Reading Back S7-1200 DB Values in TIA Portal: Complete Guide

Overview: The Read-Back Problem on S7-1200

Engineers migrating from SIMATIC STEP 7 (classic) to TIA Portal routinely lose access to one familiar function: the "Read back" / "Upload station to PG" workflow that pulled the live snapshot of every block, tag, and DB value from a connected PLC back into the STEP 7 project in a single operation. In TIA Portal the equivalent functionality is split across several commands, and the bulk "upload everything" button that existed in classic STEP 7 has no direct one-click analog for program blocks.

This article documents every available path for retrieving the current values stored in the data blocks of a SIMATIC S7-1200 CPU (firmware V4.x through V4.6) back into a TIA Portal V16, V17, V18, V19, or V20 project, with an emphasis on the operator-edited parameters that live in the non-optimized or retentive portion of the user DBs. Methods covered include the integrated Snapshot and Copy to actual values commands (one DB at a time), the program-block upload (whole station), and the scripted bulk workflow using the TIA Portal Openness API StationUploadProvider.

Prerequisites

Understanding Where the "Read Back" Function Went

Classic STEP 7 used two distinct functions that engineers commonly conflated:

1. Upload station to PG (PLC > Upload Station to PG) — pulls the entire program, including all blocks, HW Config, and the symbol table, from the CPU back into the project. This function still exists in TIA Portal under Online > Upload device to project / station, but it is restricted to program blocks (OB, FC, FB, DB) plus the system data; standard DBs are uploaded without their actual runtime values.
2. Monitor/Modify > Update and the table-driven Variable status — live read-only view of current values, used for diagnostics but never persisted to the offline project.

What classic STEP 7 lacked — and what TIA Portal added — is the ability to treat the actual values of a DB as the new start values of that DB's offline instance. This is the feature most often meant by "read back", and it is implemented as the two-step Snapshot → Copy to actual values workflow.

Method 1 - Snapshot and Copy to Actual Values (Single DB)

This is the fastest path for one or two DBs and requires no scripting. It is documented in the Siemens support article 109773506 — Applying values from the online program as start values.

Procedure

1. Open the project containing the S7-1200 station and go online: right-click the device → Go online (or press Ctrl+K after selecting the device).
2. In the project tree, expand Program blocks and double-click the target DB to open it.
3. Confirm the DB is opened with the online/offline comparison view active. The table footer shows Snapshot and Copy to actual values icons on the toolbar.
4. Click Snapshot (camera icon). TIA Portal reads the actual values from the connected CPU and displays them in a greyed "Snapshot" column adjacent to the offline actual values. The original start values are not modified.
5. Inspect the diff column. Out-of-sync cells are highlighted; you can decide which lines to accept.
6. Click Copy to actual values (the icon immediately to the right of Snapshot, tooltip "Copy snapshot to actual values"). The snapshot values overwrite the offline actual values of the DB. Start values remain untouched at this stage.
7. To promote the just-loaded actual values to the new initial / start values of the DB, right-click the DB in the project tree → Properties > Snapshot and startup → set Initial value snapshot from actual values, or use Edit > Initialize actual values on the DB table.
8. Compile the project (Ctrl+B on the DB or Ctrl+Shift+B for the whole station) so the new start values are written into the offline block container.
9. Save the project to persist the read-back values.

Verification

• Open the DB offline; the Start value column must now show the values that previously lived only in the online CPU.
• Go offline → disconnect → go online again and force a comparison: Online > Compare offline/online. The DB must report Identical.
• Reload the project from PG to confirm TIA Portal does not flag the DB as needing download.

Method 2 - Upload Device to Project (Bulk Block Upload)

For engineers who want the entire station — including all DBs — pulled back into a single offline container, TIA Portal provides Online > Upload device to project / station. This is the direct descendant of STEP 7's "Upload station to PG".

1. Establish an online connection to the CPU.
2. Select the device in the project tree, then choose Online > Upload device to project / station.
3. TIA Portal uploads program blocks, system blocks, and the device configuration. Each DB is created in the offline project with its current actual values reflected as the offline start values in one pass — no per-DB Snapshot needed.
4. If TIA Portal cannot determine a unique home (i.e., the offline project does not contain a compatible CPU), it creates a new station under the project node; you can later drag the uploaded device into your existing project.
5. Resolve any conflicts reported by the comparison editor — typically differing article numbers, missing optional packages, or password-protected blocks.

What is and is not uploaded

Method 3 - Bulk Read-Back with TIA Portal Openness (StationUploadProvider)

When the project contains dozens or hundreds of DBs — typical for skid packages, batching recipes, or fleet commissioning — manually clicking Snapshot on each DB is impractical. The TIA Portal Openness API exposes the same upload pipeline used by the integrated command, callable from a .NET host. Reference documentation: Uploading PLC device — TIA Portal Openness API V20.

High-Level Flow

1. Launch TIA Portal with the Openness interface enabled (Options > Openness > Permit Openness access).
2. From a C# / VB.NET host, reference the assemblies Siemens.Engineering, Siemens.Engineering.Hmi, and Siemens.Engineering.S7 shipped under C:\Program Files\Siemens\Automation\Portal V20\PublicAPI\V20.
3. Connect to the running TIA Portal instance via TiaPortal.GetInstance() or attach using the process-attached variant for headless operation.
4. Navigate to the target Device item (CPU 1214C) and resolve the StationUploadProvider through the service API:

using Siemens.Engineering;
using Siemens.Engineering.S7;
using Siemens.Engineering.S7.Online;

TiaPortal tia = TiaPortal.GetInstance();
Project project = tia.Projects.Open(new FileInfo(@"C:\Projects\LineA\LineA.ap18"));
DeviceItem cpuItem = project.Devices[0].DeviceItems
                              .First(d => d.Name.StartsWith("PLC_1"));

IStationUploadProvider upload =
    cpuItem.GetService<IStationUploadProvider>();

// Configure upload targets (offline container for the project)
StationUploadConfiguration cfg =
    new StationUploadConfiguration(project,
                                   cpuItem.Parent as Device);

// Perform the upload
upload.ConfigureAndUploadAsync(cfg, "BulkOperatorParameterReadback");

5. Openness writes the uploaded DBs into the project, mirroring the behavior of Online > Upload device to project.
6. Iterate cpuItem.Parent.DeviceItems and resolve the Software container to enumerate PlcBlock instances; for each DataBlock, read its Attributes["StartValue"] collection to extract the read-back parameters into CSV for QA review.

Selection Filtering

To upload only the operator-tuning DBs (for example a DB named OperatorParams and RecipeSetpoints) instead of the entire station, supply a filter via the StationUploadConfiguration before calling ConfigureAndUploadAsync:

var filter = new[] { "OperatorParams", "RecipeSetpoints" };
upload.Filter = new StationUploadFilter(filter);

Method 4 - Read-Back via HMI / SCADA Indirect Path

If the site is permanently online with a WinCC Comfort / Professional panel or a WinCC Unified station, the read-back can be triggered by the HMI's own Recipe view or by a script on the HMI that writes the live tags into a CSV file on a network share. While not strictly a TIA Portal function, it is the most field-proven path when the engineering PC is remote and only the HMI has direct PROFINET access to the CPU 1214C. Recipe export from a Comfort Panel V16+ is invoked through the Recipe view control property ExportData; the resulting CSV can then be imported back into the offline DB via the TIA Portal import wizard for data blocks.

Field-Proven Workflow for Operator-Parameter Round-Trip

The following checklist is a battle-tested routine used during commissioning to capture the as-left operator parameters from a fleet of S7-1200 CPUs:

1. Pre-stage an offline TIA Portal project whose station matches every CPU's article number and firmware major version.
2. Connect PG to the CPU's PROFINET interface; assign the PG a fixed IP in the same subnet (for example CPU 192.168.0.10, PG 192.168.0.99).
3. Use Online > Accessible nodes to confirm TIA Portal sees the CPU without error.
4. Run Online > Upload device to project / station into a dedicated sub-folder of the project (e.g. _Readback_2024_06_12). Do not overwrite the master project.
5. Compare the read-back DBs against the engineering reference DBs using Tools > Compare; export a comparison report as PDF for the QA package.
6. Tag every DB whose actual values are intentionally different from the engineering reference; do not silently promote them to start values.
7. If the master project is the source of truth for the next deployment, leave the read-back DBs in the auxiliary folder and reference them as documentation only. If the read-back values must become the new baseline, copy them back into the master DBs using Snapshot / Copy to actual values and recompile.
8. Archive the read-back project under version control with the timestamp embedded in the project name.

Troubleshooting Matrix

Specifications and Limits

Verification: Confirming the Read-Back Is Complete

1. Open every touched DB offline and visually verify the Start value column matches the expected operator-entered values captured on the floor (recipe numbers, Kp / Tn for the PID blocks, motor run-time counters, etc.).
2. Compile the project (Ctrl+B) — compilation must succeed without warnings about inconsistent start values.
3. Run Online > Compare offline/online on the device. The result must read Identical for every program block, including the DBs that were just read back.
4. Cross-check critical parameters by triggering an HMI screen that displays the tags and comparing them to the engineering values now stored in the offline DB.
5. Perform a controlled PG-stop → PG-start on the CPU to confirm the freshly read-back start values are written into the work memory at the next cold start. This is the strongest verification that the read-back actually persisted into the CPU's boot image.

FAQ