Why S7-400 Controllers Cannot Upload Graphical CFC Charts to Engineering Stations and How to Safely Read Back Runtime Parameters

In SIMATIC PCS 7, an S7-400 controller stores only compiled machine code (MC7 byte-code executed in OBs, FCs, and FBs) inside its internal RAM/Flash memory; it does NOT store graphical Continuous Function Chart (CFC), Sequential Function Chart (SFC), or CEMAT source topology. Consequently, performing a standard 'Upload Station to PG' in SIMATIC Manager retrieves only unstructured STEP 7 block code without graphical connections, symbol names, or chart hierarchies. To preserve operational parameter changes made by operators or plant engineers, you must execute a 'Read Back Charts' operation in the CFC Editor using the original offline engineering project, or back up WinCC User Archives and multi-project archives before maintenance.

Architecture of CFC Compilation: Graphic Charts vs Controller Machine Code

To understand why S7-400 controllers cannot reconstruct graphical engineering charts, one must examine the compilation architecture of SIMATIC PCS 7:

Graphical Source Layer (Engineering Station): In the PCS 7 Engineering Station, control logic is designed visually using Continuous Function Charts (CFC), Sequential Function Charts (SFC), and specialized industry libraries (such as CEMAT). These charts store block interconnections, signal routings, execution group run sequences, and plant hierarchy metadata in proprietary database tables inside the multi-project.
Compilation Process (CFC Compiler): When an engineer compiles a CFC chart, the compiler translates the visual layout into native S7-400 machine instructions (MC7). It auto-generates Function Blocks (FBs), Functions (FCs), Instance Data Blocks (DBs), and Organization Blocks (e.g., OB30–OB38 cyclic execution tasks).
Target Memory (S7-400 CPU): Only the compiled binary blocks (MC7 instructions and runtime data blocks) are downloaded to the controller. The graphical chart structure, layout coordinates, signal line paths, and user comments are completely stripped out to conserve controller memory.

Why 'Upload Station to PG' Destroys PCS 7 DCS Integrity

Plant engineers migrating from standard STEP 7 PLC environments often attempt to recover lost programs by selecting PLC > Upload Station to PG...:

The Result: The PG uploads hundreds of raw machine blocks (FC60, FB1050, DB100–DB999). None of these blocks display in CFC format. Instead, they appear as incomprehensible Statement List (STL) code generated by the internal PCS 7 driver generators and compiler.
Irreversible Data Loss: If an engineer attempts to edit these uploaded raw blocks or downloads them back to the CPU, all module driver generation, automated WinCC message routing, and OS tag compilation will be permanently broken.
The Golden Rule of PCS 7: The offline Engineering Station project is the single source of truth. Never overwrite an engineering multi-project with an uploaded station from a controller.

Proper Procedure for Parameter Readback in CFC Editor

When process setpoints, tuning constants (PID gain, integration time), alarm limits, or runtime timer presets are tuned by operators in WinCC, those modified values exist in controller RAM but differ from the offline ES database.

To synchronize the offline project with live controller parameters without losing graphical charts:
1. Open the original offline multi-project on the Engineering Station.
2. In SIMATIC Manager, open any CFC chart within the chart folder.
3. Select menu Chart > Read Back....
4. Choose the target: Entire Program or Selected Charts.
5. Select the Read Back Scope (described below).
6. Click OK. The CFC editor connects to the online CPU, reads the active data block values, and updates the offline chart block parameter fields while keeping all graphical interconnections intact.

OCM Parameters vs All Parameters Selection Criteria

In the CFC Read Back dialog, engineers must select the appropriate parameter scope:

OCM Possible (Operator Communication and Monitoring):
* Scope: Reads back only block inputs and parameters configured with the S7_m_c := 'true' attribute (parameters exposed to WinCC, such as setpoints, limits, tracking values, and PID parameters).
* Recommendation: Standard operational choice. Safely synchronizes plant tuning changes made from operator faceplates while preserving engineering design constants.
All Parameters:
* Scope: Reads back every block input parameter across the entire controller memory.
* Use Case: Used strictly prior to major software migrations (e.g., migrating from PCS 7 V7.1 to V8.2) or full CPU replacements where internal calculation states must be retained.
* Risk: Can inadvertently read back temporary test overrides or dynamic interconnects that should reset upon restart.

Comparison of Backup and Recovery Methods for PCS 7 S7-400 Controllers

The table below compares the four methods used to back up and preserve PCS 7 S7-400 automation station data.

Backup / Recovery MethodSource LocationDestinationPreserves CFC Charts?Recommended FrequencyCFC Read Back (OCM Parameters)Online S7-400 RAMOffline CFC Chart DBYes (Updates chart values)Monthly / Post-tuningCFC Read Back (All Parameters)Online S7-400 RAMOffline CFC Chart DBYes (Complete parameter sync)Prior to DCS MigrationSIMATIC Multi-Project ArchiveES Hard Drive.zip Storage / ServerYes (Complete master archive)After every project changeWinCC User Archive ExportOS Server SQL DB.csv / .dmp FileN/A (Preserves recipes/batches)Weekly / Scheduled taskUpload Station to PG (STEP 7)Online S7-400 RAMNew STEP 7 StationNO (Raw STL blocks only)Prohibited in PCS 7

Verification

To verify that parameter readback and backup succeeded:
1. In the CFC Editor, open a tuned PID loop block (e.g., PIDConL or CEMAT drive block).
2. Inspect parameter Gain and TI: verify that the offline block values now reflect the values tuned live from the WinCC faceplate.
3. Perform a test compilation: Chart > Compile > Changes Only. Confirm that compilation completes with 0 errors and zero unintended changes.
4. Open SIMATIC Manager and execute File > Archive.... Select the entire Multi-project and create a timestamped compressed backup file.
5. In WinCC Explorer, verify that User Archives (if utilized) have been exported via the User Archive Editor to a secure network repository.

Limitations and Operational Precautions

Never perform an 'Upload Station to PG' and download it back to an S7-400 controller in a PCS 7 installation; doing so will corrupt block numbers and sever all OS compilation links.
If the offline multi-project is lost, recovering CFC charts requires reverse-engineering from plant documentation or contacting Siemens Technical Support for forensic project recovery services.
Always execute CFC Read Back before archiving a project to prevent subsequent downloads from overwriting live field tuning adjustments with stale offline parameters.
Verify final hardware configurations, CEMAT library versions, and spare part requirements against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Can Siemens reverse-engineer uploaded STL blocks back into CFC charts?

No automated tool exists to reverse STL into CFC. The graphical routing, chart hierarchy, and block interconnection topology do not exist in the controller; rebuilding the CFC requires manual re-engineering from scratch.

Why did my PID tuning reset to default after a full download?

If you performed a full download without first executing 'CFC Read Back', the Engineering Station overwrote the controller's online RAM with the stale parameter values stored in the offline project database.

Does CFC Read Back cause CPU stoppage or bump the plant?

No. CFC Read Back is an online read-only operation; it queries data blocks via standard S7 communication services without halting the CPU or altering live process outputs.