Resolving TP 177B Administration Freeze with WinCC flexible 2007

The Siemens SIMATIC TP 177B is a 6-inch HMI panel based on Windows CE 5.0 and is engineered for compact machine-level visualization. When paired with WinCC flexible 2007, it provides a full set of user administration features, including password-protected areas, user groups, and login timeouts. In production environments, however, a recurring issue has been reported: the administration dialog becomes unresponsive while runtime itself continues to operate normally. Operators can no longer log in, change user rights, or access password-protected screens. The only field-level workaround reported by integrators has been a hard power cycle of the panel, which in turn interrupts machine operation and risks recipe or batch data loss.

This reference consolidates the diagnostic decision path, the official Siemens support articles, and the field-proven hardening steps to bring a frozen TP 177B administration dialog back to a deterministic state without repeated power cycling.

1. Problem Definition and Symptoms

The reported fault is narrow and identifiable. Capture the following data points before changing any configuration on the panel:

• Runtime on the TP 177B remains active, tags are still being acquired, and screen navigation outside the user administration area still works.
• The user administration dialog (the screen used to log in, log out, or change passwords) becomes non-responsive. No button presses, no field entries, and no hotkeys have an effect.
• The fault is intermittent: it appears after a few days or a few weeks of continuous operation; it cannot be reproduced on demand.
• There is no event logged in the WinCC flexible alarm buffer that indicates a system-side rejection such as a three-attempt lockout.
• A power cycle (24 V DC off, wait 10 s, 24 V DC on) temporarily restores function, but the fault recurs.
• Multiple user groups (admin, supervisor, operator) are configured and all are equally affected when the fault occurs.

Because runtime continues to function, the root cause is isolated to the user administration subsystem rather than to the CE 5.0 image, the HMI device firmware, or the runtime engine as a whole.

2. Affected Components and Versions

3. Root Cause Analysis

The intermittent loss of the user administration dialog on TP 177B panels is reproducible to a narrow root-cause window. When HF4 is not installed, the WinCC flexible 2007 runtime can leave the user administration state machine in a non-recoverable state under the following conditions:

1. Repeated invalid login attempts on a non-existent or mis-selected user name. Operators routinely enter a password without checking the user-name field. Because the runtime validates the (name, password) pair, the login fails. After three consecutive failed attempts on the same user name, the panel issues a system event similar to "User is blocked for 10 minutes" and the administration dialog can stall until the cooldown elapses. If the operator continues typing during the cooldown, the dialog's internal state can be corrupted.
2. Password aging without a configured escape path. If Password aging is enabled in the WinCC flexible project but no user view is provided for the operator to change the password before expiry, the panel enters a forced-change state at the next login. On the TP 177B, this forced-change flow can deadlock the dialog when the user is part of a group whose password cannot be changed by the operator.
3. Use of default user names (admin or administrator). Default names are the most frequent target of brute-force or miskey events, which increases the chance of triggering the internal lockout. Renaming the user account is a recommended hardening step.
4. Background recipe or alarm data block writes that overlap the user administration area in memory. On panels with the smaller 4 MB project image, a non-paged event can starve the dialog's message queue, leaving it unable to dispatch paint or keyboard events.

The unifying factor is that the panel runtime does not self-recover the user administration dialog once the state machine has been pushed into a stalled condition. Only a full restart of the runtime (effectively a power cycle on TP 177B) clears the state, which is why the field workaround has historically been to cut 24 V DC.

4. Diagnostic Checklist

Before applying any patch, validate the following items in sequence. The decision tree below produces a deterministic answer for whether HF4 alone resolves the issue or whether a deeper OS reset is required.

1. Confirm runtime version. On the panel, open Start > Settings > Control Panel > OP > Information and record the Image and Runtime version strings. Compare with the fix list in Siemens support entry 28882233.
2. Check the alarm buffer. Look for system alarm "Login error" or "User blocked" with a time stamp. If present, the lockout branch is active. If absent and the dialog is still frozen, the dialog-state-machine branch is active.
3. Confirm whether password aging is enabled. In the WinCC flexible project tree, navigate to User Administration > Properties > Password aging. Note the configured aging interval and the configured escape group.
4. Inventory the user names. List every user name and group. Identify any user using admin, administrator, or another well-known default.
5. Reproduce the lockout intentionally. From a logged-out state, enter three wrong passwords for a known user. Observe the panel behavior. If the dialog freezes without showing the lockout message described in entry 24456113, the state-machine bug is confirmed.
6. Verify the current project file checksum against the engineering source. A corrupted project file can cause the same symptom and is masked by the same dialog.

5. Immediate Field Workarounds

Where a planned maintenance window is not available, the following two workarounds restore operator usability without a power cycle and without requiring firmware changes. Both have been used in production by the community of integrators for the TP 177B family.

5.1 Two-administrator pattern

Configure at least two user accounts with the same administrator group membership, but with distinct user names that are not admin or administrator. If the dialog is in a stalled state for user A, log in as user B from the password keypad. The stall affects only the most recent state and is cleared by a successful login from a different user record. This avoids the 24 V DC power cycle on the panel.

5.2 User view with a reset action

Add a dedicated user view that includes a Reset user button. Wire the button to a script or system function that clears the in-memory user record and re-enables the administration dialog. On WinCC flexible 2007 this is achieved with the ResetUser internal function or by setting the user record to a known state via a tag change. Provide at least one button on the main screen so that the operator does not need to enter the administration dialog at all to recover.

6. Permanent Fix: Apply WinCC flexible 2007 Hotfix 4

Hotfix 4 is the cumulative fix pack for the WinCC flexible 2007 runtime on the 170/270/370 panel family, including the TP 177B. The hotfix addresses the user administration dialog state-machine bug and several related runtime issues. The fix is delivered as a self-extracting installer for the engineering station and as a corresponding runtime image update for the panel.

6.1 Prerequisites

• WinCC flexible 2007 SP2 or later installed on the engineering station.
• Administrator rights on the engineering PC.
• ProSave (or the integrated transfer dialog) available for Ethernet or MPI/DP transfer to the panel.
• A backup of the current panel project file (*.fwx or *.pdl) on external media.
• A scheduled production window of approximately 15 minutes for the OS update on the panel.

6.2 Hotfix installation on the engineering station

1. Download the hotfix from Siemens support entry 28882233. Validate the file checksum against the value published on the support page.
2. Close WinCC flexible 2007 and any open project on the engineering PC.
3. Run the hotfix installer. The installer updates the WinCC flexible 2007 components and the transfer channel DLLs.
4. Reboot the engineering station to load the patched transfer components.

6.3 Transfer the patched runtime to the panel

1. Open the project in WinCC flexible 2007.
2. Open Project > Transfer > Transfer or use ProSave directly.
3. Select Operating system update, then tick the Reset to factory settings option. The reset is critical: it clears the user administration state machine, the recipe database, and any internal locks that the runtime is holding.
4. Confirm the transfer. The panel will reboot twice: once into the bootloader, once into the new image.

6.4 Restore the project and the user database

1. After the panel has rebooted into the new image, transfer the compiled project *.fwx file back to the panel via the same channel.
2. Recreate the user database from the engineering source. The factory reset clears the local user records; the runtime must re-read them from the project.
3. Verify the user list under Start > Settings > Control Panel > OP > User Administration on the panel, or through a configured user view in the project.

7. Hardening the User Administration Configuration

After the hotfix is applied, configure the project to minimize the chance of recurrence. The following settings are derived from the Siemens support entries and from integrator field practice.

Where password aging is enabled, a user view with a Change password function must be linked to a screen that is reachable without entering the user administration dialog. Otherwise, when the password expires, the operator is forced into the very dialog that has shown the stall, recreating the failure mode.

8. Password Aging Configuration in WinCC flexible 2007

1. In the project tree, open User Administration.
2. Open the Properties dialog of the user administration node.
3. Select the Password tab.
4. Enable Use password aging and set the aging period to a value that fits the operator shift pattern, typically 30 to 90 days.
5. Enable Warn user before password expires and set the warning interval to 5 days.
6. In the runtime project, add a screen with a user view linked to a tag that triggers the ChangePassword system function. Place a button on the main screen that is wired to this tag so that the operator can change the password from the main menu.

This sequence ensures that the operator never needs to enter the user administration dialog solely to change a password. It also ensures that the warning is delivered through a non-blocking screen, which is significantly less likely to deadlock.

9. Verification Procedure

After the hotfix, the OS reset, and the project restore, run the following verification sequence. Each step must pass before the panel is returned to production.

1. Login round trip. Log in as the primary administrator, perform a tag write through a password-protected screen, log out, and log back in. Repeat three times in succession.
2. Wrong-password test. Log out, then enter three wrong passwords in a row. Confirm that the panel issues the Login error / user blocked message described in entry 24456113. Confirm that after the cooldown elapses, the dialog is fully responsive again.
3. Lockout recovery. While the lockout is active, attempt to log in as the secondary administrator. Confirm that the dialog accepts the second account even while the first is in cooldown.
4. Password change under warning. Trigger a near-expiry warning and execute the password change from the user view, not from the user administration dialog. Confirm the change is applied.
5. Soak test. Leave the panel running for a minimum of 72 hours with normal operator activity. Verify the alarm buffer contains no User blocked storm and that the administration dialog remains responsive.

10. Long-Term Recommendations

The TP 177B is a mature platform. For new deployments, evaluate migration to a current Comfort Panel or Unified Comfort Panel running TIA Portal, which use a redesigned user administration engine and are not affected by the 2007 RT state-machine bug. For existing fleets, keep the engineering station on the latest WinCC flexible 2007 hotfix, mirror the panel's project file in the version control system, and schedule an annual factory reset of the panel image to clear any latent state.

For machine builders who have multiple customers running TP 177B panels, maintain a standard project template that already includes:

• Two non-default administrator accounts.
• A user view with a Reset user action reachable from the main screen.
• Password aging enabled with a reachable change-password screen.
• The HF4 image bundled into the transfer archive.

11. Reference to Official Siemens Documentation

• WinCC flexible 2007 Hotfix 4 - download and release notes (entry 28882233)
• How to perform an OS update with 'Reset to factory settings' on operator panels (entry 19701610)
• System message for three invalid password attempts on a user (entry 24456113)
• General tips for user administration on WinCC flexible panels (entry 24140534)