Overview
The SIMATIC TP27 is a compact 6-inch STN touch panel released by Siemens for direct attachment to the S7-200 family of micro-PLCs. According to the Siemens product release document, the unit ships with an 8-color STN LCD at 320 x 240 pixels, resistive touch, and a single physical interface block that exposes both a serial RS-232 service port and a PPI/MPI/Profibus port for runtime communication. Configuration of the TP27 is performed with ProTool, the legacy HMI configuration tool that pre-dated WinCC flexible and TIA Portal's WinCC for this hardware class.
When a project download fails with the dialog message
E4020:Internal Error Download 00003621H. No connection to the OP!
ProTool is reporting that the configuration PC attempted a transfer handshake and received no response from the panel. The 32-bit code word 0x00003621H is a hardware-absence flag inside the ProTool transfer driver: the panel is reachable on the bus, the driver opened the port, but no ack came back from the OP. The symptom has three possible root causes, all field-recoverable without replacement parts in most cases:
- The TP27 is in the wrong transfer mode for the selected PC interface.
- The cable is wrong, damaged, or pinned for a different protocol than the one selected in ProTool.
- The TP27 communication PCB (MPI/PPI transceiver or RS-232 transceiver) is faulty.
This document expands each branch, gives the cable pinouts, the ProTool project-transfer rules, the on-panel diagnostic procedure, and a verification matrix that confirms the link is healthy before you leave the machine.
Problem Description: E4020 and 0x00003621H
| Field | Value | Meaning |
|---|---|---|
| ProTool error class | E4xxx | Transfer layer (serial/MPI) errors |
| Dialog text | E4020: Internal Error Download | Driver failure during download sequence |
| Sub-code | 0x00003621H | No response from OP after polling timeout |
| Typical bus state | PC port open, no telegram acked | Physical layer absent or asleep |
| Most common cause | Wrong transfer mode on the panel | TP27 is in Online mode while PC attempts Serial download, or vice versa |
0x3621 is a status code, not a hardware fault code stored in the TP27 firmware. It is generated entirely inside the ProTool transfer driver on the PC side. The hex suffix H confirms that the value is a 16-bit (or 32-bit zero-padded) hardware-absence status. There is no equivalent error stored in the TP27's diagnostic buffer for this case, so do not search the panel for a code — the dialog on the PC is the only source of truth.
Root Cause Taxonomy
Three branches account for almost every field occurrence of 0x3621. Rank by likelihood before tearing the panel open.
Branch A — Transfer Mode Mismatch (most common)
The TP27 has a hidden Transfer mode that is invoked from the loader menu at boot. If the panel boots into Online (running the project) and you attempt a Serial download, ProTool polls the RS-232 port and the panel does not respond because its serial service channel is disabled. The reverse — ProTool set to Serial and the panel set to Transfer/MPI — produces the same code, because the PC is talking RS-232 and the panel is talking RS-485 on PPI.
Branch B — Cable or Pinout Error (second most common)
Three physical cables are candidates for the TP27 link:
- RS-232 null-modem cable (DB9/F-to-DB9/M, 1:1 crossed) — used for the very first project download from ProTool to the TP27.
- Siemens PC/PPI cable (6ES7 901-3DB30-0XA0 for RS-232 PC side, 6ES7 901-3BF10-0XA0 for USB PC side) — used for PPI download after the first serial transfer.
- PC/MPI cable (6ES7 972-0CA23-0XA0 or equivalent) or Profibus cable — used for MPI/Profibus download on TP27 builds that expose the DP port.
Using a 1:1 straight-through RS-232 cable instead of a null-modem cable is the single most common reason for 0x3621 on first-time transfer. The TP27 is a DCE on its serial port and expects TX/RX crossed plus handshake loop-back.
Branch C — Hardware Failure (rare)
The TP27 communication PCB integrates the RS-232 transceiver, the RS-485 PPI/MPI transceiver, and the optocoupler isolation. A blown transceiver, an open fuse on the 24 V input that powers the RS-485 side, or a cracked solder joint on the DB9 connector can produce 0x3621 even with the right cable and the right transfer mode. The diagnostic procedure in section 7 isolates this branch.
TP27 Hardware Architecture and Interfaces
The TP27 rear face exposes a fixed terminal block for 24 V DC power, a DB9 female for the serial service port, and a DB9 female for the PPI/MPI/Profibus port. The same DB9 form factor is used on both ports, but the silkscreen and the part-number label identify which is which.
| Item | Specification |
|---|---|
| Display | 6" STN LCD, 320 x 240 pixels, 8 colors |
| Touch | 4-wire resistive, finger or stylus |
| CPU | Embedded 16-bit controller, ProTool runtime |
| Service port | RS-232, DB9/F, null-modem pinout, 19.2 kbit/s default |
| Fieldbus port | RS-485, PPI/MPI/Profibus DP slave, DB9/F |
| Power input | 24 V DC nominal, range 18–30 V, ~0.3 A |
| Configuration tool | ProTool / ProTool/Lite (legacy), see Siemens entry ID 4292253 |
Source: SIMATIC TP27 — New Graphic Display Unit (Entry ID 4292253).
The serial port and the fieldbus port are isolated from each other on the PCB. A failure of the fieldbus transceiver does not prevent serial transfer, and a failure of the RS-232 transceiver does not prevent PPI/MPI transfer. This separation is the basis of the diagnostic ladder: if you can get a successful serial transfer, the fieldbus port is the suspect; if you can get a successful PPI/MPI transfer, the RS-232 port is the suspect.
Cable Requirements and Pinout
Serial Download Cable (first transfer only)
Use a DB9/F-to-DB9/M null-modem cable with handshake loop-back. The classic Siemens 6XV1440-2KHxx family part numbers cover this role; the original part may be discontinued, but the pinout is reproducible.
| PC DB9 (DTE) | Signal | TP27 DB9 (DCE) |
|---|---|---|
| 2 (RXD) | TX → RX | 3 (TXD) |
| 3 (TXD) | RX → TX | 2 (RXD) |
| 4 (DTR) | DTR ↔ DSR | 6 (DSR) |
| 6 (DSR) | DSR ↔ DTR | 4 (DTR) |
| 7 (RTS) | RTS ↔ CTS | 8 (CTS) |
| 8 (CTS) | CTS ↔ RTS | 7 (RTS) |
| 5 (GND) | Ground | 5 (GND) |
Shields are tied at the PC end only. The cable length should not exceed 15 m for reliable 19.2 kbit/s transfer. Do not use a 1:1 straight-through cable — ProTool will not see the panel and will surface the 0x3621 code after the polling timeout.
PPI / MPI / Profibus Cable (subsequent transfers)
For PPI and MPI transfer, use a Siemens PC/PPI cable (RS-232 variant 6ES7 901-3DB30-0XA0 or USB variant 6ES7 901-3BF10-0XA0). For MPI/Profibus on TP27 builds that support it, use a PC/MPI cable 6ES7 972-0CA23-0XA0 (USB) or 6GK1 571-1AA00 (RS-232). Pinout is standard Siemens Profibus DP with bus termination 220 Ω at both ends if the TP27 is a bus end node.
Cable Reference Drawing
ProTool Project Transfer Rules
ProTool's transfer driver enforces two rules that catch first-time users:
- Rule 1 — First project must be transferred via the serial port. The TP27's MPI/PPI service channel is only enabled after a project has been loaded. An empty or freshly-flashed panel answers only on the RS-232 service port. The 6XV1440-2KHxx (or equivalent null-modem) cable is mandatory for this first transfer.
- Rule 2 — After the first successful serial transfer, future projects can be transferred via PPI, MPI, or Profibus as long as the matching driver is selected on both the PC and the panel. ProTool stores the last-used channel in the project; if you change it, you must set the panel back to the matching mode before clicking Transfer > Download.
Setting the transfer mode on the TP27:
- Power off the panel.
- Hold the top-right corner of the touch screen.
- Power on while continuing to hold. The loader menu appears.
- Tap Transfer. The panel prompts for the channel.
- Select Serial for first download, or PI (PPI/MPI/Profibus) for subsequent downloads.
- Tap Exit. The panel is now visible to ProTool on the chosen channel.
Diagnostic Procedure for TP27 Communication Board
Use this ladder to separate cable, mode, and hardware failures without removing the panel from the cabinet.
Step 1 — Visual and Power Checks
- Confirm the 24 V supply is present at the TP27 terminal block, measured between +24 V and 0 V with a true-RMS multimeter. Ripple must be below 5 % of nominal.
- Confirm the green Power LED is on. If it is off, the panel is not booting at all and 0x3621 is a downstream symptom.
- Confirm the display backlight is on. If the panel boots to a blank display, the loader cannot be reached and the transfer mode cannot be set.
Step 2 — Loader Menu Check
Cycle power while holding the top-right corner of the touch. The loader menu confirms the touch controller and the firmware are alive. If the loader does not appear, the panel firmware is corrupted and a firmware recovery download is required — a different procedure from this article.
Step 3 — Serial Port Loopback Test
With the panel powered, install a DB9 loopback plug on the TP27's serial service port (pin 2 ↔ pin 3, pin 4 ↔ pin 6, pin 7 ↔ pin 8) and run a terminal program on the PC at 19200 8N1. If the panel's loader sends a heartbeat on the serial port, you will see characters; if you see nothing, the RS-232 transceiver on the TP27 PCB is open. The fieldbus port is independent and may still be functional for runtime communication even if serial is dead.
Step 4 — Fieldbus Port LED/Activity Test
Connect the TP27 to a known-good S7-200 CPU (CPU 222, CPU 224, or CPU 226) over PPI with a known-good PC/PPI cable. Power both. The PPI activity LED on the CPU should blink within five seconds, indicating the bus is alive. If the CPU shows PPI fault, the TP27 fieldbus transceiver is suspect. Try a second known-good cable to eliminate the cable variable first.
Step 5 — ProTool Verbose Log
Open the project in ProTool and choose File > Transfer > Download. In the dialog, enable Show log. The log prints the polled address, the timeout, and the byte count. If the log shows "Polling address 0... timeout after 3 attempts" with 0x3621, the panel is not on the bus. If the log shows "Polling address 0... 1 byte returned" followed by 0x3621, the panel is on the bus but the protocol handshake is failing — almost always a transfer mode mismatch.
Step-by-Step Recovery Procedure
Apply in order. Stop at the first step that restores the link and run the verification matrix in section 9.
- Verify the cable. For a first-time transfer, use a DB9 null-modem cable with handshake loop-back. Substitute a known-good cable if available. A straight-through RS-232 cable will produce 0x3621 with no other symptom.
- Set the TP27 to Serial transfer mode via the loader menu (top-right corner on power-up, then Transfer > Serial > Exit).
- Set the ProTool transfer channel to Serial in File > Transfer > Settings. Set the COM port to the one the cable is plugged into. Set baud to 19200 8N1, which is the TP27 default.
- Click Transfer > Download. If the project has never been loaded on this panel, ProTool will perform the full image transfer. If the panel already has a project with a different protocol channel, ProTool will warn and ask for confirmation.
- When the first download completes, reboot the panel into Transfer > PI mode and switch ProTool to PPI. Re-run the download to confirm the PPI path also works. This second pass proves the fieldbus transceiver on the TP27 is healthy.
- If serial succeeds but PPI fails, the fieldbus transceiver is suspect. Inspect the DB9 pins for bent or pushed-back contacts, then replace the communication PCB.
- If serial fails after step 3, run the loopback test from section 7 step 3. Replace the RS-232 transceiver or the whole communication PCB if loopback fails.
Verification Checklist
| Check | Method | Pass Criterion |
|---|---|---|
| Serial transfer | ProTool > Transfer > Download, channel Serial | 0x0000 success code in transfer log |
| PPI/MPI transfer | ProTool > Transfer > Download, channel PPI | 0x0000 success code, panel reboots to Online |
| Runtime PLC comms | Run project, observe tag updates | Tag values from S7-200 update on screen within 1 s |
| Touch calibration | Calibrate from loader menu | All four corner targets reachable with finger |
| Loader accessible | Top-right corner on power-up | Loader menu appears within 2 s of release |
| No spontaneous resets | Leave panel in Online for 30 min | No reboots, no comms loss |
Field-Proven Cautions and Edge Cases
USB-to-Serial Adapter Caveat
Many modern field laptops no longer have a DB9. A USB-to-RS-232 adapter will work for the TP27 serial transfer, but not every chipset is supported by ProTool's transfer driver. Adapters based on the FTDI FT232 or the Silicon Labs CP2102N are known to work at 19200 8N1. Prolific PL2303-based adapters have a long history of timing-jitter problems with ProTool; if 0x3621 persists with a known-good cable, try a different USB-to-serial adapter before suspecting the panel.
Profibus Termination
If the TP27 sits at a physical end of a Profibus segment and termination is enabled on the S7-200 side, the TP27's internal termination must be enabled too, or vice versa. Double-terminated segments cause PPI faults that ProTool will report as comm loss, not as 0x3621. The 0x3621 code itself is specifically the no-response case, so check the wiring of pin 6 (P5V) and pin 5 (DGND) on the Profibus connector — these are required for the bus to be biased.
Power Supply Ripple
Field measurements show that a 24 V supply with more than 10 % ripple (from a heavily-loaded switching supply or an undersized transformer) can cause the TP27 RS-232 transceiver to reset during a long transfer. The first few KB of the project transfer succeed, then the link drops. ProTool's log will show partial-byte errors, not 0x3621, but the symptom is sometimes confused. Check supply ripple with an oscilloscope at the panel terminals, not at the supply.
Replacing the Communication PCB
On older TP27 units the communication PCB is a single module with both transceivers. When the RS-232 side is dead and the PPI side is healthy, the panel can stay in service by switching the fieldbus configuration to PPI download and abandoning serial transfer. New projects are then deployed via PPI only. This is not a clean solution — any future firmware update that requires serial transfer will fail — but it is acceptable for a panel at end-of-life.
Reference Documents
- SIMATIC TP27 — New Graphic Display Unit, Entry ID 4292253
- Siemens FAQ "Connecting a PG/PC to a SIMATIC Panel for Serial Download" — Entry ID 22765193 (covers the 6XV1440-2KHxx cable family and the null-modem pinout)
Troubleshooting Matrix
| Symptom | Most Likely Cause | First Action |
|---|---|---|
| E4020 0x3621 on first download | Straight-through cable used instead of null-modem | Replace with null-modem DB9 cable |
| E4020 0x3621 on subsequent download | ProTool channel set to Serial, panel in PI mode | Switch ProTool to PPI/MPI, or switch panel to Serial |
| E4020 0x3621, panel not visible in loader | 24 V supply below 18 V or heavily loaded | Measure supply at panel, check ripple |
| E4020 0x3621, loopback test fails | RS-232 transceiver open | Replace communication PCB or switch to PPI only |
| E4020 0x3621, loopback passes, panel in loader | TP27 serial service channel disabled | Enter loader, choose Transfer > Serial > Exit |
| E4020 0x3621 with USB-to-serial adapter | Chipset timing-jitter or wrong COM port | Try FTDI/CP2102N adapter, verify COM number |
| ProTool log shows partial bytes then timeout | Supply reset or cable intermittent | Check 24 V ripple, replace cable |
What does error E4020 with sub-code 0x00003621H actually mean on a SIMATIC TP27?
It is a ProTool transfer-driver status indicating that the PC opened the chosen COM or MPI port, polled the panel at the default TP27 address, and received no response before the timeout. The code is generated on the PC side, not inside the TP27 firmware, and points to a physical-layer or transfer-mode problem rather than a logic error in the project.
Why must the first project download to a TP27 be done over the serial port?
The TP27's PPI/MPI service channel is only enabled after a valid project has been loaded. A blank or freshly-flashed panel answers only on the RS-232 service port, and ProTool enforces this with the "first transfer must be serial" rule. Subsequent projects can be re-deployed over PPI, MPI, or Profibus once the runtime is up.
What is the correct RS-232 cable for first-time TP27 download?
A DB9/F-to-DB9/M null-modem cable with handshake loop-back. The legacy Siemens part 6XV1440-2KHxx covers this function; the pinout is TX-RX crossed (2↔3), DTR-DSR crossed (4↔6), RTS-CTS crossed (7↔8), and signal ground on pin 5. A 1:1 straight-through cable will produce error 0x3621 with no other symptom.
How do I put the TP27 into serial transfer mode?
Power off the panel, hold the top-right corner of the touch screen, and power on. The loader menu appears. Choose Transfer, then Serial, then Exit. The panel is now visible to ProTool on the RS-232 service port. For PPI/MPI, choose PI instead of Serial.
How can I confirm the TP27 communication board is healthy before ordering a replacement?
Run three checks: (1) enter the loader menu from cold-boot — if it appears, the CPU and firmware are alive; (2) install a DB9 loopback plug on the serial service port and run a terminal at 19200 8N1 — if the panel sends characters, the RS-232 transceiver is healthy; (3) connect the TP27 to a known-good S7-200 CPU over PPI with a known-good cable — if the PPI activity LED on the CPU blinks, the RS-485 transceiver is healthy. Failures localize the fault to the specific transceiver branch.