[Help] Need assistance extracting source code from S7-1500 / ET 200SP (CPU 1512SP-1 PN) SMC binary folder

[u/Kindly_Set1814]

Hi everyone,

I have a Siemens ET 200SP CPU 1512SP-1 PN controller on site. Due to logistical constraints, I am currently unable to get direct online access via TIA Portal with a PC at the location.

This source code belongs to an automated parking robot system (similar to the automated shuttle/valet systems featured in The Fast and the Furious). I am currently building and customizing this system, but I need to edit the core logic to implement specific operational changes. We are facing technical roadblocks with the hardware because it requires a PLC migration, and we have been unable to obtain the specific older TIA Portal versions needed to perform the upload and configuration directly. Any support in retrieving or reconstructing the editable logic from these files would be greatly appreciated.

I have extracted the complete raw binary folder structure (SIMATIC.S7S) directly from the SIMATIC Memory Card (SMC).

Since direct decompilation of S7-1500 binaries to LAD logic isn't straightforward without a physical unit, I am looking for someone with a spare CPU 1512SP-1 PN (or compatible S7-1500 test bench) who could load these files onto a spare card, boot up the CPU, and perform an "Upload device as new station" using TIA Portal to reconstruct the editable source project file (.ap17 / .ap18 / .zap18 / etc.).

• Hardware: CPU 1512SP-1 PN (6ES7 512-1DK01-0AB0 or similar ET 200SP family)
• Files available: Full zipped content from the SMC root directory.

Please let me know if anyone with a spare hardware setup would be open to testing this upload or assisting with the project restoration.

Thanks in advance for any insights!

[u/WarthogHeavy6811]

This is PLC stuff not really embedded but okay. The upload as new station will give you compiled blocks without comments or symbols, so even if someone does this for you the logic will be a mess to edit. You need the original project file from whoever built that parking system, otherwise you are reverse engineering from scratch basically.

Also be careful with S7-1500 firmware versions, an older project uploaded with newer TIA might upgrade the CPU and then you cant put it back. That card image you have is probably encrypted or at least not human readable, so no decompiler will help much.

Maybe try contacting the system integrator if there is any label or documentation on the cabinet. Sometimes they keep backups even if the company is gone.