Resolving Siemens MP370 Touch Panel Lockup via OS Recovery

Problem Description

The Siemens SIMATIC MP370 Multi Panel is a 12-inch or 15-inch TFT touch HMI from the x370 generation (predecessor to the x400 / WinCC flexible era). On units that have been in continuous service for five or more years, a specific failure mode appears where the resistive touch screen visibly accepts inputs (audible beep on press, screen still renders graphics), but configured button events fail to fire, and the panel subsequently stops accepting any further input until a power cycle. The OS shell may still be reachable through hardware interrupts or the loader, but the runtime is essentially frozen.

Typical observable symptoms on the affected MP370:

• Touch calibration drifts; multiple taps are required to land within a 5 mm target.
• Pressing a configured button produces the system beep but the linked Press / Click event does not execute.
• After a few failed button presses, the entire runtime becomes unresponsive to finger and stylus input.
• A minimal test project (one screen, one button) reproduces the issue, ruling out project corruption.
• Hardware self-test of the touch controller (via loader diagnostics) typically passes.

Affected Hardware and Software

Use the following table to confirm whether the recovery procedure in this article applies to your unit. The recovery procedure is valid for the entire MP370 family regardless of display size, as all variants share the same Windows CE image and the same ProSave transfer protocol.

Firmware / OS combinations known to exhibit the issue:

• Windows CE 3.0 / HMI ProTool image (early units)
• Windows CE 5.0 / WinCC flexible 2004 image
• Windows CE 5.0 / WinCC flexible 2005 / 2007 image

Programming environment that originally produced the runtime:

• SIMATIC ProTool/Pro 6.0 SP3 or later
• SIMATIC WinCC flexible 2004 SP1 / 2005 / 2007 / 2008 SP1
• Compressed / unpacked transfer modes

Remote services installed on the unit (relevant to the recovery):

• sm@rtservice – remote control / shadowing of the HMI from a PG/PC
• sm@rtaccess – web-based diagnostic and screen access via Internet Explorer 6 / 7

Root Cause Analysis

Three layered causes have been confirmed in field returns of MP370 panels exhibiting this exact symptom profile:

1. Touch driver registry corruption. The Windows CE 5.0 touch stack on the MP370 stores calibration constants and the touch input queue configuration in the registry hive \HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\TOUCH. After extended uptime, particularly with sm@rtservice active, the input queue service touch.dll (version 5.00.x) can enter a state where it consumes but does not dispatch WM_LBUTTONDOWN messages to the Win32 message pump. Beeps still fire because the beeper is bound directly to the touch interrupt, not to the message pump.
2. Incomplete OS update via Ethernet. A standard OS update performed over Ethernet (TCP/UDP) transfers only the runtime image (WinCE NK.BIN plus supporting files) and explicitly skips the bootloader, registry hive, and partition table. If the unit was previously mis-imaged, an Ethernet update writes a new NK.BIN on top of the old registry, which can leave dangling device drivers referencing deleted or renamed DLLs.
3. sm@rtaccess/sm@rtservice keying state mismatch. Because the touch input queue is stuck, the sm@rtaccess remote input client on the programming PC receives the "no input" icon and the local panel no longer accepts control. This is not a network problem; the locked touch queue is preventing the sm@rtservice local-side handshake from completing.

Required Tools and Cables

Collect the following before scheduling downtime. The serial path is mandatory for a full reset; an Ethernet-only path will not recover the unit.

Pre-Procedure Safety and Data Backup

1. Disconnect the field wiring to PLC / drive interfaces if the panel is the only operator interface for the process. A reset of the OS will power-cycle the panel and break all active HMI tags for 5-10 minutes.
2. Switch the MP370 into the loader (boot menu) by holding the F4 key during power-up, or by powering on with the CF card cover open. Verify that the loader version displayed matches the OS image you plan to deploy.
3. If the loader is reachable, use the Backup menu to copy the current registry and runtime to a CF card. This is a last-resort option; the corrupted registry should not be restored on top of the fresh image.
4. From the loader, run the Touch Test (Diagnostics > Touch). If the touch controller fails this test, the digitizer is hardware-defective and the procedure below will not recover the unit. Replace the panel.

Full OS Reinstall Procedure (RS232 / Reset to Factory Settings)

This procedure reinstalls the bootloader, partition table, registry hive, NK.BIN, and supporting DLLs. The runtime image is overwritten completely. The project must be re-transferred afterward.

1. Power off the MP370. Leave the RS232/PPI multimaster cable connected between the panel's IF1B (RS232) port and the PG/PC COM port.
2. On the PG/PC, launch ProSave from the Start menu (Start > SIMATIC > ProSave > ProSave). Select the destination:
   • Device type: MP370 Touch 12 or MP370 Touch 15
   • Connection: Serial
   • COM port: COM1 (or matching the PC's port)
   • Baud rate: 115200
3. Place the MP370 into the loader (power on while holding F4). The loader splash screen should display version information and the active COM parameters.
4. In ProSave, open the File > Download OS dialog. Click Open and navigate to the image file (*.IMG) on the WinCC flexible installation media. The file dialog will display the version and the target device.
5. In the lower section of the Download OS dialog, ensure the "Reset to factory settings" checkbox is enabled. This is the critical step. If only the bootloader needs to be updated, use the "Booting" checkbox instead. For a full wipe, leave both Booting and Reset to factory settings selected.
6. Click Download. ProSave will negotiate the PPI multimaster protocol, authenticate, and begin the image transfer. Expect 12-25 minutes over RS232 for a full image; the bar is not always linear.
7. When the transfer completes, ProSave will prompt to restart the panel. Click Yes. The panel will reboot, enumerate new devices, and stop at the loader with no project loaded.
8. Close the Download OS dialog. The panel is now at a clean factory state with a known-good touch driver and registry hive.

For reference, the official Siemens procedure that documents the "Booting" and "Reset to factory settings" options is Siemens Support Entry 19701610 — How do you perform an OS update on a panel using ProSave?

Touch Calibration After OS Reinstall

After the full image restore, the touch controller will request calibration on first boot. If it does not, or if calibration is still drifting, perform the manual sequence below.

1. From the loader or Windows CE desktop, open Control Panel > Stylus.
2. On the Touch tab, click Calibrate.
3. Tap each of the five calibration targets (four corners and the center) firmly with a plastic stylus. Avoid finger contact during calibration; the resistive overlay distinguishes by contact area.
4. Tap OK to commit the calibration data. The new constants are written to the registry hive and persist across reboots.
5. Test the calibration by opening Control Panel > Stylus > Settings > Test and tracing a slow spiral. The cursor should track within ±1 pixel.

Project and Remote Service Re-Transfer

After the image is clean and the touch is calibrated, re-deploy the project and the remote service keys.

1. In WinCC flexible / ProTool, compile the project (Project > Compiler > All) with the Generate for transfer option enabled. The compiled output is a .hmi (or .pdb) file.
2. In ProSave, use File > Download > Project with the Reset to factory settings option selected. The transfer over RS232 takes 3-10 minutes depending on the project size.
3. After the project boots cleanly, re-configure sm@rtservice and sm@rtaccess. In WinCC flexible, open Panel Settings > Services:
   • sm@rtservice: enable, set the CE password, and bind to a TCP port (default 5000).
   • sm@rtaccess: enable, set the IE access user list, and confirm the embedded web server port (default 80).
4. Transfer these settings as a delta or as part of the project recompile.
5. From the engineering PC, test the sm@rtservice connection with the Sm@rtService Viewer (Start > SIMATIC > Sm@rtService). The local panel should now accept remote control input.

Verification

After the OS reinstall, project re-transfer, and service reconfiguration, validate the unit against the following acceptance checks:

Troubleshooting Matrix

When the procedure above does not fully resolve the symptom, work through the matrix below before declaring the unit unrecoverable.

Common Pitfalls and Edge Cases

• Ethernet OS update confusion. The Ethernet path in ProSave never exposes the Booting or Reset to factory settings checkboxes. If you perform the update over Ethernet first, the corrupted registry hive remains and the panel will still misbehave. Always use RS232/PPI multimaster for a true factory reset.
• Image version mismatch. Loading a newer WinCC flexible image onto an older loader can cause the loader to reject the transfer. Confirm that the loader version reported on power-up is at least equal to the image version stamped in the file. Downgrades are not supported by the bootloader.
• sm@rtservice first-boot handshake. After a factory reset, the first sm@rtservice connection from the PG/PC must be initiated within 60 seconds of panel boot, or the panel times out and returns the "no input" icon. This is a known quirk of the CE 5.0 service stack on MP370.
• CF card boot priority. If a CF card is left in the slot at boot, the panel will attempt to boot from it. Remove the CF card before the OS reinstall, then reinsert it after the first normal boot.
• Touch calibration persistence. The new calibration constants live in the registry hive and are lost on a factory reset. Recalibrate after every full image restore, not just after the first one.
• Power supply noise. MP370 units powered from a 24 V supply with high inrush on adjacent contactors can produce touch events that "ghost" (fire without user input). This is not a software problem; isolate the panel supply with a 24 V DC filter.

Field-Proven Caveats for Long-Term Operation

Five-year-old MP370 panels frequently present this symptom because the CE 5.0 touch driver and the sm@rtservice service share an input queue that is not always safely re-entrant under sustained input load. After the full OS restore, the following measures reduce the recurrence rate:

1. Disable sm@rtservice when the remote PC is not actively connected. Use the auto-disconnect timeout (default 300 s) and confirm the panel is not hosting simultaneous local and remote operators.
2. Run the panel with a 4 GB industrial CF card and a periodic registry flush script. CE 5.0 does not commit registry writes to the CF card on a fixed schedule; manual flushes via RegFlushKey reduce the chance of a partially written hive on power loss.
3. Replace the panel's internal CMOS battery if the unit has been in service > 5 years. A weak battery produces date/time resets and can corrupt the registry timestamp, which in turn can break CE driver signing checks.
4. Apply the latest WinCC flexible 2008 SP1 image if the loader version supports it. The 2008 SP1 image ships with a touch driver revision that no longer relies on the shared input queue.

Frequently Asked Questions