Resolving S7-300 OP177B Profibus, BF Fault, and Password Issues

Overview

The SIMATIC S7-300 paired with an OP177B operator panel is a common configuration in heat-treatment and process skids, and three failure modes surface repeatedly in the field: (1) the OP177B displays a message such as "Press Control ON" that never clears, blocking the visibility of subsequent alarms, (2) the CPU indicates a BF (Bus Fault) on the integrated DP interface and refuses program upload, and (3) the S7-300/400 CPU returns "Password Protected / Password Required" when an attempt is made to upload or edit the project from the PG. All three symptoms share a common investigative workflow: validate the physical Profibus segment, evaluate the cyclic life-bit handshake between the panel and the CPU, and read the diagnostic buffer of the DP master.

This reference compiles the commissioning and field-service procedures used to isolate each symptom, with explicit block layouts (FC19/DB19), bit-level life-bit assignments, and a password-removal decision path for protected S7-300/400 CPUs.

Problem Details and Symptom Matrix

Root Cause 1: OP177B Coordination / Life-Bit Not Cycling

The OP177B (and any WinCC Flexible / TIA Panel) maintains a cyclic coordination area with the CPU. A freely selectable word is updated by the panel and read back by the CPU; if the value does not change inside the configured monitoring time (default 5 s), the panel writes a defined bit pattern to a memory word that the PLC program uses to detect a loss of HMI connection. When this handshake is not implemented in OB1, the OP cannot clear acknowledgement bits, and the oldest message is effectively pinned on the screen.

Recommended Assignment

Root Cause 2: S7-300 / S7-400 CPU Reports "Password Protected / Required"

On S7-300 and S7-400, project protection is stored in the CPU's system data, not in the offline program blocks. It can be set from HW Config under CPU Properties > Protection or programmatically via SFC 109 (PROTECT). The user has three privilege levels: No protection (1), Write-protect (2), and Read/Write protect (3).

Two field-proven paths exist:

1. Password recovery path – contact the original commissioning engineer or OEM. The password is hashed, not reversible on the PG side.
2. Memory-card reset path – perform a MRES (Memory Reset) on the CPU. This clears the load memory, work memory, and password. The PLC must then be reloaded with the offline project. This action deletes the running program; do not execute on a live process.

Root Cause 3: BF (Bus Fault) LED on CPU 31x-2DP

The BF LED on the integrated DP interface indicates the master cannot reach one or more configured Profibus slaves. On a single-node segment (one CPU 31x-2DP plus one OP177B), the most common triggers are:

• Missing or open terminator on one end of the Profibus cable (the OP177B ships with a 9-pin D-sub whose terminator switch is at position ON/OFF).
• OP177B Profibus address outside the configured HW Config master system.
• Duplicate Profibus address on the segment.
• Cable break, broken shield, or connector pin damage.

Use STEP 7 PLC > Module Information > Diagnostic Buffer (online) to capture the precise station number and the SD/ST error text. This is the fastest way to identify the offending slave before swapping hardware.

Prerequisites for the Field Service Workflow

• STEP 7 V5.5 (or compatible) installed on the PG with the project archive for the affected CPU.
• Profibus cable tester or at minimum a continuity meter for shield, data-A (pin 3), and data-B (pin 8) on the purple cable.
• Reference to SIMATIC S7-300 CPU 31xC and CPU 31x: Technical specifications for the CPU's DP port pinout.
• For OP177B: OP 177B / TP 177B Operator Panel manual for the coordination area configuration in WinCC Flexible.
• For life-bit / FC1 reference: WinCC Flexible Communication – Coordination area entry.

Step-by-Step Procedure A: Restoring the OP177B ↔ S7-300 Life Bit

The standard Siemens-supplied FC1 (Lifebit) block expects a free word from the panel and reflects a single bit that the CPU program reads every OB1 scan. The discussion thread documents using FC19 as a copy of FC1, with DB19 as the instance / data block. The data block must be re-built with the exact structure expected by FC1/FC19.

A1. Confirm OP Coordination Pointers

1. In WinCC Flexible, open the panel project and navigate to Connection > Coordination.
2. Tick "Coordination" and assign the pointer MW26 (or any unused word such as MW100, MW200). For this reference we use MW26 with life-bit M27.2.
3. Download the panel project to the OP177B.

A2. Create the FC19/DB19 Pair in STEP 7

1. Open the S7 project in STEP 7 V5.5 and right-click Blocks > Insert New Object > Function (FC) → name it FC19.
2. From the Lifebit project, copy the contents of FC1 into FC19 using the source/symbol editor.
3. Insert a new shared DB named DB19 and define the layout below:

DATA_BLOCK DB19
TITLE = Coordination Instance for FC19
STRUCT
  AreaPointer : ARRAY[0..1] OF WORD;  // word 0 = pointer, word 1 = life-bit
END_STRUCT;
BEGIN
  AreaPointer[0] := W#16#0;  // initialised by FC19 at first call
  AreaPointer[1] := W#16#0;
END_DATA_BLOCK

This is the minimal structure that mirrors the FC1 lifebit contract: a two-word array that holds the area pointer (MW26) and the corresponding life-bit (M27.2). Any extra DB contents in the original FC1 example program (timestamps, error counters) are not strictly required for the bare handshake.

A3. Call FC19 in OB1

1. Open OB1, navigate to Segment 1, and check whether CALL FC19 already exists. If it does, do not add a second call – the task will then run twice per scan and corrupt the toggle.
2. If CALL FC19 is not present, drag FC19 from the library into Segment 1. The instance DB19 is generated automatically by STEP 7 on the first compile if it is declared in the FC19 interface; if not, create it manually using the structure above.
3. Save, compile, and download blocks to the CPU (do this during a safe window or with the process in HOLD).

A4. Verify the Handshake

1. Open a VAT or Monitor/Modify table online.
2. Watch MW26: the value must toggle at the OP-side update rate (typically every 1–2 s).
3. Force-disconnect the Profibus cable at the OP connector. Within 5 s, MW26 must take the panel-side error pattern (the bit at M27.2 will latch).
4. Re-connect; the toggle resumes and the OP clears its stuck "Press Control ON" message.

Step-by-Step Procedure B: Diagnosing BF on CPU 31x-2DP

1. Connect the PG, go online, right-click the CPU → PLC > Module Information > Diagnostic Buffer. Note the most recent event: "DP slave failure", "Station failure", "Bus fault" – each reports a station number.
2. Match the reported station number to the configured OP or slave in HW Config. The OP177B default Profibus address is 1; the CPU 31x-2DP master is typically address 2.
3. Walk the segment: at the CPU DP port and at the OP177B DP port, verify the terminator switch is ON only at the two physical ends. On a single-pair segment with two devices, both switches must be ON.
4. Measure continuity of pin 3 (Data A, green) and pin 8 (Data B, red) of the Profibus cable, and verify shield continuity at pin 1.
5. If the OP177B's address has been changed, re-assign it from the panel's Control Panel → OP > Properties > Profibus or via the HMI transfer menu.
6. After each change, perform a power cycle on the OP first, then on the CPU, to force a fresh DP enumeration.

Step-by-Step Procedure C: Handling the "Password Required" Prompt

1. Go online with the CPU. From PLC > Access Protection, the protection level and a masked password entry are shown. Without the password, the level cannot be downgraded from the PG side.
2. Open the offline project and verify the same Protection setting. If the offline project shows no password while the CPU prompts for one, the online CPU has been protected post-commissioning by a later project download.
3. Decision path: option 1 – request the password from the OEM. Option 2 – if a backup of the project exists, perform a full Download to Target Device from the offline project; this prompts for the CPU password only if the offline protection level is lower than the online one. Option 3 – MRES (full memory reset) of the CPU, which removes the password and all program blocks. The project must then be re-downloaded.
4. After a successful upload or MRES recovery, audit the protection level in HW Config and re-apply a known password to prevent recurrence.

Verification Matrix

Edge Cases and Field-Proven Caveats

• Duplicate FC19 call in OB1. A second inadvertent call of FC19 in OB1 doubles the toggle period and is a common cause of the OP still reporting the same event. Always confirm segment 1 before adding a call.
• Symbolic vs. absolute access. When the offline project shows DB19 created with a different structure (for example, custom UDTs), the panel may not interpret the data correctly. Stick to the minimal ARRAY[0..1] OF WORD layout unless the original lifebit documentation explicitly defines more fields.
• Multiple HMI panels on one CPU. If more than one panel is configured, each panel must have its own coordination word. Using MW26 for two panels will collide and the second panel will always appear to lose the handshake.
• Profibus address conflict. When the BF fault reports a station number that does not match the OP177B label, check whether a CP module or distributed I/O is sharing the address.
• Password in a transferred MMC. For S7-300 with an MMC, removing the card clears the password only if the CPU's password was stored on the card. Power-cycle the CPU with the card removed to confirm; always re-insert the same MMC, otherwise the CPU will request a complete re-load.
• SCADA over CP module vs. direct MPI/DP. In the Sealed Quench Furnace architecture the SCADA PC reaches the S7-400 via CP modules. The "Password Required" prompt will appear on the SCADA connection too; the password is the same one stored on the S7-400 CPU.

Quick Reference: Bit and Word Mapping

FAQ