Siemens OP20 Memory Module Troubleshooting: 6AV3971-1NA02-0CA0

Problem Overview

The Siemens OP20 is a legacy text-display HMI panel from the early 1990s that was deployed extensively on S5 and early S7 PLC lines. Field engineers continue to encounter service calls on these devices because the installed base is large, the panels are physically robust, and the user programs still operate critical machines. The single most common service event on an OP20 is a memory-module fault that manifests as a cold-start failure: after a controlled power-down (or after an unintended mains interruption), the panel fails to boot on the first attempt, sometimes shows garbage on its 2x20 or 2x40 LCD, and requires two to six manual power cycles before the application screen finally appears.

When the suspected memory module is swapped with a known-good unit harvested from a sister machine, the symptom disappears. This is the diagnostic signature of a degrading flash-memory sub-system rather than a mainboard, LCD, or keypad failure. This article walks through the identification, diagnosis, repair, and migration options for the Siemens OP20 memory module, with primary reference to catalog number 6AV3971-1NA02-0CA0.

Hardware Identification

The OP20 family has several model variants. Identifying the exact variant is mandatory before sourcing a replacement memory module or migration panel.

Each variant uses the same backplane connector footprint but expects a different screen layout and key matrix. The memory module holds the project configuration that maps variable tags, screens, and key actions. Migrating the project to a different OP variant requires rewriting screen coordinates and key actions even though the variable tags remain identical.

Memory Module 6AV3971-1NA02-0CA0: Internal Architecture

The OP20 memory module, Siemens catalog number 6AV3971-1NA02-0CA0, is a small PCBA that plugs into the rear of the OP20 mainboard. It carries two distinct non-volatile devices:

• EPROM — Holds the OP20 firmware / operating system. This is normally write-protected and is not user-programmable in the field. If the firmware is corrupt the panel will not boot at all and the symptom is not the cold-start issue described above.
• FLASH memory — Holds the user project (screens, tags, messages, recipes, password table). This is the device the user can upload, download, and erase using the COMTEXT configuration software.

The flash chip is typically a 28F256 or 28F512-compatible parallel NOR flash from Intel or AMD. These devices have a finite endurance rating of typically 10,000 to 100,000 erase cycles per sector, and after 15-25 years in service the cells at the boot sector commonly fail first. A failing boot sector forces the OP20 bootloader to retry the flash read multiple times during initialization, which is the physical cause of the multi-retry cold-start symptom.

COMTEXT Configuration Software

OP20 panels are programmed with Siemens COMTEXT, a CP/M-based configuration tool that pre-dates ProTool, ProTool/Pro, and WinCC flexible. COMTEXT runs under DOS or under Windows 95/98 native DOS mode (the Windows NTVDM does not reliably support the OP20 serial transfer protocol).

Why COMTEXT is hard to source

COMTEXT was withdrawn from sale in the late 1990s and is not available on the current Siemens HMI software catalog. Field engineers typically obtain working copies through one of these channels:

1. Archive of original 3.5" install floppies kept by long-tenured plant electricians.
2. Siemens regional sales office request — when a known industrial customer still maintains an active service contract, Siemens HMI Technical Support can occasionally produce archived media.
3. Compatibility-aware image of COMTEXT running under DOSBox on a modern Windows host, used as a viewer only — the OP20 serial transfer rate is timing-sensitive and DOSBox serial passthrough often fails; use a real DOS or Win9x machine for any flash programming operation.

Minimum PC requirements for COMTEXT

Establishing the serial link to the OP20

1. Connect the OP20's serial port (TTY / RS-232, 9-pin) to the PC's COM1 with a null-modem cable. Pin 2/3 crossed, pin 5 straight, pins 4/6/8 crossed, pin 7 straight per Siemens 6ES5734-2BD20 wiring diagram.
2. Apply 24 V DC to the OP20 and wait for the boot screen.
3. On the OP20, enter setup mode by holding F1 + F2 during power-up; the panel displays the transfer menu.
4. Select TRANSFER → PC → OP on the panel side.
5. In COMTEXT on the PC, choose File → Transfer → Upload from OP. The project is dumped into a .ptp or .bin archive in the working directory.
6. For download, reverse the procedure: select PC → OP in COMTEXT and confirm the OP20 prompts.

Root Cause Analysis of Cold-Start Failure

When the OP20 is powered up, the bootloader reads the first sector of the flash memory on the 6AV3971-1NA02-0CA0 module. The sector contains the project header, the tag table pointer, and the boot screen bitmap. If any byte in the sector fails its CRC check the bootloader retries the read up to N times (N is firmware-defined, typically 5) before either accepting the read or flagging a fatal error.

Two failure modes are observed in service:

• Recoverable retries: Each retry is slow enough that the operator perceives the panel as “dead.” After 1-5 retries the read succeeds and the panel proceeds to the application screen. This is the symptom described in the original service report.
• Unrecoverable failure: The retries exhaust, the panel displays ERROR 04: FLASH or ERROR 12: CRC, and the operator cannot reach the application screen at all.

Both modes are caused by charge loss in the floating-gate cells of the parallel NOR flash. As the cell threshold drifts, the read-sense amplifier takes longer to distinguish a 0 from a 1, and the bit-line settling time exceeds the bootloader's read window. Repeated read cycles eventually produce a correct sense because the sense amplifier settles.

Memory Module Replacement Procedure

The 6AV3971-1NA02-0CA0 module is field-replaceable. The procedure below covers both the “swap from a known-good donor” path and the “transplant the flash chip to a new module” path that the original field engineer asked about.

Prerequisites

• Replacement module 6AV3971-1NA02-0CA0, either factory-new, factory-refurbished, or harvested from a decommissioned OP20 of identical variant.
• COMTEXT installed on a DOS-class PC with a verified null-modem cable.
• Anti-static wrist strap, anti-static mat, and an EPROM/flash programmer capable of 28F256 / 28F512 (e.g. Xeltek SuperPro 580, Wellon CE600, or TL866 II Plus with an adapter) if the chip transplant path is chosen.
• A verified project backup on the DOS-class PC.

Step-by-step: swap from donor

1. Power down the OP20. Disconnect 24 V DC. Wait 30 seconds.
2. Remove the rear cover; the memory module is the small PCB on the back of the mainboard, retained by a single screw and a 30-pin header.
3. Discharge static. Lift the donor module straight up, observing the keyed header orientation (pin 1 marker is a small triangle on the PCB silkscreen).
4. Inspect the donor module's flash chip for any visible damage, leakage, or lifted pads. Reject if compromised.
5. Insert the donor module with pin 1 aligned to the header marking. Press firmly and reseat the retaining screw.
6. Re-apply 24 V DC. The OP20 should boot directly to the application screen within 2 seconds.
7. If the panel boots but displays the wrong screens for the variant, the donor came from a different OP20 variant — return to step 4.

Step-by-step: chip transplant

Yes, the user project is stored on the flash device and, with appropriate tooling, the chip can be transferred to an empty module. This is the most economical repair when a donor of the correct variant is not available.

1. Remove both the suspect module and a known-good empty donor module (or a new blank 6AV3971-1NA02-0CA0).
2. Use a hot-air rework station at 280-310 °C with a focused nozzle to remove the flash chip from the suspect module. Avoid prolonged heating; the PCB is single-sided and pad lift is the main risk.
3. Clean the pads with braid and no-clean flux.
4. Either re-ball the salvaged chip and reflow it onto the donor module, or — preferred — read the suspect chip first with a programmer, save the binary image to disk, then program a fresh 28F256 / 28F512 chip and solder it onto the donor module.
5. Verify the programmed image byte-for-byte against the original read.
6. Install the donor module as in steps 5-7 above.

Verification

After any memory-module intervention, perform these checks before returning the OP20 to production:

1. Power-cycle test — perform five cold starts from a powered-off state. Each must reach the application screen within 2 seconds. No retries, no flicker, no ERROR codes.
2. Serial transfer test — connect COMTEXT and perform a full project upload; the uploaded image must match the last known-good archive exactly.
3. Tag-loopback test — with the PLC offline, force a known tag in COMTEXT and confirm the value is reflected on the OP20 screen within the configured poll interval.
4. Keypad test — exercise every function key and every numeric key, confirming the configured action fires.
5. 24-hour burn-in — leave the OP20 powered and observe that no spontaneous reboots, screen blanks, or error codes appear.

Migration Path to a Modern HMI

OP20 panels are no longer in production, and even refurbished 6AV3971-1NA02-0CA0 modules are increasingly difficult to source. For new installations and for situations where the OP20 has been rebooted too many times to be reliable, migrating to a current Siemens HMI is the long-term answer.

Migration is not a drag-and-drop. Expect the following work items:

• Screen rebuild — the OP20 fixed-character display must be redesigned for the new panel's pixel grid and touch zones.
• Tag remap — COMTEXT used a flat numeric tag namespace; WinCC uses symbolic names with optional data-type conversion. The variable addresses themselves do not change in the PLC, but the OP-side representation does.
• Keypad-to-touch remap — function keys become touch buttons; the action logic must be moved from OP-side key actions to button events in the screen.
• Recipe migration — recipes stored on the OP20 flash must be exported via COMTEXT, parsed, and re-imported as WinCC recipes.
• Cutover window — schedule the swap during a planned downtime; the OP20 and the new panel should not be on the line at the same time unless you have verified both work independently.

Spare Parts Strategy

For plants that still operate OP20 panels, a deliberate spare strategy reduces unplanned downtime:

• Maintain a pool of at least 2 known-good memory modules per OP20 variant in service. Burn a verified project image onto each.
• Label each spare with the OP20 variant it is configured for, the project version, and the date of last successful verification.
• Re-verify spares on a 12-month cycle. Flash memory continues to degrade on the shelf; a spare that has not been read in five years is itself a candidate for the cold-start symptom.
• Store spares in anti-static bags, in a climate-controlled cabinet (15-25 °C, < 60 % RH), away from direct sunlight.
• Document the COMTEXT project archive on a modern medium (USB key, network share) so that the spares can be re-imaged even if the original DOS-class programming PC fails.

Power Supply Diagnostic

Before assuming the memory module is the root cause, verify the 24 V DC supply. The OP20 draws an inrush of approximately 1.2 A for 50-100 ms at cold start, which is enough to collapse an undersized supply or a long, thin cable run.

1. Connect an oscilloscope or a recording DMM across the OP20's 24 V terminals.
2. Power down, then power up, capturing the inrush event.
3. Check that the minimum voltage does not dip below 21.0 V DC during inrush. If it does, the boot retries are caused by the supply and not the flash.
4. Calculate the cable voltage drop: V_drop = 2 × L × I / (k × A) where L is one-way cable length (m), I is inrush current (A), k is copper conductivity (56 m/Ω·mm²), and A is conductor cross-section (mm²). Add V_drop to the supply's nominal output to verify the worst-case terminal voltage stays above 21.0 V.

Field Commissioning Checklist

Frequently Asked Questions