Resolving Siemens TP 177A MPI Address Reset to 1 After Power Loss

David Krause13 min read
HMI / SCADASiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Problem Summary

A SIMATIC TP 177A panel configured as an MPI slave on a bus with a SIMATIC S7-314C-2DP is downloaded successfully over an MPI cable. After the download the panel communicates with the CPU, and the operator can read/write tags. The moment the 24 V DC supply to the TP 177A is removed and reapplied, the panel comes back online with MPI address 1 instead of the address (typically 2, 3 or 4) that the engineer had assigned in the Control Panel. The HMI immediately drops off the bus, "Not Connected" or "Connection failed" alarms appear, and tags stop updating.

The field symptom is consistent: changes made directly in the HMI Control Panel are not retained across a power cycle, even though the operator pressed "OK" or "Apply" before leaving the screen. The behavior is independent of the MPI cable, the PLC MPI/DP interface, the bus terminators, and the panel firmware revision.

Engineering note: An MPI address conflict on the bus is not the same as this reset problem. If the panel always reports address 1, the bus may still respond (the S7-314C-2DP itself uses address 2 by default). What fails is the project-defined connection, not the bus scan.

2. Affected Hardware and Software

Component Order Number / Version Role
SIMATIC TP 177A 4" mono 6AV6 642-0BA01-1AX1 HMI, MPI slave
SIMATIC TP 177A 4" color 6AV6 642-0BC01-1AX1 HMI, MPI slave
SIMATIC S7-314C-2DP 6ES7 314-6CG03-0AB0 CPU with combined MPI/DP interface
WinCC flexible 2008 SP5 (or SP3 minimum) 6AV6 613-0AA01-2... Project engineering
ProTool / WinCC flexible image on TP 177A Image <= V1.3.0.0 for TP177A Runtime on panel
PC adapter USB / MPI 6ES7 972-0CB20-0XA0 Engineering download

Reference manuals to keep open while troubleshooting:

3. Root Cause: WinCC flexible Runtime Overrides the Control Panel

On the TP 177A, the MPI address, the "highest station address" (HSA), the transmission rate, and the "only master on the bus" flag are project properties. They live in two places:

  1. The compiled WinCC flexible runtime image (the *.fwx file that is downloaded to the panel).
  2. The Control Panel (the Windows CE-style settings applet, opened from the loader or from Start > Settings > Control Panel).

When the TP 177A is in runtime (the project is running), the HMI uses the values from the compiled image. The Control Panel entry shows the same numbers, which is why the operator believes the change was applied. The instant the user touches OP > MPI/DP Settings in the Control Panel and presses OK, those values are written to the registry on the panel. On the next reboot, however, the loader re-applies the runtime image values and the registry is overwritten. The address therefore jumps back to 1 (the default that WinCC flexible stamps into the project if the engineer never changed it).

This is the documented behavior: in the TP 177A, OP/control panel changes are a temporary diagnostic override, not a permanent configuration. The only persistent configuration source is the WinCC flexible project.

Why the panel "looks like" it accepts the change: the Control Panel writes the registry keys HKLM\SOFTWARE\Siemens\HMI\OP\MPI\Station and ...\MPI\Master. The TP 177A loader (CeRDisp.exe / HmiLoader) reads the project image on every cold start and pushes the project values back into the registry. Only the project survives a power cycle.

4. Why the Control Panel "Save to OP" Path Does Not Persist

WinCC flexible exposes two different workflows for MPI configuration:

  • Temporary change (for commissioning, before the project is finished): edit in the Control Panel, leave the panel in the loader, reboot. The value is kept as long as the panel is not put back into runtime. The moment the engineer transfers a project, the runtime overrides the registry again.
  • Permanent change: edit the connection in the WinCC flexible project tree, recompile, and transfer the project to the panel.

The TP 177A's Control Panel does offer a Save Registry / OP applet, but its only practical effect on a TP 177A with a WinCC flexible runtime is to write the registry values that the runtime will overwrite on the next boot. Use it only when the panel is being used in transfer mode without a project (loader only).

5. Prerequisites

To fix the persistent MPI address the engineer must work at the engineering station, not on the panel:

  1. WinCC flexible 2008 SP3 or later installed on a Windows XP / Windows 7 (32-bit) engineering PC.
  2. The original *.hmi project that was used to commission the TP 177A. If only the compiled *.fwx exists, the project must be reverse-compiled (WinCC flexible > Project > Compiler > Reverse) or recovered from the most recent ProSave backup.
  3. PG/PC interface set to PC Adapter (MPI) or PC Adapter (PROFIBUS) with transmission rate 187.5 kbps (default for MPI) and station address 0.
  4. Free MPI address on the bus. For a TP 177A on the same MPI segment as the S7-314C-2DP (default MPI = 2), pick address 3 or 4 to leave room for additional nodes and for any PG used during service.

6. Step-by-Step: Configure the MPI Address in WinCC flexible

  1. Open the project in WinCC flexible 2008.
  2. In the project tree, right-click the TP 177A node and choose Properties.
  3. Switch to the Connection tab.
  4. Select the S7-300/400 driver and the network MPI.
  5. Set HMI station address to the desired value (example: 3).
  6. Set Highest station address (HSA) to a value at or above the highest node on the segment. For an S7-300 CPU at MPI = 2 plus a single TP 177A at MPI = 3, HSA = 31 is safe and is the WinCC flexible default.
  7. Set Transmission rate to 187.5 kbps (mandatory for the S7-300 default MPI bus; 1.5 Mbps only on isolated segments with repeaters).
  8. Tick "The HMI is the only master on the bus" only if the segment has no other class-1 master (no PG, no other panel doing active data exchange). Otherwise leave it cleared.
  9. On the PLC side, set the CPU's MPI address to 2 (default) and confirm the same transmission rate.
  10. Save, compile (Project > Compiler > Generate) and check that no warnings reference the MPI address.

7. Step-by-Step: Alternative - Saving the Control Panel Value on the Panel

Use this only if the panel is going to remain in loader mode (no runtime project) or if you need a one-shot value while waiting for a recompiled project.

  1. Boot the TP 177A and stay in the loader (do not start runtime).
  2. Tap Start > Settings > Control Panel > OP.
  3. Set Station Address to the desired MPI address.
  4. Set Only Master on the Bus if applicable.
  5. Press Save and confirm with OK.
  6. Power-cycle the panel. The address is now kept as long as the panel is not put back into runtime.

As soon as a WinCC flexible runtime is transferred to the panel, the loader will overwrite the registry on the next boot. Treat the Control Panel save as a temporary measure.

8. Transfer the Project to the HMI

  1. Connect the PC adapter to the TP 177A's MPI port (lower of the two 9-pin D-sub connectors on the rear of the device, labelled IF 1B).
  2. Switch the panel into transfer mode: Start > Settings > Transfer, enable Automatic transfer, accept the default MPI address and click OK.
  3. In WinCC flexible, choose Project > Transfer > Transfer. Set the mode to MPI/DP, target address equal to the HMI station address (3 in the example), and click Transfer.
  4. Watch the progress bar; a full transfer (project + firmware if requested) takes 3-6 minutes on a 187.5 kbps MPI link.
  5. When the dialog reports Transfer completed, the panel will restart automatically.
Backplane warning: do not set the target MPI address in the transfer dialog to a value that conflicts with a node already on the bus. The transfer tool only writes to the loader's registry; it does not check for collisions.

9. Verification Procedure

After the project is on the panel and the panel has rebooted into runtime, verify the configuration is now persistent:

  1. Read the address back from the Control Panel: Start > Settings > Control Panel > OP. The station address must show the value set in the project (3 in the example). It may be displayed as "read-only" because the runtime has locked the field - this is correct.
  2. Remove the 24 V supply for at least 10 seconds.
  3. Reapply 24 V. The panel must come up at MPI = 3, start the project, and re-establish the connection to the S7-314C-2DP within the configured Connection monitoring time (default 3 s).
  4. Open a WinCC flexible screen that contains a tag from the CPU (e.g. a status word). The tag value must update without a "connection interrupted" alarm.
  5. Run a second power cycle to confirm reproducibility. The behavior must be identical on cycle 2, 5 and 20.

If the address still drifts back to 1, the runtime is reading an old image. Wipe the panel's flash first:

  1. Start > Settings > Control Panel > System > OP > Clear Flash (password-protected, default 100).
  2. Reboot, stay in loader, then re-transfer the project.

10. Related Parameters and Settings

Parameter Location Typical value Comment
HMI station address WinCC flexible project > Connections > MPI 3 Must be unique on the segment.
CPU MPI address STEP 7 > Hardware > CPU314C-2DP > Properties > MPI/DP interface 2 Default. Do not change unless the bus master plan requires it.
Highest station address (HSA) WinCC flexible > OP > MPI/DP Settings 31 Must be >= max(used addresses). Affects token rotation time.
Transmission rate WinCC flexible > OP > MPI/DP Settings 187.5 kbps Must match PLC and all other nodes.
Profile WinCC flexible > OP > MPI/DP Settings MPI Set to "MPI" unless the bus is wired as PROFIBUS with class-2 repeater logic.
"Only master on the bus" WinCC flexible > OP > MPI/DP Settings Cleared Only tick if no other master (PG, panel) will be on the segment.
Connection monitoring time WinCC flexible > Connection > Properties 3 s Time before the HMI reports a connection error.
Time-out for PLC response WinCC flexible > Connection > Properties 1000 ms Increase to 2000-3000 ms on long MPI cables with strong EMC.

11. Troubleshooting Matrix

Symptom Likely cause Check Remedy
Address = 1 after every reboot WinCC flexible project still has address 1 Project tree > Connection > HMI station address Set the correct address, recompile, re-transfer
Address = 1 only after power cycle, not after warm restart Loader re-applies runtime image WinCC flexible > Transfer > settings Use "Reset on target" option in the transfer dialog
Panel stays at 3 in Control Panel but loses connection Address collision (another node already at 3) STEP 7 > PLC > MPI diagnostics Pick an unused address; scan the bus with ProTool/Pro
Address jumps to 31 or 126 Default HSA overwritten, address > HSA WinCC flexible > OP > MPI/DP > HSA Set HSA = 31 or higher
Address retained for hours then reverts to 1 Stale image, panel is in "Backup project" mode Loader > Settings > Backup/Restore Disable backup mode, transfer the live project
Panel cannot be reached at any address Different transmission rate set in panel vs. PLC Control Panel > OP > MPI/DP > Baud rate Set both sides to 187.5 kbps
Connection OK, but tags show "###" MPI works, area pointer/DB not loaded WinCC flexible > Tags > connection check Recompile tag list, verify DB exists in S7 project

12. Extended Diagnostics

For deeper analysis connect to the bus with STEP 7 and run PLC > Diagnostics/Settings > MPI Bus Nodes. The online view lists every active station with its address, transmission rate and diagnostic buffer entries. A healthy segment with the S7-314C-2DP at 2 and the TP 177A at 3 will show both nodes, status "OK", and no "station failure" events.

If the panel appears twice (once at 1, once at 3) the loader has not finished swapping the runtime image. Wait one full minute and re-scan; the duplicate should disappear. A persistent duplicate at address 1 indicates that an older project is still in flash and a new transfer is required.

For ring/line topology, MPI permits a maximum of 32 stations per segment without repeater, maximum cable length 50 m at 187.5 kbps with no repeater (extended to 1000 m with two repeaters). The TP 177A's MPI port provides the bus terminator only when the adjacent DIP switch on the rear of the panel is set to "ON"; the S7-300 does not provide a built-in terminator - install a 9-pin D-sub with 220 Ω between pins 3 and 8 at each end of the bus.

13. Field-Proven Caveats

  • Never change the MPI address with the bus powered and a second master active; the master may pick up the new station only after the next token rotation (up to one HSA cycle, typically < 1 s at 187.5 kbps, but up to 30 s on heavily loaded segments).
  • Some legacy WinCC flexible 2004 projects use Station instead of MPI Station in the registry. The TP 177A firmware knows the difference; if the loader keeps writing the old key, the image is from WinCC flexible 2004 and must be re-imported into a 2008 project to migrate cleanly.
  • Do not set the HMI's address to the same value as the CPU. Some S7-300 firmware revisions will report a non-fatal bus error and the panel may appear to "lock up" in transfer mode for several seconds.
  • After clearing the panel's flash, the loader shows Transfer as the only available option. Transfer the project, do not just reboot, otherwise the panel returns to the loader with the default address 1 and looks like a fault.
  • Always keep the most recent project on a shared drive; the TP 177A's compact flash can fail and a re-transfer is then impossible without the source *.hmi file.

14. FAQ

Why does the TP 177A forget the MPI address I set in the Control Panel?

Because the panel's loader re-applies the compiled WinCC flexible runtime image on every cold start, overwriting the registry values that the Control Panel wrote. The Control Panel change is a temporary override; the permanent value lives only in the WinCC flexible project under Connections > MPI > HMI station address.

What is the default MPI address of a TP 177A?

1. The S7-300 CPU 314C-2DP defaults to MPI = 2. So the very first download, if the user did not change anything, places the HMI at 1 and the CPU at 2, which is why an "out of the box" pair of devices talks at all. The default is overwritten the moment the engineer assigns a different address in WinCC flexible.

Can I keep the Control Panel value and just skip the WinCC flexible change?

Only as long as the panel is not running a WinCC flexible project. The loader ignores the registry values of a panel that is in transfer mode. Once a runtime is transferred, the next boot will restore the project's address.

Is the TP 177A the only Siemens panel with this behavior?

No. The same "loader overrides Control Panel" rule applies to the OP 77A, OP 77B, TP 170A, TP 170B, TP 177A, TP 177B, OP 177B and the smaller Mobile Panels. The behavior changed for the Comfort and Unified panels, where most of these settings are now persisted in flash and respect the Control Panel edits.

How do I prove that the fix is permanent?

After the project transfer, perform at least three cold starts (24 V removed for 10 s) and read the address back from the Control Panel each time. The address must stay at the value configured in the project. Also confirm in STEP 7's MPI Bus Nodes online view that the panel reports the correct address and no diagnostic-buffer entries are written.

Back to blog