Resolving TIA Portal Upload Limitations for S7-1500 PLCs

Overview: The TIA Portal Upload Philosophy

Since its release in 2010, the Totally Integrated Automation (TIA) Portal has consolidated STEP 7, WinCC, Startdrive, and Safety Integrated into a single engineering environment. A direct consequence of this unification is a deliberate restriction of the "Upload to PG" function. Where legacy STEP 7 v5.5 would reconstruct a nearly complete project (including symbol tables, comments, and most source blocks), the TIA Portal upload device-to-PG is limited to the compiled runtime representation on the SIMATIC Memory Card. Source-level reconstruction, STL-to-graph conversion, and full HMI decompilation are not supported.

This reference documents exactly what is retrievable from a SIMATIC S7-1500 (6ES7 5xx-xxxxx), S7-1200 (6ES7 2xx-xxxxx), ET 200SP CPU, and the connected HMI panels, then provides engineering procedures to mitigate data loss when the original TIA Portal project archive is unavailable.

What "Upload to PG" Returns from an S7-1500/S7-1200

When a TIA Portal engineer selects Online > Upload to PG (software) from a connected CPU, the following items are retrieved from the online view:

Behavior is consistent across all current S7-1500 firmware versions (V1.8 through V3.1 as of mid-2024). Refer to the Siemens Industry Online Support portal for the current firmware release matrix.

Upload Limitations: HMI Runtime on Comfort and Unified Panels

Complaints about missing "decompile" functionality extend to the HMI side. WinCC Professional (TIA Portal) and the Comfort Panel family (TP, KP, MP series, e.g., 6AV2 124-1MC01-0AX0) follow the same philosophy:

• Backup of HMI runtime: Available via Online > HMI > Backup, which produces a .hmi_backup archive containing recipe data, user administration, alarms, and the compiled visualization. The original WinCC source project is not included.
• Reverse engineering (HMI upload to PG): Available in the WinCC TIA Portal Engineering Tool as a restricted function; the resulting project has lost the original screen layout hierarchy, dynamization source, and scripting. It is sufficient for parameter adjustment and recipe recovery, not for restoring the original engineering result.
• Script decompilation: VB scripts are uploaded as compiled p-code; JavaScript and C-scripts on Unified Panels are similarly opaque.

For older WinCC flexible 2008 SP5 and ProTool, the situation was identical: no source-level reconstruction from the runtime image. Refer to the STEP 7 TIA Portal product page for the current engineering toolset.

Comparison Table: Upload Capabilities Across PLC Platforms

Siemens' TIA Portal is not the only platform that locks source on the device, but it is the only mainstream one in this comparison that does not even retain a project comment or network title unless the project was downloaded with symbol information selected in the download dialog.

Why Siemens Locked Down the Upload Path

The design intent, as documented in the Siemens Ten Years after a Great Milestone retrospective, was to embed intellectual property protection at the platform level:

1. Know-how protection: Block-level password to hide proprietary algorithms.
2. Anti-tamper binding: The S7-1500 signature binds program blocks to the SIMATIC Memory Card serial number (V2.6+ firmware), preventing simple card cloning.
3. Security Integrated: Access protection (CPU password levels 1-4) integrated with the upload dialog.
4. TIA Portal Project versioning: The TIA Portal project is a single-file binary .apXX archive; the source-of-truth must live in the engineering repository (TiaPortalMultiuser server, Git, or SIMATIC Automation Tool archives).

While these measures protect OEMs, they shift the burden of long-term project retention to the end customer or system integrator. A machine builder that ships a TIA Portal project without a handover package effectively forces the customer to call the OEM for any future modification or CPU replacement.

STEP 7 v5.5 vs TIA Portal: A Migration Reality

Engineers familiar with STEP 7 v5.5 (SIMATIC Manager) often expect the following workflow from a SIMATIC S7-300/400 CPU, which is no longer available in the S7-1500 world:

1. Connect to PLC with no project available.
2. Select PLC > Upload Station to PG.
3. Receive a fully annotated S7 program with symbol table, comments, and a reconstructed hardware configuration.
4. Edit offline and re-download.

For the S7-1500 family (article numbers 6ES7511-1xxxxx through 6ES7518-4xxxxx) and S7-1200 (6ES7211/212/214/215/216), this workflow terminates at step 1. The "Upload device as new station" wizard in TIA Portal produces a project that contains the runtime code but no engineering source. To re-edit logic, the engineer must manually recreate tag names, comments, and network titles from the uploaded blocks.

HMI Upload Behavior: WinCC Professional and Comfort Panels

The HMI upload case is more nuanced. WinCC TIA Portal supports Online > HMI > Project > Upload to PG for the Comfort and Mobile panels, but the result is a partial project:

• Compiled screens, not source.
• Tag connections are preserved (DB address, PLC variable).
• Layout, dynamization, and script code is lost.
• Alarms and recipes: Yes, fully recoverable.

For panel replacement (e.g., a damaged TP900 Comfort, 6AV2 124-0MC01-0AX0), the original WinCC project must be available; the runtime image is not enough to recreate it. The HMI backup function produces a .hmi_backup archive for restoring an identical panel without source re-engineering.

Mitigation Strategy 1: SIMATIC Memory Card as Project Carrier

The recommended engineering practice is to treat the SIMATIC Memory Card (SMC) as a portable project carrier:

1. After project completion, perform Online > Card Reader / USB memory > Write to memory card for the CPU.
2. Store the SMC in a controlled, labeled location with the project archive.
3. For CPU replacement, the SMC is inserted into the new S7-1500 CPU (e.g., 6ES7516-3xxxxx). The CPU boots from the card and resumes the program state without a TIA Portal project.

SM cards for the S7-1500 are catalog numbers 6ES7954-8LCxx-0AA0 (4 MB) through 6ES7954-8LE02-0AA0 (32 MB). For S7-1200, the smaller 6ES7954-8LFxx-0AA0 series is used.

Mitigation Strategy 2: TIA Portal Project Archives and Versioning

To make projects recoverable without the original PC, mandate the following deliverables at project hand-over:

1. Compiled TIA Portal archive: Project > Archive > Archive project produces a .zapXX file containing source code, hardware configuration, HMI, and symbol information. The archive is required to re-open a project in the matching TIA Portal version (e.g., V18, V19).
2. Multi-User Server archive: TIA Portal Multi-User Engineering (TiaPortalMultiuser server) keeps server-side history with check-in / check-out semantics. Each check-in produces a recoverable revision.
3. PDF printout of cross-references: Provide a paper/PDF cross-reference export as a last-resort reference for tag names and data block structures.

Mitigation Strategy 3: SIMATIC Automation Tool and Project Source Integrity

For machine builders shipping many units, the SIMATIC Automation Tool (Siemens article number 6ES7853-2AE00) provides a CLI for project deployment and device backup. Combined with a TIA Portal project vault, the engineering tooling can validate that each shipped controller has a known-good project reference. This avoids the situation where an end customer finds themselves with a controller but no source.

Field Procedure: Recovering a Replacement Controller with No Project

When the TIA Portal project archive is genuinely lost, follow this procedure to minimize downtime:

1. Connect and inventory: Use TIA Portal Online > Accessible devices to identify the CPU, firmware version, and connected HMI. Note the article number and firmware (CPU > Properties > Diagnostics > Firmware).
2. Upload to PG: Select the CPU and use Upload to PG (software). The result is a runnable but unreadable project.
3. Trace and force tables: Use the online watch tables to map I/O and read DB contents. Document the live tag values before power-down.
4. Decompile DB structures: With the online DB view in TIA Portal, the Monitor/Modify view shows the actual data layout. Reconstruct tag names by cross-referencing against the I/O map and any available HMI backup.
5. Order a SIMATIC Memory Card clone: If the original SMC is available, clone it to a new SMC using the SIMATIC Automation Tool. The cloned card is the fastest path to a working controller.
6. Re-engineer offline: From the uploaded blocks and the documentation in steps 3-4, rebuild the project in TIA Portal. Expect to spend 40-200 hours depending on project size, with no network comments or block titles.
7. Re-deploy to replacement CPU: Insert the original SMC into the new S7-1500. If the SMC is unrecoverable, download the re-engineered project to a new SMC and new CPU.

Firmware-Specific Behavior on S7-1500

For S7-1200 CPUs (article family 6ES721x-1xxxxx), card binding is not enforced. The CPU-internal load memory can be flashed without an SMC, which slightly simplifies replacement.

Know-How Protect and S7-1500 Anti-Tamper

When a block is set to Know-How Protected in TIA Portal, the upload returns only the compiled code; the SCL/ST source is encrypted on the CPU. Combined with the S7-1500 CPU password levels (full access, read-only, HMI access, no access), the protection hierarchy is:

1. Local CPU password (front panel or TIA Portal)
2. User-specific access (UMAC) for plant operators
3. Block-level Know-How Protect (per FB/FC/DB)
4. Card binding signature (S7-1500 V2.6+)
5. Security Integrated password (F-CPU only)

This is the same mechanism that prevents the upload-then-edit workflow that legacy STEP 7 v5.5 made routine. Removing Know-How Protect is impossible without the original TIA Portal project and password.

Alternatives: TIA Portal Cloud Connector and Industrial Edge

For new installations, two Siemens approaches address the project-loss problem at the architecture level:

• TIA Portal Cloud Connector: Provides a project backup in a cloud project vault; the engineering team can access the source from any TIA Portal installation matching the version.
• SIMATIC Industrial Edge: The project, runtime, and data are stored in edge devices with versioned archives, allowing rolling back to a known-good state.

Both move the project-source problem from the local PC to a managed repository, which is the right answer for high-availability plants. For brownfield sites with controllers already deployed, the SMC + project archive strategy above is the only practical mitigation.

Engineering Recommendations

1. Mandate project hand-over: The TIA Portal project archive (zapXX) and the SIMATIC Memory Card are contractually binding deliverables. Do not accept a controller without them.
2. Use the Multi-User Server: For teams of three or more engineers, the TiaPortalMultiuser server provides check-in/check-out, version history, and parallel editing. This is the de-facto Siemens answer to the upload problem.
3. Use the Web Server of the S7-1500: The integrated web server (activated per CPU in TIA Portal > Properties > Web server) provides read-only access to diagnostic buffers, tag values, and trace data. This does not replace the project, but it reduces the impact of a project-loss event.
4. Subscribe to firmware updates: Keep the S7-1500 firmware current (V3.1.x as of 2024) to benefit from the latest security and trace features. Stale firmware is more vulnerable to data loss scenarios during a failed upgrade.

FAQ