PCS 7 ES possesses complete native functionality to communicate with, program, and diagnose any standard SIMATIC S7-300, S7-400, or C7 automation controller.
* The Common Field Question:
Engineers frequently ask whether a PCS 7 field laptop can connect to an existing auxiliary PLC (e.g., an S7-300 packaging machine, water treatment skid, or emergency diesel generator programmed in Ladder Logic) to upload the program and monitor logic online during commissioning.

Uploading Standard STEP 7 Logic (LAD, FBD, STL) from S7-300 / S7-400

When an automation controller is programmed using standard STEP 7 languages (Ladder Logic / LAD, Function Block Diagram / FBD, or Statement List / STL):
* Direct Station Upload (Upload Station to PG):
Connecting to the controller over MPI, PROFIBUS, or Industrial Ethernet allows executing PLC > Upload Station to PG.
* Retrieved Artifacts:
1. The complete Hardware Configuration (HW Config), including racks, I/O cards, and communication addresses.
2. All compiled executable blocks: OBs, FBs, FCs, DBs, and system calls (SFCs, SFBs).
* Online Dynamic Monitoring:
The engineer can open any uploaded block, click the glasses icon (Monitor), and observe live rung states, timers, and mathematical accumulator registers.
* The Missing Information:
Unless the offline project was saved with symbolic information loaded into the CPU's memory card, uploaded blocks display absolute addressing (e.g., I 0.0, Q 4.1, DB10.DBW4) without variable names or network comments.

Why Graphical CFC and SFC Logic Cannot Be Uploaded from Controller Memory

If the controller was engineered within SIMATIC PCS 7 using Continuous Function Charts (CFC) or Sequential Function Charts (SFC), an upload attempt reveals the fundamental architectural boundary of DCS compilation:

The Compilation Transformation:
When an engineer compiles a CFC chart in PCS 7, the compiler translates interconnected graphical blocks into dozens of background Function Calls (FCs) and Data Blocks (DBs) written in raw MC7 machine code.
Where the Graphic Resides:
The graphical chart layouts, block instance names (e.g., Motor_101), chart partitions, sheet connectors, and comments reside exclusively in the offline Sybase/FoxPro project database (chart.dbf) on the Engineering Station hard drive.
The Empty Controller Trap:
The S7-400 CPU memory card stores zero graphical data. Uploading from a CFC-programmed CPU yields an unreadable collection of auto-generated numeric blocks (FC 882, DB 620, DB 621) with machine-generated hexadecimal jump pointers.
Never Edit Uploaded CFC Blocks:
Attempting to modify these uploaded blocks in STL and downloading them back to the CPU corrupts the CFC compiler's internal memory map, permanently disabling delta compilation and forcing a full controller STOP download.

Managing S7-300 Integration Alongside PCS 7 S7-400 Systems

In many process facilities, auxiliary plant skids run on SIMATIC S7-300 hardware. While S7-300 controllers cannot be programmed using PCS 7 Advanced Process Library (APL) module drivers:
* The Coexistence Architecture:
The S7-300 project can be inserted as a standard SIMATIC 300 Station inside the PCS 7 Multi-project.
* Communication Coupling:
Communication between the main PCS 7 S7-400 controllers and the S7-300 skids is established across Industrial Ethernet via S7 Connections (PUT/GET calls via FB 14/FB 15), or via physical fieldbus couplers (DP/DP Coupler 6ES7158-0AD01-0XA0 or PN/PN Coupler 6ES7158-3AD10-0XA0).
* Supervisory Visualization:
The WinCC OS station can communicate with the S7-300 skid directly using standard S7 Protocol Suite channel drivers without disrupting the primary PCS 7 Named Connections.

Comparison Table: Standard STEP 7 vs PCS 7 CFC Upload Capabilities

The following table details the functional differences when uploading from different programming environments:

Engineering DimensionStandard STEP 7 (LAD / FBD / STL)PCS 7 Process Control (CFC / SFC)Supported HardwareS7-300, S7-400, C7, WinACS7-400, CPU 410-5H, WinAC RTXStation Upload ExecutionFully supported (Upload Station to PG)Not Supported (Retrieves machine blocks only)Logic MonitoringNative graphical rung monitoringNative graphical block & sheet monitoringSymbolic InformationAvailable if Symbol Table is presentStripped in CPU; requires offline databaseNetwork CommentsLost upon upload (unless stored on MMC)Completely absent in CPU memoryReverse EngineeringPossible via decompiled STLImpractical (machine code without structures)Disaster Recovery RequirementCan recover partial logic from CPUStrictly requires offline project backup

Step-by-Step Procedure to Upload and Monitor a Standard STEP 7 PLC

Follow this verified engineering procedure to upload and monitor a regular S7-300/400 PLC using a PCS 7 ES:

Configure Physical PG/PC Interface:
* Open Set PG/PC Interface in SIMATIC Manager or Windows Control Panel.
* Set Access Point of the Application to S7ONLINE (STEP 7).
* Select your physical network adapter (e.g., TCP/IP -> Intel Gigabit NIC or CP 5711 (PROFIBUS)).
Execute Station Upload:
* In SIMATIC Manager, create a new empty project (File > New).
* Select PLC > Upload Station to PG....
* In the dialog, enter the Rack (0), Slot (2 for S7-300, or matching CPU slot for S7-400), and target IP/MPI address.
* Click OK and allow hardware and software block extraction to complete.
Open and Monitor Blocks:
* Expand the uploaded station > CPU > S7 Program > Blocks.
* Double-click any Function Block or Organization Block (e.g., OB1).
* In the LAD/STL editor, click the Monitor icon (glasses icon) to observe live signal execution.
Re-Link Offline Symbol Table (If Available):
* If a customer offline copy or printout is available, import the SYMLISTS file into the S7 Program Symbols folder to restore meaningful tag names to the uploaded logic.

Verification

Verify that standard PLC monitoring operates deterministically:
1. In the LAD/FBD/STL editor, confirm that the bottom status bar displays RUN with a green indicator.
2. Confirm that power flow lines in Ladder Logic reflect real-time field contact states (solid green for energized, dashed for de-energized).
3. Open the CPU Diagnostic Buffer (Ctrl+D in SIMATIC Manager); verify that active operating states and hardware diagnostic interrupts are accessible.
4. Verify that the upload did not disturb the running automation program in the target controller.

Limitations and Operational Precautions

Never Upload Over a PCS 7 Multi-Project: Never execute "Upload Station to PG" into an active PCS 7 multi-project folder. Doing so can overwrite the offline CFC chart container, permanently corrupting the plant hierarchy database.
Firmware and Block Version Mismatches: If the target S7-300/400 CPU uses newer firmware or library instructions not installed on the ES, HW Config will display the module as an unknown slave. Install the matching Hardware Support Package (HSP).
Work Memory vs Load Memory: Uploading retrieves blocks from the controller's load memory. Ensure that the controller memory card has not been write-protected.
Commercial Accuracy: Standard STEP 7 engineering capabilities are included natively with standard PCS 7 Engineering licenses (6ES7658-2CX58-0YB5). Validate software options with an authorized Siemens distributor quotation.

Engineer FAQ

Can I convert an uploaded STL block into a CFC chart?

No. There is no automated utility to convert compiled STL machine code into a graphical CFC chart. The CFC compiler operates in one direction (CFC -> MC7 binary code). Reverse compilation is technically impossible.

Why are all the block names just numbers (e.g., FC 100) after an upload?

The controller hardware executes compiled binary machine code referenced purely by numeric block numbers. Human-readable names (e.g., FC_Pump_Control) reside in the offline Symbol Table.

Can I use my PCS 7 field laptop to troubleshoot an S7-1200 or S7-1500 PLC?

No. S7-1200 and S7-1500 controllers are programmed exclusively using TIA Portal (Totally Integrated Automation Portal). PCS 7 SIMATIC Manager only supports S7-300, S7-400, and C7 architectures.

Does uploading a standard S7-300 station stop the running controller?

No. Uploading station blocks and hardware configurations is a read-only operation executed across communication buffers while the controller remains in RUN mode.