Overview: Why an OP7 to OP77B Field Swap Goes Wrong
Replacing a failed SIMATIC OP7 panel with the newer OP77B is a routine maintenance activity on S7-200/S7-300 lines that were originally commissioned under ProTool. The OP77B is not supported by ProTool/ProTool/ProRT — it must be programmed with WinCC flexible (2005 SP1 or later, ideally 2008 SP5 for cleanest migration). When the panel comes back with no comms to the S7 CPU, the failure pattern is almost always a combination of three issues:
- Wrong MPI bus parameters on the OP77B (address, baud rate, profile).
- Lost PLC tag connections because the WinCC flexible migration did not bind all Bit-Meldungen, Wort-Meldungen, and area pointers correctly.
- Function key / system key reassignment differences between OP7 and OP77B (Chapter 5.2.5 of the WinCC flexible 2008 Migration manual).
This reference walks through diagnosis and repair of all three failure modes, including the exact DIP switch positions for an MPI node, the migration tool behavior, and the verification steps to bring the line back up without a project rewrite.
Hardware and Protocol Background
OP7 vs OP77B Key Differences
| Parameter | SIMATIC OP7 (6AV3 607-1JC) | SIMATIC OP77B (6AV6 641-0BA01-0AX0) |
|---|---|---|
| Display | Monochrome LCD, 4.5" / 8 lines | Monochrome STN, 4.5" / 8 lines, blue mode |
| Configuration tool | ProTool / ProTool/Pro RT | WinCC flexible 2005+ / TIA Portal V11+ |
| Built-in port | RS485 (MPI/PROFIBUS), 9.6 kbit/s to 1.5 Mbit/s | RS485 (MPI/PROFIBUS), 9.6 kbit/s to 12 Mbit/s |
| Function keys | 8 F-keys + 8 K-keys (soft) | 8 F-keys, 4 K-keys fixed assignment |
| Default MPI address | 1 | 1 |
| Max project size | 256 KB internal Flash | 1024 KB + option card |
| Tags (max) | 512 / 256 area | 1024 / 256 area pointers |
The OP77B is a hardware-superset for the OP7 in nearly every category. The migration headache is purely software-tooling, not electrical.
MPI Bus Topology Used at Field
MPI (Multi-Point Interface) is RS-485, isolated, with a Siemens-proprietary token-passing protocol that runs over the same PROFIBUS cable (two-core shielded, 120 Ω termination at both ends). The OP77B sits on the MPI/PROFIBUS port labelled IF1B on the bottom of the device. A typical S7-300 line looks like:
Maximum MPI segment length is 50 m at 1.5 Mbit/s without repeaters. Each node has a unique address 1..32; the OP77B is shipped with default address 1.
Pre-Checks Before Touching the Project
Confirm the four field-bus parameters on the physical device before opening WinCC flexible:
| Parameter | Expected | How to check on OP77B |
|---|---|---|
| MPI address | 1 (default), 1..32 unique on segment | Control Panel → Transfer → MPI/DP Settings → Address |
| Baud rate | 187.5 kbit/s (default) or 1.5 Mbit/s | Same menu, Profile = MPI (187.5) or DP (1.5 M) |
| Highest station address (HSA) | 31 (default) or = max addr on bus | Control Panel → MPI/DP → HSA |
| DIP switches (back of unit) | All UP = no special function; switch 1..3 reserved for PROFIBUS DP node address override | Power off, remove cover, read 8-way DIP bank |
Root Cause 1 — Migration Tool Did Not Re-Connect the Tags
The WinCC flexible 2008 SP5 migration wizard reads the *.pdb/*.hmi file and re-emits an HMI project for OP77B. The wizard reports success on compile even when:
- Bit messages reference markers that no longer exist in the S7 program (because the S7 project is from an archive).
- Area pointer Coordination and Date/Time are not re-bound, so the HMI never refreshes.
- Symbolic tag names (e.g.
MOTORE_1_AVVIAMENTO) lose their connection to the DB/MW when the source language was non-English and the symbolic table export was incomplete.
The field symptom is the "cannot read that Marker in the PLC" alarm on every function-key press. The panel has the cable right; it just cannot resolve the tag.
Repair Procedure
- Open the migrated project in WinCC flexible 2008 SP5 or 2005 SP3 (the migration GUI only ships with 2008).
- Select Project → Transfer → MPI/DP Settings and verify the connection. Then Project → Compile → Check Consistency. All red rows = broken tag references.
- Open Project → Connections. The migrated connection will be of type
SIMATIC S7-300/400 MPI(correct) or, after a bad import,SIMATIC S7-200 PPI(wrong for OP77B on a 300/400). Re-create with the correct driver if needed. - Re-attach each area pointer:
Pointer PLC address Width Why required Coordination DBn.DBW0 (default) 1 word HMI life bit, screen refresh Date/Time DBn.DBD2 8 bytes (DT) PLC → HMI time sync PLC ID DBn.DBW10 1 word Service ID for diagnostics Project ID DBn.DBW12 1 word Version number, optional - Re-bind symbolic tags. Where the S7 STEP7 archive is not available, switch to absolute addressing (e.g.
MW 120instead ofSTART_PUMP_1). Absolute addresses never break during migration. - Recompile (Ctrl+F9) and re-download via MPI or Ethernet (RS232 backplane) into the OP77B.
Root Cause 2 — DIP Switch / PROFIBUS-DP Override Active
The OP77B inherits the OP7 hardware foot-print, including the 8-way DIP bank behind the rear cover. Switches 1..3 encode a PROFIBUS DP slave address (binary, switch 1 = LSB, switch 3 = MSB). If the original OP7 had the switches in any non-up position left from a commissioning mistake, the OP77B interprets that as a DP address and runs the bus as DP slave — the S7 CPU never sees it as an MPI peer.
Forcing MPI Mode
- Power off the OP77B.
- Open the rear cover (4 captive screws, OP77B Service Manual Chapter 4.1).
- Set all 8 DIP switches to UP (= off / logical 0).
- Re-power and verify: Control Panel → Info/System shows MPI in the Interface field, not DP.
Root Cause 3 — Function Key and System Key Reassignment
Chapter 5.2.5 of the WinCC flexible 2008 Migration manual states explicitly that OP7 K-softkeys (K1..K8) and OP7 system keys (S1..S16) cannot be mapped 1:1 to OP77B. The OP77B has only 8 F-keys + 4 K-keys with fixed assignment:
| OP7 source | OP77B target | Action required |
|---|---|---|
| F1..F8 (function keys) | F1..F8 | Direct, no change |
| K1..K8 (soft keys under display) | No equivalent | Map to function keys F1..F8, drop the K-key shift plane, or use screen tabs |
| S1..S8 (system keys ACK, ESC, PAGE, etc.) | S1..S8 fixed = soft keys on new model | Re-author: ACK → ESC, ESC → ACK if reversed |
| S9..S16 (cursor, ENTER) | S9..S12 | Re-check ENTER and arrow mappings |
If the original Italian-language project used K-keys to acknowledge alarms and to drive bit M 200.0, the migrated project will compile but the keypress is dead. Open every screen in WinCC flexible, examine the Events tab of every key, and verify the function list (e.g. SetBit, ResetBit) points to a tag the panel can read.
Step-by-Step Recovery Procedure
- Verify the bus: with the OP77B powered off, connect a PG/PC with STEP7 to the same MPI segment, run PLC → Accessible Nodes. The CPU must show up. If it does not, the bus is broken before the HMI is the problem.
-
Verify the panel: power only the OP77B, open Control Panel → Transfer, set MPI addr 1, baud 187.5 kbit/s, HSA 31, all DIP up. The panel should boot to the project without error code
0x1Fin the system line. -
Re-migrate: in WinCC flexible 2008 SP5, open the source
*.hmi, choose target OP77B, tick Create complete migration. Save the new project under a new name so the source is never lost. - Rebind pointers: re-create the Coordination and Date/Time pointers (Root Cause 1, step 4).
- Convert symbolic tags to absolute (optional but recommended when STEP7 archive is unavailable).
- Re-author K-keys and S-keys (Root Cause 3).
- Compile / Download: Project → Compiler → All; Transfer → to HMI; choose MPI, addr 1.
- Cycle test: from the OP77B, press each F-key, observe the corresponding marker with STEP7 Monitor/Modify. The bit should toggle within 200 ms.
Verification Matrix
| Test | Pass criteria | Diagnostic tool |
|---|---|---|
| MPI token rotation | OP77B visible in Accessible Nodes within 5 s | STEP7 PLC → Accessible Nodes |
| HMI → PLC write | F1 sets M 100.0 = 1 within 200 ms |
STEP7 VAT table, online |
| PLC → HMI read | Set DB100.DBX0.0 = 1 in PLC, OP77B shows the alarm |
OP77B alarm screen, message buffer |
| Time sync | Date/time on OP77B matches CPU after 1 min | OP77B Control Panel → Info |
| Softkey / system key | ACK silences active alarm; ESC steps one screen back | Visual / sequence test |
| Re-transfer integrity | Power cycle OP77B, project auto-starts without CRC alarm | Boot screen, error log |
Cable and Pinout Reference
For an OP7→OP77B swap on an existing S7-300/200 segment, use Siemens 6XV1 830-0EH10 (purple PROFIBUS cable, 2-core shielded) or 6XV1 830-3BH10 (fast-connect). The OP77B port is a standard PROFIBUS 9-pin D-sub (IF1B):
| Pin | Signal | Note |
|---|---|---|
| 3 | RxD/TxD-P (B, red) | Data line + |
| 4 | RTS (TTL) | Direction control, used by some DP repeaters |
| 5 | DGND | Digital ground, isolated from chassis |
| 6 | VP (+5 V, terminated) | Bus termination supply |
| 8 | RxD/TxD-N (A, green) | Data line - |
| Shield | Shell | Terminate 360° at connector backshell |
Fault-Code / Status Quick Reference
| Code on HMI line | Meaning | First action |
|---|---|---|
| 0x01 | Power-up / firmware OK | — |
| 0x1F | No project / CRC error | Re-transfer the project |
| 0x21 | Transfer interrupted | Retry, check cable |
| 0x30 | Connection error to PLC | Verify address/baud, check Accessible Nodes |
| 0x31 | HMI tag read error | Check area pointer binding (Coordination) |
| 0x32 | HMI tag write error | Check tag address type, e.g. MW vs M
|
| 0x40 | License / memory error | Recompile with Rebuild All |
Advanced: When the STEP7 Archive Is Missing
Often the S7 archive is lost; only the running CPU is available. To recover tag bindings without a STEP7 source:
- Use STEP7 Accessible Nodes to upload the S7 program to a temporary PG project. This brings the symbol table only if it is online-readable (S7-300 ≥ V3.0 with adapted symbol online).
- Use the OP77B Tag Simulation feature: Control Panel → Tags → Simulation. Tag values update locally without the PLC, letting you see which tag addresses are dead.
- Watch the OP77B log buffer: Control Panel → Logs → System. A persistent Tag error, address 0x0000C8 = the marker is not in the PLC, or the wrong DB is referenced.
Commissioning Checklist (Print and Tick)
- ☐ DIP bank on OP77B = all UP
- ☐ MPI address = 1 (or per project), unique on segment
- ☐ Baud = 187.5 kbit/s, profile MPI
- ☐ HSA = 31
- ☐ Accessible Nodes sees CPU and OP77B
- ☐ Coordination pointer bound to a writable DB
- ☐ Date/Time pointer bound
- ☐ Every F-key Events tab has a valid function + tag
- ☐ No K-key or S-key > 8 references remain in project
- ☐ Power-cycle and re-test 3 times
Safety Note
FAQ
Why does the OP77B show "cannot read Marker" on every F-key press even though DIP switches are UP and the baud is correct?
This is a tag-connection issue, not a bus issue. The WinCC flexible 2008 migration wizard re-emits the project but loses symbolic tag bindings. Open the project, switch to absolute addressing (e.g. MW 200), re-bind the Coordination and Date/Time area pointers to a real DB, recompile, and re-download.
Can I open an OP7 ProTool project directly in WinCC flexible 2008?
Yes. WinCC flexible 2008 SP5 (and 2005 SP3 Hotfix 2) include the migration wizard under Project → Migrate ProTool Project. The wizard translates messages, screens, and tags but will not preserve user-defined K-key softkey planes; the OP77B has 4 fixed K-keys versus the OP7's 8, so re-author those screens manually.
What is the default MPI baud rate for the OP77B and is it compatible with the S7-200 default?
The OP77B default is 187.5 kbit/s. The S7-200 default is also 187.5 kbit/s on port 0, so a like-for-like swap works. If the original OP7 was set to 19.2 kbit/s or 1.5 Mbit/s for an S7-300, set the OP77B to match; do not change the CPU side.
Do I have to power the OP77B through the same 24 V supply as the OP7, or can I reuse the S7 CPU backplane feed?
The OP77B must be powered from a separate 24 V DC, ≥ 200 mA supply, not the CPU backplane. The 9-pin IF1B port is the only field connection that can come from the S7 segment. Pin 2 (+24 V) and Pin 7 (0 V) on the 24 V connector on the bottom of the OP77B feed the panel; use a regulated SELV source per the device manual.
What is the simplest verification that an OP7 → OP77B swap is fully working without a STEP7 archive?
Use STEP7 Accessible Nodes to confirm the OP77B appears on MPI; then use the OP77B Tag Simulation mode in Control Panel to drive one F-key → one bit and observe that the configured PLC address receives the change in Monitor/Modify. A single round-trip on one F-key and one bit is enough to certify the migration bus integrity before re-commissioning the full Italian-language project.