Adding a Second TP1200 HMI to an ET200S CPU on TIA Portal Without the Original Project

Engineers who maintain brownfield Siemens machines routinely face the situation where the original TIA Portal project is unavailable, but a duplicate operator panel must be added to extend the workstation. The typical hardware combination is a SIMATIC ET 200S CPU (an IM151-8 PN/DP head module acting as PROFINET IO controller with integrated S7 CPU) wired to a SIMATIC TP1200 Comfort HMI over PROFINET. The recovered or uploaded PLC project in TIA Portal becomes the master reference, while a fresh *.hmi runtime file is generated for the second panel.

This article documents the field-proven procedure to clone a TP1200 Comfort project using ProSave, assign a new PROFINET IP, connect the panel to the existing ET200S CPU through a TIA Portal HMI connection, and configure coordination / job-mailbox area pointers so two operators can run the same screens without corrupting PLC tags. The procedure is written for TIA Portal V16 / V17 / V18 with WinCC Comfort or WinCC Advanced, but the ProSave backup-restore path is identical back to V13 SP1.

1. Hardware Identification and Topology

Before any software work, capture the actual hardware on the panel and CPU door labels. The PROFINET device name on the HMI must be unique on the network, and the IP/MAC must not collide with the existing TP1200.

Refer to the SIMATIC HMI TP1200 Comfort Operating Instructions and the SIMATIC ET 200S IM151-8 PN/DP CPU Manual for the device reference details. The TP1200 is a Comfort-class panel that supports both HMI tags and area pointers (coordination, job mailbox, data record, date/time, PLC version ID). These pointers are central to running two panels in parallel against one PLC.

2. Prerequisites and Toolchain

1. TIA Portal V16 / V17 / V18 with the same HSP (Hardware Support Package) used to upload the ET200S project. The HSPs are mandatory for the IM151-8 PN/DP device version; without them the CPU will appear in the catalog as unknown and the upload will not decompile the blocks correctly.
2. WinCC Comfort or WinCC Advanced license (Comfort is the matching edition for TP1200). The basic WinCC Basic license cannot compile a TP1200 runtime.
3. ProSave V16+ (ships with TIA Portal under Siemens Automation\SIMATIC\ProSave). ProSave is the only tool that performs an out-of-project backup of an HMI image; WinCC alone cannot read a panel that is not part of an open project.
4. Ethernet cable direct to the TP1200 service port (X1 on Comfort panels) or to the same PROFINET subnet through the SCALANCE switch.
5. Configured PG/PC interface in TIA Portal pointing to the physical NIC (TCP/IP → <NIC>). A second virtual NIC (e.g. Intel I210) is recommended to keep HMI download traffic off the engineering network.
6. The uploaded PLC project (TIA Portal upload to PC) for the ET200S CPU. The upload creates an unattached S7 program tree; you will use this as the reference for the HMI tag list.
7. Administrator rights on the engineering PC; the SIMATIC HMI License Manager and ProSave services require local admin to install/start.

3. Recovering the Reference Project from the ET200S CPU

Because the original TIA Portal archive is missing, the first deliverable is an upload of the S7 program from the ET200S CPU. This gives you the data blocks, FC/FB interfaces, and tag symbols required to build the HMI tag list for the second panel.

1. Open TIA Portal → Project → New project from source → Migrate project if the upload is from a pre-V15 source. Skip if the CPU firmware is V3.x and TIA Portal is V16+.
2. Switch to the Project view. In the project tree, right-click the new device and select Online & diagnostics → Upload from device (software).
3. Choose Upload device to PG/PC as new station. TIA Portal reconstructs the device configuration (rack, IM151-8 head module, attached signal modules) and the S7 program.
4. Open Program blocks → System blocks → PLC tags and export the tag table to .xlsx for reference. This is the canonical symbol list the HMI will mirror.
5. Note the PLC IP address and the PROFINET device name of the ET200S CPU under Properties → PROFINET interface → Ethernet addresses. The new HMI must use the same PLC IP as its S7 connection target.

4. Backing Up the First TP1200 with ProSave

ProSave reads the first TP1200 over Ethernet and stores a complete *.psb backup (image + recipe DBs + project) on the engineering PC. The backup is panel-specific, but the runtime *.hmi file extracted from it is reusable on any other TP1200 Comfort of the same article number once the IP and device name are changed.

1. Set the PG/PC interface to the NIC connected to the TP1200. In TIA Portal: Options → Set PG/PC interface → TCP/IP → <your NIC>.
2. Launch ProSave from C:\Program Files\Siemens\Automation\SIMATIC\ProSave\ProSave.exe.
3. Set Device type = TP1200 Comfort. Set Connection = Ethernet (TCP/IP).
4. Click Connect. Enter the panel IP (default for an unconfigured TP1200 Comfort: 192.168.0.1 with PROFINET device name tp1200-comfort). The panel's Control Panel → Network & Dial-up Connections → PN_X1 page shows the current IP if it was changed at commissioning.
5. Switch to the Backup tab. Select Complete backup with recipes and user administration. Tick Compress backup to keep the *.psb under 200 MB.
6. Click Run → Start. Typical restore on a 12.1" Comfort panel takes 2-4 minutes over Fast Ethernet. A green status line confirms success; an error code 1502 or 1702 indicates the panel is in transfer mode or the operating mode is on STOP — toggle the panel to Transfer mode from the loader (Settings → Loader → Transfer).
7. Save the *.psb archive to a network share with the machine serial number for traceability.

Reference: ProSave V16+ Backup and Restore Procedure (SIOS entry 109755202). For panel-side settings, see the TP1200 Comfort Manual (SIOS 109744218).

5. Restoring the Project to the Second TP1200 via ProSave

1. Connect the engineering PC directly to the second TP1200 (X1 service port). Disconnect the cable from the first panel to avoid a duplicate-IP conflict during restore.
2. Open ProSave and connect to the panel. Accept the panel's transfer prompt.
3. Open the Restore tab. Select the *.psb from step 4.6.
4. Choose Restore complete backup. Activate Reset panel to factory settings before restoring to clear any previous IP, name, and certificate state. This is critical when the panel was previously used on another PLC.
5. Click Start. When the restore finishes, the panel reboots automatically.
6. After reboot, open the panel's Control Panel → Network & Dial-up Connections → PN_X1 and assign a unique static IP, e.g. 192.168.0.11 for the second panel vs. 192.168.0.10 for the first. Use the same subnet mask 255.255.255.0.
7. Open Control Panel → PROFINET IO → Device name and rename the second panel to tp1200-2 (the IO controller only knows names, not IPs).
8. Save and close the Control Panel. The runtime starts in the configured HMI language; if it crashes immediately, the IP change has not been saved — repeat step 6.

6. TIA Portal: Adding the New HMI Connection to the PLC Project

Although the runtime on panel 2 already contains the S7 connection string, you must mirror the connection in the TIA Portal project so that a future download from engineering does not drop the second panel. Two paths are available:

6.1 Path A: Mirror the existing HMI project in TIA Portal

1. In the TIA Portal project tree, right-click Devices & Networks → Add new device → SIMATIC HMI → TP1200 Comfort. Give the new device a unique name (e.g. HMI_2).
2. Open the device configuration. Under Properties → PROFINET interface → Ethernet addresses, set the IP to 192.168.0.11 and the device name to tp1200-2. This is the value the IO controller will compare during ARP/DCP discovery.
3. Copy the existing HMI project: in the project tree, right-click HMI_1 → Copy, then right-click the project root → Paste with rename. The pasted HMI inherits the screens, tags, and connections.
4. Open Devices & Networks. Drag a connection from the new HMI device to the ET200S CPU port. In the pop-up select S7 connection. The connection editor opens; the Local ID of the new connection must differ from the first HMI (e.g. HMI_2_Conn).
5. In the Connection editor on the PLC side, expand the connection partner list — the Establish active connection flag must be set on the HMI side, with the Partner IP matching the ET200S CPU IP. With IM151-8 PN/DP, the PLC cannot initiate a connection; the HMI is the only active endpoint.
6. Compile the HMI project (Compile → Software (rebuild all)). The resulting *.hmi is the new runtime for the second panel. Transfer it via ProSave Restore or via WinCC Online → Download to device if the panel is reachable.

6.2 Path B: Reuse the connection from the first HMI in the connection editor

If the HMI project is part of a separate archive, the Siemens support workflow for connecting a HMI from another project to a PLC recommends recreating the connection inside the new TIA Portal project, copying the connection name from the legacy project, and assigning it to the new HMI in Devices and Networks. This avoids orphan Unknown connection warnings on the panel.

1. In the legacy HMI archive, open Connections and note the connection name (e.g. Connection_1) and the partner IP.
2. Add the new TP1200 device in the current TIA Portal project.
3. In the new HMI's Connections editor, paste the legacy connection name and partner IP. Save.
4. Compile the project. The HMI will now reference the same connection identifier as the original panel, and any DB tag references will resolve to the same offsets in the PLC.

7. Area Pointers Required for Dual-Panel Operation

Two panels running the same screens against one ET200S CPU share every DB tag. To prevent the operators from toggling the same bit simultaneously (e.g. Start vs. Stop) and to coordinate screen control, configure the HMI area pointers in TIA Portal under HMI_2 → Properties → Connections → Area pointers.

To set the pointers in TIA Portal: open the HMI device, Properties → Connections → Area pointers, click Add for each entry, choose the connection, and select the DB number and offset. Compile the HMI — the area pointers are baked into the runtime.

8. PLC-Side: Tag Access Arbitration and Operator Locking

The ProSave restore alone does not arbitrate operator access. With two panels, both can write the same bit at the same time; the last write wins, which in a safety-relevant machine can mean the operator presses Stop on panel 1 while panel 2 is being used to jog a servo. The standard mitigations, all implemented in the PLC program (not the HMI), are:

8.1 Operator lock with area pointer handshake

Use a single byte in the PLC to hold the active panel (0 = none, 1 = panel 1, 2 = panel 2). Each panel sets a request bit in its coordination area. The PLC sets the active panel to the first requestor and clears the second's write enable mask. Only the active panel can execute write tags; both panels can still read.

// Example SCL for the ET200S CPU (FW 3.x, TIA V17)
FUNCTION_BLOCK "FB_OperatorLock"
VAR
    RequestPanel1 : BOOL; // from HMI_1 coordination byte.0
    RequestPanel2 : BOOL; // from HMI_2 coordination byte.0
    ActivePanel   : INT;  // 0=none, 1, 2
    EnablePanel1  : BOOL; // to HMI_1 area pointer enable bit
    EnablePanel2  : BOOL; // to HMI_2 area pointer enable bit
END_VAR

IF RequestPanel1 AND ActivePanel = 0 THEN
    ActivePanel := 1;
END_IF;
IF RequestPanel2 AND ActivePanel = 0 THEN
    ActivePanel := 2;
END_IF;

EnablePanel1 := (ActivePanel = 1);
EnablePanel2 := (ActivePanel = 2);

// Release after 30s of inactivity on the active panel
IF (ActivePanel = 1) AND NOT RequestPanel1 AND NOT (life1_tick_in_last_30s) THEN
    ActivePanel := 0;
END_IF;
IF (ActivePanel = 2) AND NOT RequestPanel2 AND NOT (life2_tick_in_last_30s) THEN
    ActivePanel := 0;
END_IF;

8.2 Read-only on both panels for the second operator

If the design intent is observer + operator (e.g. second panel is a supervisor station), configure the second HMI's Connections → Mode to Passive (read only). The PLC marks the second connection as passive, and any write attempt is rejected by the CPU. The IM151-8 PN/DP allows multiple S7 connections (up to 16) but the connection editor in TIA Portal must set the role correctly.

8.3 Job mailbox routing

For PLC-driven screen changes, the job mailbox should target the currently active panel. Use the active-panel word to switch the job mailbox source DB in the PLC program before issuing the job. Avoid broadcasting a screen change to both panels unless both operators have explicitly opted in.

9. Verification Procedure

After the ProSave restore, the IP change, and the TIA Portal project update, perform these checks before handing the machine back to operations.

1. PROFINET name resolution. From the engineering PC, run Online → Accessible devices in TIA Portal. The second panel should appear as tp1200-2 with the assigned IP and a green Accessible status. If the panel shows as Not accessible, the device name in the panel Control Panel is wrong — go back to step 5.7.
2. S7 connection status. On the panel, open Diagnostics → Connection status. The HMI_2_Conn row should show Established. A red Connection error with SF (system fault) on the PLC usually means the partner IP is wrong or a firewall on the SCALANCE is blocking the S7 protocol (port 102).
3. Tag read/write round-trip. Create a temporary value display on the new panel bound to a known DB word (e.g. DB200.DBW0). In the PLC, use a watch table to set the value. The panel must display the new value within one cycle (typical 100 ms update). If the value is stuck, check the tag's Acquisition mode — it must be Cyclic continuous or Cyclic in operation, not On demand.
4. Write arbitration. If step 8.1 was implemented, simulate two operators by toggling RequestPanel1 and RequestPanel2 in the watch table. The ActivePanel word must transition correctly, and EnablePanel1 / EnablePanel2 must never both be TRUE.
5. Alarm synchronization. Trigger a PLC alarm (e.g. set DB300.DBX0.0 to TRUE). Both panels must display the alarm in the alarm view within 2 seconds. The alarm area pointer must be configured identically on both panels.
6. Recipe transfer. Load a recipe set on panel 1; change one element; save. Switch to panel 2 and read the recipe — the values must match. If they do not, the recipe area pointer data record number has a collision; reassign per section 7.
7. Firmware check. Compare the panel firmware under Control Panel → System → Device information against the runtime's compiled version. Mismatched firmware is the most common cause of intermittent screen redraws.

10. Troubleshooting Matrix

11. Long-Term Maintenance Tips

• Tag the panel name, IP, and PROFINET device name on the inside of the cabinet door. Field engineers who later replace a panel will save an hour by reading it.
• Keep the *.psb backup with the machine's documentation package. A new panel in five years should be restored from the same image, not rebuilt from a stale archive.
• When the ET200S PLC program is changed in TIA Portal and downloaded, both HMI runtimes must be re-transferred if any tag address changed. The PLC upload and HMI retransfer sequence is: PLC upload → HMI tag re-assign → HMI recompile → ProSave restore on both panels.
• Add a single PROFIBUS or PROFINET diagnostic repeater if the second panel is more than 80 m from the IO controller. The IM151-8 PN/DP port is rated for 100 m copper; longer runs need an SCALANCE X108 or X208 in line.
• Document the operator lock logic in the FBD/LAD/whatever — it is the most likely thing to be simplified away in a future refactor, which would re-introduce the dual-operator write race.

12. Summary Workflow

1. Upload ET200S PLC project to TIA Portal — capture the tag list and PLC IP.
2. Back up the first TP1200 with ProSave to a *.psb file.
3. Restore the *.psb to the second TP1200 with ProSave; reset to factory first.
4. On the second panel, set a unique static IP and a unique PROFINET device name.
5. In TIA Portal, add a new TP1200 device, mirror the connection, configure area pointers with unique DBs.
6. Implement operator arbitration in the PLC program (active-panel handshake).
7. Compile and retransfer the new runtime; run the verification procedure in section 9.
8. Hand the machine back with a documented tag, IP, and name map.

The PLC hardware configuration does not need to be modified to add the second HMI — the S7 connection is initiated by the HMI, and the IM151-8 PN/DP supports up to 16 simultaneous S7 connections over PROFINET. The two panels can coexist on the same network, share the same screens, and serve two operators — provided the application engineer adds the operator-lock and area-pointer configuration covered above. For deeper background, refer to the TP1200 Comfort Manual and the ET 200S IM151-8 PN/DP Manual on the Siemens Industry Online Support portal.