Field-Updating S7-1200 PLC and KTP400 HMI Without TIA Portal

Overview

Field updates of an S7-1200 CPU and a connected KTP400 Basic HMI must be performed without TIA Portal access when the customer environment prohibits remote engineering software (no VPN, no engineering station on site, locked-down network). Two native Siemens mechanisms cover this use case: the SIMATIC Memory Card (SMC) transfer-card function for the S7-1200, and the ProSave backup/restore utility for the HMI. The PLC update is delivered as a pre-loaded SMC that the customer hot-swaps; the HMI update is delivered as a ProSave .psb backup file plus the ProSave installer, which the customer runs against the HMI over Ethernet.

This procedure covers TIA Portal V17 projects targeting an S7-1200 CPU 1211C/1212C/1214C/1215C with firmware V4.5 or later and a KTP400 Basic PN with a WinCC Comfort V17 image. Both targets support transfer-card operations, but each must be handled through its own mechanism.

Prerequisites

S7-1200: Preparing the Transfer Card

The S7-1200 supports two SMC operating modes set by the physical write-protect slide on the card itself, in combination with the project-side configuration:

1. Program card — Stores the project; the CPU boots from the card if one is inserted at power-up.
2. Transfer card — Contains a single transfer job (S7_JOB.S7S) that copies its contents into internal load memory and then erases the job from the card. Used to push a new project into the CPU without TIA Portal.

For field updates, configure the SMC as a transfer card so that the customer action is simply: power down, swap the card, power up. The CPU detects the transfer job, copies the program to internal flash, and restarts with the new image.

Step-by-step: TIA Portal V17

1. Open the customer project in TIA Portal V17. Compile the project (Project tree → CPU → Compile → Software, rebuild all).
2. Insert the SMC into the engineering PC card reader. If using a virtual card reader path, point it at a folder via Project tree → Card Reader/USB Memory → Add User-defined Card Reader.
3. Drag the CPU station onto the card reader node. The "Load preview" dialog opens.
4. In the load preview, select the action "Transfer card: write to plug-in memory card, then insert in CPU". Accept.
5. The wizard creates SIMATIC.S7S (project container) and S7_JOB.S7S (transfer job marker) on the card.
6. Verify file listing on the card:

   DIR \ (root of SMC)
   ├── SIMATIC.S7S
   ├── S7_JOB.S7S
   └── LOGS\
       └── ...
   

7. Eject the card from the PC safely.

S7-1200: Card Reader / USB Memory Workflow

The "Card Reader/USB Memory" entry in the TIA V17 project tree accepts any removable drive letter. This is the recommended method for engineers who want to inspect the file structure before shipping the card, and for users who replicate the card via an SD duplicator rather than a PC-resident reader.

1. Connect the SMC via the PC's card reader.
2. Project tree → Card Reader/USB Memory displays the new card automatically with the drive letter.
3. Drag-and-drop the CPU station onto the card icon. Choose Transfer card in the action list.
4. If the card was previously used as a program card, TIA prompts to overwrite. Confirm.
5. After the write completes, navigate to the card in Windows Explorer and verify:
   • SIMATIC.S7S is present and the timestamp matches the compile run.
   • S7_JOB.S7S is present (it is not present on a program card).
   • File size on the card matches the sum of blocks in the project (rough sanity check against the build log).

Handling SD card replication

If you intend to clone the SMC using a 1-to-N SD duplicator (for fleet updates), use a sector-level copy, not a file copy. The SIMATIC file system uses a non-standard FAT layout; Windows file copies drop the OEM-specific boot sector, which causes the CPU to refuse the card with a memory card error event in the diagnostic buffer.

S7-1200: Customer-Side Update Procedure

Document the customer steps as a single-page field instruction. Each step requires confirmation before moving on.

1. Power down the S7-1200 CPU. The MAINT and RUN/STOP LEDs go dark.
2. Open the CPU door and eject the existing SMC (press to release).
3. Insert the new SMC, label side up, contacts down.
4. Restore power to the CPU.
5. Observe the LED sequence:
   • RUN/STOP LED → yellow flashing during transfer.
   • MAINT LED → flashing during transfer.
   • Transfer completes when RUN/STOP turns solid green (RUN) or solid yellow (STOP), depending on the configured startup mode of the project.
6. The CPU erases S7_JOB.S7S from the card on successful transfer. If S7_JOB.S7S is still present after the cycle, the transfer failed — remove the card and inspect LOGS\ for the S7_JOB.LOG text log.

KTP400: ProSave Backup at the Engineering Site

The KTP400 Basic line supports ProSave backup/restore over Ethernet (PN/IE). Because the customer does not have TIA Portal, the workflow is reversed: engineer creates a backup file on a representative (or simulated) panel, customer restores that backup onto the field panel.

Generate the ProSave backup file

1. On the engineering PC, set the IP address of the local Ethernet port to 192.168.0.1 / 255.255.255.0.
2. Connect the PC directly to the KTP400 Basic PN. Set the HMI's IP via the control panel or transfer it from the TIA project (Project tree → HMI → Online → Accessible nodes → Assign IP).
3. Launch ProSave V17 (Start → Siemens Automation → SIMATIC → ProSave).
4. Select device type: KTP400 Basic PN.
5. Connection: Ethernet (TCP/IP).
6. Target IP: address of the HMI.
7. Operation: Backup. Choose output path (e.g., C:\FieldUpdate\KTP400_v2_3.psb).
8. Tick "Include recipes" and "Include user administration" if these are present in the project. Leave "Include parameter sets" ticked unless intentionally clearing them.
9. Click "Start Backup". The status line shows transfer progress and writes the resulting .psb file when complete.

KTP400: Customer-Side Restore

1. Customer installs ProSave V17 (or the standalone HMI Tools V17 installer) on a Windows PC.
2. Customer connects the PC to the KTP400's PN port with the same 192.168.0.1 / 255.255.255.0 PC IP. If the panel's IP is unknown, hold a finger on the centre of the screen during power-up to open the service menu, then navigate to Settings → Network → IP Address.
3. Launch ProSave. Configure:
   • Device type: KTP400 Basic PN.
   • Connection: Ethernet (TCP/IP).
   • HMI IP: address of the panel.
   • Operation: Restore.
   • Backup file: path to .psb file.
4. Tick "Overwrite existing project" and "Reset to factory settings prior to restore" only if a full image replacement is intended. For incremental updates, leave "reset" unticked to preserve recipes.
5. Click "Start Restore". The HMI reboots automatically when complete.

USB restore limitation on the KTP400 Basic

The KTP400 Basic line does not support USB restore from the HMI front port. ProSave restore is performed only via Ethernet for the KTP400 Basic family. Comfort Panels (TP700/900/1200/1500 Comfort) support USB restore with firmware V14.0.0.0 or later — verify your panel family before selecting this method.

Combined Field Update Workflow

Verification Procedure

After the customer completes both updates, run this verification sequence before handing the machine back to operations.

1. PLC diagnostics: Open the CPU's web server at http://<CPU_IP> → Module Information → Diagnostics buffer. Confirm no "Memory card removed" or "Project inconsistent" entries since the power cycle.
2. Block consistency: Module Information → check the firmware version matches the released project and the serial number matches the hardware in the cabinet.
3. Retain check: Power down for 30 s and power back up. Verify all retentive tags (declared with Retain = true in the PLC tags table) hold their values.
4. HMI tag test: From the HMI, toggle each control that maps to a known PLC tag (e.g., a manual override bit) and confirm the PLC online monitor reflects the change within the configured update cycle (default 1 s for the S7-1200 HMI connection).
5. Recipe / alarm verification: Trigger each alarm class and confirm colour, acknowledgement, and logging behaviour match the project documentation.
6. Watchdog / safety: If the application includes F-CPU code, perform the F-CPU acceptance test per the safety plan — field updates do not exempt you from F-acceptance.

Troubleshooting Matrix

Data Block Compatibility Considerations

If the field update changes the structure of any DB (added/removed tags, changed UDTs), the S7-1200's "Download in RUN" path is unavailable for the offline-block delta when the project is delivered via transfer card. The CPU performs a full cold restart on the next STOP→RUN transition. Ensure that:

• All HMI tags reference DBs that exist after the update.
• Retain tags keep the same byte offsets if their declared order is changed.
• Any FieldRead / FieldWrite calls into an array (see the FieldRead and FieldWrite instructions reference) use an INDEX that the updated DB still has — extending arrays is safe; shrinking arrays breaks any persisted INDEX values stored in HMI recipes.

Preparing TIA Portal for Clean Field Updates

Before generating the first transfer card, ensure the engineering environment matches what the customer will run. The hardware catalog in TIA V17 must include the latest CPU and HMI support packages so that the compiled project does not reference a newer HW revision than the field hardware.

1. Open TIA Portal V17 → Options → Support Packages → Find support packages.
2. Install the latest CPU 1200 and KTP400 Basic PN support packages.
3. Refer to Siemens Support entry 54163658 for the full procedure.
4. Recompile the project to bind the latest SP, then re-generate the transfer card and the .psb backup.

Safety and Best Practices

• Stop the process before the update. Place the machine in a safe state (E-stop active, drives disabled, hazardous energy locked out) before the customer powers down the CPU.
• Never MRES a remote CPU — a memory reset wipes internal load memory and forces a complete re-transfer; if the card is damaged the site is bricked until a replacement card arrives.
• Label every SMC with project version, target CPU order number, and date. Mis-inserted cards are a common field failure.
• Hash the deliverables. Compute SHA-256 of SIMATIC.S7S and the .psb on the engineering PC and record the values on the shipment paperwork. Customer-side verification is not practical, but file sizes can be cross-checked by phone.
• Rollback plan. Keep the previous SMC in a labelled envelope at the cabinet. If the new image fails verification, the customer reverts by swapping back.
• Documentation. Provide the customer with a single PDF: bill of materials, expected LED behaviour, ProSave configuration screenshot, and engineering support contact.

Frequently Asked Questions