The protected save option in your HMI software stops anyone uploading the project from the panel and switches off the panel's Project Backup function. That protects your work only if the editable master stays on the engineering PC. Save two files: an unprotected master for editing, a protected copy for the download, both labeled with panel name and revision.
The fix is two files: save the editable master normally on the engineering PC, and produce the deployment copy with File>Save Project as protected. After a protected save, the programming software can no longer upload the project from that panel, and the Project Backup function on the panel's system screen switches off. The screens, alarms and communications keep running as they did. That is a fair trade when the project should stay off other people's laptops, and a disaster when the only copy lived on the panel. The rest is organization: download only a labeled protected copy, name it line3-filler-hmi-v4, and log which revision sits on which panel. Set that up once and a failed panel costs you a short download.
What protected save blocks
Two effects are documented for the option, and both matter to your recovery plan. After a protected project is downloaded, the programming software cannot upload that project from the panel, and the Project Backup feature on the panel's system screen is unavailable while it is loaded. The runtime side is untouched: the same screens come up, alarms fire, and the panel talks to the PLC as before.
On an unprotected panel, the normal way back is to upload the project from the panel to your PC. Protected save closes that path. It is an extraction block, not a password: the option sets no password and asks for none at the panel. If the requirement is a password in front of download, editing or overwrite, that is a different feature, and the panel manual is where to confirm what it is called and which actions it guards.
What you need
- The engineering PC with the HMI programming software at the version that matches the panel firmware. Confirm that match before any transfer; our note on checking the firmware revision before a project transfer shows the check.
- The editable master project, with its revision noted.
- One USB stick or a network share for the second copy. Project files hold screens, tag databases and text, so they run a few megabytes: at 4 MB per project, an 8 GB stick holds about 2,000 files (8,192 MB ÷ 4 MB ≈ 2,048).
- A naming convention that puts the panel, revision and date in the file name:
line3-filler-hmi-v4. - A log, on paper or a shared sheet, with one line per panel: panel ID, project revision, date, and where the master lives.
Set up the two files
- Open the editable master on the engineering PC and confirm it is the current revision for that panel.
- Save it normally. The master stays unprotected for life; it is the file you edit, and the file that saves the machine.
- Save a second copy with
File>Save Project as protected. Name it by the convention:line3-filler-hmi-v4. - Download that protected copy to the panel. A healthy project download over Ethernet takes about 2 minutes; when it runs long, the slow-download checklist sorts out the usual causes.
- Log the panel ID, the revision, the date and the master's storage path.
- Copy the master set so it follows the 3-2-1 backup rule: 3 copies of each master, on 2 different media, with 1 copy off site. The working file on the PC counts as one; a USB stick or network share is the second medium; the off-site copy rides your normal plant backup.
- On the next edit, bump the revision number, re-save the protected copy at the new revision, and download again. The panel, the log and the file names move together, or the system drifts.
Recommendation: Run the two-file rule on every panel you commission. Save the editable master normally on the engineering PC, produce the deployment file with File>Save Project as protected, download only that copy, and keep the master inside your 3-2-1 backups. Turn protected save on for the deployment file on any panel whose project should stay out of other laptops; never on the master.
Example: a failed panel on line 3
A plant runs six filling lines, one HMI panel each, all commissioned with the two-file rule in May. A power event kills the panel on line 3, the same family of failure as a panel that loses its project after a power cycle, and a spare panel goes in.
The archive arithmetic first: 6 lines means 6 masters and 6 protected copies, 12 files. At 4 MB each, 12 × 4 MB = 48 MB, which fits on the 8 GB archive stick alongside room for roughly 2,000 more files (8,192 MB ÷ 4 MB ≈ 2,048).
Recovery with the master on hand: confirm the spare's firmware revision, 5 minutes; download line3-filler-hmi-v4 over Ethernet, about 2 minutes; walk the screens and communications checks, 10 minutes. Total 5 + 2 + 10 = 17 minutes, call it under 30 with the mounting. The line runs the same shift.
Recovery without the master: rebuild from screenshots and memory. Ten screens at 30 minutes each is 10 × 30 = 300 minutes, 5 hours of screen work, before tag links, alarm setup and communications checks. The line idles a full shift, and nobody can show that the rebuilt screens match what the operators were trained on.
Same failure, two outcomes; the difference is 12 small files and one log line.
How to check it worked
Run these checks on a spare panel, never on a production one:
- Download the protected copy, then attempt an upload with the programming software. The upload should be refused.
- Open the panel's system screen and confirm Project Backup is unavailable for that project.
- Open the master on the PC and confirm it still opens and saves unprotected, and that the log's revision matches the deployed file name.
- If USB restore is part of your recovery plan, prove it on the spare: load the protected project, restore from the USB copy, and confirm screens, tag links and communications come back. Backup and restore are documented differently across panel families, so test your combination before a failure tests it for you.
When protected save is not enough
Protected save stops extraction of the loaded project. If the plant's requirement is a password before anyone downloads, edits or overwrites, protected save does not answer that; the feature to look for is the panel family's access control, confirmed by name in its manual against each of those three actions.
One safety note for panels that sit on the plant network for remote support: project protection and network access control are separate jobs. Keep remote paths behind the plant's normal access rules, and treat the panel as an ordinary device on that network no matter how its project file is marked.
A separate line-status or notice board next to the cell is a different job again; our shop-floor screens take it without touching the panel project.
Questions
Does protected save put a password on the project?
No. The option marks the project so the programming software refuses to upload it from the panel, and the panel's Project Backup function is unavailable while it is loaded. No password is set and none is requested later. A password gate on download, editing or overwrite is a separate access-control feature; confirm its name and what actions it covers in the manual for your panel family before you rely on it.
Does protected save affect restoring a project from a USB stick?
The interaction is not spelled out the same way in every panel family's documentation, so test it on your combination. On a spare panel at the same firmware revision, load the protected project, then restore a project from the USB stick and confirm the screens, tag links and communications come back intact. Until that test passes, treat the unprotected master on the engineering PC as the only recovery path.
Does the panel run differently once the project is protected?
No. The setting changes only what the programming software and the panel's system screen allow; the screens, alarms and PLC communications behave as before. Operators see nothing, and neither does the next technician, which is the trap: a protected panel looks identical to one that will still upload its project. The log entry naming the master and revision is what tells the next person where recovery lives.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.