Want to change Simatic OP/TP without configuration .hmi file? Want to change Siemens PLC program without backup?

The company that made software doesn't exist anymore?

It is possible to access and change PLC S7 CPU program!
It is even possible to make corrections in OP/SCADA!

We can help even off-site! This email address is being protected from spambots. You need JavaScript enabled to view it.

How we work

OP/SCADA level: We can change texts (labels, alarms, lists) of Siemens HMI even without configuration file. The following Simatic panels and devices can be text-changed without source code (runtime programs of panels can be modified without configuration file): WinCC Flexible SCADA (PC-Runtime), Mobile Panel 170, Mobile Panel 177 DP, Mobile Panel 177 PN, Mobile Panel 277, Mobile Panel 277 IWLAN, OP77B, TP170B, OP170B, TP170B mono DP, OP177B mono DP,TP170B color PN/DP, OP177B color PN/DP, TP270, OP270, TP277, OP277, MP177, MP270, MP270B Touch, MP270B Touch, MP277 Touch, MP277 Touch, MP370 Touch, MP370 Touch, MP377 Touch, MP377 Touch, C7-635 (TP170B, OP 170B), C7-636 (OP 270). You can send us backup from device and we will make changes and send you modified runtime which will be loaded to device. Aletrnatively we can do everything on your site! Each and every forum claims that is impossible to make changes only with fwd file/fwx file/fwc file. We are here to say that we can do it!

If you need major changes on your Simatic panel (adding buttons, new screens, removing objects) – it is also possible. We can rebuild a new Simatic HMI configuration file and changes based only on runtime file. Our specially designed tools enable us to do it in a fast and reliable way and thus to make it much cheaper than competition. Furthermore, those actions seem impossible for most automation engineers. Read our case studies and small guide designed especially for maintenance colleagues and find out about the possibilities for reconstruction and how we can change HMI programs.

PLC level: We are coming to your site, make a check-up, make access to S7 300 program and any changes you need - without damaging the original system.

Case study (1): panel MP277 + PLC S7-315-2 DP. Translation of panel texts; PLC changes.

Foundry - Radijator ltd, Zrenjanin, Serbia

MP277: original screen VS translated screen

One of south east european more famous and biggest foundries – Radijator, ltd, has recently purchased an used line for sand preparation. They have done the installation, defect detection, reparation and installation checkups. The final step was changing of control system, but configuration files were unavailable. Luckilly, they engaged our company and we made all necessary changes.
HMI level: all the texts were extracted, translated and downloaded in the panel program.
PLC level:
- Removal of series of actuators which had been excluded from the original platform
- Some changes of algorithm
- Interface and integration with other systems
It should be also said that the good knowledge of the process and the system that the colleagues from the maintetnace had, was crucial for the success of the job.

Case study (2): panel TP170A + PLC S7-314. Restauration of HMI program in order to add new objects; PLC changes – adding of new devices.

Gazpromneft NIS ltd – Oil refinery Pancevo, Serbia

TP170A: original screen VS changed screen

The existing sootblower system in refinery's Power Plant consisted of 6 sootblowers. The reconstruction was conducted in order to add a new sootblower. Configuration files were unavailable and at one moment they thought it was necessary to write whole program from the stretch. Then they engaged our company and we made only changes – so we saved both time and money.
HMI level: Restauration of HMI program in order to add a new blower (new selection buttons, parameters, alarms; renumbering of all sootblowers).
PLC level: new blower functionalities incorporated.

Case study (3): panel MP370. Translation of panel texts.

Wood processing industry "Rajcanka", Gradacac, Bosnia and Hercegovina

MP370: original screen VS translated screen
The factory obtained used boiler, the equipment was installed, but the language of HMI was Italian – not understandable for technicians. They thought it was unpossible to translate without configuration files so they tried to translate in paper and to stick (20!) papers near panel. Luckilly, they found us and we translated all texts directly on panel.

Case study (4): panel OP77B. Translation of panel texts.

Foundry - Radijator ltd, Zrenjanin, Serbia

OP77B: original screen VS translated screen
Foundry obtained used machine. There was no need to change PLC program, but panel language was not understandable for technicians, so we made translations directly on runtime file.

What are the available options when reconstructing a used Simatic S7 system?

A control system generally consists of PLC and HMI device, which is either an operation panel or SCADA. A programmer makes programs both for PLC and HMI. These programs contain code comments and symbolic names of variables. Those follow notation given in a project and defined by technology, user's needs and programmer's feelings about what should be clarified in order to do a program maintenance as simply as possible. Such programs are called configuration programs. When you download them in PLC/HMI , the program is compiled. The final program within a device is called a runtime program. A common feature of all runtime programs is that they don't have any comments or symbolic designation.
It should be pointed out in the beginning that it is in your interest to have a configuration programs. You, as a system owner, will be able to make changes to your system with configuration versions. You won't exclusively depend on a company that made a software. It is advisable to assure deliverance of all passwords and configuration files before the beginning of a project, in a negotiation phase already. The fact is that users either don't think about it or mean that they will get them. But nothing is implied. In fact, an automation company will rather try not to deliver them. Sometimes they want to protect their specific solutions, sometimes they want to be exclusive supliers. Whatever the reason may be, the interests are legitimate, so negotiation should be a place to deal with this problem.

One way or another, you don't have configuration files...

Either you need some changes or not, try to get contact with the company that made the software. Ask them to send programs to you. If it doesn't work (they don't want to or the company doesn't exist anymore), you should make a runtime backup. Runtime programs can be uploaded from running Simatic devices. Those backups primarily serve to download the program into identical spare PLC/HMI in case of a device breakdown. Don't wait for the system to breakdown – make a backup straightaway! Assign this task to a professional, because there are a lot of options – even the one with a possible configuration file hiding within a device.
Runtime backups are not meant for changes. The majority of programmers don't want to deal with changes and both Siemens and forums claim that most of changes are impossible. However, there are solutions...

Changes to Simatic panel programs/SCADA

We can start from the most delicate case. A backup panel can be made with Siemens Prosave program or with USB/memory card – for devices that have these slots. We also recommend taking photos of all the screens, so that you have recordings of parameters values.
Prosave program will make a binary backup that you can do nothing with, except from downloading it to an identical device when the original one breaks down.
The situation is pretty different with devices that have a USB/MMC slot. You could also download such backup into identical device. The other option when a device breaks down is to get an adequate runtime license from Siemens and to run a backup panel made on a card on your computer. No matter how helpful this can be, it is a temporary solution before you get a new panel. Apart from a problem of replacing physical buttons with different robust combinations on the keyboard, there is another problem which is even more problematic: a laptop can't be exposed to a dusty/humid/hot environment/inaccessible place for long, where usually the panel is located.
But what can you do if you need a change on a panel? Surf the Internet: everyone unanimously says that it can't be helped. We have a solution, though! With backup by means of USB/MMC it is possible to make changes to texts on the panel (alarms, labels on buttons and objects, list text, help text). In this way you can do update of a terms after technological or mechanical changes on a system have been made. Even more extreme case is when terms are in a foreign language. It is possible to translate and insert your terms into a panel. Production stoppage – 0 minutes. There is only one restriction to those changes: replacement terms (strings) can't be longer than the original ones. However, this rarely makes a problem.
In many cases these changes will be enough. Unfortunately, in cases when you need to add or remove an object (a button, an image, a list, a new screen) – no runtime backup can be changed.
Some alternatives are available even in this case, though.
If the changes are minor or clearly divided from the main system, you can build in an additional panel with only additions displayed. On PLC level it is usually not a problem to add something within the same PLC. Some IO cards will be added, if needed.
If changes are dispersed, an additional panel can't be a solution.

There are two options:
1 A total reconstruction, which implies making a new PLC program and new HMI program
2 Rebuilding panel program and adding corrections + making only additions on PLC level

A total reconstruction is common in practice. It is always difficult to make your way in someone else's code, especially if there are no comments. Besides, most of the programmers believe that it is impossible to make a new HMI program based only on the old runtime. The benefit of a total reconstruction is beginning from a clear situation, someone else's solutions are avoided and user's demands are easier to implement. The drawback of a total reconstruction is having to pay for two new programs and indirectly even for a technologist, that is "know – how". The unavoidable production stoppage has to be taken into account, too. The stoppage in itself can't be short since the whole system is made from the beginning.

An option where a small addition is made on PLC level and HMI program is rebuilded and changed according to needs is unfamiliar among most programmers. The problem is that what can be actually observed are buttons, texts and input/output fields, but the most important can't be seen: tags hit by HMI. There is no typical way to locate them.
We wanted to tackle this problem so we made a series of tools which detect tags and activate them. In this way it is possible to reconstruct a panel program. The reconstruction itself is more comfortable for a user. The benefits also cover lower expenses: you only pay for making additions on PLC level and making HMI program. It also should be considered that a technological know – how is hidden on PLC level, so the expenses are further reduced. The stoppage is shorter, too, since it is always possible to use the existing HMI during commissioning and start – up.

Obsolete panel case

If you have an obsolete Simatic panel and you want to obtain a spare one, you will realize that old models cost more than new ones. Especially if the application is simple, you should consider a possibility of reconstructing the program. You will get a configuration backup that you will be able to download into a new panel. The price of reconstruction is comparable to the difference between prices of an old and a new device and the advantage is incomparable.

You are surely interested to know how to rebuild configuration from a runtime backup of a Siemens panel

A backup made by means of USB/MMC slot is used as a pattern and it is run on a computer. It is, of course, possible to use the original running panel, but it is usually unavailable or impractical. It is also a must to have a backup of a PLC program and it is also good to have electrical drawings, manuals and similar documentation. The first step is making screens (buttons, texts, images) based on the original. This is the easiest part of the job.
It is followed by detection of conditionally visible objects, as well as tags. For detection of objects and tags it is necessary to develop a special PLC program with the adequate interface. For majority of programmer colleagues it is an unachievable task.
Conditionally visible objects are buttons and structures which appear only if tags have a specific value. Although there is endless number of combinations, in practice it comes down to "normal" cases which are routinely detected. A user can also give guidelines what to look for and under which conditions. Detection of tags covers the detection of addresses, the type of the tag, the type of activation, field format, the upper and the lower field limit. In great majority of cases one button activates one tag, but it is necessary to investigate each object more closely, since in principal there can be a lot of tags on each object.
The tags are entered in an Excel file and in VAT tables which will serve later for a test of a constructed panel. Then the detected tags are attached to the made objects. In the end, the resulting program is tested. It is done in the following way: both the old and the new programs are activated and the reaction is observed on the screen and in the VAT tables. The tests are conducted by two programmers working together.
Almost all functionalities are detected routinely and copied successfully. Detection of jobs and scripts can cause problems, but luckily those are the things that can be either solved in another way or are peripheral to the basic performance of a system. It is important to emphasize that in the meantime a user can use the existing program and panel. After internal testing has been completed, a newly made program is downloaded and it is tested on site. Since a panel is in question here, testing is usually reduced to one cycle of operator's work, without any disturbance of production.

PLC S7 300/400 level

It is evident that it is important to save backup of this program as well. Do not forget to take photos of HMI screen or to record set values of parameters in some other way. Any changes on PLC level are more accessible than on HMI level. Hardware platform is modular, in principal it is possible to add IO cards or communication cards. Processors are compatible to great extend, so, if it is necessary it is possible to replace the existing one by another model with minor programmer's interventions.
There is another thing that can make some of a problem: MMC password and similar protections. The programmers set them to protect intellectual property or, more often, to protect the system from curious adventurers. If you search on the Internet, you will see that Siemens' attitude is that there is no official way to avoid such a protection. What you should do is contact the company that made the software, which actually is the right way. However, the real problem arises when the company in question doesn't exist anymore, or if even they don't have your data any longer.
If you Google further, you'll see that there's another way which has been a public secret for a long time now. However, the proper and the most reliable solution is to get into contact with the program designer and to make an arrangement with him. You have to bear in mind that the change of PLC program which doesn't have comments is a feasible, but very painstaking experience. The user should provide the programmer with support of the staff who know the system well: technologists and operators.

Life cycle of equipment analysis

As all others, Siemens devices become obsolete and they are replaced by new models. As we have seen, S7 300/400 controllers are not problematic. It's best to have an identical spare device, but some stronger can serve, too.
The situation with panels is much more complicated. We have seen that the only way out is to have an identical device in stock. Many devices are outdated, some are not produced anymore and for some of them service can't be provided either. There are many companies that sell used equipment, but you have to bear in mind that you buy an old machine with a suspicious electronics which will cause problems sooner or later. The maintenance of old equipment is always more expensive than purchase of new one.
It's been shown again that it's best to have a configuration file. In this case you can transform a program designed for one type of panel into another.
As we have said before, even if you don't plan changes, consider possibility of rebuilding the panel program, since it can be a more favourable solution than buying an old outdated panel.

Conclusion

- Try to get configuration files and all the passwords from a software designer.
- If you don't have them, engage professionals who will securely make backup and give advice about how to make changes, if you need them.
- If you have an old Simatic panel, consider an option of rebuilding the program.
- If you want a reconstruction of Siemens S7 300/400 system, now you are aware of possibility of rebuilding HMI program, which will significantly reduce the costs and production stoppage time.
We are at your disposal!

General hints for obtaining used systems

Here are some simple rules which can save you a huge amount of money, time and nerves.

If you plan obtaining used control system, do the following:

Part of the delivery has to be documentation, too!
Check all the documentation as soon as you can - previous owner often delivers only partial or even wrong files.
Try to obtain support of former personnel (technologists, mechanical/electrical engineers, operators).
Find the company who made software.
Obtain all configuration files and usernames/passwords.

Used control system has come to your plant:

You must find enough time for detailed instalational and functional checking. If you miss to do it, it will find you in the middle of production!
Make backup of all softwares. Sooner or later, everything breaks down and used systems even faster. Don't let yourself be without backups. You can see here how to perform backup/restore on Simatic panels.
If you need any software changes, it is best to contact the company that made software.
If you cannot find original software company, we can help!