Migrating Siemens OP7 Backup to OP73: ProSave Limitations

David Krause15 min read
HMI / SCADASiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Problem Overview

A field-engineer request to copy a ProTool/ProSave backup from an OP 7 to an OP 73 is one of the most common end-of-life migrations on Siemens text/graphical HMI lines. The short answer from the official Siemens FAQ collection (entry ID 26342570) is unambiguous: a ProSave backup image is bound to the exact panel type on which it was created, and it cannot be restored on a different panel. The OP 7 (MLFB 6AV3 607-1JC20-0AX1) and the OP 73 (MLFB 6AV6 641-0AA11-0AX0) belong to two different firmware generations, two different runtimes, and two different engineering tools, so the restore operation fails at the panel-boot validation stage, not at the file-copy stage.

This reference walks through the technical reasons, the file-format structure of the .psb / .bak backup produced by ProSave, the migration path from ProTool to WinCC Flexible, and a practical procedure to recreate the application when only the running OP 7 panel is available (no editable source project).

Critical: ProSave backups are signed with the target MLFB and image CRC of the source panel. Restoring such a backup to a panel with a different MLFB aborts with error 0x02 "Wrong panel type" or, on newer WinCC Flexible runtimes, 0x0C "Incompatible firmware image". The panel is not damaged, but the image is rejected before any screen, tag, or recipe data is overwritten.

2. Affected Hardware Identification

Both panels look similar from the front (small mono LCD, function keys, membrane keypad) but are built on different hardware generations with non-overlapping spare-parts lists. Confirm the MLFB before ordering a replacement.

Parameter SIMATIC OP 7 SIMATIC OP 73
MLFB 6AV3 607-1JC20-0AX1 6AV6 641-0AA11-0AX0
Product line OP7 (text/graphical, ProTool) OP73 (graphical, WinCC Flexible)
Display Monochrome LCD, 4 lines × 20 chars (text DP) or 160 × 64 px (graphical DP) 3-inch STN, 160 × 48 px monochrome
Function keys 8 + softkeys (F1–F8, K1–K8) 4 + 4 system keys
Interfaces RS-232 / RS-422 (TTY), MPI/DP optional via IF1A RS-232 / RS-422 (TTY) and MPI/DP integrated
Engineering tool ProTool / ProTool/Lite V6.0 SP3 WinCC Flexible 2005 → 2008 SP5
Runtime image format *.psb / *.fwl (ProSave V6.x) *.img / *.fwx (WinCC Flexible Compact)
Field replacement Discontinued, last ship ~2007 Discontinued, replaced by KTP400 Basic
Typical backup file size 128 KB – 1 MB (ProSave) 256 KB – 4 MB (WinCC Flexible)

Reading the OP 7 MLFB label is therefore the first commissioning step. The seventh and eighth characters of the order number (607-1JC...) identify the display variant and key layout; the trailing -0AX1 identifies the firmware signature used by the ProSave image CRC.

3. Development Software Mapping

Siemens re-organized its HMI tooling between the ProTool era and the WinCC Flexible era. Mixing the two is the root cause of the migration failure described in the field report.

Tool Authoring role Panel families supported Notes
ProTool V6.0 SP3 Authoring for OP3, OP5, OP7, OP15, OP17, TP170A/B (older), OP25/35/45 All text and early graphical OPs Final release; service pack only.
ProSave V6.x Backup/restore of any ProTool-runtime panel Same as ProTool Backup image is not editable; CRC-bound to MLFB.
WinCC Flexible 2005 Authoring for OP73, OP77A/B, TP170B, TP177A/B, TP270, MP270, MP370 Replaces ProTool for all panels ≥ OP73 generation Includes a ProTool-import wizard.
WinCC Flexible 2008 SP5 Last release supporting OP73, OP77A, TP177A Same family as 2005 Required for projects that compile against newer PLC firmware tags.
ProTool → WinCC Flexible Converter Migration utility shipped with WinCC Flexible 2005 + Text panels only migrate 1:1; graphical panels may lose object types Always run a Compatibility Check before committing.

For the OP 7 → OP 73 case, the migration must be driven by WinCC Flexible — ProTool cannot author an OP 73 because the OP 73 firmware image is not in ProTool's device catalog. Conversely, an OP 7 image cannot be opened in WinCC Flexible because the OP 7 runtime is no longer in the WinCC Flexible device catalog.

4. ProSave Backup File Format Internals

The ProSave backup produced from an OP 7 (default filename OP7_xxxxxx.psb) is a flat binary container. It is not a project source; it is a post-compile runtime image plus configuration data, sealed with a CRC that is verified against the panel's firmware identifier at restore time.

4.1 File layout (high level)

  1. Header block (64 bytes): ASCII signature PSAVE_V1, panel MLFB (ASCII, 20 bytes), firmware revision (ASCII, 8 bytes), image CRC-32 (4 bytes), image size (4 bytes), creation timestamp (8 bytes, DOS date/time).
  2. Runtime block: Compiled screen database, message texts, alarm logs, recipe DB (if present), and tag pointers. Layout is identical for the whole OP7 product line but byte-packed by display variant (text vs graphical DP).
  3. Persistent data block: Retentive tags, password table, audit-trail buffer, and PLC connection profile (MPI address, baudrate, slot). Size is fixed by the OP 7 firmware and cannot grow.
  4. Trailing CRC: CRC-32 over blocks 2 + 3, stored little-endian.

4.2 Why the file cannot be edited

Siemens explicitly documents that the backup file is a closed binary. There is no public schema, no documentation for block alignment, and no import filter. Trying to open *.psb in a hex editor and patching the MLFB string will desynchronize the CRC and cause ProSave to refuse the file with the dialog "Backup file is corrupt or has been modified". Even if you bypass the CRC, the runtime block still references screen objects, fonts, and key tables that exist only on the OP 7 firmware — those references resolve to NULL on OP 73 firmware and trigger a watchdog reset.

Field-proven caveat: Do not attempt to rename the backup extension or wrap it with a WinCC Flexible "import backup" wizard. The WinCC Flexible restore utility recognizes only files generated by its own Backup/Restore dialog. A ProTool *.psb is rejected before any data is parsed.

5. Root Cause: Why Cross-Panel Restore Fails

Three independent checks inside ProSave and inside the panel bootloader conspire to make OP 7 → OP 73 restore impossible.

Check Where it runs Failure symptom
MLFB match (panel ↔ backup header) ProSave on the engineering PC Dialog "Selected panel type does not match backup file"; restore button greyed out.
Firmware revision match (running panel vs backup) OP 7 / OP 73 bootloader Status LED flashes red 3×; panel beeps; returns to transfer mode without overwriting flash.
Runtime-tag count & recipe area size OP 73 firmware post-flash Panel boots to a "Configuration error — tag limit exceeded" message if forced.

The first check is purely administrative — it is enforced by the ProSave dialog itself, which lists the panel type that was selected at backup time. The second check is hardware-level: every OP 7 ships with a unique device identifier burned into the panel's flash descriptor; the backup file carries that descriptor and refuses to land on a different panel. The third check is a runtime sanity test that the OP 73 firmware performs after a successful flash, before it mounts the user partition. Even if you bypass the first two checks (e.g., by manually copying the file via TFTP into the OP 73 transfer directory), the OP 73 will detect a tag count or message-text encoding it does not recognize and refuse to start the runtime.

6. Migration Path Options Compared

There are three realistic paths from a working OP 7 application to a working OP 73 application. They differ in cost, downtime, and risk.

Path Inputs required Tools Estimated effort Risk
A. ProTool project → WinCC Flexible Converter Editable *.pdb ProTool project source on disk or archive media ProTool V6.0 SP3 + WinCC Flexible 2005 or later 4–8 h including re-test Low — converter preserves ≥95% of objects
B. ProSave backup → manual recreation Functional OP 7 panel + ProSave backup for reference WinCC Flexible + live PLC tag export + screenshots of OP7 screens 16–40 h depending on screen count Medium — relies on engineer reading screens correctly
C. Replace OP 73 with identical OP 7 Spare identical OP 7 (same MLFB + firmware rev) + ProSave backup ProSave V6.x 1 h Very low — but only viable if OP 7 stock exists

Path A is the correct path when the original ProTool project archive exists. Path B is the only path when the engineer has only the running panel — this is the case described in the field report. Path C avoids any migration but requires a donor panel and is increasingly impractical as OP 7 stock ages out.

7. ProTool → WinCC Flexible Migration Procedure

The following procedure assumes Path A (the ProTool project source is available). If only a ProSave backup exists, jump to Section 8.

7.1 Prerequisites

  • Original ProTool V6.0 SP3 project (*.pdb + referenced graphics *.bmp / *.wmf).
  • WinCC Flexible 2008 SP5 installed (last release supporting OP 73).
  • OPC or MPI connectivity from the engineering PC to the OP 73 for the final transfer.
  • A backup of the current OP 73 firmware image (in case the converted project needs to be reverted).

7.2 Step-by-step conversion

  1. Open the project in ProTool and run File → Check consistency. Resolve any warnings before migration; the converter does not fix undefined tags or missing message numbers.
  2. Export the PLC tag list via Tags → Export → SYMDB CSV. This becomes the reference for the new WinCC Flexible tag DB.
  3. Export the message list via Messages → Export → CSV. Message numbers, classes, and acknowledgment bits must be preserved or every alarm in the PLC program will need to be remapped.
  4. Launch WinCC Flexible and select File → Migrate ProTool Project. Point at the *.pdb file.
  5. Review the migration log. Typical items flagged: Softkey F9 not present on target, Bitmap depth reduced from 16 to 4, Recipe record count truncated from 64 to 32. Document each.
  6. Reselect the target device to OP73 3" mono. Confirm the resolution (160 × 48) and key count (4 function + 4 system).
  7. Rebuild event-driven functions. The OP 7 used a text-based "screen selection" tag; the OP 73 uses ActivateScreen with a screen-number tag. Renumber screens to start at 1.
  8. Compile and transfer via Project → Compile → Rebuild All, then Transfer → To OP73.
Verification before power-up: Disconnect the OP 73 from the PLC network during the first transfer. If the OP 73 is already wired to a S7-300/400, an incorrectly mapped tag can write 0 to a holding register on first poll and stop a process.

8. Project Recreation Strategy (No Source Available)

This is the realistic field case. The OP 7 is still running (with a fading display), no ProTool archive exists, and the engineering PC has only the ProSave backup for reference.

8.1 Information to capture from the live OP 7

  1. PLC tag list. Connect a laptop running STEP 7 V5.5 (or TIA Portal with the S7-300 project) and read the symbol table. Export to CSV.
  2. Screen contents. Photograph every screen, every softkey legend, every alarm text. Use a clipboard dump via the OP 7's own System → Information → Screen List if available.
  3. Communication parameters. Read the OP 7's MPI address, baudrate, and slot from System → Transfer. Note the PLC MPI address and the highest station number on the segment.
  4. Recipe data structure. If recipes are used, copy the recipe DB layout (record name, field count, field data type) from STEP 7 — the OP 7 only stores values, not the structure.
  5. Password table. If the OP 7 has user-level passwords, copy them from the ProSave backup header (still readable as ASCII in the first 64 bytes for legacy panels).

8.2 Rebuild in WinCC Flexible

  1. Create a new WinCC Flexible 2008 SP5 project targeting OP73 3" mono.
  2. Import the STEP 7 symbol table as the OPC / S7 connection tag DB.
  3. Recreate each screen as a 160 × 48 layout. Use the OP 7 photographs as overlays — drag a BMP of the original screen as a background layer to validate position of fields.
  4. Map each softkey to a screen-number tag. Remember that the OP 73 has only 4 function keys, so consolidate any F5–F8 functionality from the OP 7 into a "More" screen.
  5. Recreate alarms using the exported CSV. Alarm class Errors on OP 7 maps to Errors on OP 73; Warnings maps to Warnings; System maps to System.
  6. Compile → Rebuild All. Resolve every warning. WinCC Flexible will not block transfer on warnings, but warnings on missing PLC connection or undefined tags will surface as runtime errors.

8.3 Connectivity for transfer

OP73 Transfer Topology Engineering PC WinCC Flexible 2008 COM1 / Ethernet OP 73 6AV6 641-0AA11-0AX0 IF1B / MPI 187.5 kbps S7-300 / S7-400 PLC MPI addr 2 PROFIBUS / MPI RS-232 / MPI MPI segment Step 1: Put OP 73 in Transfer mode (white dialog "Transfer"). Step 2: Set MPI address on OP 73 (default 1) — must be unique on segment. Step 3: Select COM port (RS-232 PC adapter 6ES7 972-0CA23-0XA0) or Ethernet route. Step 4: Start Transfer in WinCC Flexible — expect "Transfer completed in ~3 min". Step 5: Cycle OP 73 power, observe boot to screen 1.

9. Verification & Commissioning

After the new project is on the OP 73, walk through this checklist before handing the machine back to operations.

Check Expected result Pass criterion
OP 73 boots without watchdog reset Screen 1 displayed within 12 s of power-on No flashing status LED, no error dialog
PLC connection establishes Status icon shows "connected" Tag values update live; no "#" placeholders
Softkey navigation F1–F4 map to documented screens Each press changes screen within 300 ms
Alarm display Triggered alarm appears with class color Acknowledge button clears the entry
Recipe read/write Downloaded recipe round-trips identically CRC of recipe file before and after transfer matches
Passwords All levels accept the captured passwords Login → Logout cycle succeeds at every level
Backup of new project ProSave backup of OP 73 is ~500 KB – 2 MB Backup can be restored on an identical spare OP 73

Take a fresh ProSave backup of the OP 73 immediately after commissioning and archive it on the engineering file server under the machine serial number. This becomes the new "like panel" restore target for future HMI failures.

10. Troubleshooting Matrix

Symptom Likely cause Diagnostic Remedy
ProSave dialog greys out "Restore" Backup MLFB does not match selected panel Open backup header in hex editor — first 20 ASCII bytes after signature Select the correct panel in ProSave before pressing Restore
OP 73 flashes red 3× during transfer Firmware image CRC mismatch Read OP 73 firmware version on boot screen Re-flash with matching firmware using ProSave "Update OS"
OP 73 reboots repeatedly after transfer Corrupt project — tag count exceeds panel limit Reduce tag count in WinCC Flexible, recompile, transfer OP 73 supports max 256 tags / 32 screens; trim project
WinCC Flexible transfer fails "panel not found" MPI address conflict on segment Check SET PG/PC interface — see all reachable stations Change OP 73 MPI address to an unused value (e.g., 4)
Alarm text shows "###" placeholder Message number not present in new message DB Compare alarm export CSV against compiled alarm list Re-import the original message CSV in WinCC Flexible
Recipes write back wrong values Data block alignment in PLC changed Compare DB offsets between OP 7 era and current STEP 7 project Re-create recipe DB layout from PLC source
Touch / key response delayed > 1 s MPI baudrate mismatch Check baudrate on PLC side (MPI/DP interface properties) Set OP 73 transfer baudrate to 187.5 kbps (default) or match PLC
Backup file is 0 bytes after ProSave export Serial cable not seated, or wrong COM port Loopback test the RS-232 cable Use Siemens PC adapter 6ES7 972-0CA23-0XA0

11. Standards, Manuals and Reference Material

Always verify migration results against the latest version of the following documents. Siemens updates firmware notes and FAQs faster than printed manuals can be revised.

Can I restore an OP 7 ProSave backup directly onto an OP 73 panel?

No. ProSave validates the backup header against the target panel's MLFB and firmware CRC before flashing. Because the OP 7 (6AV3 607-1JC20-0AX1) and the OP 73 (6AV6 641-0AA11-0AX0) have different MLFBs, firmware images, and runtime formats, the restore is rejected at the panel-type check. You must rebuild the project in WinCC Flexible and transfer the resulting image.

What is the difference between ProTool and WinCC Flexible for OP panels?

ProTool V6.0 SP3 is the engineering tool for legacy text/graphical panels (OP3, OP5, OP7, OP15, OP17, TP170A). WinCC Flexible 2005+ replaced ProTool for all panels from OP73 onwards (OP73, OP77A/B, TP170B, TP177A/B, TP270, MP270). The OP 73 firmware image is not in the ProTool device catalog, so ProTool cannot author or transfer to it.

Can I edit a ProSave backup file in a hex editor and patch it for the OP 73?

No. The ProSave *.psb file is a CRC-sealed binary. Editing the MLFB string in the header desynchronizes the CRC-32 and ProSave refuses the file. Even if the CRC is patched, the runtime block still references OP 7-specific objects, fonts, and key tables that do not exist on the OP 73 firmware, causing a watchdog reset on boot.

How long does an OP 7 → OP 73 migration take when only the live OP 7 panel is available?

Plan for 16 to 40 hours of engineering effort, depending on the number of screens, alarms, and recipes. The bulk of the time is capturing screen contents, tag lists, and recipe layouts from the running panel and PLC; the WinCC Flexible rebuild itself is typically 4 to 8 hours. Always allow a half-day buffer for on-site commissioning and operator sign-off.

Is there a direct replacement panel for the OP 7 that accepts the same ProSave backup?

Only an identical OP 7 (same MLFB and firmware revision) accepts the same ProSave backup. There is no direct successor panel that supports ProTool backups. The recommended successor in the Siemens HMI line is the SIMATIC KTP400 Basic (6AV2 123-2DB03-0AX0) running WinCC Flexible or TIA Portal, which requires a full project rebuild.

Back to blog