Siemens HMI Backup Editing: WinCC Flexible .psb Recovery Guide

Problem Overview

A field engineer is tasked with upgrading a Siemens OP277 6" panel (SIMATIC HMI family) on an existing machine. The original WinCC Flexible 2008 project files have been lost, misplaced, or were never delivered with the machine. The only artifact available is the runtime backup pulled from the panel via ProSave or the integrated WinCC Flexible "Transfer / Backup" menu. When the engineer attempts to open that backup in WinCC Flexible 2008 SP5 or migrate it to TIA Portal V18, the project opens in a read-only state and refuses to accept any configuration change. Screens, tags, alarms, and connection tables appear grayed out, and "Project > Save As" produces a usable file but without editable engineering data.

This is one of the most common, and most frustrating, after-sales support cases raised against Siemens HMI panels. The root cause is not a software defect; it is a deliberate engineering workflow control implemented in WinCC Flexible and inherited by TIA Portal.

Affected Products and Software Versions

The OP277 6" reported in the field report is built around the WinCE 5.0 / XScale runtime. It belongs to the 270 series and is engineered exclusively with WinCC Flexible 2008 SP2 or later (SP3/SP4/SP5 for newer firmware). TIA Portal can not open an OP277 panel project; only WinCC Flexible 2008 SP5 can, and only if the Backtransfer feature was active when the original project was compiled and downloaded.

Root Cause Analysis: The Backtransfer Mechanism

WinCC Flexible supports two distinct data flows between the engineering station and the panel:

1. Download (Project → Panel): the compiled runtime files are transferred to the panel. This is the normal commissioning flow.
2. Backtransfer (Panel → Engineering Station): the compressed engineering project is uploaded from the panel back into WinCC Flexible for editing.

Backtransfer is an opt-in checkbox located in the project tree under Device Settings → Transfer / Download → "Enable backtransfer". The runtime image generated by WinCC Flexible only embeds the editable project archive when this checkbox is ticked and a panel password matching the configured transfer password has been supplied. The generated *.psb file therefore has two logical sections:

• The Runtime Image — always present, used to restore the panel to operating state.
• The Compressed Engineering Project — present only if Backtransfer was enabled at download time, plus the panel password supplied at upload.

If the original engineering project was compiled and downloaded without enabling Backtransfer, the uploaded backup contains runtime data only and is structurally a black box. WinCC Flexible refuses to decompile the runtime image back into editable objects; the decompiler was never a supported feature and was removed entirely from WinCC Flexible 2005 onward.

File Format Identification

Before assuming the backup is unrecoverable, identify what was actually pulled from the panel. WinCC Flexible and ProSave produce several different file types, and each one has a different recovery path:

Open the *.psb with 7-Zip or WinRAR. A Backtransfer-embedded backup expands into a folder tree containing *.hmi, *.ldf, *.pdf, *.bmp, scripts, recipes and the entire project layout. A runtime-only backup expands into a single binary image plus license and recipe CSV files. The presence or absence of a project folder is the definitive diagnostic.

Step-by-Step: Pull a Backup with ProSave and Verify Recoverability

Prerequisites

• ProSave V9.0 SPx or higher (matched to the panel generation; install from the WinCC Flexible 2008 SP5 DVD or the TIA Portal installation media under Support → ProSave).
• Serial (MPI/PPI) or Ethernet (TCP/IP) connection; for OP277 the panel ships with one RS485 MPI/DP port and an optional Ethernet module (6AV3 972-1DX00-0AA0).
• Panel transfer password (default 100 for unconfigured panels, or whatever was set in the original project).

Procedure

1. Launch ProSave, select General → Panel type = "OP277 6"" and the connection type (MPI or Ethernet).
2. Set the panel IP address (Ethernet) or MPI address (default 1, baud 187.5 kbps for OP277).
3. Click File → Backup. Browse to a local folder and accept the default *.psb filename.
4. When prompted, enter the transfer password.
5. Wait for "Backup completed successfully".
6. Copy the resulting *.psb to the engineering station and rename to *.zip.
7. Extract with 7-Zip. Look for the project subfolder containing a WinCC Flexible project file (*.hmi or older *.mcp).

Verification

• If the extracted folder contains *.hmi and you know the project password, open it with WinCC Flexible 2008 SP5: Project → Open → HMI file. The project opens fully editable.
• If the extracted content is a single image (*.img, *.fwx), the Backtransfer section was not embedded. Recovery via editing is impossible.

Why the Uploaded Project Cannot Be Edited

Three independent failure modes can each produce the "I cannot edit the uploaded project" symptom reported in the source:

Diagnostic Procedure

1. Extract the *.psb as a ZIP. If the archive contains a folder named HMI, Project, or files with extensions *.hmi / *.ldf, Backtransfer data is present.
2. Open WinCC Flexible 2008 SP5 and select Project → Open. Navigate to the extracted folder and open the *.hmi file directly (do not use Open from panel).
3. If a password dialog appears, the project is editable once the correct password is supplied.
4. If no project files are found inside the archive, the upload is a runtime-only backup. Editing is impossible by design.

Recovery Paths and Workarounds

When the editable project cannot be recovered from the panel, work systematically through the following options before resigning to a full re-engineering effort.

Path 1 — Recover the Source Project

• Check the customer's EWS / engineering file share. Most machine builders archive projects per machine serial number; look for *.zip, *.mcp, or the WinCC Flexible *.hmi original.
• Ask the OEM for the source code. Under many service contracts the OEM is contractually obligated to provide the engineering files within a defined window (typically 10 years for EU machinery).
• Check version control (SVN, TFS, Git) on the integrator's servers.
• Check the panel's CF/SD card slot. Some integrators store the project on the same industrial card that holds the runtime.

Path 2 — Re-create the Project Using the Runtime as Reference

If the runtime is functional on the OP277, the screens can be photographed or screen-captured via the panel's serial protocol and used as background bitmaps in a new project. This is a "reverse-engineering from screenshot" approach:

1. Enable the OP277's screen-shot capability via Control Panel → Display → Screenshot to USB (if the optional USB module 6AV3 671-1XC00-0AX0 is fitted).
2. Capture each runtime screen as a *.bmp.
3. Create a new WinCC Flexible project targeting OP277 6" (resolution 320 × 240, 256 colors).
4. Import the bitmaps as backgrounds and re-create tags, alarms, and connections by reading them off the PLC via the live connection.

Path 3 — Migrate the Runtime to a New Panel

If re-engineering is infeasible but the application is still required, migrate to a newer panel while keeping the PLC program intact:

1. Install TIA Portal V18 with WinCC Comfort/Advanced.
2. Configure a SIMATIC TP700 Comfort (6AV2 124-1GC01-0AX0) as the replacement target.
3. Build a new project from scratch using the live PLC tag list as reference (export tags from the connected S7-300/400 via TIA Portal → "Read tags from PLC").
4. Use the OP277 runtime screenshots as visual reference for screen layout.

Path 4 — Third-Party Decompiler Tools

Preventive Measures for Future Projects

Eliminate this problem class by enforcing the following on every WinCC Flexible / TIA Portal HMI project delivered to a customer:

1. Always enable Backtransfer in the panel device settings before compiling. In WinCC Flexible: Project → Device → Properties → Transfer → "Enable backtransfer". In TIA Portal: Project tree → HMI device → Properties → Transfer → "Allow panel to send project to engineering system".
2. Document the project password in the project handover dossier and store it in a secure vault.
3. Archive the original engineering project in a per-machine folder named with the machine serial number, and check the archive into a version control system.
4. Export a TIA Portal Portal View backup (*.zip) of every project before download and attach the archive to the machine documentation.
5. Standardize the panel firmware across the fleet. Locking a single firmware image makes it much easier to re-issue a project after an unexpected loss.

Compatibility Matrix: WinCC Flexible ↔ OP/TP/MP 270/370 Panels

Field Commissioning Checklist After Recovery

When a project has been recovered by any of the paths above, the following checks must be executed before returning the panel to production service:

1. Compile and rebuild the project in the recovered engineering tool (WinCC Flexible 2008 SP5 or TIA Portal V18) and check for warnings about deprecated tags or unsupported connections.
2. Verify the tag list against the live PLC by exporting the PLC symbol table (STEP 7 → Symbol Table → Export) and diffing it against the HMI tag list.
3. Test every alarm by triggering each condition from the PLC side. OP277 supports up to 4000 discrete alarms and 1000 analog alarms; ensure none were dropped during recovery.
4. Verify the connection in Project → Connections. OP277 typically connects via MPI/DP to an S7-300/400, baud 187.5 kbps, MPI address 1 by default.
5. Test recipes by saving, modifying, and reloading at least three recipe records. OP277 stores recipes on internal Flash; verify the storage path is correct (\Flash\Storage Card\recipes or equivalent).
6. Back up the recovered project immediately and store it in the machine documentation archive.

Related Siemens Resources

• WinCC Flexible 2008 SP5 Manual
• FAQ: Back-up and restore of WinCC Flexible panels with ProSave
• SIMATIC HMI Operator Panels OP/TP/MP 270/370 device manuals
• TIA Portal Help: Transferring projects between engineering system and panel

Frequently Asked Questions