WinCC Flexible 2008: Create an OP270 Project from a Panel Backup

Overview

This procedure recovers and rebuilds a SIMATIC HMI project for the OP270 operator panel from a panel-side backup (.hmi_cmp archive). Engineers routinely inherit OP270 installations where only the runtime backup survives - the engineering source on the original PC is gone, the PLC program is the only ground truth for the process, and the HMI screens must be reconstructed or reverse-engineered to enable future maintenance, screen modifications, or migration to a Comfort Panel running TIA Portal.

WinCC Flexible 2008 is the engineering tool for the OP270 series. It supports the OP270-6 (5.7" STN) and OP270-10 (10.4" TFT) variants, with monochrome and 256-color sub-models. Later Service Packs (SP1, SP2, SP3) added driver support and bug fixes; the project file format remained stable, so backups created under any 2008 SP open cleanly in the latest installed SP.

The workflow below covers three scenarios: (1) full restoration of a backup when the .hmi_cmp is intact, (2) creating a new project from scratch when only the PLC program and the physical panel survive, and (3) tracing tag read/write traffic to reconcile the screens against the real PLC tag database.

Prerequisites

WinCC Flexible 2008 Installation and Service Pack Patching

Install the base product from DVD, then apply the latest Service Pack. The Service Pack updates the .NET runtime, the HMI device description database (DDB), and the OPC catalog. Skipping the SP install is the single most common cause of compile errors on restored projects.

1. Mount or insert the WinCC Flexible 2008 DVD. setup.exe autoruns; if not, launch it from the root.
2. Select language and target directory. Default C:\Program Files\Siemens\WinCC flexible 2008.
3. Choose Complete install to include the OP270 device description files; Custom install risks missing the .ddf for the panel variant in use.
4. Enter the license or defer to the ALM later (project opens in demo mode without a license and refuses to compile after a grace period).
5. Reboot. Apply the latest Service Pack. The SP installer detects the base install and applies patches in place; no separate uninstall is required.
6. Verify by launching WinCC Flexible and opening Help > About. The about-box shows the full version string (e.g., WinCC Flexible 2008 SP3) and the build number.

Reference: SIMATIC HMI WinCC flexible 2008 Getting Started - First-Time Users and SIMATIC HMI WinCC flexible 2008 Compact/Standard/Advanced system manual. Both are available on the Siemens Industry Online Support portal at support.industry.siemens.com under the WinCC Flexible 2008 product tree.

Restoring the OP270 Backup to the Engineering PC

The OP270 backup is a .hmi_cmp archive. Inside the archive WinCC Flexible stores the editable engineering source (.hmi), the compiled runtime image (.bin), the recipe database (.rdb), the alarm and tag logs (.ldb), the screen files (.pdl), and any password-protected area data. Restoring on the engineering PC gives you the editable project.

1. Connect the backup medium (CF card reader, USB stick) to the engineering PC.
2. Launch WinCC Flexible 2008.
3. Project > Open. In the file dialog, set the filter to Compressed projects (*.hmi_cmp).
4. Browse to the .hmi_cmp and click Open. WinCC Flexible decompresses the archive to a working directory; by default the working copy lands in %USERPROFILE%\Documents\WinCC flexible Projects\.
5. The decompressed project opens with the project tree expanded: Project > HMI tags, Connections, Screens, Alarms, Recipes, Logs, Area pointers, Schedules, VB scripts.
6. Verify the device selection: Project > Properties > Device. The Device field must show OP270 6" or OP270 10" matching the physical hardware. A mismatch here is the most common reason a project compiles but fails to load at transfer time.

Creating a New Project from Scratch (No Recoverable Backup)

When the backup is unreadable but the PLC program and the physical panel survive, build a new project that mirrors the panel and exposes every tag the PLC expects.

1. Open WinCC Flexible, File > New. The Device Selection wizard appears.
2. Filter by Operator Panel > 270 Series. Pick OP270 6" or OP270 10" to match the actual hardware. The wizard shows the resolution, color depth, and number of function keys; double-check the function-key count matches the physical panel.
3. Set the panel firmware version. WinCC Flexible lists available images; pick the entry whose firmware string matches the panel boot screen. A warning fires at compile if the project requires a newer image than the panel carries.
4. Set the connection type. For an S7-300/400 use MPI/PROFIBUS (PROFIBUS DP for higher baud). For S7-200 use PPI/MPI. For Ethernet-attached PLCs use Ethernet (TCP/IP). PROFINET IRT is not supported on OP270; the panel predates PROFINET.
5. Set the HMI station address (default 1, valid range 1-126 for PROFIBUS, 1-31 for PPI) and the PLC station address (typically 2 for S7-300 CPU 314-2 DP at default).
6. Save the project with a meaningful name (e.g., Plant42_LineA_OP270.hmi). The path must be writable; do not place the working file on a network share because WinCC Flexible holds exclusive locks on the .hmi and adjacent files during compile.

Configuring the PLC Connection and Area Pointers

The OP270 uses standard area pointers to communicate with the PLC: Coordination, Date/Time, Job Mailbox, Project ID, Screen Number, User Version, and optionally Data Record and PLC Acknowledge. Area pointers are data blocks in the PLC that WinCC Flexible reads or writes at the configured polling cycle.

Configure each pointer in Project > Connections > [Connection] > Area Pointers. Specify the PLC DB number, the offset, the length (only required for some pointers), and the acquisition cycle. The coordination pointer is mandatory; the others are optional but recommended for any production-grade OP270 deployment.

Connection Parameters by PLC Family

The HMI address is the panel's own bus address; the PLC address is the destination CPU. On PROFIBUS, the first and last station on the segment must be terminated (resistor ON); intermediate stations have the terminator OFF. The OP270 does not include a built-in terminator, so the bus cable connector (6ES7972-0BA50-0XA0 with PG socket, or 6ES7972-0BB50-0XA0 without) provides the switchable terminator for the last station.

Defining HMI Tags and Cross-Referencing

WinCC Flexible maps external PLC addresses to internal HMI tags. Each tag has a symbolic name, an external address, an acquisition cycle, a scaling rule, and limits. The Project > HMI tags editor is the central registry.

1. Open Project > HMI tags. The tag table shows columns: Name, Connection, Address, Acquisition cycle, Scaling, Limits, Comments.
2. Add a new tag. The Properties dialog exposes:
   • Name - symbolic, used in animations and IO fields. Match the PLC symbol name where possible to keep cross-reference against STEP 7 trivial.
   • Connection - which PLC connection the tag belongs to. A project can have multiple connections (e.g., one to S7-300, one to S7-200).
   • Address - PLC-relative. For S7-300/400: DB<n>.<type><offset>, e.g., DB100.DBW0 (word), DB100.DBD4 (DWORD), DB100.DBX2.0 (bit). For S7-200: V<offset>, VW<offset>, VD<offset>, or symbolic I/O (I0.0, Q0.0).
   • Acquisition cycle - 100 ms typical default; tighten to 50 ms for fast loops, loosen to 1 s for non-critical status. On demand cycles are only polled on event - useful for "load recipe" but not for periodic display.
   • Scaling - linear conversion between PLC raw (e.g., INT 0-27648) and HMI engineering units (e.g., 0.0-100.0 %).
   • Limits - low/high for color or alarm binding on an IO field.
3. For each tag, optionally set Logging (yes/no) and Limits for alarm (analog alarm trigger thresholds).
4. Repeat for every tag the screens need. The tag count for a typical OP270 application runs 50-500 tags.

Tag Address Formats Reference

Note: on S7-300/400, words and DWords must be word-aligned in DBs (offset even). On S7-200, VW0 occupies VB0 and VB1, VW1 occupies VB1 and VB2 - overlapping is allowed but creates aliasing and is a common bug source.

Tracing Data Flow: Read vs. Write, Panel vs. PLC

The original poster's specific question was how to trace which data the panel reads and writes. WinCC Flexible has limited cross-reference compared to TIA Portal but provides three tools that together cover most troubleshooting scenarios.

1. Tag Cross-Reference (Engineering Time)

• Tools > Cross Reference - opens a list of every object in the project (screens, alarms, recipes, schedules, VB scripts, events) that references any tag. Filter by tag, by category, or by screen. The output can be printed or exported to CSV for documentation.
• HMI tags > right-click > Where used - tag-centric view. Shows the same data as the Cross Reference but pivoted on the selected tag.
• The cross-reference covers animation bindings and IO field tag assignments but does not cover VB script dynamic references - those must be traced by reading the script (select the script and inspect the tag access calls).

2. Runtime Tag Simulator (PC-Side Test)

• Tools > Tag simulator opens a panel that exposes selected tags. The simulator overrides the polled value at runtime, allowing screens to be tested against synthetic data without a live PLC.
• Useful to verify that an IO field is reading from the right address (force the tag value, observe the field update) and that a button is writing to the right address (trigger the button, see the value change in the simulator).

3. Live Trace from the PLC Side (Authoritative)

For a definitive answer, observe the PLC. Open the STEP 7 (or TIA Portal with the STEP 7 project imported) project, go online with the CPU, and add the suspected address to a VAT or watch table. Trigger the action on the OP270 and watch the value change in STEP 7.

S7-300/400 CPU security: by default modern firmware blocks HMI-initiated PUT/GET access unless the CPU security setting "Permit access with PUT/GET communication" is enabled. Symptom: connection status shows Online at start, but every tag read returns 0 and every write is silently rejected. Fix in STEP 7 hardware configuration: CPU properties > Protection > check the PUT/GET box.

Building Screens

OP270-10 supports 256 colors at 640x480; OP270-6 supports 16 grayscales (monochrome variant) or 256 colors (color variant) at 320x240. Design the screen template once, then instantiate.

1. Open Project > Screens > Add screen. The new screen starts blank with the panel's resolution.
2. Use the Toolbox (right side) to drop IO fields, buttons, bars, alarm views, recipe views, and graphic objects. Each object binds to one or more tags via its Properties > General > Tag assignment.
3. Configure Events for buttons. The most common events are Press, Release, and Click. Common actions:
   • Set value - write a constant or tag value to a PLC address (e.g., set bit to start a motor).
   • Activate screen - jump to a named screen by its symbolic name.
   • Set bit / Reset bit - set/reset a single bit in the PLC.
   • Logon / logoff - change the user level (operator, supervisor, administrator).
   • Run script - invoke a VB script for compound actions (e.g., write three tags and then trigger a Job Mailbox command).
4. Use Layers (under View > Layers) to separate static template elements (header, footer, navigation) from screen-specific content. Layers simplify template changes: a single edit propagates to every screen that uses the template.
5. For graphics, OP270 supports BMP, GIF, JPG, and PNG. The runtime color-chops PNG to 256 colors. Convert PNGs with alpha channel to 256-color BMP via an external editor (IrfanView, GIMP) to avoid runtime artifacts and minimize flash wear.
6. Use Text and graphic lists (under Project > Text and graphic lists) to externalize labels and icon sets. A single list can be referenced from many screens, so renaming a button or changing an icon is a one-place edit.

Alarms

OP270 supports three alarm classes: Errors (red, must be acknowledged), Warnings (yellow, displayed but not blocking), and System (informational, white on monochrome panels). Configure under Project > Alarms.

For a typical OP270 application, expect 30-200 discrete alarms. Bind the trigger bit to the exact bit position the PLC toggles - off-by-one on the bit index is the most common reason an alarm never appears.

Recipes

Recipes are collections of tags whose values are saved together as a named data record on the panel. OP270 stores recipes on the internal flash or an external CF/USB storage. Configure under Project > Recipes.

1. Add a new recipe. Define the recipe name (e.g., "Batch_Parameters") and the tag list (e.g., 20 tags from the process).
2. Define the data records. The minimum is 1 (just the active values), but production recipes typically have 5-50 named records (e.g., "Recipe_01_ProductA", "Recipe_02_ProductB").
3. Set the storage path: Storage card (CF) or Internal flash. The CF is preferred for archival and easy backup.
4. Use the Recipe view object on a screen to read/write data records. The view can be configured for read-only display, edit, save-as, or transfer to/from PLC.
5. Wire the Data Record area pointer if you need the PLC to coordinate the recipe transfer (PLC triggers load, panel pushes values, PLC triggers save, panel commits).

Recipe round-trip verification: load record 1 to PLC, modify one tag in the PLC, save back to the panel, change to record 2, then reload record 1 - the tag must match the original value. This is the field-proven acceptance test for a new recipe structure.

Logs

Logs are circular buffers on the panel that store tag values or alarm events over time. Project > Logs > Data logs for tag history, Alarm logs for alarm event history. Logs are exported as CSV from the panel's Control Panel or via ProSave backup.

Logs are wrapped: when full, the oldest entry is overwritten. Size them to retain at least 30 days at the configured logging rate. Use the Trend view object on a screen to display a log in real time without exporting.

Compile, Simulate, and Transfer

Compile

Project > Compiler > Compile (or F7). WinCC Flexible checks tag validity, screen syntax, alarm references, and recipe structure. Errors are listed in the Output window with file:line references. Warnings (yellow) do not block transfer; errors (red) must be resolved.

Common compile errors and their fixes:

• Tag address out of range - the DB offset exceeds the DB length in the PLC. Extend the DB in STEP 7 or fix the HMI tag address.
• Duplicate tag name - two tags in the table share the same name. Tag names are project-unique.
• Screen object references unknown tag - a screen element is bound to a tag that was deleted. Use Cross Reference to find orphan references.
• Recipe tag not in any connection - the recipe structure references a tag whose connection is disabled.

Simulate

Project > Compiler > Start runtime simulation. WinCC Flexible launches a PC-side emulator that mimics the OP270 display and behavior. Use the tag simulator to inject values and verify screen reactions without the physical panel. The simulation respects the same area pointer logic as the real panel, including coordination life bit, but does not enforce real-time network cycle times.

Transfer

1. Back up the current panel runtime with ProSave first. A failed transfer can leave the panel in an inconsistent state; only a full OS + project restore recovers it.
2. Set the panel to transfer mode: Control Panel > Transfer > enable (or press the transfer button if equipped). The panel waits on the configured interface for a transfer request.
3. In WinCC Flexible, Project > Transfer > Transfer. Select the transfer channel (MPI/DP, Ethernet, USB, or serial).
4. For MPI/PROFIBUS: ensure the PC Adapter is set to the same baud as the panel and that the PG/PC interface in STEP 7 / SIMATIC Manager is assigned to PC Adapter (MPI) or PC Adapter (PROFIBUS).
5. For Ethernet: confirm the panel's IP is reachable (ping <panel IP>). The OP270 must be on the same subnet; the panel does not route.
6. The transfer progress dialog shows file count, file size, and time remaining. A typical 4 MB OP270 project transfers in 1-3 minutes over MPI 187.5 kbps, in seconds over Ethernet.
7. The panel reboots automatically into the new runtime. Watch the boot screen; any error there is logged in Control Panel > System > Event log.

Verification and Commissioning

After a successful transfer, perform a structured acceptance test before handing the line back to production.

• Connection test: open the connection status screen (a built-in system screen on OP270). All configured connections should show Online. A persistent Offline state points to bus termination, address conflict, missing cable, or a CPU security block.
• Tag spot-check: select 5-10 representative tags - one BOOL input, one BOOL output, one INT, one REAL, one WORD. Trigger the action on the panel and verify the value reaches the PLC; modify the value in STEP 7 and verify the panel updates. Cover both directions on every tag class.
• Alarm flow: force-trip a discrete alarm in the PLC (set the trigger bit in STEP 7). Confirm the panel displays it in the correct color class, that operator acknowledgment propagates back to the PLC handshake bit, and that the entry appears in the alarm log.
• Recipe round-trip: write a recipe data record, save to the panel storage, change to a different data record, restore the first, and confirm values match the original.
• Power-cycle: cycle the panel power twice. The runtime must reload without prompting for transfer and without losing recipe or log data. Watch the boot screen for the firmware and project versions on each reboot.
• User level enforcement: log in as operator, attempt a supervisor-level action - it must be rejected. Log in as supervisor with the correct password, the action must succeed. Tests that the password / user level matrix is loaded.

Troubleshooting Matrix

Migration Path to TIA Portal and Comfort Panels (Optional)

Once the WinCC Flexible 2008 project is stable, plan migration to a Comfort Panel (TP700, TP900, TP1200) running TIA Portal. The Comfort line is the supported successor to the 270 series and is the only path for new features like PROFINET, Sm@rtClient, and the unified TIA engineering environment.

WinCC Flexible 2008 (with the latest Service Pack) includes a project converter: Project > Migrate. The converter exports the project to a TIA Portal V11 / V12 compatible format. Expect manual rework in these areas:

• Custom VB scripts: TIA Portal uses VBScript and C. WinCC Flexible's VB subset differs - some intrinsic functions and tag access patterns need manual translation.
• Graphics without a TIA counterpart: certain WinCC Flexible object types (e.g., the OP270-specific status bar) are dropped during conversion and must be re-implemented with TIA standard objects.
• Area pointers: TIA Portal derives area pointers from the connection configuration; verify each pointer maps to the expected DB and offset after conversion.
• PLC connection: the S7 connection type in TIA differs from WinCC Flexible. Re-verify the rack/slot and TSAP.
• User administration: WinCC Flexible users and passwords must be re-entered in the TIA Portal user administration.

Before migration, document the OP270 backup, the PLC program, the recipe list, and the alarm archive. The migration is one-way editable in TIA Portal: the original WinCC Flexible project remains the fallback if the conversion loses screens or tags. Always run the migrated project in TIA Portal simulator mode for several hours before committing it to a live Comfort Panel.

FAQ