1. Problem Summary
A SIMATIC TP 177A panel configured as an MPI slave on a bus with a SIMATIC S7-314C-2DP is downloaded successfully over an MPI cable. After the download the panel communicates with the CPU, and the operator can read/write tags. The moment the 24 V DC supply to the TP 177A is removed and reapplied, the panel comes back online with MPI address 1 instead of the address (typically 2, 3 or 4) that the engineer had assigned in the Control Panel. The HMI immediately drops off the bus, "Not Connected" or "Connection failed" alarms appear, and tags stop updating.
The field symptom is consistent: changes made directly in the HMI Control Panel are not retained across a power cycle, even though the operator pressed "OK" or "Apply" before leaving the screen. The behavior is independent of the MPI cable, the PLC MPI/DP interface, the bus terminators, and the panel firmware revision.
2. Affected Hardware and Software
| Component | Order Number / Version | Role |
|---|---|---|
| SIMATIC TP 177A 4" mono | 6AV6 642-0BA01-1AX1 | HMI, MPI slave |
| SIMATIC TP 177A 4" color | 6AV6 642-0BC01-1AX1 | HMI, MPI slave |
| SIMATIC S7-314C-2DP | 6ES7 314-6CG03-0AB0 | CPU with combined MPI/DP interface |
| WinCC flexible 2008 SP5 (or SP3 minimum) | 6AV6 613-0AA01-2... | Project engineering |
| ProTool / WinCC flexible image on TP 177A | Image <= V1.3.0.0 for TP177A | Runtime on panel |
| PC adapter USB / MPI | 6ES7 972-0CB20-0XA0 | Engineering download |
Reference manuals to keep open while troubleshooting:
- SIMATIC HMI TP 177A, TP 177B, OP 177B (WinCC flexible) - Device Manual
- SIMATIC S7-300 CPU 314C-2 DP - Device Manual
- WinCC flexible 2008 - Compact/Standard/Advanced - User Manual
3. Root Cause: WinCC flexible Runtime Overrides the Control Panel
On the TP 177A, the MPI address, the "highest station address" (HSA), the transmission rate, and the "only master on the bus" flag are project properties. They live in two places:
- The compiled WinCC flexible runtime image (the
*.fwxfile that is downloaded to the panel). - The Control Panel (the Windows CE-style settings applet, opened from the loader or from
Start > Settings > Control Panel).
When the TP 177A is in runtime (the project is running), the HMI uses the values from the compiled image. The Control Panel entry shows the same numbers, which is why the operator believes the change was applied. The instant the user touches OP > MPI/DP Settings in the Control Panel and presses OK, those values are written to the registry on the panel. On the next reboot, however, the loader re-applies the runtime image values and the registry is overwritten. The address therefore jumps back to 1 (the default that WinCC flexible stamps into the project if the engineer never changed it).
This is the documented behavior: in the TP 177A, OP/control panel changes are a temporary diagnostic override, not a permanent configuration. The only persistent configuration source is the WinCC flexible project.
HKLM\SOFTWARE\Siemens\HMI\OP\MPI\Station and ...\MPI\Master. The TP 177A loader (CeRDisp.exe / HmiLoader) reads the project image on every cold start and pushes the project values back into the registry. Only the project survives a power cycle.4. Why the Control Panel "Save to OP" Path Does Not Persist
WinCC flexible exposes two different workflows for MPI configuration:
- Temporary change (for commissioning, before the project is finished): edit in the Control Panel, leave the panel in the loader, reboot. The value is kept as long as the panel is not put back into runtime. The moment the engineer transfers a project, the runtime overrides the registry again.
- Permanent change: edit the connection in the WinCC flexible project tree, recompile, and transfer the project to the panel.
The TP 177A's Control Panel does offer a Save Registry / OP applet, but its only practical effect on a TP 177A with a WinCC flexible runtime is to write the registry values that the runtime will overwrite on the next boot. Use it only when the panel is being used in transfer mode without a project (loader only).
5. Prerequisites
To fix the persistent MPI address the engineer must work at the engineering station, not on the panel:
- WinCC flexible 2008 SP3 or later installed on a Windows XP / Windows 7 (32-bit) engineering PC.
- The original
*.hmiproject that was used to commission the TP 177A. If only the compiled*.fwxexists, the project must be reverse-compiled (WinCC flexible > Project > Compiler > Reverse) or recovered from the most recent ProSave backup. - PG/PC interface set to
PC Adapter (MPI)orPC Adapter (PROFIBUS)with transmission rate 187.5 kbps (default for MPI) and station address 0. - Free MPI address on the bus. For a TP 177A on the same MPI segment as the S7-314C-2DP (default MPI = 2), pick address 3 or 4 to leave room for additional nodes and for any PG used during service.
6. Step-by-Step: Configure the MPI Address in WinCC flexible
- Open the project in WinCC flexible 2008.
- In the project tree, right-click the TP 177A node and choose
Properties. - Switch to the
Connectiontab. - Select the S7-300/400 driver and the network
MPI. - Set HMI station address to the desired value (example:
3). - Set Highest station address (HSA) to a value at or above the highest node on the segment. For an S7-300 CPU at MPI = 2 plus a single TP 177A at MPI = 3, HSA =
31is safe and is the WinCC flexible default. - Set Transmission rate to
187.5 kbps(mandatory for the S7-300 default MPI bus; 1.5 Mbps only on isolated segments with repeaters). - Tick "The HMI is the only master on the bus" only if the segment has no other class-1 master (no PG, no other panel doing active data exchange). Otherwise leave it cleared.
- On the PLC side, set the CPU's MPI address to
2(default) and confirm the same transmission rate. - Save, compile (
Project > Compiler > Generate) and check that no warnings reference the MPI address.
7. Step-by-Step: Alternative - Saving the Control Panel Value on the Panel
Use this only if the panel is going to remain in loader mode (no runtime project) or if you need a one-shot value while waiting for a recompiled project.
- Boot the TP 177A and stay in the loader (do not start runtime).
- Tap
Start > Settings > Control Panel > OP. - Set
Station Addressto the desired MPI address. - Set
Only Master on the Busif applicable. - Press
Saveand confirm withOK. - Power-cycle the panel. The address is now kept as long as the panel is not put back into runtime.
As soon as a WinCC flexible runtime is transferred to the panel, the loader will overwrite the registry on the next boot. Treat the Control Panel save as a temporary measure.
8. Transfer the Project to the HMI
- Connect the PC adapter to the TP 177A's MPI port (lower of the two 9-pin D-sub connectors on the rear of the device, labelled
IF 1B). - Switch the panel into transfer mode:
Start > Settings > Transfer, enableAutomatic transfer, accept the default MPI address and clickOK. - In WinCC flexible, choose
Project > Transfer > Transfer. Set the mode toMPI/DP, target address equal to the HMI station address (3 in the example), and clickTransfer. - Watch the progress bar; a full transfer (project + firmware if requested) takes 3-6 minutes on a 187.5 kbps MPI link.
- When the dialog reports
Transfer completed, the panel will restart automatically.
9. Verification Procedure
After the project is on the panel and the panel has rebooted into runtime, verify the configuration is now persistent:
- Read the address back from the Control Panel:
Start > Settings > Control Panel > OP. The station address must show the value set in the project (3 in the example). It may be displayed as "read-only" because the runtime has locked the field - this is correct. - Remove the 24 V supply for at least 10 seconds.
- Reapply 24 V. The panel must come up at MPI = 3, start the project, and re-establish the connection to the S7-314C-2DP within the configured Connection monitoring time (default 3 s).
- Open a WinCC flexible screen that contains a tag from the CPU (e.g. a status word). The tag value must update without a "connection interrupted" alarm.
- Run a second power cycle to confirm reproducibility. The behavior must be identical on cycle 2, 5 and 20.
If the address still drifts back to 1, the runtime is reading an old image. Wipe the panel's flash first:
-
Start > Settings > Control Panel > System > OP > Clear Flash(password-protected, default100). - Reboot, stay in loader, then re-transfer the project.
10. Related Parameters and Settings
| Parameter | Location | Typical value | Comment |
|---|---|---|---|
| HMI station address | WinCC flexible project > Connections > MPI | 3 | Must be unique on the segment. |
| CPU MPI address | STEP 7 > Hardware > CPU314C-2DP > Properties > MPI/DP interface | 2 | Default. Do not change unless the bus master plan requires it. |
| Highest station address (HSA) | WinCC flexible > OP > MPI/DP Settings | 31 | Must be >= max(used addresses). Affects token rotation time. |
| Transmission rate | WinCC flexible > OP > MPI/DP Settings | 187.5 kbps | Must match PLC and all other nodes. |
| Profile | WinCC flexible > OP > MPI/DP Settings | MPI | Set to "MPI" unless the bus is wired as PROFIBUS with class-2 repeater logic. |
| "Only master on the bus" | WinCC flexible > OP > MPI/DP Settings | Cleared | Only tick if no other master (PG, panel) will be on the segment. |
| Connection monitoring time | WinCC flexible > Connection > Properties | 3 s | Time before the HMI reports a connection error. |
| Time-out for PLC response | WinCC flexible > Connection > Properties | 1000 ms | Increase to 2000-3000 ms on long MPI cables with strong EMC. |
11. Troubleshooting Matrix
| Symptom | Likely cause | Check | Remedy |
|---|---|---|---|
| Address = 1 after every reboot | WinCC flexible project still has address 1 | Project tree > Connection > HMI station address | Set the correct address, recompile, re-transfer |
| Address = 1 only after power cycle, not after warm restart | Loader re-applies runtime image | WinCC flexible > Transfer > settings | Use "Reset on target" option in the transfer dialog |
| Panel stays at 3 in Control Panel but loses connection | Address collision (another node already at 3) | STEP 7 > PLC > MPI diagnostics | Pick an unused address; scan the bus with ProTool/Pro |
| Address jumps to 31 or 126 | Default HSA overwritten, address > HSA | WinCC flexible > OP > MPI/DP > HSA | Set HSA = 31 or higher |
| Address retained for hours then reverts to 1 | Stale image, panel is in "Backup project" mode | Loader > Settings > Backup/Restore | Disable backup mode, transfer the live project |
| Panel cannot be reached at any address | Different transmission rate set in panel vs. PLC | Control Panel > OP > MPI/DP > Baud rate | Set both sides to 187.5 kbps |
| Connection OK, but tags show "###" | MPI works, area pointer/DB not loaded | WinCC flexible > Tags > connection check | Recompile tag list, verify DB exists in S7 project |
12. Extended Diagnostics
For deeper analysis connect to the bus with STEP 7 and run PLC > Diagnostics/Settings > MPI Bus Nodes. The online view lists every active station with its address, transmission rate and diagnostic buffer entries. A healthy segment with the S7-314C-2DP at 2 and the TP 177A at 3 will show both nodes, status "OK", and no "station failure" events.
If the panel appears twice (once at 1, once at 3) the loader has not finished swapping the runtime image. Wait one full minute and re-scan; the duplicate should disappear. A persistent duplicate at address 1 indicates that an older project is still in flash and a new transfer is required.
For ring/line topology, MPI permits a maximum of 32 stations per segment without repeater, maximum cable length 50 m at 187.5 kbps with no repeater (extended to 1000 m with two repeaters). The TP 177A's MPI port provides the bus terminator only when the adjacent DIP switch on the rear of the panel is set to "ON"; the S7-300 does not provide a built-in terminator - install a 9-pin D-sub with 220 Ω between pins 3 and 8 at each end of the bus.
13. Field-Proven Caveats
- Never change the MPI address with the bus powered and a second master active; the master may pick up the new station only after the next token rotation (up to one HSA cycle, typically < 1 s at 187.5 kbps, but up to 30 s on heavily loaded segments).
- Some legacy WinCC flexible 2004 projects use
Stationinstead ofMPI Stationin the registry. The TP 177A firmware knows the difference; if the loader keeps writing the old key, the image is from WinCC flexible 2004 and must be re-imported into a 2008 project to migrate cleanly. - Do not set the HMI's address to the same value as the CPU. Some S7-300 firmware revisions will report a non-fatal bus error and the panel may appear to "lock up" in transfer mode for several seconds.
- After clearing the panel's flash, the loader shows
Transferas the only available option. Transfer the project, do not just reboot, otherwise the panel returns to the loader with the default address 1 and looks like a fault. - Always keep the most recent project on a shared drive; the TP 177A's compact flash can fail and a re-transfer is then impossible without the source
*.hmifile.
14. FAQ
Why does the TP 177A forget the MPI address I set in the Control Panel?
Because the panel's loader re-applies the compiled WinCC flexible runtime image on every cold start, overwriting the registry values that the Control Panel wrote. The Control Panel change is a temporary override; the permanent value lives only in the WinCC flexible project under Connections > MPI > HMI station address.
What is the default MPI address of a TP 177A?
1. The S7-300 CPU 314C-2DP defaults to MPI = 2. So the very first download, if the user did not change anything, places the HMI at 1 and the CPU at 2, which is why an "out of the box" pair of devices talks at all. The default is overwritten the moment the engineer assigns a different address in WinCC flexible.
Can I keep the Control Panel value and just skip the WinCC flexible change?
Only as long as the panel is not running a WinCC flexible project. The loader ignores the registry values of a panel that is in transfer mode. Once a runtime is transferred, the next boot will restore the project's address.
Is the TP 177A the only Siemens panel with this behavior?
No. The same "loader overrides Control Panel" rule applies to the OP 77A, OP 77B, TP 170A, TP 170B, TP 177A, TP 177B, OP 177B and the smaller Mobile Panels. The behavior changed for the Comfort and Unified panels, where most of these settings are now persisted in flash and respect the Control Panel edits.
How do I prove that the fix is permanent?
After the project transfer, perform at least three cold starts (24 V removed for 10 s) and read the address back from the Control Panel each time. The address must stay at the value configured in the project. Also confirm in STEP 7's MPI Bus Nodes online view that the panel reports the correct address and no diagnostic-buffer entries are written.