OP7 to OP77B Migration: Resolving MPI Communication Failures

David Krause11 min read
HMI ProgrammingSiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: Why an OP7 to OP77B Field Swap Goes Wrong

Replacing a failed SIMATIC OP7 panel with the newer OP77B is a routine maintenance activity on S7-200/S7-300 lines that were originally commissioned under ProTool. The OP77B is not supported by ProTool/ProTool/ProRT — it must be programmed with WinCC flexible (2005 SP1 or later, ideally 2008 SP5 for cleanest migration). When the panel comes back with no comms to the S7 CPU, the failure pattern is almost always a combination of three issues:

  1. Wrong MPI bus parameters on the OP77B (address, baud rate, profile).
  2. Lost PLC tag connections because the WinCC flexible migration did not bind all Bit-Meldungen, Wort-Meldungen, and area pointers correctly.
  3. Function key / system key reassignment differences between OP7 and OP77B (Chapter 5.2.5 of the WinCC flexible 2008 Migration manual).

This reference walks through diagnosis and repair of all three failure modes, including the exact DIP switch positions for an MPI node, the migration tool behavior, and the verification steps to bring the line back up without a project rewrite.

Hardware and Protocol Background

OP7 vs OP77B Key Differences

Parameter SIMATIC OP7 (6AV3 607-1JC) SIMATIC OP77B (6AV6 641-0BA01-0AX0)
Display Monochrome LCD, 4.5" / 8 lines Monochrome STN, 4.5" / 8 lines, blue mode
Configuration tool ProTool / ProTool/Pro RT WinCC flexible 2005+ / TIA Portal V11+
Built-in port RS485 (MPI/PROFIBUS), 9.6 kbit/s to 1.5 Mbit/s RS485 (MPI/PROFIBUS), 9.6 kbit/s to 12 Mbit/s
Function keys 8 F-keys + 8 K-keys (soft) 8 F-keys, 4 K-keys fixed assignment
Default MPI address 1 1
Max project size 256 KB internal Flash 1024 KB + option card
Tags (max) 512 / 256 area 1024 / 256 area pointers

The OP77B is a hardware-superset for the OP7 in nearly every category. The migration headache is purely software-tooling, not electrical.

MPI Bus Topology Used at Field

MPI (Multi-Point Interface) is RS-485, isolated, with a Siemens-proprietary token-passing protocol that runs over the same PROFIBUS cable (two-core shielded, 120 Ω termination at both ends). The OP77B sits on the MPI/PROFIBUS port labelled IF1B on the bottom of the device. A typical S7-300 line looks like:

Term Term S7-300 CPU MPI addr 2 S7-200 CPU MPI addr 3 OP77B MPI addr 1 PG/PC

Maximum MPI segment length is 50 m at 1.5 Mbit/s without repeaters. Each node has a unique address 1..32; the OP77B is shipped with default address 1.

Pre-Checks Before Touching the Project

Confirm the four field-bus parameters on the physical device before opening WinCC flexible:

Parameter Expected How to check on OP77B
MPI address 1 (default), 1..32 unique on segment Control Panel → Transfer → MPI/DP Settings → Address
Baud rate 187.5 kbit/s (default) or 1.5 Mbit/s Same menu, Profile = MPI (187.5) or DP (1.5 M)
Highest station address (HSA) 31 (default) or = max addr on bus Control Panel → MPI/DP → HSA
DIP switches (back of unit) All UP = no special function; switch 1..3 reserved for PROFIBUS DP node address override Power off, remove cover, read 8-way DIP bank
Common field error: The OP77B DIP bank is a service tool used to override the software MPI address via PROFIBUS DP node-number rules (1..125). If the user places switches 1..3 in DOWN with address > 32, the OP7 worked (ProTool ignored DP) but the OP77B boots as a PROFIBUS-DP slave and stops talking MPI to the S7 CPU. Set all switches UP for plain MPI operation.

Root Cause 1 — Migration Tool Did Not Re-Connect the Tags

The WinCC flexible 2008 SP5 migration wizard reads the *.pdb/*.hmi file and re-emits an HMI project for OP77B. The wizard reports success on compile even when:

  • Bit messages reference markers that no longer exist in the S7 program (because the S7 project is from an archive).
  • Area pointer Coordination and Date/Time are not re-bound, so the HMI never refreshes.
  • Symbolic tag names (e.g. MOTORE_1_AVVIAMENTO) lose their connection to the DB/MW when the source language was non-English and the symbolic table export was incomplete.

The field symptom is the "cannot read that Marker in the PLC" alarm on every function-key press. The panel has the cable right; it just cannot resolve the tag.

Repair Procedure

  1. Open the migrated project in WinCC flexible 2008 SP5 or 2005 SP3 (the migration GUI only ships with 2008).
  2. Select Project → Transfer → MPI/DP Settings and verify the connection. Then Project → Compile → Check Consistency. All red rows = broken tag references.
  3. Open Project → Connections. The migrated connection will be of type SIMATIC S7-300/400 MPI (correct) or, after a bad import, SIMATIC S7-200 PPI (wrong for OP77B on a 300/400). Re-create with the correct driver if needed.
  4. Re-attach each area pointer:
    Pointer PLC address Width Why required
    Coordination DBn.DBW0 (default) 1 word HMI life bit, screen refresh
    Date/Time DBn.DBD2 8 bytes (DT) PLC → HMI time sync
    PLC ID DBn.DBW10 1 word Service ID for diagnostics
    Project ID DBn.DBW12 1 word Version number, optional
  5. Re-bind symbolic tags. Where the S7 STEP7 archive is not available, switch to absolute addressing (e.g. MW 120 instead of START_PUMP_1). Absolute addresses never break during migration.
  6. Recompile (Ctrl+F9) and re-download via MPI or Ethernet (RS232 backplane) into the OP77B.

Root Cause 2 — DIP Switch / PROFIBUS-DP Override Active

The OP77B inherits the OP7 hardware foot-print, including the 8-way DIP bank behind the rear cover. Switches 1..3 encode a PROFIBUS DP slave address (binary, switch 1 = LSB, switch 3 = MSB). If the original OP7 had the switches in any non-up position left from a commissioning mistake, the OP77B interprets that as a DP address and runs the bus as DP slave — the S7 CPU never sees it as an MPI peer.

Forcing MPI Mode

  1. Power off the OP77B.
  2. Open the rear cover (4 captive screws, OP77B Service Manual Chapter 4.1).
  3. Set all 8 DIP switches to UP (= off / logical 0).
  4. Re-power and verify: Control Panel → Info/System shows MPI in the Interface field, not DP.

Root Cause 3 — Function Key and System Key Reassignment

Chapter 5.2.5 of the WinCC flexible 2008 Migration manual states explicitly that OP7 K-softkeys (K1..K8) and OP7 system keys (S1..S16) cannot be mapped 1:1 to OP77B. The OP77B has only 8 F-keys + 4 K-keys with fixed assignment:

OP7 source OP77B target Action required
F1..F8 (function keys) F1..F8 Direct, no change
K1..K8 (soft keys under display) No equivalent Map to function keys F1..F8, drop the K-key shift plane, or use screen tabs
S1..S8 (system keys ACK, ESC, PAGE, etc.) S1..S8 fixed = soft keys on new model Re-author: ACK → ESC, ESC → ACK if reversed
S9..S16 (cursor, ENTER) S9..S12 Re-check ENTER and arrow mappings

If the original Italian-language project used K-keys to acknowledge alarms and to drive bit M 200.0, the migrated project will compile but the keypress is dead. Open every screen in WinCC flexible, examine the Events tab of every key, and verify the function list (e.g. SetBit, ResetBit) points to a tag the panel can read.

Step-by-Step Recovery Procedure

  1. Verify the bus: with the OP77B powered off, connect a PG/PC with STEP7 to the same MPI segment, run PLC → Accessible Nodes. The CPU must show up. If it does not, the bus is broken before the HMI is the problem.
  2. Verify the panel: power only the OP77B, open Control Panel → Transfer, set MPI addr 1, baud 187.5 kbit/s, HSA 31, all DIP up. The panel should boot to the project without error code 0x1F in the system line.
  3. Re-migrate: in WinCC flexible 2008 SP5, open the source *.hmi, choose target OP77B, tick Create complete migration. Save the new project under a new name so the source is never lost.
  4. Rebind pointers: re-create the Coordination and Date/Time pointers (Root Cause 1, step 4).
  5. Convert symbolic tags to absolute (optional but recommended when STEP7 archive is unavailable).
  6. Re-author K-keys and S-keys (Root Cause 3).
  7. Compile / Download: Project → Compiler → All; Transfer → to HMI; choose MPI, addr 1.
  8. Cycle test: from the OP77B, press each F-key, observe the corresponding marker with STEP7 Monitor/Modify. The bit should toggle within 200 ms.

Verification Matrix

Test Pass criteria Diagnostic tool
MPI token rotation OP77B visible in Accessible Nodes within 5 s STEP7 PLC → Accessible Nodes
HMI → PLC write F1 sets M 100.0 = 1 within 200 ms STEP7 VAT table, online
PLC → HMI read Set DB100.DBX0.0 = 1 in PLC, OP77B shows the alarm OP77B alarm screen, message buffer
Time sync Date/time on OP77B matches CPU after 1 min OP77B Control Panel → Info
Softkey / system key ACK silences active alarm; ESC steps one screen back Visual / sequence test
Re-transfer integrity Power cycle OP77B, project auto-starts without CRC alarm Boot screen, error log

Cable and Pinout Reference

For an OP7→OP77B swap on an existing S7-300/200 segment, use Siemens 6XV1 830-0EH10 (purple PROFIBUS cable, 2-core shielded) or 6XV1 830-3BH10 (fast-connect). The OP77B port is a standard PROFIBUS 9-pin D-sub (IF1B):

Pin Signal Note
3 RxD/TxD-P (B, red) Data line +
4 RTS (TTL) Direction control, used by some DP repeaters
5 DGND Digital ground, isolated from chassis
6 VP (+5 V, terminated) Bus termination supply
8 RxD/TxD-N (A, green) Data line -
Shield Shell Terminate 360° at connector backshell
Termination: Only the two physical ends of an MPI segment carry 120 Ω resistors. The OP77B has an internal non-switched terminator on IF1B — disconnect power to the OP77B and to its neighbour if you add an external terminator, or bus voltage will fight itself and nodes drop out intermittently. If the OP77B is in the middle of the bus, leave its internal terminator disabled (cut jumper X2 on the back of the unit per OP77B service note).

Fault-Code / Status Quick Reference

Code on HMI line Meaning First action
0x01 Power-up / firmware OK —
0x1F No project / CRC error Re-transfer the project
0x21 Transfer interrupted Retry, check cable
0x30 Connection error to PLC Verify address/baud, check Accessible Nodes
0x31 HMI tag read error Check area pointer binding (Coordination)
0x32 HMI tag write error Check tag address type, e.g. MW vs M
0x40 License / memory error Recompile with Rebuild All

Advanced: When the STEP7 Archive Is Missing

Often the S7 archive is lost; only the running CPU is available. To recover tag bindings without a STEP7 source:

  1. Use STEP7 Accessible Nodes to upload the S7 program to a temporary PG project. This brings the symbol table only if it is online-readable (S7-300 ≥ V3.0 with adapted symbol online).
  2. Use the OP77B Tag Simulation feature: Control Panel → Tags → Simulation. Tag values update locally without the PLC, letting you see which tag addresses are dead.
  3. Watch the OP77B log buffer: Control Panel → Logs → System. A persistent Tag error, address 0x0000C8 = the marker is not in the PLC, or the wrong DB is referenced.

Commissioning Checklist (Print and Tick)

  1. ☐ DIP bank on OP77B = all UP
  2. ☐ MPI address = 1 (or per project), unique on segment
  3. ☐ Baud = 187.5 kbit/s, profile MPI
  4. ☐ HSA = 31
  5. ☐ Accessible Nodes sees CPU and OP77B
  6. ☐ Coordination pointer bound to a writable DB
  7. ☐ Date/Time pointer bound
  8. ☐ Every F-key Events tab has a valid function + tag
  9. ☐ No K-key or S-key > 8 references remain in project
  10. ☐ Power-cycle and re-test 3 times

Safety Note

Functional safety: an HMI is an operator interface, never a primary safety function. Before returning the line to production, ensure the E-Stop, guard-door, and light-curtain circuits are not routed through the OP77B softkeys. The OP7 → OP77B swap must not be used as an opportunity to consolidate safety logic into the HMI. Comply with EN ISO 13849-1 PLd minimum and any applicable IEC 61511 SIL targets for process cells.

FAQ

Why does the OP77B show "cannot read Marker" on every F-key press even though DIP switches are UP and the baud is correct?

This is a tag-connection issue, not a bus issue. The WinCC flexible 2008 migration wizard re-emits the project but loses symbolic tag bindings. Open the project, switch to absolute addressing (e.g. MW 200), re-bind the Coordination and Date/Time area pointers to a real DB, recompile, and re-download.

Can I open an OP7 ProTool project directly in WinCC flexible 2008?

Yes. WinCC flexible 2008 SP5 (and 2005 SP3 Hotfix 2) include the migration wizard under Project → Migrate ProTool Project. The wizard translates messages, screens, and tags but will not preserve user-defined K-key softkey planes; the OP77B has 4 fixed K-keys versus the OP7's 8, so re-author those screens manually.

What is the default MPI baud rate for the OP77B and is it compatible with the S7-200 default?

The OP77B default is 187.5 kbit/s. The S7-200 default is also 187.5 kbit/s on port 0, so a like-for-like swap works. If the original OP7 was set to 19.2 kbit/s or 1.5 Mbit/s for an S7-300, set the OP77B to match; do not change the CPU side.

Do I have to power the OP77B through the same 24 V supply as the OP7, or can I reuse the S7 CPU backplane feed?

The OP77B must be powered from a separate 24 V DC, ≥ 200 mA supply, not the CPU backplane. The 9-pin IF1B port is the only field connection that can come from the S7 segment. Pin 2 (+24 V) and Pin 7 (0 V) on the 24 V connector on the bottom of the OP77B feed the panel; use a regulated SELV source per the device manual.

What is the simplest verification that an OP7 → OP77B swap is fully working without a STEP7 archive?

Use STEP7 Accessible Nodes to confirm the OP77B appears on MPI; then use the OP77B Tag Simulation mode in Control Panel to drive one F-key → one bit and observe that the configured PLC address receives the change in Monitor/Modify. A single round-trip on one F-key and one bit is enough to certify the migration bus integrity before re-commissioning the full Italian-language project.

Back to blog