TP270 Backup Restore: Safely Transfer CF Card to New Panel

Problem Overview: Replacing a Suspect TP270 with Minimum Downtime

Siemens SIMATIC TP270 panels from the 270-series HMI family have been in continuous service on HVAC, marine, and offshore platforms since the early 2000s. After 10-15 years of operation, symptoms such as touch calibration drift, intermittent freezes, dim backlights, or spontaneous reboots begin to appear. The replacement panel is mechanically identical to the failed unit, but the field engineer faces a tightly constrained window: the controlled process cannot be shut down, the recipe and alarm history must be preserved, and the commissioning engineer may have never worked with this product line before.

The most common question is whether a CompactFlash (CF) card can be used as a "sneakernet" project carrier: copy the project onto a CF card from the suspect panel, walk the card to a fresh TP270, and restore the project on the new hardware. The short answer is yes, with three important constraints that this article explains in detail:

1. The TP270 runtime must be stopped before the CF card is removed, regardless of whether the card contains only logs or a full project backup.
2. A project restore is not a single-button operation; the new panel must be placed into Transfer mode and the restore must be triggered manually from the Backup/Restore control panel applet.
3. Licensing, recipes, and alarm logs live on different storage layers and each must be transferred explicitly. A blind copy of the project folder does not move licenses or runtime SRAM data.

The official Siemens Support FAQ entry ID 28928853 documents the restore sequence in summary form; the procedure below expands each step with the field-engineering detail that the FAQ assumes you already know.

TP270 Hardware, Memory Architecture, and the CF Card Subsystem

Understanding what lives where inside the TP270 is essential before pulling a card. The 270 series (TP270 6", TP270 10", MP270, MP270B) runs Windows CE on an x86-compatible processor with a layered storage model. Misidentifying any of these layers leads to the most common field failure: a successful backup that does not include the recipes, or a successful restore that triggers a "License missing" overlay at runtime.

The CF card is the only removable media that the TP270 accepts; there is no USB stick and no SD slot. A standard Type I or Type II CF card up to 2 GB (FAT16) is supported on most 270-series firmware revisions. Some later firmware builds extend support to 4 GB (FAT32), but the panel does not auto-format. A card formatted as NTFS or exFAT will be rejected by WinCE with the message "Unsupported file system".

The TP270 reads the CF card at boot and mounts it as \Storage Card\ on most firmware revisions (or \CF Card\ on older builds). Runtime logs and recipe exports are written into a folder structure on the card by default. If the panel has been configured to use the CF card as the primary backup target, the compiled project file is also mirrored there on every successful project transfer.

Backup Methods Compared: ProSave, CF Card, and Automatic Backup

There are three sanctioned paths for capturing the project from a TP270. Each has different downtime characteristics, and the choice drives the restore procedure.

For the field scenario of an HVAC system on an oil rig where the controlled process must remain live, the only practical backup path is the CF card with runtime temporarily suspended. ProSave over Ethernet would otherwise be ideal, but it also requires Transfer mode, which halts runtime for 30-90 seconds. The minimum-impact procedure is therefore:

1. Schedule the operator to put the controlled process into a stable state.
2. Stop the HMI runtime via the item changeover switch.
3. Trigger a CF card backup from the panel menu.
4. Verify the backup file size on the card.
5. Pull the card.
6. Restart runtime.

Total operator-visible downtime: typically 2-5 minutes for a 5 MB project.

Runtime Mode, Transfer Mode, and Storage State Transitions

The TP270 boots into one of three mutually exclusive top-level states, and the storage rules change with each.

The transition from Runtime to Offline is initiated by touching the item changeover switch on the panel. By default this is a small grey rectangle in the bottom-right of the screen, or it can be invoked from a configured button. Pressing the switch brings up a dialog with three options:

1. Stop Runtime — exits to WinCE desktop, leaves all services running, CF card still mounted.
2. Transfer — same as Stop, but additionally opens the transfer ports for ProSave or remote restore.
3. Cancel — return to the project screen.

Pre-Replacement Checklist and Required Tools

Before the suspect TP270 is opened and the CF card pulled, verify that the following items are present and accessible. Skipping any of these is the most common cause of an extended outage.

Two model-number mismatches that bite field engineers on the TP270 line:

• The TP270 6" and TP270 10" have the same firmware family but different display drivers. A project compiled for the 10" will not display correctly on the 6", and vice versa, because the screen resolution and color depth are baked into the compiled binary.
• The TP270 and the MP270 look almost identical externally but use different runtime binaries. Confirm the replacement label on the nameplate before powering up.

Step-by-Step: Backup to CF Card Without Process Shutdown

The following procedure is the lowest-impact path when the controlled process must keep running. It assumes the operator can tolerate a 2-3 minute pause in HMI visibility while runtime is stopped for the backup. The PLC continues to control the process unaffected.

1. Notify operations. Inform the control room operator that the HMI will briefly go offline. Confirm that no critical operator action is in progress. The HVAC process under PLC control continues unaffected because the PLC retains the last setpoints.
2. Touch the item changeover switch (bottom-right corner by default) to bring up the Stop / Transfer dialog.
3. Select "Stop Runtime". Wait for the WinCE desktop or transfer dialog to appear. Do NOT select "Transfer" yet; that opens network ports and is unnecessary for a CF card backup.
4. Open Start > Settings > Control Panel > Backup applet (German UI: "Sicherung").
5. Select "CF Card" as the destination. The dialog will show the mounted card's free space. A typical TP270 project is 2-8 MB; recipes and logs add 1-50 MB.
6. Tick the "SRAM data" checkbox if recipe and alarm history must be preserved. Untick it if the new panel is being commissioned with default recipes.
7. Touch "Start Backup". A progress bar appears. Duration: 30 seconds to 3 minutes depending on project size and CF card write speed.
8. Verify the backup file. The default filename is ProjectBackup.psb with a timestamped suffix. Touch the file with the on-screen file manager and confirm its size is non-zero. A 0-byte file indicates a write failure; repeat the backup.
9. Touch "Safe to Remove Card" or wait 10 seconds after the progress bar completes. The CF card activity LED (if present on the socket) must extinguish.
10. Eject the CF card by pressing the eject button on the socket. Do not pry the card with a screwdriver.
11. Restart Runtime from the WinCE desktop or transfer dialog. The operator screen returns within 20 seconds.

If step 4-7 fail with an error message such as "Backup destination not ready" or "Insufficient permissions", the most common cause is a write-protected CF card (the small slider on the card edge) or a card formatted with NTFS. Re-format the card as FAT16 or FAT32 on a Windows PC and retry.

Step-by-Step: Restoring the Backup on the Replacement TP270

The replacement TP270 arrives from Siemens with firmware installed but no project. On first power-up it shows the WinCE desktop. Restoring a project from CF card requires the panel to be in Transfer mode (not just Offline).

1. Inspect the replacement panel for transit damage. Confirm the model number on the nameplate matches the suspect unit.
2. Insert the CF card containing the *.psb backup into the replacement panel's CF socket. The card auto-mounts as \Storage Card\.
3. Power on the panel. It boots to the WinCE desktop. If the firmware version on the new panel differs significantly from the source panel, a compatibility warning may appear; note the version and proceed.
4. Open Start > Settings > Control Panel > Backup/Restore (German UI: "Sicherung/Wiederherstellung").
5. Select "Restore from CF Card". A file browser appears, defaulting to \Storage Card\.
6. Navigate to the backup file (for example ProjectBackup.psb) and select it.
7. Tick the "Restore SRAM data" checkbox if recipe and alarm history must be transferred. Be aware: restoring SRAM to a panel with a different firmware patch level may revert tag names to the firmware-default dictionary. If the operator will re-enter recipes manually, leave this unticked.
8. Touch "Start Restore". A confirmation dialog appears; accept.
9. Wait for completion. A typical restore takes 1-3 minutes. The panel may reboot automatically when the restore finishes.
10. Verify the project starts after reboot. The runtime should display the same start screen as the suspect unit.
11. Touch "Safe to Remove Card" and eject the CF card.

Hot-Swap Risk Analysis: Why You Must Not Yank the CF Card During Runtime

The original field question was "can I remove the CF card while the unit is running and then go ahead and restore the backup on the new device". The answer is unambiguous: no, not if the card contains any data the runtime is currently writing.

The TP270 runtime, by default, performs the following background operations on the CF card when one is mounted:

• Data logging: each configured log writes a row every cycle (1 s to 60 s typical). The runtime keeps an in-memory buffer and flushes to the card on buffer-full or on a configurable flush interval (default 30 s).
• Recipe export: if a recipe is configured to export to file, the export happens on every write.
• Alarm logging: alarm events are appended to \Storage Card\Logs\Alarms.csv.
• Audit trail: on GxP-configured panels, every operator action is appended to \Storage Card\Audit\AuditTrail.csv.

If the card is removed mid-flush, the FAT directory entry for the open log file can be left in an inconsistent state. The next time the runtime tries to open that log for append, WinCE returns a file-system error. The runtime then either silently disables that log or, in older firmware revisions, crashes with a watchdog reset. Recurring watchdog resets are themselves a known trigger for CompactFlash card slot wear on the 270-series hardware.

On the Windows CE side, the same rules apply that apply to a desktop Windows machine: removable media must be logically unmounted, or the file system driver must support surprise removal. The TP270's FAT driver does not support surprise removal. Therefore:

For projects where runtime cannot be stopped even briefly, the alternative is to read the logs over Ethernet using FTP. The panel exposes its CF card contents over FTP when the "Remote File Transfer" option is enabled in the project. This avoids the hot-removal risk entirely, but it does not capture the compiled project — for that, runtime must still be stopped.

Decision Flowchart: Backup or Restore on a TP270

Licensing, Recipes, and Alarm History Handling

Three classes of data need to migrate with the panel: the project (handled above), the licenses, and the runtime data.

The license-handling detail is the one most often missed. If the suspect panel used a WinCC flexible option such as WinCC flexible/Archives or WinCC flexible/Scripts, the option license lives in one of two places:

1. On the CF card, in a folder named \System\, file License.cfg. If this is the case, the license travels with the card automatically.
2. In the internal flash, signed against the panel's serial number. If this is the case, the license does NOT travel with the card. The replacement panel will show "License missing" until the license is re-transferred using the Automation License Manager and ProSave.

To check which case applies on the source panel before pulling the card, open Start > Settings > Control Panel > OP/PC Properties and read the "License" tab. If the license is on internal flash, export it via Automation License Manager to a USB-attached license key before powering down the suspect unit.

MPI/DP and Ethernet Addressing on the Replacement Panel

A restore from CF card does not transfer the panel's communication parameters. The replacement TP270 ships with default MPI/DP address 1 and DHCP-enabled Ethernet. If the source panel used any other address, the new panel will fail to come online at runtime and the operator will see "Offline" or "Connection failed" on every screen.

Before mounting the panel in its cutout and applying 24 V DC, set the MPI address and any static IP parameters. The PLC project expects the HMI at a specific node number; getting this wrong is the single most common cause of "the new screen does not communicate with the PLC".

Verification and Commissioning Tests

After the restore completes and the new TP270 is mounted in the panel cutout, run the following verification sequence before handing the system back to operations.

1. Visual check: confirm the runtime is showing the expected start screen, with no "License missing" or "Project CRC error" overlays.
2. Touch calibration: touch the four corners and the centre of the screen. If the touch is miscalibrated, the runtime may have re-loaded a default calibration. Recalibrate via Start > Settings > Control Panel > Touch.
3. Tag spot-check: from the engineering station, read three to five known tags via ProSave or by reading the PLC directly. Confirm they match the values displayed on the panel.
4. Alarm history continuity: trigger a known test alarm and confirm it appears in the alarm log and that the historical alarms from the source panel are visible.
5. Recipe round-trip: if recipes were restored, write the recipe to the PLC and read it back. Confirm values match the source panel.
6. Communication link: if the panel communicates via MPI, watch the "Online" indicator on the screen. If it shows "Offline" or "Connection failed", check the MPI address of the replacement panel and confirm it matches the source.
7. Time and date: the replacement panel may have a different RTC battery state. Verify the system clock is correct, otherwise timestamps on logs will be wrong and audit trails will be inadmissible.
8. Operator acceptance: hand the screen to the operator for a 10-minute observation period.

Document each verification result on the commissioning sheet. If any fail, do not return the system to operations until the failure is diagnosed and resolved.

Troubleshooting Matrix: Common Failure Modes

What To Do If the Original Project Source Is Lost

The TP270 CF backup procedure preserves the compiled runtime binary (*.fwx) but not the editable project source (*.hmi). If the engineering station also has no archive, the panel can be kept in service but cannot be edited in WinCC flexible. Field-engineer mitigations:

1. Upload the running project from the panel via ProSave (Start > Transfer > Upload). This recovers the compiled binary, which can be reverse-compiled with WinCC flexible's "Reverse" function (where licensed) to recover most of the screens, tags, and scripts.
2. Extract tag and screen information from the running panel using the ProSave tag export utility.
3. For recipes, the values live in SRAM and are preserved by ticking "SRAM data" on the backup. Once restored to the new panel, they remain editable.

Frequently Asked Questions