OP270 OS Update: Preserving User Authorizations (WinCC flexible)

Overview

An OS update on a Siemens OP27 or OP270 operator panel is occasionally required to apply bug fixes, add new communication driver support, or transition the configuration project to a newer toolchain. When the panel is configured with user authorizations (privilege/password groups that gate runtime functions, recipe operations, or screen changes), the field engineer must know whether those authorizations are preserved across the update or whether they are wiped from the panel's internal Flash.

The answer depends on three independent variables: the exact panel model (OP27 vs OP270), the configuration tool in use (ProTool vs WinCC flexible), and the WinCC flexible version (2004, 2005, 2007, or later). The behavior is documented in Siemens Support Entry 19701610 and the related Entry 22778339 and Entry 22777582. This article consolidates those entries into a single engineering reference and adds the procedure required to back up, update, and re-establish authorizations if the toolchain in use erases them.

OP27 vs OP270 Hardware and Tool Classification

The OP27 and OP270 belong to two distinct generations of the Siemens 170/270 series operator panel family. Although the model numbers differ by a single digit, the underlying runtime, configuration toolchain, and OS update mechanism are not interchangeable.

The OP27 predates the Windows CE-based panels, so a true "OS update" in the ProSave sense is not available. The closest operation is a project recompile and download with a newer ProTool service pack, which transfers the full runtime image including the authorization table. The OP270, by contrast, stores authorizations in a runtime database that is overlaid by the OS image, which is why the tool version matters.

Root Cause: Why Authorizations Are Erased on Some Updates

On the OP270 (and all 170/270/370 Windows CE panels), the internal Flash is partitioned into separate regions for the OS image, the compiled project, the recipe database, and the user administration database. When ProSave writes a new OS image to the panel, the writer overwrites the OS region and, depending on the WinCC flexible version, either preserves or reformats the user administration region.

Before WinCC flexible 2007, the ProSave OS update procedure re-initialized the runtime database area, including the password/authorization table, even when the user explicitly requested a backup. The 2007 release introduced preservation of the user administration block across OS updates, eliminating the need to manually re-enter user names, group memberships, and passwords after each firmware maintenance task. This is the specific behavior change described in Siemens Support Entry 19701610.

WinCC flexible Version Compatibility Matrix

The behavior change for authorization preservation is tied specifically to WinCC flexible 2007. Engineers who maintain a fleet of OP270 panels across multiple vintages of the configuration software must apply different workarounds.

The linked Entry 22777582 provides additional context for the removal procedure that must precede an OS update on the older toolchains.

Pre-Update Preparation Procedure

Before any OS update on an OP270, perform the following steps. Skipping any step risks permanent loss of the user administration table or the recipe/audit-log data stored alongside it.

1. Verify the panel model. Read the nameplate on the back of the panel. Confirm "OP270" (not "OP27", "TP270", "OP370", or similar). The MLFB printed on the sticker is the authoritative source.
2. Verify the configuration tool version. Open WinCC flexible, select the active project, and check Help > About for the build number. Record the WinCC flexible service pack. The version on the development PC, not the panel, determines the post-update behavior.
3. Export the user administration. In WinCC flexible, open Project > User Administration > Export. Save the CSV file to a versioned network share. This file contains the user names, group memberships, and password hashes that may be lost on WinCC flexible 2004/2005 OS updates.
4. Back up the recipe database. If the project uses recipes, use ProSave to create a recipe backup (*.brf) on a USB stick or PC share. The recipe database may be cleared depending on the OS image being flashed.
5. Remove authorizations from the running panel. For WinCC flexible 2004/2005 only, navigate to User Administration > Remove all users on the panel itself. This is the documented workaround in Entry 22778339 and Entry 22777582.
6. Back up the project from the panel. Use ProSave Backup to save the complete project state (*.psb) to a safe location. This backup is the recovery point if the OS update fails mid-flash.

OS Update Execution

The actual OS update is performed with ProSave, which is bundled with every WinCC flexible installation. Connect the PC running ProSave to the OP270 over Ethernet, PROFIBUS, MPI, or USB, depending on the panel variant.

1. Launch ProSave from the WinCC flexible installation directory.
2. Select the device type matching the panel (for example OP270 6" or OP270 10").
3. Select the connection mode. For Ethernet, enter the panel IP address; for PROFIBUS, set the MPI/PROFIBUS address; for USB, plug into the panel's service USB port.
4. Open the OS Update tab.
5. Browse to the OS image file (*.img) shipped with the WinCC flexible installation media or downloaded from Entry 19701610.
6. Check Reset to factory settings only if the project file system is corrupted. Uncheck for a clean OS update that retains the project.
7. Click Update OS. ProSave will report progress in 1% increments.
8. Wait for the panel to reboot automatically. Do not interrupt.

After the panel reboots, the runtime project should load automatically. If the project does not load, transfer it from WinCC flexible using Project > Transfer > Compile and Download, then perform the user administration re-import described in the next section.

Post-Update Verification

Verification is required to confirm both that the OS update succeeded and that the expected authorization state matches the project requirements.

1. Boot screen check. The panel should boot to the configured start screen. If the panel hangs on the Windows CE boot logo for more than 90 seconds, the OS image is likely corrupted and a re-flash is required.
2. OS image version check. On the panel, open Start > Settings > OP > System > Version and confirm the new OS image version matches the build number you installed.
3. Authorization table check. Navigate to User Administration on the panel. If the user list is empty when the project expects named users, the WinCC flexible version in use has erased the database and re-import is required.
4. Login test. Log in with a known user name and password. If the panel rejects the credentials that were valid before the update, the user administration block was reformatted.
5. Recipe and audit-log check. Open the recipe view and confirm the recipe data is intact. Review the audit trail for any uninitiated gaps in the timestamps.

Reconfiguring Authorizations After Loss

If the OS update was performed with WinCC flexible 2004 or 2005, or if the user list is empty after the update for any reason, re-establish the authorization table as follows.

1. Open the WinCC flexible project that targets the OP270.
2. Navigate to Project > User Administration. Re-create the user groups and assign the privilege levels (0 to 15) as specified in the project documentation.
3. Re-add each user name and password. Passwords are case-sensitive and must match the exported CSV from the pre-update step. If the export was not performed, retrieve the passwords from the plant's HMI administration record.
4. Re-import the user list using User Administration > Import if the CSV export was retained.
5. Compile the project and download to the OP270 via Project > Compiler > Compile and Download (or use the standalone Transfer dialog). The transfer overwrites the empty user administration on the panel with the new table.
6. Test each user group on the panel. Confirm that privilege-gated functions (setpoint changes, recipe edits, user logout) are accessible only to the correct group.

Backup Strategy with ProSave

A disciplined ProSave backup policy is the most reliable defense against authorization loss, project corruption, and panel hardware replacement. Implement the following schedule for any production OP270.

ProSave can be invoked from the command line for scripting. A typical unattended backup uses:

Wrap this in a Windows Task Scheduler job to ensure the backup occurs outside production windows. Always verify the *.psb checksum after creation; a backup that was interrupted during write will not restore cleanly.

ProTool vs WinCC flexible Architecture

Engineers coming from the ProTool era often expect a single "compile and download" operation to be sufficient for the entire HMI lifecycle, because the project binary contains the user administration, recipes, and runtime in a single file. WinCC flexible introduced a more compartmentalized architecture to support longer panel lifecycles and OS-level updates that were not possible on the older hardware.

In ProTool/Pro and ProTool/Lite, the user administration is part of the project file. The download transfers the entire project, and there is no concept of a separate OS update; the runtime image is the project image. Passwords and user groups travel with the project. Re-downloading the project is the recovery mechanism if the user list is corrupted.

In WinCC flexible, the OS image and the project image are separate files. The OS image (*.img) controls the Windows CE kernel, the panel firmware, and the basic input/output subsystem. The project image contains the screens, tags, alarms, scripts, and the user administration table. An OS update refreshes the kernel; a project download refreshes the project layer. The two can be performed independently, which is why the user administration can survive an OS update in WinCC flexible 2007+ but not in earlier versions.

Troubleshooting Matrix

The following matrix maps the most common symptoms reported by field engineers to their likely root cause and the corrective action.

Field Engineering Notes

Several constraints are documented in the field and are not always highlighted in the Siemens support entries themselves.

• Always perform a full ProSave backup immediately before the OS update. This is the only recovery point if the update corrupts the OS image. Partial backups (project only, recipes only) are insufficient because the OS image overwrite also clears the runtime scratch area.
• Never mix OS images across panel hardware variants. An OP270 6" image will not load on an OP270 10" hardware. The image checks the panel's flash geometry at boot and refuses to start if the size does not match.
• Document the WinCC flexible version per panel. Panels commissioned with WinCC flexible 2005 may still be running the OS image from 2005 even if the project has been recompiled with 2007. The behavior on a future OS update will follow the OS image version, not the project compilation version.
• Service packs for WinCC flexible are not interchangeable with major versions. A 2005 SP3 project will not load on a panel running a 2004 SP1 OS image. Match the OS image to the project compilation target, or update both atomically.
• ProTool-to-WinCC flexible migration is one-way at the panel level. Once a panel has been commissioned with WinCC flexible, it cannot be returned to a ProTool project. The configuration tool that commissioned the panel is the one that must be used for all future updates, or the panel must be reset to factory and re-commissioned from scratch.
• Keep the project file, the OS image, and the user CSV in the same versioned directory. This eliminates the most common version-skew failure mode where a recompiled project references a newer OS image than the one currently on the panel.

FAQ