Resolving KTP900 Basic Panel Recipe Backup Over Network

1. Problem Overview

Operators using a SIMATIC KTP900 Basic color PN panel (typical catalog number 6AV2 123-2JB03-0AX0, 9" widescreen, 800 x 480, 16.2 M colors) report that the only supported medium for recipe data record backup is the front USB 2.0 host port with a removable FAT32 flash drive. The desired workflow is to back up recipes to a Windows file share on the plant LAN without an operator touching the panel or the USB stick. Siemens engineering confirmation is that the recipe network share function is reserved for the Comfort Panel family (TP/KTP Comfort 4" to 22") and is not available on Basic Panels running WinCC Basic / TIA Portal Basic. This article documents why the SMB / UNC path configuration described in Siemens support entry 13336639 does not take effect on a Basic Panel and the four field-proven workarounds that are.

2. KTP900 Basic Hardware and Software Boundaries

The KTP900 Basic uses the WinCC Basic / Basic Panels runtime, which is a deliberately scaled-down image of WinCC Comfort. The constraints that matter for recipe handling are:

These boundaries are defined in the device description of TIA Portal and in the WinCC Basic / Comfort manuals. The TIA V20 Recipe view basics documentation covers the recipe object that is common to both families, but the storage backend differs.

3. Why Recipes Disappeared After Two Years

The most common root cause of a "recipes were there yesterday, gone today" condition on a Basic Panel is not a hidden hotkey. It is one of the following mechanical or firmware triggers:

1. Recipe data record count limit reached. The internal flash holds a finite number of data records per recipe element (default 100, max 1,000). When the limit is hit, the oldest record is overwritten silently if "Ring buffer" is enabled, or new writes are rejected silently. The operator sees an empty list.
2. Panel restore or project download. A ProSave / TIA download operation, a power loss during a write, or a project version mismatch wipes the recipe DB. Recipes are stored under /recipes in the internal flash and are not retained across a complete OS image update.
3. Bad USB stick with stale index. The panel keeps a DataRecords.rdf index. If the operator deletes files on the stick from Windows while the panel is offline, the index points to entries that no longer exist, and the recipe view shows blank rows that can be misinterpreted as "cleared".
4. Date/time rollover on data record timestamp. Recipe data records carry the PLC clock stamp. If the panel loses the time (battery, NTP), all data records can show timestamp 01.01.2000 and sort to the bottom, again appearing as "lost".
5. Firmware bug in < V14 SP1. Older Basic Panel images had a known data record leak on uncontrolled power-down. The fix is firmware update via ProSave (S7-USB or Ethernet, project-level service).

4. Why the Siemens Support Article 13336639 Path Fails on a Basic Panel

Entry 13336639 describes the configuration steps for the recipe network share. The TIA Portal navigation it documents is correct, but on a KTP900 Basic the property page "Network → Storage location for recipes" is grayed out because the device type does not implement the SMB client. Setting the value in the offline project is accepted, the compile is clean, and the runtime silently ignores it. This is the reason "it does not work".

Confirmation in the runtime can be done with the panel's diagnostic page (Control Panel → OP → Information → System): the runtime version string is WinCC Basic V..., not WinCC Comfort V.... Comfort strings begin with Comfort or Advanced. A project that has been built with a Comfort target device and then downloaded to a Basic Panel is an error condition that also produces the same symptom.

5. Workaround 1 — Network USB Server (Most Common, Lowest Cost)

A network USB server (also called USB-over-IP, virtual USB hub) presents a remote USB port as a local device to a Windows host, or — with the panel in focus — shares a USB stick out of the panel's port onto the LAN. Two topologies are used in the field:

Topology A is the only topology that works on a Basic Panel. Commissioning steps:

1. Mount a transparent USB-over-IP device in the cabinet. Configure its IP statically (example: 192.168.10.50) and reserve the IP in the DHCP scope.
2. Insert the operator's USB stick into the panel's USB port, then attach a USB extension pigtail from the panel port to the network USB server's "device" port. The panel enumerates the stick as /media/usb.
3. On the engineering PC install the server's virtual USB driver. The stick now appears as a Windows drive letter.
4. Use the same workflow as before (ProSave Backup → Recipes) but with the network-mounted drive letter as target. Operators never touch the stick again; the engineering PC pulls the backup on a schedule.

6. Workaround 2 — OPC UA Recipe Mirroring to a Server PLC

Because the Basic Panel itself cannot host an OPC UA server, the mirror must be hosted on a SIMATIC S7-1200 / S7-1500 PLC acting as an OPC UA server. The architecture is:

1. Create a recipe DB on the PLC (e.g. DB_RecipeBuffer) with the same elements as the panel recipe.
2. On a panel change-value event (recipe view, button "Save") write the record into the PLC DB using a 100-byte area pointer or 16 x 1,024-byte raw-data area pointer to the PLC.
3. On the PLC side, enable the OPC UA server and expose DB_RecipeBuffer as a structured node.
4. A Windows service (C# / Python opcua client) subscribes to the node and writes any change to a Windows file share, e.g. \\PLANT-FS01\Recipes\LineA\.

This gives the engineering team a true network path without changing the panel, but it requires the PLC to be the master of record for the recipes. It is the recommended architecture for new lines that already have an S7-1500.

7. Workaround 3 — Scheduled ProSave Pull from a Windows Service

If the panel is on a flat IP network and TIA Portal is installed on the engineering PC, the operator's recipe can be mirrored nightly using the ProSave command-line interface. ProSave is the Siemens service tool that comes with every TIA Portal installation and supports Ethernet backup / restore.

1. Identify the panel's IP address (Control Panel → Network & Dial-up Connections → PN-IE). Example: 192.168.10.20.
2. On the panel, enable Transfer in Control Panel and set the PG/PC port.
3. On the engineering PC, schedule a task that calls:

   "C:\Program Files\Siemens\Automation\Portal V20\TIA Portal V20\Bin\s7wb39xa.exe" \
     -backup \
     -recipe \
     -ip 192.168.10.20 \
     -path "\\PLANT-FS01\Recipes\LineA\KTP900\"

4. Run a daily task at 23:00. The PLC and the panel are online during the operation, and the file lands on the Windows share without operator action.

8. Workaround 4 — Migrate the Panel to a Comfort Variant

If the line is being rebuilt and the cost of a panel swap is acceptable, the only configuration that natively delivers the operator's original requirement (recipes pushed automatically to a Windows share) is the KTP900 Comfort (or TP900 Comfort for the keyed version). The configuration that works on Comfort is the one documented in support entry 13336639.

1. In the device configuration of the Comfort panel, open Recipes → Storage location and select Network path.
2. Enter the SMB UNC path in the form \\<server>\<share>\<optional subdir> and a Windows user that has read / write / change rights on that share. Example: \\PLANT-FS01\Recipes\LineA\ with user recipe-svc.
3. Under Properties → Network & Ethernet → SMB, set the workgroup, the user name, and the password. The runtime caches the credential and re-uses it on each save.
4. Compile and download. From this point on, every Save data record in the recipe view writes the .rdf file to the share and the operator no longer needs the USB stick.

The wiring of the Comfort panel is drop-in compatible with the KTP900 Basic (24 V DC, 9" cut-out, 24-pin ribbon to PLC), so the migration is a panel-swap plus a project re-target in TIA Portal.

9. Recipe File Locations and Format

Knowing where the recipe binary lives on the panel and on the USB stick is essential for diagnosing the loss and for scripting any of the workarounds above. Paths are case-sensitive on the WinCE / Win Embedded Standard image used by the panel:

The .rdf file is a binary record with a fixed header (recipe name length, record name length, timestamp, element count) followed by the data record elements. The format is the same on Basic and Comfort, which is why files copied manually are still readable in TIA Portal's recipe editor.

10. TIA Portal V20 — Recipe View Configuration

The recipe view that the operator uses to save, load, and delete data records is a single TIA object. Its configuration is identical on Basic and Comfort, but the storage backend (the property the workaround depends on) is device-specific. TIA V20 documents the configuration under Recipe view basics. The key configuration items are:

• Recipe name — bound to a recipe data block on the connected PLC; case-sensitive.
• Storage location — for Basic: Local on panel and USB only. For Comfort: Local on panel, USB, Network path.
• Data record name scheme — fixed or free text (operator-editable).
• Synchronization with PLC — on every load, the recipe view re-issues the WRITE/READ function block calls, ensuring the PLC is the source of truth.
• Bar at the bottom — configurable buttons: New, Save, Save As, Delete, Synchronize, Export, Import. On Comfort the Export and Import buttons can target the network share; on Basic they are local-only.

11. Verification and Commissioning Checklist

Whichever workaround is selected, run the following checks before signing off the line:

1. Create a recipe in the panel, save a data record, and confirm the file appears at the configured target (network share or PC folder) with a current timestamp.
2. Power-cycle the panel and reload the recipe view. The saved data record must still be present.
3. Save three data records, then delete the middle one, then save a fourth. Confirm the index DataRecords.rdf on the target contains four records and the order matches the operator's intent.
4. Trigger a transfer during a running recipe (PLC in RUN, recipe view open). Confirm that ProSave / network-server pull does not interrupt the operator workflow.
5. Validate firewall: TCP/102 open for ProSave, TCP/445 open for SMB on Comfort, ICMP reachable for the operator's PC ping check.
6. For the network USB server path: pull and re-insert the stick three times, confirm the panel re-enumerates the storage and the Windows driver reattaches within 5 s.

12. Field-Proven Caveats

• Do not run two recipe write sources at once (operator button + scheduled ProSave). Concurrent writes corrupt the .rdf index and can present as "all recipes cleared".
• The Basic Panel's RTC battery (BR2032 on the rear) keeps the timestamp valid for roughly 3 years. After that the recipe view shows 01.01.2000 across all data records. Replace the battery at the 30-month mark on a maintenance plan.
• If a Comfort panel is used, the SMB credential is stored in plain text in the project. Restrict the Windows user to the share only; never grant domain admin.
• ProSave scheduled pull on TCP/102 requires that the panel is in Transfer mode at the time of the call. If the operator has not enabled Transfer, schedule the task with a 30-minute pre-transfer mode activation script (ProSave flag -activate_transfer).

13. FAQ