TP1500 Comfort ProSave Backup Recovery Modifying Without TIA

Problem: Modifying a TP1500 Comfort From a ProSave Backup Only

A field engineer boots a SIMATIC HMI TP1500 Comfort (catalog number 6AV2124-0QC02-0AX0) and discovers the project on the panel must be changed — a new tag, a renamed button, a screen layout correction — but the original TIA Portal project file (.ap15, .ap16, .ap17, .ap18, .ap19) is gone, corrupted, or was never archived. The only artifact available is a ProSave backup taken from the running panel.

This is a recurring field situation. The instinctive assumption is that ProSave creates a file that can be opened, edited, recompiled, and pushed back. It cannot. ProSave generates an encrypted runtime image, not a TIA Portal project. Engineers who do not internalize this distinction waste hours attempting to import a .brf / .pwx / .psb file into TIA Portal as if it were a source project.

This reference documents exactly what ProSave produces, what you can and cannot do with it, the recovery paths that actually work, and the version compatibility matrix that governs whether an older project can still be opened in a newer TIA Portal release.

TP1500 Comfort Hardware Reference

Before selecting recovery paths, confirm the panel revision. Catalog number 6AV2124-0QC02-0AX0 is the second-generation 15" widescreen Comfort device. Key specifications:

The Windows CE 6.0 runtime is what makes the ProSave backup non-portable as a project source. Siemens compiles the WinCC Comfort project into a CE-targeted runtime and signs it; the compiled runtime is what is stored on the panel and what ProSave extracts.

What ProSave Actually Produces

ProSave is the Siemens service tool shipped with TIA Portal (Start > Siemens Automation > ProSave) and bundled inside WinCC flexible / WinCC Comfort. When you perform Backup > HMI Backup from ProSave connected to a live TP1500 Comfort, you get a binary image containing:

• The compiled WinCC Runtime project (screens, scripts, tags as resolved at compile time).
• The panel operating system image (Windows CE 6.0 plus Siemens runtime binaries).
• Recipe data, alarm logs, and user administration tables (depending on scope selection).
• A signature and integrity block that ties the image to the panel.

The backup is a black-box runtime. It cannot be decompiled into editable TIA Portal objects. There is no sanctioned reverse path from a ProSave image back to a .ap* source. Siemens does not publish a decompiler and the runtime binaries are not symbolic.

What You Can Do With a ProSave Backup

The backup is still useful, just not for editing. Valid operations on a TP1500 Comfort ProSave image:

1. Restore to identical hardware. Push the backup back onto the same TP1500 Comfort (or a compatible spare) using ProSave > Restore. The panel returns to the exact runtime state at the moment of backup.
2. Migrate to a compatible successor. Restoring a Comfort panel backup onto a newer Comfort panel of the same class is supported as long as the image version on the source panel is supported by the target panel's firmware. The TP1500 Comfort (6AV2124-0QC02-0AX0) accepts images from predecessor models in the same MLFB family after an OS update via ProSave.
3. Bulk-clone identical stations. Use the backup as a deployment artifact for production-line machines with the same configuration. This is the canonical use case and the reason ProSave exists.
4. Extract runtime data. Recipe data and alarm history contained in the image can be read via the panel's file system if the backup is restored to a panel and exported; they cannot be opened on a PC without restoring first.

What You Cannot Do With a ProSave Backup

• Open in TIA Portal. TIA Portal will not accept a ProSave file as a project source. Import > Project from runtime does not exist.
• Edit screens, tags, scripts, or alarms. The image is compiled bytecode, not editable source.
• Diff against the live project. No tool exists to compare a ProSave image to a .ap* project.
• Re-version upward. You cannot convert a ProSave image into a TIA Portal V17 project if the original was compiled in V15.

Root Cause: Why the Source Project Disappears in the Field

Engineering teams lose TIA Portal project archives for predictable reasons:

1. The integrator delivered the .ap* project only to the end customer; the in-house maintenance team never received a copy.
2. Version control was managed on a single engineer's laptop that has since been replaced, reimaged, or retired.
3. The project was archived to a network share whose permissions or retention policy deleted it.
4. The TIA Portal version on the archive workstation cannot open projects saved by a newer release — TIA does not silently downconvert.
5. A TIA Portal upgrade was performed and the project was resaved in the new format, overwriting the last archive of the original format.

Recovery depends on which of these applies. Knowing the original TIA Portal version is the single most valuable piece of metadata because it determines which release you can install to re-create the project.

Recovery Path 1: Locate or Rebuild the Original TIA Project

This is the only path that allows full editing. Sub-paths in order of preference:

Sub-path A: Recover the .ap* archive

• Search network shares, OneDrive, SharePoint, and engineering NAS for *.ap*, *.zap* (compressed archives), or *.tnzip.
• Check the integrator's engineering server. Even when the integrator is gone, hardware suppliers often hold a copy under service contract.
• Query the panel's System > Load Monitor or the panel information screen: the runtime version string typically includes the TIA Portal version used at compile time (e.g., "Runtime V16.0.1.0").
• Read the panel's version.txt in \Flash\Simatic via CE file system access over Ethernet (ProSave > File Browser or via ActiveSync-equivalent).

Sub-path B: Rebuild from documentation

If no archive survives, the project must be re-authored. Acceptable inputs for reconstruction:

• Functional specification / FDS documents.
• I/O lists and PLC tag databases exported from the connected S7 CPU. Use TIA Portal > Online > Accessible Devices to read the S7-1500 / S7-1200 tag table even when the HMI project is missing.
• Screen captures taken on-site from the running panel.
• Alarm logs retrieved via ProSave and exported to CSV.
• Recipe files in CSV format pulled from the panel file system.

Sub-path C: Reverse the connected PLC program

Since the HMI only displays what the PLC exposes, the PLC project is often the larger source of truth. Online read of the S7 CPU yields:

• Full tag table (data blocks, inputs, outputs, markers).
• Block call hierarchy (OB/FB/FC).
• Hardware configuration of the rack.

Reverse-engineering the PLC and rebuilding the HMI screens against the recovered tag list is a one-to-three-day effort for a typical Comfort-panel application, dominated by screen layout work.

Recovery Path 2: Live Edit on the Panel (Limited)

For minor textual changes, the TP1500 Comfort supports on-panel editing of specific items via the CE control panel:

• Edit project name.
• Modify network parameters (IP address, subnet, gateway, PROFINET device name).
• Set date / time and time zone.
• Manage users and passwords (default admin: admin / 100 on older images; later images force password change on first login).
• Import / export recipes via the recipe view.

These edits are operational, not project edits. They do not change a single screen graphic, script line, or tag connection. They are the absolute ceiling of what can be done without source.

Recovery Path 3: Clone the Panel and Replace Hardware

If the panel itself is failing and the goal is simply to keep the line running:

1. Source a compatible replacement TP1500 Comfort (6AV2124-0QC02-0AX0 or a supported successor).
2. Perform ProSave > Restore on the new panel from the .brf / .pwx backup.
3. If the replacement has a newer image version, ProSave will prompt to update the OS first; allow it.
4. Verify the PROFINET device name on the replacement matches the controller's expected name (TIA topology configuration), or rename it on the panel via Control Panel > PROFINET IO > Device Name.

This path restores operation but does not unlock any modification capability.

TIA Portal Version Compatibility Matrix

Once you identify the original TIA Portal version, you must decide which release to install to work with the project. The compatibility rules Siemens publishes for Comfort panels:

Hard rule: TIA Portal cannot downgrade a project. If the surviving archive was last saved in V17 and only V15 is available on hand, the project cannot be opened. Install a TIA Portal version at or above the archive version.

The WinCC Comfort / Professional license is what authorizes HMI project editing. The license is bound to the TIA Portal version installed. Without the right Comfort license for the installed version, you can open and view but not compile.

ProSave Backup Procedure (Reference)

For teams that still have the original TIA project and want to preserve it before further edits, the canonical backup sequence is:

1. Connect the engineering PC to the TP1500 Comfort via PROFINET (recommended) or MPI/PROFIBUS.
2. Set the PC and the panel to the same subnet. Default panel IP is 192.168.1.1; many sites use 192.168.0.x.
3. Launch ProSave (Start > Siemens Automation > ProSave).
4. Device type: TP1500 Comfort.
5. Connection: PROFINET (TCP/IP), enter panel IP.
6. Select Backup > HMI Backup. Choose complete backup (Recipe + Alarms + User Admin enabled).
7. Select target path. ProSave writes a .brf file (legacy) or .pwx / .psb file (newer).
8. Verify: file size > 0, ProSave reports Backup successful.
9. Store the file under version control with a date stamp and the panel serial number.

Restoring a ProSave Image (Reference)

1. Connect PC to TP1500 Comfort, launch ProSave.
2. Select Restore > HMI Restore, choose the .brf / .pwx file.
3. Select restore scope: complete restore (overwrites everything) or partial.
4. Click Transfer. Panel reboots mid-restore; do not power-cycle during the LED sequence that follows the reboot trigger.
5. On first boot after restore, verify image version, IP, device name, and PROFINET connectivity to the PLC.

Verification Checklist After Any Recovery

Confirm the panel is functionally identical to the pre-recovery state before signing off:

• Image version on the panel matches the version expected from the source TIA Portal release.
• PROFINET device name matches what the PLC expects in the topology.
• IP / subnet / gateway are correct; panel responds to ping from the engineering station.
• HMI-to-PLC connection is green in Control Panel > Connection Status.
• All known screens load without "Connection failure" or "Tag invalid" indications.
• Recipes round-trip: read existing recipe, write modified recipe, verify persistence.
• Alarms can be acknowledged and clear.
• User login with admin credentials works; user list is intact.

Best Practices to Prevent Recurrence

1. Archive the TIA Portal project on every successful compile. Configure TIA Portal's auto-archive under Options > Settings > General > Project archiving.
2. Bind archives to the panel serial number. Folder scheme \Projects\HMI\<MLFB>\<SerialNumber>\ avoids confusion when multiple panels coexist.
3. Commit the .ap* file to a version control system with the matching PLC project. Treat the HMI and PLC as one logical deliverable.
4. Take a ProSave backup after every commissioning milestone and store it alongside the .ap* archive. ProSave is the recovery of last resort if the .ap* is lost; the inverse is not true.
5. Document the TIA Portal version in the machine functional specification. When the project is later needed, knowing the original version drives the TIA installation decision.
6. Maintain a TIA Portal license server with the Comfort add-on for at least the highest version ever used in the fleet. Licenses expire; install media does not.

Troubleshooting Matrix