Resolving Siemens MP277 'Runtime Terminated' FWX Loading Error

1. Problem Statement

A Siemens MP277 8" Touch panel (multi-panel, 6AV6 643-0CD01-1AX1 or equivalent 8" variant in the 277 series) refuses to start any WinCC flexible Runtime project (*.fwx). The HMI's loader bar hangs on the message "Please wait until runtime has been terminated" and the visualization never reaches the configured start screen. The unit has been de-energized and out of service for more than four years; an OS update performed with ProSave (without the "Reset to factory settings" option) did not clear the condition. The controller side is a SIMATIC S7-300 connected to the MP277 over PROFINET/Ethernet, and the panel's internal identification reads:

• Image (firmware): V01.01.04.00_01.16
• Bootloader: 1.02
• Operating system: Windows CE 5.0
• Engineering target: WinCC flexible 2008 (Runtime / Compact / Standard)

2. Device Identification and Image Family

The MP277 belongs to the SIMATIC Multi Panel 277 family, which replaced the MP270B. It uses a 32-bit x86-compatible CPU module with Windows CE 5.0 as the embedded operating system. The 8" Touch variant has an 800 x 600 pixel TFT display, 24-bit color, and is rated for 6 to 31 V DC operation. The 277 series is programmed with WinCC flexible 2008 (Compact, Standard, or the discontinued Runtime 2008 ES), never with TIA Portal — TIA only targets the Comfort Panels (TP/MTP/KTPx00 Comfort and the Unified Comfort series).

The image file itself is shipped as MP277_8_Touch_V01010400.img (or similar) on the Siemens support portal under entry ID 38752513. The exact file name and size should match the MD5 listed in the corresponding Updates.txt shipped in the same archive; a corrupted download is one of the most common reasons an OS update completes yet the unit still fails to boot the runtime.

3. Root Cause Analysis

Four primary causes produce the symptom set described (FWX projects will not start, OS update appears to succeed, runtime terminates with the "Please wait" banner and never recovers). The first is the dominant cause for long-out-of-service equipment.

3.1 Corrupted project storage and registry (most likely)

Flash storage on the MP277 is partitioned as: a read-only OS partition, a persistent registry hive (NK.HV equivalent on CE), and a project partition holding the active *.fwx, transfer logs, and recipe data. After four years unpowered, the project partition and registry frequently suffer from journal breakage, especially if the panel was last shut down with the runtime still active. ProSave's "Update operating system" call alone rewrites the OS partition; it does not rebuild the project partition or wipe the registry. The result is an OS image that boots cleanly, a loader that finds a half-valid registry entry pointing to a non-existent or truncated FWX, and a runtime that fails its initialization handshake — which is exactly the message being shown.

3.2 OS image / project version mismatch

WinCC flexible 2008 SP3 Update 3 (build 01.03.03.00_01.07) generates *.fwx files that are backward compatible with image V01.01.04.00_01.16. Projects compiled with WinCC flexible 2008 SP1 or SP2 against older images use a different runtime DLL set. If the project on the panel was last transferred with a build earlier than SP2 and the OS was not updated at the same time, the runtime DLLs do not match the registry hash and the loader will time out rather than launch.

3.3 Remote-transfer / loading state lock

When the loader is in the middle of a transfer (ProSave restore in progress, file system write, or a previously interrupted transfer) it sets an internal remote flag. If the transfer is killed mid-flight, that flag can persist and cause every subsequent start attempt to wait for the "runtime termination" handshake that will never come. Unchecking "Remote" in the loader menu (Loader → Settings → Remote) clears this flag and forces the next cold start, but it is only a soft reset — it does not repair the underlying corruption.

3.4 Ethernet / S7-300 connection-point fault

If the configured S7 connection is broken (wrong IP, wrong slot, different subnet, S7-300 powered off), the runtime still starts but stops at the first connection attempt and shows a system alarm dialog. The panel's loader is not the one displaying "Please wait" in this case — the dialog comes from the runtime itself. If the project is set to Start runtime automatically after loading and the alarm dialog blocks the loader, the symptom can mimic the corrupt-project case. Verify by checking the loader's Event log for Connection failed: 0xE0... entries.

4. Diagnostic Procedure

1. Power the MP277, wait for the Windows CE 5.0 desktop to appear, then tap Start → Programs → Loader to reach the loader screen manually.
2. Open Control Panel → OP (Operator Panel) Information and confirm the image/bootloader versions match the values above. Mismatched values mean the OS update did not complete.
3. Open Control Panel → Transfer and record the channel configuration. For Ethernet the channel is set to Ethernet (TCP/IP) with a target IP inside the same subnet as the engineering station. Note the panel's own IP here — it must be reachable with a ping from the engineering PC.
4. Open the loader's Event log (Loader → Settings → Event log) and read the most recent entries. Look for Runtime terminated by OS, FWX load error 0x..., or Runtime initialization failed. The exact 8-digit hex code narrows the cause.
5. From the engineering PC, ping the panel and run ProSave → Ethernet → Device status. The device status pane must report a reachable node before any project transfer is attempted.
6. Boot the engineering PC into WinCC flexible 2008 SP3 Update 3 only. The MP277 will not respond correctly to WinCC flexible 2007, to TIA Portal, or to older SP levels of WinCC flexible 2008.

5. Resolution: ProSave Factory Reset and Project Re-Transfer

The recommended recovery for an out-of-service MP277 is a full factory reset performed through ProSave, followed by a clean transfer of the project compiled with WinCC flexible 2008 SP3 Update 3.

5.1 Prerequisites

• ProSave V9.0 or newer, installed on the engineering PC. (ProSave is bundled with WinCC flexible 2008; it can also be installed standalone.)
• The MP277 image file MP277_8_Touch_V01010400.img (or matching) downloaded from the Siemens support portal.
• An Ethernet point-to-point cable or the plant Ethernet, with the engineering PC configured to a static IP in 192.168.1.x / 255.255.255.0 if the panel is at its factory default IP of 192.168.1.1.
• WinCC flexible 2008 SP3 Update 3 installed. The build is reported in Help → About as 01.03.03.00_01.07 or later within that service pack.

5.2 Step-by-step: factory reset via ProSave

1. Connect the engineering PC to the MP277's Ethernet port (X1). For a direct connection without a managed switch, use a crossover cable or rely on the panel's Auto-MDI/MDIX support.
2. Power the panel and wait for the Windows CE 5.0 desktop. Do not open Loader — the reset can be initiated from the loader or from the desktop.
3. Open ProSave → Ethernet. Enter the target panel IP (default 192.168.1.1), set the access password if one was previously assigned, and click Device status. Confirm the response before continuing.
4. Select the Operating system tab. Click Browse and load the downloaded MP277_8_Touch_V01010400.img.
5. Tick the "Reset to factory settings" option. This is the critical checkbox that was missed during the first attempt. With this option enabled ProSave will, after flashing the image, erase the persistent registry and the project partition so the panel returns to its as-shipped state.
6. Click Update OS. The transfer takes 6-12 minutes. Do not interrupt power during the writing phase; a power loss here bricks the panel and requires an authorized service partner to re-image the flash.
7. When ProSave reports success, allow the panel to reboot automatically. After reboot the desktop appears, but no project is present and the loader is in an idle, "no project loaded" state.

5.3 Step-by-step: re-transfer the WinCC flexible project

1. Open the original *.hmi project in WinCC flexible 2008 SP3 Update 3. If the project is on a different PC, copy the entire project folder to maintain image references.
2. Open Project → Transfer → Transfer settings and confirm the channel (Ethernet), the target panel IP, and the access password. Tick Replace transfer password only if the password was forgotten.
3. Compile the project with Project → Compiler → Generate. The compiler must produce a clean build with no warnings. Warnings about missing tags or broken connections are tolerated; errors are not.
4. Click Transfer → Transfer to target system. WinCC flexible launches ProSave internally. The transfer of the *.fwx takes 2-5 minutes depending on screen count and tag count.
5. When the transfer finishes, the panel restarts Loader and starts the runtime. The screen should reach the configured start screen within 30 s of the OS image boot.

5.4 Step-by-step: clear a stuck "Remote" flag

If the loader continues to show the "Please wait" banner after a successful transfer:

1. On the panel, open Loader → Settings.
2. Uncheck Remote (or set it to Off on firmware versions that show a tri-state). This clears the residual remote-transfer handshake.
3. Tap Restart Runtime or power-cycle the panel. The runtime will then launch from the newly transferred FWX.

6. Verification

Once all checks pass, the recovery is complete and the panel can be re-integrated into the production line.

7. Event-Log and Error-Code Reference

The MP277 event log writes to \Storage Card\Logs\EventLog.csv (and a circular buffer in the registry) using the same numeric codes as the older MP270B / TP270 families. The codes most relevant to this failure mode are:

Export the log to USB stick through the panel's Control Panel → Backup/Restore utility, or read it from the engineering PC over Ethernet using ProSave's Read event log function.

8. Ethernet and S7-300 Connection Validation

The MP277 and the S7-300 are connected on a TCP/IP subnet, but the runtime uses S7 communication on top of ISO-on-TCP (port 102) for tag polling and a separate TCP connection for alarms/auditing. Verify each leg independently before assuming the runtime itself is broken.

1. From the engineering PC, ping the panel IP. A reply confirms L3 is up; Request timed out points to a cable, switch, or IP problem.
2. From the engineering PC, ping the S7-300 CPU IP. A reply confirms the PLC is reachable.
3. In STEP 7, open the CPU's Hardware configuration and note the rack/slot. The MP277 must reference that exact slot in its Connection editor.
4. On the panel, in Control Panel → Set PG/PC interface, confirm the S7ONLINE access point is bound to the Ethernet adapter. Without this the S7 channel cannot establish.
5. Use the runtime's System diagnostics view to read out the connection state. A green indicator means a healthy S7 session; a red indicator with a down-arrow shows the direction of the fault.

9. Field-Commissioning Checklist

Before returning the cell to production, walk through the following eight points. Each is sized to be completed in under five minutes by a single engineer with the project, the engineering PC, and a multimeter.

1. Confirm power supply voltage at the MP277 connector: 24 V DC ± 5 % under load, ripple < 5 %.
2. Confirm the backlight reaches rated brightness after warm-up; if the backlight fails to ignite on the first cold start, suspect the inverter and replace the display module.
3. Touch-calibrate through Control Panel → Touch if the original project used a non-default calibration.
4. Set the system clock through Control Panel → Date/Time and confirm the time zone.
5. Load the S7 project onto the CPU, run CPU in Run, then re-trigger each connection from the runtime.
6. Force a known value into a DB and verify it shows in the runtime. Then write a value from the runtime and verify it lands in the PLC.
7. Save the runtime's recipe and alarm log to a USB stick to confirm persistent storage is functional.
8. Run the runtime for 30 minutes without faults, then power-cycle twice to confirm clean restart behavior.

10. Spare-Parts and Service Notes

The MP277 8" Touch is supplied as a sealed unit; the backlight inverter is non-replaceable in the field and a dim or dead display requires a full panel exchange. The flash, the bootloader, and the Windows CE image are field-replaceable through ProSave, but the bootloader itself can only be re-flashed through a service operation that requires the back-panel service UART — that interface is not documented in the operator manual and is reserved for Siemens service partners.

For spare parts, the 6AV6 643-0CD01-1AX1 is the order number most commonly substituted for the older 6AV6 643-0CD01-1AX0; both share the same image and bootloader, so a swap does not require re-commissioning the WinCC flexible side beyond a connection re-test.

11. Frequently Asked Questions