Siemens Comfort Panel HMI Back-Transfer: Limits & Workarounds

Overview: The Siemens HMI Back-Transfer Gap

Engineers maintaining Siemens SIMATIC Comfort Panels routinely need to recover, modify, or redeploy an HMI project after the source files have been lost. On competitor platforms this is a routine upload operation; on the Siemens SIMATIC WinCC (TIA Portal) platform, editable project back-transfer is not supported from runtime-generated files. This article documents exactly what can and cannot be recovered, the technical reasons behind the restriction, and the workarounds that field engineers use in production environments to handle a damaged or replaced panel.

Why Editable Project Back-Transfer Is Not Available

When a TIA Portal project is compiled and downloaded to a Comfort Panel, the engineering system produces a runtime image consisting of compiled screens, scripts, alarms, tags, and binary data, plus a checksum and panel-specific licensing metadata. The original TIA Portal source archive is not stored on the panel's flash file system. The panel retains:

• Compiled runtime binaries in /active, /backup, and historical folders
• Internal data records for recipes, logs, and alarms
• Panel-specific certificates, license keys, and PROFINET device name/IP

This design choice is intentional. Shipping the uncompiled source onto the device would (a) expose the engineering IP, (b) allow unauthorized code modification in the field, and (c) introduce a vector for arbitrary script execution outside of the signed TIA Portal build pipeline. Siemens has confirmed in the WinCC (TIA Portal) documentation that reverse engineering of the runtime image back into an editable TIA Portal project is not part of the supported workflow. The legacy WinCC Flexible back-transfer option (transfers the editable *.hmi project back to engineering) is no longer available for TIA Portal projects.

Comfort Panel Hardware Status: TIA Portal V17 Freeze

The SIMATIC HMI Comfort Panel line - including TP700 Comfort (6AV2 124-1MC01-0AX0), TP1200 Comfort (6AV2 124-1QC10-0AX0), TP1500 Comfort (6AV2 124-1UC02-0AX0), TP1900 Comfort (6AV2 124-1XC02-0AX0), TP2200 Comfort (6AV2 124-1DC01-0AX0), KP400 Comfort, KP700 Comfort, KP900 Comfort, KP1200 Comfort, and KP1500 Comfort - is no longer being extended in TIA Portal. Per the public product lifecycle notice, the final feature release for the Comfort Panel image is TIA Portal V17, after which only service packs and security patches are issued.

References: Siemens support entry 109746406 - TIA Portal V17 release notes and the SIMATIC HMI Comfort Panels product page.

New development is concentrated on the SIMATIC HMI Unified Comfort Panels (MTP700 Unified, MTP1000 Unified, MTP1200 Unified, MTP1500 Unified, MTP1900 Unified, MTP2200 Unified) running WinCC Unified. The Unified platform inherits the same back-transfer policy: editable project recovery from the panel is not supported. Engineers planning new installations should treat the engineering archive (*.zap for TIA Portal V14+, *.ap for V13) as the single source of truth and plan for archival accordingly.

ProSave Backup and Restore: What You Can and Cannot Do

ProSave is the official Siemens service tool for backup, restore, and firmware update of SIMATIC Panels. It is bundled with TIA Portal or available as a standalone installation from the Siemens Industry Online Support portal. Reference: Siemens support entry 21738818 - ProSave manual.

Capabilities

• Full backup of runtime image including recipes, logs, user administration, and parameters
• Restore of the same image to a panel of the same article number (MLFB / reference)
• Restore of recipe data only to a different panel of the same family
• Firmware update of the panel
• Transfer of HMI device certificate (for OPC UA, HTTPS)

Limitations

• Restoring to a different MLFB is not supported - the runtime image is keyed to the panel's article number and firmware version
• The restored image is the compiled runtime, not an editable TIA Portal project
• PLC connection parameters (IP address, rack/slot, PROFINET name) are baked into the runtime and must be reconfigured via the panel's Service Center if the target PLC has a different address
• License keys tied to the original panel's hardware are not transferable to a different panel

Field Procedure: Replacing a Damaged Comfort Panel With a Different PLC Address

The scenario from the source material - a damaged Comfort Panel at a customer site with a working but differently-addressed PLC - is the most common recovery case. The correct procedure is:

1. Identify the article number (MLFB) of the damaged panel from the nameplate or TIA Portal device configuration. Record the firmware version from Control Panel → OP Information.
2. Source a replacement panel of the same MLFB. If only a newer revision exists (for example original 6AV2 124-1MC01-0AX0 replaced by 6AV2 124-1MC01-0AX1), verify the firmware compatibility matrix in the ProSave compatibility list before attempting restore.
3. Use ProSave to restore the latest full backup to the new panel. This brings the runtime image including compiled screens, recipes, and alarms.
4. Power on the panel and enter the Control Panel → Network interface to set the panel's own IP address. This is independent of the PLC address and may need to change if the new PLC is on a different subnet.
5. Open the loader, select the project, and use the Control Panel → Service Center → Connection to edit the HMI-to-PLC connection parameters. Change the target IP address / PROFINET name to match the new PLC.
6. Save the connection change and restart the runtime. Verify tag communication by switching to a screen with live values bound to PLC tags.
7. If the PLC connection is hard-coded in the HMI tags (HMI tag connection, area pointers), those are restored as part of the runtime image and do not need to be re-engineered. Only the connection node needs editing.

If no ProSave backup exists, the panel must be re-engineered from the original TIA Portal project. If the TIA Portal project itself is lost, recovery is not possible through the panel - the only remaining path is reconstruction from the PLC tag list, electrical drawings, and screen captures.

Comparison: How Other Vendors Handle HMI Upload

The contrast is the basis of the field report: third-party vendors treat the HMI as a peer in the engineering workflow, while Siemens positions the HMI as a runtime target. For maintenance organizations, the practical impact is significant when the engineering archive is lost or the original system integrator is no longer available.

Schneider Vijeo Designer Upload Procedure (Reference Workflow)

For comparison, the documented Schneider Electric procedure for uploading a Vijeo Designer project to a PC for editing is:

1. Launch Vijeo Designer on the engineering PC.
2. Right-click on Vijeo Manager in the project tree and select "Upload Editor Project".
3. Select the transfer method (Ethernet, serial, USB) to the target panel.
4. Authenticate if a project password is configured on the panel.
5. Vijeo Designer retrieves the editable *.vpe file from the panel and opens it for modification.

Reference: Schneider FAQ FA194109 - Upload project from HMI using Vijeo Designer. This workflow is what Siemens field engineers reference when lobbying for an equivalent capability on Comfort and Unified panels.

Workarounds When the Source Project Is Lost

When a Comfort Panel is operational but the TIA Portal source is missing, the following recovery options remain:

• ProSave full backup - take a backup from the running panel and use it to seed a replacement. Does not produce editable source. Verify the backup completes without error before declaring success.
• Reverse engineering from PLC tag database - export the PLC tag list (S7-1200/1500 PLC tag tables, DB definitions, symbolic I/O) and reconstruct screen-to-tag mappings from screen captures. Time-intensive but feasible for small projects with fewer than 50 screens.
• HMI trace via the runtime - on the panel, use Control Panel → OP Information / Diagnostics to read the firmware version, project name, last compiled timestamp, and total tag count. This metadata can be used to identify the correct engineering archive in a versioned repository.
• Service request to original system integrator - in many installations, the SI is contractually obligated to maintain the engineering archive. Raising a service ticket with the SI has higher recovery odds than attempting to recover from the panel.
• Third-party screen capture reconstruction - using photos of the running panel plus the PLC tag list, an engineering firm can rebuild a functionally equivalent TIA Portal project. This is a last-resort option and is rarely used in production due to cost.
• Siemens Technical Support escalation - for warranty cases, Siemens GTAC can sometimes recover archived engineering data from their internal repository if the original project was registered to a Siemens support contract.

Best Practices for Project Archival

• Use TIA Portal's "Archive project" function at every engineering change. Store archives in a versioned repository (Git LFS, SVN, or a CMMS document store) with commit messages describing the change and the customer site ID.
• Take a ProSave full backup before every firmware update and store it alongside the engineering archive. ProSave backups include recipe data and log archives that the engineering archive does not contain.
• Configure the panel's automatic backup schedule to write a runtime backup to a network share at every shutdown. This protects recipe and log data, not source. Configure the share path in Control Panel → Backup.
• Document the panel's MLFB and current firmware version in the project archive metadata or in a sidecar manifest.txt file in the same repository folder.
• When commissioning a new project, physically label the panel with the engineering archive filename and repository commit hash. Field engineers replacing the panel will know exactly which archive to pull without having to enumerate the entire repository.
• Include a checksum (SHA-256) of the engineering archive in the panel's startup script display so that field engineers can verify they are restoring the correct version.

Troubleshooting Matrix: Common HMI Recovery Failures

FAQ