TP700 Comfort Won't Boot: Recovery via ProSave, MMC, USB

1. Problem Statement: SIMATIC TP700 Comfort Stuck on Splash

A SIMATIC TP700 Comfort panel (6AV2 124-1GC01-0AX0 / 6AV2 124-1MC01-0AX0 / 6AV2 124-1QC01-0AX0 variants depending on the 7", 9" or 12" touch generation) presents a hard-freeze condition in which only the Siemens boot logo is displayed, and no further progress is made to the loader or runtime. The panel does not respond to touch, the configured project does not load, and there is no reachable HMI device on any of the available interfaces (PROFINET, PROFIBUS via the IF1B port where fitted, or USB host). In this state the operator cannot enter the loader through the touch area to trigger a manual reset, so all recovery must be performed out-of-band through Siemens service tooling (ProSave / ProAgent) or via removable media (MMC / SD / USB).

This article documents the field-proven recovery path for a TP700 Comfort panel that has lost its runtime image, has a corrupted internal flash, or has a misconfigured PROFINET device name that prevents loader startup. The methods below cover:

• Factory reset through ProSave over Ethernet using the MAC address of the panel.
• Operating system / image restore through an external MMC / SD card when the loader is still reachable.
• USB image reload when only the bootloader is functional.
• Hardware-level checks to determine if the panel must be returned for repair.

2. Root Cause Analysis

The TP700 Comfort runs Windows CE / Embedded Compact as the underlying operating system with the WinCC Comfort runtime on top. A freeze on the splash logo is typically caused by one of the following conditions:

Begin triage by checking whether the panel's PROFINET LEDs (Link / Activity on X1) flash, whether the loader web UI responds on port 80/443, and whether a simple ICMP ping (default IP fallback 192.168.1.100 / DHCP-fallback) reaches the device. The combination of "logo only, no PROFINET link" usually indicates a corrupted image; "logo only with link, but no loader" usually indicates a PROFINET name or address mismatch.

3. Pre-Recovery Checklist

Confirm the following before initiating any recovery action. Skipping these steps is the single most common reason a TP700 remains bricked after a failed first attempt.

1. Capture the panel's MAC address from the rear label. Format: 00-0E-8C-xx-xx-xx (or 28-63:36 and 40:16:9F blocks depending on hardware revision). The MAC is required for ProSave's Ethernet recovery path.
2. Identify the panel's article number (6AV2 124-1xxx) and the firmware version currently flashed (visible in the loader, or in the original TIA project under "Devices & Networks > Device properties > Firmware version").
3. Install the matching version of ProSave. ProSave ships with every WinCC Comfort/Advanced DVD and with every TIA Portal installation. Use the same version line as the firmware to avoid image-loader incompatibilities.
4. Verify the engineering PC's PG/PC interface assignment: the panel cannot be reached on S7USB for a factory reset on a TP700 Comfort; you must use Ethernet (TCP/IP) routed via the panel's MAC address.
5. Place the engineering PC on the same subnet as the panel's fallback IP (192.168.1.x / 255.255.255.0) or assign a static IP within that range.
6. Prepare a USB stick formatted as FAT32 if you intend to attempt the USB image reload path. Use a stick <= 32 GB; larger sticks may not be recognised by the panel bootloader.

4. Method 1: Factory Reset via ProSave over Ethernet (Primary Recovery Path)

The supported factory-reset channel for a TP700 Comfort panel that still powers up is ProSave over Ethernet using the panel's MAC address as the addressing key. The S7USB channel is not supported for factory reset on the Comfort line; attempting it will produce a "cannot establish connection" error and has been the cause of many repeated dead ends in field tickets.

4.1 PG/PC Interface Configuration

1. Open "Set PG/PC Interface" (Start > Siemens Automation > Set PG/PC Interface).
2. Select the access point used by ProSave (default: "S7ONLINE" or "ProSave").
3. Assign the interface parameter "TCP/IP (Auto) -> <your LAN adapter>". Do not select S7USB; the TP700 will refuse this channel for a reset.
4. Confirm and close the dialog.

4.2 Initiating the Reset in ProSave

1. Launch ProSave (Start > Siemens Automation > ProSave).
2. Set "Device type" to TP700 Comfort.
3. Set "Connection" to Ethernet (TCP/IP).
4. Click "Connect". ProSave prompts for the panel address.
5. Enter the panel's MAC address. Format: 00:0E:8C:xx:xx:xx (colons, no dashes).
6. If the panel responds, ProSave lists its current firmware and runtime version.
7. Select the menu "OS Update" (operating-system restore) or "Restore Factory Settings" depending on what you need:
   • OS Update: re-flashes the WinCE image only (does not touch project data).
   • Restore Factory Settings: clears the project, recipes, passwords, and PROFINET name.
8. Point ProSave to the matching *.img file from your WinCC Comfort installation media (default location: C:\Program Files\Siemens\Automation\WinCC\Images\TP700\ or the TIA Portal installation under Support\Images\).
9. Confirm the dialog. ProSave transfers the image (~250-400 MB depending on build), verifies the checksum, and reboots the panel.

The full procedure is documented in Siemens Support entry ID 19701610: "How do you reset a SIMATIC Panel to factory settings using ProSave?" and the WinCC Comfort manual on the Siemens Support Portal.

5. Method 2: MMC / SD Card Recovery

If ProSave cannot establish a connection (the panel does not respond to MAC-address discovery, or the loader is not active), the MMC/SD restore path is the next step. The TP700 Comfort (depending on variant) has either an SD card slot at the rear or accepts an MMC adapter. The procedure works only if the bootloader is still intact enough to mount external storage; if the panel is fully bricked, fall through to the USB image method.

1. Prepare an SD/MMC card formatted as FAT32 with capacity ≤ 32 GB.
2. Copy the firmware image file(s) onto the card. The exact filename expected depends on the image generation; for V14 / V15 / V16 Comfort images the file is typically TP700.fw or TP700.img at the card root.
3. Power off the panel.
4. Insert the card.
5. Hold the touch area in the upper-left corner while powering on. The panel should enter service/loader mode.
6. From the loader menu, select "Restore from MMC/SD" (menu wording varies by firmware version; V13 SP2 and newer have an explicit "External storage" entry).
7. Confirm the prompt. The bootloader re-flashes the internal NAND from the card.
8. Wait for the panel to reboot automatically. Do not remove mains power during the flash.

Full reference: Siemens Support Portal > WinCC Comfort > "Restoring the panel image via external storage" (search entry 19701610 series).

6. Method 3: USB Image Reload

If the panel's bootloader can still mount a USB mass-storage device (i.e. it can detect and read files but cannot enter the loader UI), the USB path becomes the last software-level recovery before hardware repair.

1. On a Windows PC, insert a USB stick and format it as FAT32 (default cluster size).
2. Create the directory structure expected by the bootloader: \SIMATIC\HMI\ (older revisions) or simply place TP700.fw at the root (current WinCC Comfort / TIA Portal images).
3. Copy the firmware image extracted from the WinCC Comfort installation media into that directory.
4. Some firmware versions additionally require a Boot.bin and a HwConfig file. If the first attempt fails, copy the entire \Support\Images\TP700 directory of the TIA Portal DVD onto the USB stick.
5. Insert the USB stick into the panel's USB host port (the upper X60 USB-A socket on the rear).
6. Power on the panel. The bootloader polls the USB port; if a valid image is found, it prompts automatically.
7. Confirm the prompt via the touch area (loader screen) or, if the touch is unresponsive, by waiting ~30 s and observing the PROFINET LEDs (Link LED blinks rapidly during transfer, then settles).

If the panel never reads the USB stick (no LED activity, no prompt), the bootloader itself is corrupted; this is the failure mode that requires a hardware repair.

7. PG/PC Interface Diagnostic Matrix

Symptom-to-action mapping for the most common states encountered during a TP700 recovery. Use this to determine whether the panel is reachable or whether the host configuration is the actual fault.

8. Hardware Failure Diagnosis

If after attempting all three software paths the panel remains unresponsive, the failure is almost certainly hardware. Indicators that confirm a hardware fault:

• No Link LED on PROFINET port X1 with a known-good patch cable connected to a known-good switch.
• Power LED off, or panel drawing less than its rated ~1.0 A at 24 V (typical TP700 Comfort consumption is 0.9-1.4 A depending on variant and backlight level).
• Touch controller unresponsive even in the loader; touchscreen LED backlight works but glass does not scan.
• Display shows vertical/horizontal banding, white screen, or partial image with frozen pixels: indicates a damaged TFT backplane or LVDS link failure.
• Buzzer beeps continuously at boot: signals bootloader-detected hardware fault (check Siemens diagnostic log via ProSave if reachable).

9. Verification and Commissioning

After any successful recovery, validate the panel before returning it to production. The following sequence exercises every subsystem that could have been affected by the flash.

1. Power-cycle the panel three times consecutively. Confirm clean boot to loader each time, no halt, no watchdog reset.
2. In the loader, verify the firmware version matches the project's target version (e.g. WinCC Comfort V17 Update 2 on a V17.0.0.2 TIA project).
3. Set the PROFINET device name and IP via the loader or via TIA Portal "Online > Accessible nodes".
4. Transfer the runtime project from TIA Portal (HMI device > "Download to device > Software (all)").
5. From the loader, run "Calibrate touch screen" if the project uses absolute touch positions; some builds require recalibration after a factory reset.
6. Transfer recipes and user administration from the TIA project. Verify with a test login.
7. On the connected PLC (S7-300 / S7-400 / S7-1200 / S7-1500 / LOGO! / ET 200SP CPU), check that the HMI connection is up via the diagnostic buffer.
8. Test every screen and every alarm class. A factory reset clears all runtime alarm classes; verify that they reload from the project.
9. Re-check time / date and timezone; the RTC is preserved by the battery but a long discharge period during shipping can cause an obvious drift on first boot.

10. Preventive Recommendations

For installations where the TP700 Comfort is part of a regulated line, add the following safeguards to reduce the probability of needing the recovery path:

• Maintain the engineering source as the single point of truth. Always re-generate the panel image after a TIA update; never rely on the running panel as the source.
• Use a UPS for the panel's 24 V supply in installations subject to brown-outs. The Comfort line's flash write cycle is most vulnerable to power loss.
• Document the panel's MAC address and PROFINET device name in the asset record. A 30-second entry at commissioning saves an hour during a recovery.
• Schedule a yearly full-image backup via ProSave's "Backup to PC" function. Store the backup in the engineering repository.
• For firmware updates, always use ProSave's OS Update function rather than the in-project HMI firmware upgrade. ProSave has a more robust recovery path on failure.

11. Summary of Recovery Decision Tree

1. Panel boots to logo only, loader unreachable, PROFINET Link LED active → ProSave OS Update via Ethernet / MAC.
2. Panel boots to logo only, loader unreachable, PROFINET Link LED off → Verify cable / switch; if cable and switch are good, hardware fault, return for repair.
3. ProSave reachable but project corrupted → ProSave Factory Reset, then re-download the project.
4. Loader reachable but ProSave still fails → MMC / SD restore of the firmware image.
5. Loader cannot mount MMC / SD → USB image reload.
6. USB path fails → Bootloader itself corrupted; hardware repair required.

Documented official references: WinCC Comfort V17 manual SIMATIC HMI WinCC Comfort V17 manual entry 109773506; ProSave / factory reset entry 19701610; TIA Portal Help Portal 109779176.