TP270 Source Recovery: Enabling Back Transfer on Siemens HMI

1. Problem Statement: TP270 Project Source Unavailable

Engineers responsible for legacy Siemens installations frequently encounter a TP270 (or related TP170A / TP170B / TP270 / TP370) panel whose compiled runtime is on the device but whose editable source project (.hmi, .pdb, .sdf, .ldf) is no longer available on the engineering workstation. The typical trigger is a panel replacement, a failed workstation disk, or a project handover where the original integrators did not archive the WinCC flexible / ProTool source. Without the editable project, screen modifications, tag remapping, alarm retext, and recipe structure changes are blocked at the engineering level even though the panel still runs the original runtime.

The critical gating factor in this scenario is the Enable Back Transfer checkbox in the transfer dialog. When this option is not ticked at the moment the project is compiled and downloaded to the TP270, the panel stores only the runtime executable, the compiled tag database, and the language resources in a form that ProSave and the WinCC flexible transfer utility treat as read-only. Although the runtime can still be backed up bit-for-bit, the editable project structure is not preserved in a format that the engineering tool can re-open.

2. Why Decompilation of TP270 Runtimes Is Not Supported

The TP270 (Siemens order number 6AV6 545-0BA15-2AX0 for the 10" color version, 6AV6 545-0BB15-2AX0 for the 12" version) runs an embedded Windows CE image plus a Siemens runtime interpreter. The project that an engineer authors in WinCC flexible 2004 / 2005 / 2007 / 2008 SP2 / 2008 SP3 or in ProTool/Pro 6.0 SP2 is compiled into a proprietary runtime image. The compile step performs the following irreversible actions:

• Strips all editor metadata: screen grid snap points, object z-order, grouped-object membership, layer assignments.
• Discards source code comments and tag documentation strings.
• Replaces symbolic tag names with internal handle IDs, removing the symbolic→address mapping from the public file.
• Compiles scripts (VBScript, C-Script) into a p-code form whose operand names are reduced to numeric indices.
• Reduces dynamic dialogs, animations, and indirect addressing to compiled lookup tables.
• Converts the multi-language text library to a tokenized resource that indexes into compiled string tables.

Because the mapping from runtime token back to source symbol is not retained in the panel image, no Siemens-supported path exists to round-trip the runtime back into an editable WinCC flexible project. This is by design, not a tooling oversight — it is a deliberate protection of integrator IP and a reflection of the fact that the source representation carries information that simply does not survive the compile.

3. What ProSave Can and Cannot Do

ProSave is the Siemens service and backup utility that ships with WinCC flexible (\Programs\Siemens\Automation\WinCC flexible\\Support\ProSave.exe) and with ProTool. It communicates with the panel over MPI, PROFIBUS, Ethernet (PROFINET on later panels), or USB. ProSave's documented capabilities on a TP270 are limited to:

1. Backup — copies the entire panel image (firmware, runtime, recipe, logs) to a .psb / .brf container on the engineering PC.
2. Restore — writes a previously captured image back to the panel, typically used for cloning spares or recovering a bricked unit.
3. OS Update — pushes a Windows CE image (TP270B variant) or the panel's internal CE loader.
4. Authorization — installs / removes runtime license keys.
5. Reboot / Reset to factory defaults — clears persistent storage.

4. Step-by-Step: Verifying Whether Back Transfer Data Exists on the TP270

Before giving up on source recovery, confirm what is actually inside the panel. The TP270 stores the editable project on the internal flash under the project name, but only if the checkbox was active at the time of the original download. Use the following procedure:

1. Connect the engineering PC to the TP270 via Ethernet (TP270 6" / 10"), MPI (TP170A), or PROFIBUS. The TP270 10"/12" Multi Panel exposes a standard PROFINET interface at 10/100 Mbit/s.
2. Start ProSave. Under Device type select TP270 6" / TP270 10" / TP270 12" matching the actual device (read the rating plate, e.g. 6AV6 545-0BA15-2AX0).
3. Set the connection parameters: IP address, subnet mask, router. For MPI/PROFIBUS, set the bus address (default 1, panel default 1, PG default 0). Set baud rate to 1.5 Mbit/s for MPI or 1.5 / 3 / 6 / 12 Mbit/s for PROFIBUS as negotiated with the PLC master.
4. Open the Backup tab and run Read backup from device. Specify a destination path. This produces a single .psb container.
5. Open the .psb in 7-Zip or WinRAR. The TP270 backup container is a plain ZIP-style archive with a Siemens-specific header. Inside you will see firmware files, runtime files, and — if present — a folder named after the project that contains the back-transfer-compatible bundle.
6. Look for the *.bck file or a directory with extension .bck. If you find one, the editable source is preserved and you can open it in WinCC flexible with Project → Open → From transfer (or by direct import).
7. If no .bck is present, the project on the panel was downloaded with Enable Back Transfer disabled. The remainder of this article applies.

5. Step-by-Step: Best-Effort Recovery Using a Fresh WinCC flexible Project

When the original .bck is absent, the only engineering-grade path is to author a new project from scratch. The technique below lets you at least import the panel's runtime tag list, alarm classes, and connection settings by performing a back transfer from a freshly authored empty project. This will not recover screens, but it can be used as a baseline for re-engineering.

1. Launch WinCC flexible 2008 SP3 (or 2008 SP5, the last release with TP270 support). Newer TIA Portal WinCC releases do not support TP170/TP270 panels — they support Comfort Panels and later. Selecting the right tool version is therefore mandatory.
2. Create a new project. In the New Project wizard, pick the exact TP270 device variant. The device catalog entry determines the available screen resolution (800×480 for the 10", 1024×768 for the 12") and the maximum number of tags, alarms, and screens.
3. Configure the Connections node to match the panel's runtime connection to the PLC. The TP270 supports SIMATIC S7-300/400 MPI, S7-300/400 PROFIBUS, S7-200 PPI, and OPC. Set the PLC address, rack/slot (for S7-300/400), and the bus profile.
4. Configure the panel's Device Settings to match the physical TP270: transfer channel, time zone, language, screensaver, and the like.
5. Save the empty project locally.
6. From the WinCC flexible menu, select Project → Transfer → Back Transfer. (In the German edition: Projekt → Übertragen → Rückübertragung.)
7. In the Back Transfer dialog, choose the connection to the TP270 and start the back transfer. WinCC flexible reads from the panel what it can — primarily the active runtime configuration, the tag database visible to the runtime, and the connection parameters — and merges them into the open project.
8. After the back transfer completes, inspect the new project. You will see that the Connections and Tags nodes are now populated, but the Screens node will be empty. Alarms and recipes will be partially recovered if the runtime persists them in a way that the tool can interpret.

6. Procedure: ProSave Image Restore to a Spare TP270

When source recovery is impossible and the goal is to keep the same runtime working on a replacement panel, the workflow is image restore. This is the only operation ProSave can perform end-to-end without source files.

1. Identify the target panel. The replacement must be the same model (e.g. 6AV6 545-0BA15-2AX0). Mixing models, even within the TP270 family, will fail the restore or produce a mismatched image.
2. Connect the engineering PC to the target panel. Use Ethernet where possible; PROFIBUS / MPI is supported but slower.
3. Launch ProSave. Set Device type to the replacement panel's exact order number.
4. Open the Restore tab. Browse to the .psb captured in step 4 of section 4.
5. Start the restore. The panel reboots and the flash is rewritten. Do not interrupt power during the restore; an interrupted restore on a TP270 leaves the panel in a state recoverable only via OS update.
6. Verify the panel boots to the original runtime screen.

7. Tag-List Forensics from Runtime Logs

Even when source and screen cannot be recovered, the tag list and alarm history are often recoverable from runtime logs if the panel was configured to log them to the storage card. ProSave's backup captures these as raw CSV. The forensic procedure is:

1. Restore the panel image to a spare TP270 as described in section 6.
2. Mount the spare panel's storage card on the engineering PC using a CF card reader (the TP270 uses Type I CompactFlash).
3. Open \Logs\AlarmLog.csv and \Logs\TagLog.csv in a spreadsheet. The CSV columns are typically: timestamp, trigger, tag name, value, quality.
4. Use the tag names appearing in the log to bootstrap a new WinCC flexible project. Cross-reference against the PLC's tag table in STEP 7 (TIA Portal or classic) to identify which tags the panel was reading and writing.
5. If the original STEP 7 project is also lost, the runtime log is your best surviving record of the I/O map.

8. Recommended Workflow for a Defective TP270 with Unknown Project

When the existing TP270 is defective and you need to put a new panel into service in the shortest possible time without a source file, follow this prioritized procedure:

9. Best Practices to Prevent Future Source Loss

The TP270 / WinCC flexible ecosystem has no source-control integration comparable to TIA Portal's multi-user server. The integrator is responsible for archiving. The following practices are field-proven to prevent the situation this article addresses:

• Always check Enable Back Transfer in the WinCC flexible transfer dialog for every download. This adds roughly 1.5× the transfer time and 5–15 MB of flash footprint, but it makes the panel a self-contained backup of the editable project.
• Use the Project → Archive function (produces a .zip with the project + revision metadata) and store the archive in a controlled VCS — even a network share with read-only ACL is vastly better than a single workstation.
• After every successful download, run a ProSave backup. Store the .psb in the same folder as the project archive. The .psb guarantees image-restore ability even if the source archive is later corrupted.
• Document the order number, firmware version, and WinCC flexible version on a label on the back of the panel. The TP270 series spans at least three firmware generations; mismatching versions during a restore causes subtle tag and alarm behavior changes.
• For multi-panel machines, keep a one-to-one mapping of TP270 order number, runtime version, and the engineering PC that authored the project.

10. WinCC flexible Version Compatibility

Selecting the correct WinCC flexible version is critical because TIA Portal cannot open TP270 projects. The compatible versions and their support windows are:

When authoring a new project for a TP270, install the latest 2008 SP5-compatible build available in your organization. Mixing a 2004 project with a 2008 SP5 runtime can produce warnings during compile; in some cases the compiler silently upconverts and the project then refuses to open in 2004.

11. Hardware-Specific Limits to Remember

The TP270 has hard limits imposed by its image and by WinCC flexible's compiler. Knowing them prevents misdiagnosis when the new project refuses to compile or transfer:

• Tags: 2048 internal + external, of which 1024 are power tags.
• Screens: 500 max.
• Screen objects per screen: 200 (TP270 6"), 400 (TP270 10"/12").
• Alarms: 4000 bit-triggered, 500 analog, 500 discrete.
• Recipes: 500 with 1000 data records each.
• Languages: 5 online-switchable.
• Scripts: 100 VBScript functions, 100 KB per function.

If a recovered tag list contains more entries than the panel's tag limit, the runtime will silently drop excess tags and you will see "tag not found" errors on screen. Trim the recovered list to the limits above before re-engineering.

12. Verification Checklist After Recovery

After any recovery — whether image-restore or fresh-project back-transfer — verify the panel is functionally equivalent to the original:

1. Power-cycle the panel; confirm clean boot to the home screen.
2. Verify the PLC connection: open a screen with a live tag, confirm the value updates from the PLC.
3. Toggle each configured alarm trigger; confirm the alarm text matches the original.
4. Open each recipe; load and save a record; confirm round-trip integrity.
5. Exercise one VBScript function (if present) with a forced input; confirm the script runs without compile error.
6. Test language switching if multi-language is in use.
7. Check the panel's time zone and DST setting; TP270 panel time mismatches are a common source of post-recovery alarm-timestamp complaints.