Siemens Comfort Panel PDF Print to Network Folder on IPC

Siemens SIMATIC Comfort Panels (TP700, TP900, TP1200, TP1500, TP1900, TP2200) and Unified Comfort Panels (MTP700, MTP1000, MTP1200, MTP1500, MTP1900, MTP2200) support screenshot capture and PDF export through the PrintScreen runtime function. The legacy PDF V1.5 driver is hard-wired to the local USB port and does not expose a configurable path field, which prevents writing screenshots directly to a network location. This reference documents the correct PDF printer driver selection, the TIA Portal configuration procedure, SMB share setup on the target IPC, UNC path mapping, and a dual-target scheme that writes to both a network share and a USB stick.

1. Problem Definition

The default WinCC runtime installation on a Comfort Panel provides a printer called PDF V1.5. When the HMI operator triggers Print screen via a configured button, the runtime invokes PrntScreen (or the user-defined print job) and the image is rendered through this driver. The driver writes the output file to a fixed local path, typically \Hard Disk\USB\Storage_USB_1\<filename>.pdf on the panel's internal flash file system. The driver settings page inside the panel's Control Panel > Printer does not expose a user-editable path field, so the USB port index is implicit and cannot be redirected to a UNC path or mapped network drive.

Symptoms in the field:

• Screenshots are written successfully to the USB stick inserted in port X61 (USB-1) on the Comfort Panel.
• No file appears in \\IPC01\Screenshots\ or any other network location, even though the panel has network connectivity and the IPC share is reachable from the panel via SMB ping.
• The runtime log file \Hard Disk\Logs\PrintLog.txt shows the print job completing in <200 ms, indicating the file was buffered locally rather than transferred over the network.

2. Root Cause: Driver Selection, Not a Network Fault

The PDF V1.5 driver is a legacy local-only driver retained for backward compatibility. It does not implement the Win32 spooler redirector that the standard PDF Printer driver uses to write to arbitrary file system paths. The cure is not to patch the V1.5 driver but to replace it with the PDF Printer driver that TIA Portal installs in the panel image. Once the PDF Printer driver is selected, the Printer Properties page exposes:

• Primary location: drop-down with values Local, Network, Other.
• Path: free-text field accepting local, mapped-drive, or UNC paths.
• User name / Password: fields for SMB authentication against the target share.
• File name template: configurable (e.g., Screen_%DATE%_%TIME%.pdf).

Setting Primary location = Other and entering a UNC path of the form \\<servername>\<sharename>\<subfolder> is the documented mechanism for sending PDF screenshots to a Windows host. The panel's SMB client resolves the UNC and authenticates using the configured credentials.

3. Prerequisites

Before configuring the runtime, verify the following:

4. Selecting the PDF Printer Driver in TIA Portal

1. Open the TIA Portal project containing the Comfort Panel device (e.g., HMI_1 [TP1500 Comfort]).
2. In the project tree, navigate to Runtime settings > Printer.
3. Delete the existing PDF V1.5 entry if present.
4. Click Add and select PDF Printer from the driver list. Do not select PDF V1.5 or Hardcopy.
5. In the General column, set the printer name to a unique identifier, e.g., PDF_NetworkShare. The name is referenced by VBScript and the system function PrntScreen.
6. Confirm the driver shows Manufacturer: Siemens AG, Model: PDF Printer, Version: 1.0 or higher.

The Siemens support entry 92346478 (How do you print from a SIMATIC HMI to a network printer or a file on a network share?) provides the official cross-reference for this procedure and is the recommended first stop when commissioning.

5. Network Integration on the Comfort Panel

The panel must be configured for SMB before it can resolve UNC paths. The procedure differs by panel generation.

5.1 Second-Generation Comfort Panels (Windows Embedded Compact 7)

1. Open the Control Panel on the panel: Start > Settings > Control Panel. (On Unified Panels, see 5.2.)
2. Open System and set the panel's Computer name to a unique NETBIOS name, e.g., HMI01.
3. Open Network and Dial-up Connections and double-click the Ethernet adapter (DM9CE1 for the PROFINET port or DM90001 for the second port).
4. Assign a static IP address, subnet mask, and default gateway consistent with the IPC subnet, or configure DHCP if a server is available.
5. Set Name Servers to the corporate DNS or to a value consistent with the IPC's WINS resolution.
6. Click OK and restart the network adapter.
7. Return to Control Panel, open Network and Dial-up Connections again, and verify the SMB Client applet shows the panel joined to the workgroup (default WORKGROUP).
8. If the IPC is in a different workgroup or domain, change the Workgroup value on the panel to match.

5.2 Unified Comfort Panels (Windows 10 IoT)

1. Open the Windows IoT Settings app on the panel.
2. Navigate to System > About > Rename this PC and assign a unique host name.
3. Open Network & Internet > Ethernet and assign a static IP address (or use DHCP with a reservation).
4. Open This PC > Properties > Advanced system settings > Computer Name and click Change. Set the workgroup or domain to match the IPC's workgroup.
5. Restart the panel to apply.

6. Configuring the SMB Share on the IPC

The target folder must be published as an SMB share with write permission for the service account that the panel will use.

1. On the IPC, create a local folder for the screenshots, e.g., C:\HMI_Screenshots\.
2. Right-click the folder, select Properties > Sharing, and click Share....
3. Add the service account svc_hmi_print with permission level Read/Write. Remove Everyone if present.
4. Set the share name to a short, DNS-friendly identifier, e.g., HMI_Shots. The resulting UNC will be \\<ipcname>\HMI_Shots.
5. Click Advanced Sharing and ensure Allow caching is enabled only if the IPC is on a UPS-backed power supply; otherwise disable to avoid corrupted PDF files during write loss.
6. Click Permissions > Add on the Security tab to add the same service account with Modify rights on the NTFS side.
7. Test the share from a third Windows host: net use * \\ipc01\HMI_Shots /user:svc_hmi_print <password>. A successful drive mapping confirms the IPC side is correct before touching the panel.

7. Configuring the UNC Path in the Panel Printer Settings

The UNC path is set in the panel's runtime Control Panel, not in TIA Portal. TIA Portal deploys the printer definition; the actual path and credentials are configured on the target device so that they survive project re-compiles.

1. Download the project to the panel and let runtime start.
2. Open the Control Panel on the panel (Start > Settings > Control Panel on CE; Settings app on Unified).
3. Open Printer (or Devices and Printers on Unified panels).
4. Right-click the PDF_NetworkShare printer and select Printer Properties (not Printing Preferences).
5. On the General tab, click Printing Preferences...
6. In the Primary location drop-down, select Other. The Path, User name, and Password fields become active.
7. Enter the path: \\ipc01\HMI_Shots\Screenshots (the subfolder Screenshots is optional; it can also be created on the share beforehand).
8. Enter the user name as IPC01\svc_hmi_print (full domain-qualified form) or simply svc_hmi_print if the IPC is in a workgroup matching the panel's workgroup.
9. Enter the password. The field is masked; re-enter on a confirmation prompt.
10. Set the file name template. Recommended value: Screen_%DATE%_%TIME%.pdf. The runtime substitutes the panel's local date and time using the locale configured in Control Panel > Regional Settings.
11. Click Apply and OK.

Repeat step 4 to add a second printer instance for USB if dual-target is required (see Section 9). The V1.5 driver can be retained as PDF_USB for the USB path; only the network path requires the new driver.

8. Path Resolution and Authentication Internals

When PrntScreen is invoked at runtime, the PDF Printer driver calls into the panel's SMB client with the configured UNC and credentials. The sequence is:

1. DNS resolution of ipc01 to its IPv4 address. If the IPC is referenced by IP only (e.g., \\192.168.1.50\HMI_Shots), this step is skipped.
2. TCP three-way handshake on port 445 (SMB direct) or NetBIOS session setup on 139.
3. Negotiation of the SMB dialect. Comfort Panels negotiate SMBv1 (CE) or SMBv2/v3 (Unified).
4. Session setup with the supplied credentials, returning a UID (User ID) handle.
5. Tree connect to IPC01\HMI_Shots returning a TID (Tree ID).
6. File open with Disposição: Create, Access: Generic Write, Share: Read.
7. Sequential Write requests of the PDF body, typically 4 096 bytes per chunk.
8. File close and tree disconnect.

If any step fails, the driver writes an entry to the panel's print log file. Common NTSTATUS values returned by Windows:

9. Dual-Target Printing: Network + USB

WinCC runtime does not natively fan out a single PrntScreen call to two printers. Three practical approaches exist:

9.1 Two Printer Instances Triggered by VBScript

Add two printers in TIA Portal: PDF_NetworkShare (pointing to UNC) and PDF_USB (pointing to \Hard Disk\USB\Storage_USB_1\). In a button's Press event, replace the default PrntScreen system function with a VBScript that calls both printers sequentially:

' VBScript attached to the Print Screen button, Press event
Dim sNet, sUSB, sFile
sFile = "Screen_" & Year(Now) & Right("0" & Month(Now),2) & _
        Right("0" & Day(Now),2) & "_" & _
        Right("0" & Hour(Now),2) & Right("0" & Minute(Now),2) & _
        Right("0" & Second(Now),2) & ".pdf"

sNet  = "\\\\ipc01\\HMI_Shots\\Screenshots\\" & sFile
sUSB  = "\\Hard Disk\\USB\\Storage_USB_1\\" & sFile

' Print to network share
HMIRuntime.Print sNet, "PDF_NetworkShare"

' Print to USB stick
HMIRuntime.Print sUSB, "PDF_USB"

The HMIRuntime.Print method takes a fully qualified path as the first argument and the printer name as the second. The runtime will append the configured file name template if the path argument ends with a backslash; if it ends with a file name, that name is used verbatim.

9.2 Network Primary, USB Replicated by Sync Job on IPC

Print only to the network share from the panel. On the IPC, schedule a robocopy mirror job that copies C:\HMI_Screenshots\ to a USB stick attached to the IPC, every 60 seconds:

robocopy "C:\HMI_Screenshots" "E:\HMI_Backup" *.pdf /MIR /R:3 /W:5 /NP >> C:\Logs\hmi_sync.log 2>&&1

Run via Windows Task Scheduler. The /MIR switch purges files from the USB that no longer exist on the share, keeping the USB footprint bounded.

9.3 USB Primary, Network Replicated by Panel-Side Script

Retain the V1.5 USB path and add a VBScript that copies the freshly written PDF to the network share after a short delay:

' Called by a scheduled event (e.g., every 5 s) on a tag trigger
Dim fso, src, dst
Set fso = CreateObject("Scripting.FileSystemObject")
src = "\\Hard Disk\USB\Storage_USB_1\"
dst = "\\ipc01\HMI_Shots\Screenshots\"

If fso.FolderExists(src) Then
    Dim file
    For Each file In fso.GetFolder(src).Files
        If LCase(fso.GetExtensionName(file)) = "pdf" Then
            fso.CopyFile file.Path, dst & file.Name, True
        End If
    Next
End If
Set fso = Nothing

This approach is more failure-tolerant because the USB write is local and instantaneous; the network copy is best-effort and will retry on the next cycle.

10. Verification Procedure

After commissioning, perform the following tests in order:

1. From the panel, open Control Panel > Network and Dial-up Connections > Ping. Ping the IPC's IP address. Expect < 5 ms on a same-subnet link.
2. Insert a USB stick and confirm the panel's file manager shows Storage_USB_1.
3. Trigger a Print Screen from the engineering station or by pressing the runtime button.
4. Within 2 seconds, verify a new PDF file appears in \\ipc01\HMI_Shots\Screenshots\ from a Windows host.
5. Open the PDF to confirm the screenshot is intact. A truncated file (e.g., 0 KB or 12 KB) indicates the SMB session was interrupted mid-write; check the panel's event log for STATUS_NETWORK_NAME_DELETED.
6. Verify the file size grows monotonically with the screen complexity. A typical 1920 x 1080 screen with minimal graphics produces a 60-150 KB PDF; a fully populated screen with controls and trend views can exceed 1.5 MB.
7. Test failure modes: pull the network cable mid-write, restart the IPC, exhaust disk space, lock the share. The driver should fall back gracefully and not crash the runtime.

11. Troubleshooting Matrix

12. Security and Operational Notes

• Service-account hygiene. The service account password is stored in the panel's registry under HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\HMI\Printer. Anyone with administrative access to the panel's CE shell (e.g., via SecureClient or a maintenance cable) can extract it. Restrict panel access at the physical layer; rotate the password quarterly.
• Credential transport. SMBv1 transmits NTLMv1 hashes. If the IPC must accept SMBv1, force NTLMv2 on the IPC side via Local Security Policy > Network security: LAN Manager authentication level = Send NTLMv2 responses only. CE-based panels cannot negotiate higher; plan a migration to Unified panels for new projects.
• File retention. Screenshots accumulate indefinitely. Add a maintenance task on the IPC to delete files older than N days. Example: forfiles /p "C:\HMI_Screenshots" /m *.pdf /d -30 /c "cmd /c del @path".
• Path injection. The file name template is rendered at runtime from a tag or system clock. Avoid exposing the template as a writable tag; an attacker who can write tags could potentially craft a path containing ..\ and write outside the share.
• Logging. Enable file access auditing on the share (Properties > Security > Advanced > Auditing) and forward events to a SIEM. Each print job produces exactly one 4663 event with the file name and the service account SID.

13. Related Siemens Documentation

• Siemens Support Entry 92346478: Print from a SIMATIC HMI to a network printer or file on a network share
• SIMATIC HMI Panels Comfort Panels Operating Instructions (article ID 49313233 on Siemens Support)
• WinCC Comfort / WinCC Advanced V18 System Manual (TIA Portal Help > Documentation)
• SIMATIC S7-1500 / ET 200MP Manual Collection - section on PROFINET and industrial Ethernet commissioning