Backing Up S7 PLC Programs: Complete TIA Portal Procedure

Overview

Backing up a SIMATIC S7 controller is not a single click; it is a workflow whose outcome depends on which engineering tool generated the project, which CPU family is on the shop floor, and which artefacts (program blocks, symbols, comments, DB initial values, hardware configuration, safety signature) must survive the round trip. A naive File → Save As on the offline project only preserves what already exists on the engineering station, and an Upload to PG/PC from a connected CPU returns compiled blocks stripped of symbols and comments unless an upstream source project is available.

This reference consolidates the working backup procedures for the two current Siemens controller families and their associated engineering tools, with emphasis on the S7-1200 and S7-1500 lines served by TIA Portal (STEP 7 Basic / Professional V20 and later). Procedures for legacy S7-300 / S7-400 systems using the classic SIMATIC Manager (STEP 7 V5.x) are included because many plants still operate them and a backup workflow frequently crosses both ecosystems.

Prerequisites

Before initiating any backup, verify the following prerequisites on the engineering station and on the target controller:

• Engineering software installed and licensed:
  • TIA Portal V20 (or the matching project version) for S7-1200 / S7-1500, including the correct Support Package for the CPU firmware.
  • SIMATIC Manager STEP 7 V5.6 or V5.7 (with the latest Service Packs) for S7-300 / S7-400 / WinAC.
• Online connectivity between PG/PC and CPU:
  • PROFINET (TCP/IP) for S7-1200 / S7-1500 with the CPU in the same subnet or reachable via router.
  • PROFIBUS (MPI) or PROFINET for legacy S7-300 / S7-400.
• A SIMATIC Memory Card (SMC) for S7-1200 / S7-1500 if an offline card image is part of the backup strategy. S7-1500 requires the SMC for full operation; S7-1200 uses it for program-card mode and firmware updates.
• A consistent offline source project with symbols and comments for the round-trip workflow; otherwise only runtime artefacts can be retrieved.
• Read / write / HMI passwords collected from the plant documentation. TIA Portal CPUs ship with the protection concept Know-how protection active on many blocks; without the password the upload will yield encrypted blocks.

Backup Strategy Selection

The "right" backup depends on what must be restored after a failure. The matrix below maps the failure scenario to the recommended mechanism.

Backup Procedure in TIA Portal (S7-1200 / S7-1500)

The official Siemens TIA Portal V20 documentation describes two distinct backup destinations: the Online backups sub-folder of the project tree, and the Online > Backup from device command. Both are required for a complete backup workflow.

Step 1 – Establish an online connection

1. Open the project in TIA Portal.
2. Expand the project tree and select the target CPU under Devices & networks.
3. From the menu, choose Online → Online & diagnostics. TIA Portal will scan the accessible nodes. Select the CPU and click Go online.
4. Confirm that the online view of the device (Online & diagnostics pane) shows the firmware version, serial number, and slot configuration matching the plant asset database.

Step 2 – Create a backup of the connected CPU

1. With the CPU selected, choose Online → Backup from device.
2. In the dialog, choose the backup scope:
   • Complete backup (recommended): user program, hardware configuration, DBs with actual values, retentive data, parameter assignments of the central/ distributed I/O.
   • Project-related backup: only the parts of the online firmware image that belong to the loaded project; useful for comparing a corrupted project to a known-good backup.
3. Set the backup password (or confirm the default). The backup file is encrypted with this password; without it the file cannot be restored.
4. Click Backup and select the target folder. TIA Portal writes a file with extension *.bak (legacy) or a password-protected *.tiaf archive depending on the version.

Step 3 – Save the backup file to the project tree (Online backups folder)

To keep the backup tied to the engineering project:

1. In the project tree, expand the Online backups folder of the device.
2. Right-click the freshly created backup entry and select Save as.
3. Navigate to the file-share path used for project archives and confirm. This places a copy in the version-controlled engineering repository.

Storing the backup inside the project tree guarantees that any change to the project (HMI screens, additional devices, safety-related blocks) is paired with a reproducible controller image.

Step 4 – Upload station to PG (when source project is missing or untrusted)

1. Select the CPU and choose Online → Upload from device (software).
2. In the dialog Upload from device, tick Include software and click Upload.
3. Choose the target project and the device name. TIA Portal creates a new project containing the compiled blocks retrieved from the CPU.

The uploaded project does not contain the symbol table or the source comments, because these are stored only in the engineering database of the original offline project. Restoring them requires either:

• Re-importing the matching symbol table from a CSV / XLSX export previously archived by the original author, or
• Re-creating the symbols by re-binding them to the absolute addresses shown in the uploaded blocks.

Step 5 – Archive the project

1. From the project tree root, choose Project → Archive.
2. Select the target path and the archive type:
   • *.zap (TIA Portal V13–V18) compressed archive.
   • *.zap20 (TIA Portal V20) compressed archive with the latest project format.
   • External version control (Git / SVN) for code review and change tracking.
3. Save the archive to a write-once or off-line location after the backup is complete.

Restoring is performed with Project → Retrieve. When opening an archive from an older TIA Portal version, upgrade warnings will prompt to install the matching Support Package.

Backup Procedure in SIMATIC Manager (S7-300 / S7-400)

Plants that still operate on STEP 7 V5.x must use SIMATIC Manager. The legacy tool stores comments and symbols in the offline project only, and "Upload to PG" returns compiled blocks stripped of source annotations.

Step 1 – Archive the offline project (preferred)

1. In SIMATIC Manager, open the project.
2. Choose File → Archive.
3. Select the user-defined tree (typically S7_Pro1 or the project container) and confirm. SIMATIC Manager produces a single *.zip-style archive that contains the S7 program, symbols, comments, and the hardware configuration.

To restore, choose File → Retrieve and select the archive. The project is re-expanded to the same folder layout on the destination drive.

Step 2 – Upload station to PG (no source available)

1. Open SIMATIC Manager with a new, empty project.
2. From the menu, choose PLC → Upload Station to PG.
3. Select the accessible node (MPI / PROFIBUS / TCP/IP address) and confirm. SIMATIC Manager reads the S7 program, the HW config (in compressed form), and the system data blocks.
4. Once the upload completes, immediately choose File → Archive to capture the result.

The uploaded program has the following limitations:

• All block comments and network titles are blank.
• Symbol names are replaced by absolute addresses (e.g. DB1.DBD0 instead of MotorSpeed_RPM).
• HW Config is uploaded but may require manual re-validation of the rack layout and module order.

To make an uploaded project readable again, the symbol table must be re-imported from the *.seq or CSV export that the original author archived. Without this step, the program is "a backup of a working PLC" but not "a backup of a maintainable program".

Handling Data Blocks (DB) Across Backups

Data blocks are the most failure-prone artefact in any S7 backup because they have two value layers:

1. Initial values defined in the DB source / declaration; written to the load memory at download time.
2. Actual values in the work memory at runtime; updated by the program and, for retentive tags, preserved across power cycles.

When you copy a DB online → offline and the offline declaration does not match the online structure, TIA Portal / SIMATIC Manager will warn that the data will be lost. Two safe patterns avoid this:

Symbols, Comments, and the "Upload" Footgun

Both TIA Portal and SIMATIC Manager store symbol tables, block comments, and network titles only in the engineering project database, not in the CPU. A backup that consists solely of "Upload to PG" will leave you with a working but unreadable program. The mitigation is process-based, not technical:

• Maintain a single, version-controlled source project per CPU. Tools such as the TIA Portal Multiuser Server or external Git / SVN servers are acceptable.
• Every release of the program is paired with a TIA Portal project archive (and, for S7-1200 / S7-1500, a CPU backup file).
• Symbol tables are exported to CSV and committed alongside the archive so that an uploaded CPU image can be cross-referenced.
• Know-how-protected blocks are documented: the password (stored in a credential vault) is part of the backup package.

Verifying a Backup

A backup that has never been restored is not a backup. Verification must occur on a sandbox CPU or in the TIA Portal PLCSIM instance before the production line depends on it.

1. Copy the archive file to a fresh engineering station.
2. Retrieve / unzip it, confirm the project opens without warnings about missing Support Packages.
3. For TIA Portal backups: select the CPU and choose Online → Restore from device backup; choose the *.bak file and confirm the firmware compatibility.
4. For SIMATIC Manager archives: File → Retrieve, then PLC → Download to a test CPU (or to PLCSIM).
5. Compare the restored program to the original offline project using Online → Compare offline / online. Resolve every conflict before signing the backup off.
6. Document the verification: file name, hash (SHA-256), verification date, and the verifying engineer.

Troubleshooting Matrix

Automating Backups Across a Fleet

Manually executing Online → Backup from device for hundreds of CPUs is not sustainable. Siemens provides two fleet-scale tools that integrate with the same backup format:

• SIMATIC Automation Tool – a free utility that enumerates S7-1200 / S7-1500 CPUs on the network and triggers a backup on each, naming files by serial number and timestamp.
• PRONETA – primarily a network-analysis tool, but supports a "Backup & restore" function for small fleets.
• TIA Portal Teamcenter gateway – integrates program archives with PLM; used where formal change management is required.

For scripting environments, the Open Controller (ET 200SP) and the S7-1500 Software Controller expose the Web API; backup files can be fetched via HTTPS, but this is a vendor-specific endpoint and must be tested against the firmware version in service.

Security and Compliance Considerations

A backup file is, in most jurisdictions, part of the asset's compliance record. Treat it accordingly:

• Integrity. Compute a SHA-256 hash at archive time and store it with the backup metadata; verify on retrieval.
• Confidentiality. Backup files include passwords, DB actual values (which may contain process secrets), and the engineering fingerprint of the plant. Encrypt the archive at rest.
• Retention. Align the backup retention with the asset's audit cycle. S7-1500 projects under IEC 62443 may require retention across the full operational lifetime plus the regulatory grace period.
• Access control. Limit retrieval privileges to the engineering team. The TIA Portal archive itself is not encrypted by default; wrap it with a corporate password manager or an encrypted file share.

FAQ