An HMI panel holds one resident project and a download erases it by design, so recovery lives on labeled media. Back up through the system screen before every download, restore through Memory > Restore when a panel changes machines, boot a prepared card in CF1 when a spare panel takes a line, and verify project identity and controller IP before the machine starts.
An HMI panel serving a fixed machine keeps exactly one project resident, and a new download erases the old one. That is deliberate: with a single resident project, a panel that powers up next to a machine can only show that machine's interface, which is what stops an operator from starting equipment against screens and controller addresses written for a different machine. Recovery therefore lives on labeled media, not inside the panel. Back each project up through the panel's system screen before any download, restore through the same menu when a panel has to change machines, or boot a prepared card in the CF1 slot when a spare panel takes over a line. The sections below give the steps, the labeling scheme and the checks that must pass before the machine is allowed to start.
Why the panel holds one project
The behavior is part of the design, and the reasoning is safety. One resident project means the panel sitting at a machine can only run that machine's project, so nobody can power up into an interface whose screens and controller IP address belong somewhere else. A start against the wrong project is how people get hurt and machines get wrecked, so the panel offers no project list to pick from.
This also explains why the common shortcut breaks. Giving each machine its own screen inside one shared project, each screen pointing at its own controller IP address, works only while every machine needs exactly one screen. A screen belongs to its project; it is not a selectable project of its own. The moment a machine needs several screens, the shortcut is gone, and the two honest paths are a labeled backup per machine and a prepared card per machine.
What you need
- A USB pen drive or a CF card per machine for the backup and restore path. The documented menu accepts both media types. A typical HMI project file runs 1 to 5 MB, so one 1 GB card holds well over a hundred backups with room to spare.
- One prepared CF card per machine if you also want the boot-from-card method.
- Labels with three fields on every item: machine number, project revision, date.
- The machine's controller IP address written down where the machine is, not only inside the project.
- One storage slot per machine, a drawer or a binder sleeve, so an operator cannot grab the wrong card in a hurry.
Menu names below follow the documented system screen path. Keep the manual for the exact panel in reach the first time through, since wording differs between panel families.
Back up before every download
- Put the labeled USB pen drive or CF card in the panel.
- On the panel, open the system screen and choose System Screen > Memory > Backup, then save the project to the media.
- Complete the label before the media leaves the panel: machine number, project revision, date.
- Store the media with the machine's controlled project records, not in a toolbox.
- If the project holds recipe files, back those up as well, because the download erases them along with everything else. The steps are in back up HMI recipe files before a project download.
One backup per project revision is the rule, made immediately before the download. Once the download starts, the resident project it replaces is gone, and there is no second copy unless you made one.
If the plan is to edit the project, read the project from the panel before editing so the working copy and the backup start identical.
Restore a project from media
- Confirm which machine the panel will serve, and take that machine's labeled backup. Two backups with similar-looking screens are not interchangeable; the label is the authority.
- Insert the media into the panel.
- Open the system screen, choose System Screen > Memory > Restore, and load the backup.
- Let the panel finish writing before the media comes out.
- Run every check in the final section before the machine starts.
If the machine's controller IP address has changed since the backup was made, correct it through the supported path shown in machine-specific NetVar IP and port settings so the project, the panel and the controller agree again.
If the panel comes back up with no project after a restore, stop and check the media in the panel's slot and the label against the machine's record, then repeat the restore once. If it still fails, switch to the machine's prepared CF1 card and get the line running; diagnose the restore path with the machine stopped.
Run a project from a card in CF1
The second method skips the download completely. Put the machine's project on its own CF card, insert the card in the panel's CF1 slot and power the panel: it runs the project on that card.
Nothing is written to the panel, so every machine's project stays intact and one card per machine is the whole bookkeeping. The costs are physical: the right card has to exist, stay readable and stay identifiable. Store the cards in a locked drawer with one labeled slot per machine, and swap cards only with the panel powered off, following the same handling rules as a safe proprietary HMI CompactFlash card swap.
A card carrying no project, or the wrong one, leaves the panel with nothing useful to run; that is the situation described in a panel that boots to no user program with a blank CF card. If a card does not start the expected project, stop there and check the card, the slot and the project contents against the machine's documents. Never cycle through unknown cards on a running machine.
Example: one spare panel covers two machines
Say a cell runs two machines, each with a multi-screen project of about 4 MB. Machine 1's controller sits at 192.168.1.10 and Machine 2's at 192.168.1.20, both example addresses on a private network. The recovery kit is one spare panel and two prepared 1 GB CF cards: 1 panel plus 2 cards covers 2 machines, because any panel in the cell can run either project, and 2 x 1 GB holds both 4 MB projects many times over.
At 06:40 the panel on Machine 1 fails. Recovery is four moves:
- Power the spare panel off, insert the card labeled MACHINE 1, REV C in CF1, and power up. The panel runs the Machine 1 project from the card.
- Read the controller IP address in the loaded project: it must show 192.168.1.10, never 192.168.1.20.
- Ask the operator for one value they know, for instance a motor speed the machine actually runs, and confirm the panel reads it and it tracks.
- Enable the start button only after the operator confirms the interface is Machine 1's.
Done this way the swap takes one person under 10 minutes, because there is no PC, no download and no project engineering. Machine 2's project was never loaded anywhere, so nothing from it can follow Machine 1's line, and if the spare panel still holds Machine 2's resident project, that project is untouched, because the card method writes nothing to the panel.
Which method to use when
| Method | Media | Use it when | What it protects |
|---|---|---|---|
| System Screen > Memory > Backup, then Restore | USB pen drive or CF card | planned panel moves, a panel changing machines, recovery after a download wiped a project | the project together with its matching firmware |
| Prepared card in CF1 | one CF card per machine | panel failures, a spare panel taking a line, frequent changeovers | every machine's project, because nothing is written to the panel |
| One screen per machine in a shared project | none | only while every machine needs exactly one screen | nothing, once any machine needs a second screen |
Recommendation: give every machine one labeled backup on a USB pen drive or CF card, plus a prepared CF card in a locked drawer wherever a spare panel must be able to take the line. Recover planned moves through Memory > Restore and panel failures through the CF1 card, and hold one rule above the rest: back up the resident project before any download, because the download erases it and there is no second copy unless you made one.
How to check it worked
Before the machine is allowed to start, five checks:
- The project identity or name shown on the panel matches the machine's controlled project record.
- The controller IP address in the loaded project matches the address written at the machine; 192.168.1.10 belongs to Machine 1 and nothing else.
- Every screen the project should have is present, the opening screen and the rest.
- One live value the operator names in advance reads plausibly and tracks the machine as it moves.
- The responsible operator has looked at the interface and confirmed it belongs to this machine.
Until all five pass, keep the machine locked out. A start against the wrong project can injure people or wreck equipment, and the panel's one-project design cannot help once the wrong project is already loaded.
Questions
Can I keep several projects on the panel and pick one from a list?
On panels built this way, no. The design keeps one project resident and a download replaces it, and that single-resident rule is what prevents a start against the wrong machine interface. The supported equivalents are a labeled backup per machine for restore and a prepared CF card per machine for boot. Some newer panel families go further and keep an automatic backup of everything the panel needs for operation on their own memory card, so check the manual for what your panel stores.
How do I recover a project from a panel that has died?
It depends on where the panel family stores the project. If the design runs the project from the removable memory card, the card is the recovery point and can move to a replacement panel. If the project lives in panel memory, your labeled backup is the only copy, and it goes back through Memory > Restore. Since a dead panel cannot tell you which design it used, back every panel up as if it will fail tomorrow.
Does a backup pair the project with the panel firmware?
Yes, the documented backup and restore path is designed to keep the firmware and the project matched through the round trip. Treat the two as one recovery set: store them together, label them together, and never load an unverified backup onto a panel running a different firmware image from the one it was saved on.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.