TP177B FTP Error 530: Resolving WinCE 3.0 Pocket IE FTP Issues

1. Problem Overview

The Siemens SIMATIC TP177B (6-inch and 4-inch variants) ships with Windows CE 3.0 embedded and the legacy Pocket Internet Explorer browser engine. Engineers who attempt to load files, recipes, logs, or firmware into the panel over FTP from a Windows 7 (or later) PC running Microsoft IIS FTP, FileZilla Server, or any RFC 959-compliant FTP daemon frequently encounter a reproducible fault pattern:

• Navigating to ftp://192.168.0.155 on the panel returns error 530 ("Not logged in" or "Login incorrect").
• Navigating to ftp://user:[email protected]/ produces no error and no listing; the browser sits idle or shows a blank page.
• Other Windows PCs on the same subnet can list the FTP root and download files without issue.
• The same FTP server is reachable from an MP277 running Windows CE 5.0 using its standard Internet Explorer browser without modification.

This behavior is not a network fault, an IIS misconfiguration, or a firewall rule. It is a documented limitation of the WinCE 3.0 Pocket Internet Explorer FTP client, and it cannot be resolved by upgrading the panel operating system or the browser.

2. Affected Hardware, Firmware, and Software Versions

3. Prerequisites for FTP File Transfer to a TP177B

Before troubleshooting, verify the engineering environment meets all of the following conditions:

1. Network reachability – the panel and PC share a subnet (e.g., 192.168.0.x / 255.255.255.0) with no VLAN or router ACL blocking TCP port 21 (control) and the dynamic data port range (typically 1024-65535 in passive mode).
2. Control Panel / Network on the TP177B shows the configured IP, subnet mask, and default gateway. Use Start → Settings → Network and Dial-up Connections on the panel.
3. FTP server installed and listening on the PC. On Windows 7 with IIS, verify with netstat -an | findstr :21 – the line 0.0.0.0:21 LISTENING must appear.
4. FTP user account created with Read (and Write, if uploading) permission on the virtual directory.
5. FTP Basic Authentication enabled. IIS by default permits anonymous; if anonymous is disabled, the client must supply credentials.
6. FTP over SSL/TLS disabled in the IIS FTP site settings. WinCE 3.0 Pocket IE does not implement FTPS (RFC 4217) and cannot negotiate AUTH TLS.
7. Firewall exception for the FTP service. Windows Firewall must allow the "FTP Server" rule on the appropriate profile (Domain, Private, or Public).

4. Root Cause Analysis

WinCE 3.0 ships with a stripped-down browser that implements HTTP/1.0 and a partial FTP client. The client is designed to request anonymous listings only when the user navigates to a bare ftp://host/ URL. Two specific deficiencies explain every symptom observed:

4.1 Anonymous-Only Authentication

When the user enters ftp://192.168.0.155, Pocket IE opens the control connection, sends USER anonymous, and the IIS server (with anonymous authentication disabled or with a password policy that rejects "anonymous@") replies with 530 Not logged in. The error number is the standard RFC 959 status code and is returned by every conformant server when authentication fails.

4.2 URL-Embedded Credentials Not Parsed

When the user enters ftp://user:[email protected]/, Pocket IE's URL parser ignores everything after the host. It then attempts anonymous login and receives 530, but the parser suppresses the error message because it considered the URL "already authenticated." The result is the silent blank page: the session is technically open but anonymous, the root directory is empty for the anonymous account, and the listing is empty.

4.3 Why MP277 Works but TP177B Does Not

The MP277 uses Windows CE 5.0, whose bundled Internet Explorer implements the full RFC 1738 <userinfo> URL grammar. It correctly extracts the username and password, sends USER user and PASS password, and renders the directory listing. The TP177B's WinCE 3.0 PIE does not implement <userinfo> for the FTP scheme.

5. FTP Error 530 Reference

For the TP177B case, the 530 is expected behavior from a server that is correctly enforcing authentication. The fault is on the client (panel) side, not the server.

6. Diagnostic Procedure

Use this sequence to confirm the root cause and rule out genuine server/network faults before applying a workaround.

1. Verify from a Windows PC. From a second workstation on the same subnet, open Command Prompt and run:
   ftp 192.168.0.155
   Log in with the same user/password that the panel should use. A successful 230 User logged in, proceed and a working dir listing confirm the server is healthy.
2. Capture the FTP exchange on the PC server (IIS → FTP site → Logging, or Wireshark on TCP port 21). Confirm that the panel's USER command is USER anonymous regardless of what the user typed in PIE.
3. Try the panel in IE Mobile 6 emulation. From the PC, open http://192.168.0.155/ if an HTTP server is also installed. If HTTP works and FTP returns 530/silence, the issue is protocol-specific to the PIE FTP client.
4. Compare platforms. If an MP277 is available on the bench, connect it to the same FTP server using the same credentials in IE Mobile 6. A successful listing on MP277 with identical credentials, combined with the failure on TP177B, isolates the fault to the WinCE 3.0 client.
5. Inspect the TP177B firmware loader. From Start → Programs → Transfer or the WinCC flexible transfer dialog, attempt a recipe/parameter upload. The transfer dialog uses its own SMB-like protocol, not the browser FTP, and may succeed even when the browser fails.

7. Solution 1 — Configure the FTP Server to Allow Anonymous Read of the Required Files

If the use case is read-only (firmware, manual, recipe download from server to panel), enable anonymous FTP read on the IIS site:

1. In IIS Manager, select the FTP site → FTP Authentication.
2. Enable Anonymous Authentication.
3. Set the anonymous user identity to IUSR (default) or a domain account with Read on the target folder.
4. Set NTFS permissions on the physical directory: IUSR → Read & Execute, List Folder Contents.
5. From the TP177B, open Pocket IE and navigate to ftp://192.168.0.155/. The directory listing will appear.

8. Solution 2 — Migrate to MP277 / TP177B Successors

If authenticated FTP is mandatory, replace the TP177B with an HMI that ships with WinCE 5.0 or later. The following Siemens panel classes support a fully RFC-1738-compliant FTP browser:

The migration is largely drop-in: the WinCC flexible project compiles to the new target with the same tags, screens, and scripts. Only the panel type and display size need updating in the project tree.

9. Solution 3 — Switch from FTP to HTTP or SMB File Transfer

Both protocols are supported by the TP177B's WinCE 3.0 stack and avoid the PIE FTP client entirely.

9.1 HTTP File Download (read-only)

1. On the PC, install IIS Web Server role (if not already present) and create a virtual directory pointing to the file share, e.g., http://192.168.0.155/share/.
2. Add MIME types for .bin, .fwx, .csv, and .pdf in IIS MIME settings.
3. On the TP177B, open Pocket IE and navigate to http://192.168.0.155/share/. PIE will render the directory listing (if directory browsing is enabled) and the user can tap any file to download it to the panel's \Flash File System\<filename> or \Storage Card\<filename> location.

9.2 SMB/CIFS File Share (read/write)

The TP177B includes the WinCE SMB client (CIFS redirector). The most reliable method for transferring files to and from a TP177B is a Windows share:

1. On the PC, create a folder C:\TP177B_Transfer and share it as TP177B$ (hidden) with Read/Write for the engineering account.
2. Disable Password Protected Sharing in Network and Sharing Center, or set a known user/password pair that matches a local WinCE account.
3. On the TP177B, open Start → Programs → Windows Explorer and enter in the address bar:
   \\192.168.0.155\TP177B_Transfer\
4. Authenticate when prompted. Files can be copied in either direction.

10. Solution 4 — Use the WinCC flexible Transfer Dialog

The WinCC flexible Transfer mode on the TP177B is purpose-built for engineering file transfer and uses a Siemens-proprietary protocol over Ethernet or MPI/Profibus. It is independent of the FTP stack.

1. In WinCC flexible, select Menu → Transfer → Transfer Settings and choose Ethernet.
2. On the TP177B, enable Start → Settings → OP → Transfer → Ethernet. Set the panel IP to a fixed address in the same subnet as the PC.
3. Click Transfer on the panel. The panel announces itself via UDP broadcast on port 1105 (WinCC flexible Transfer).
4. In WinCC flexible, the panel appears in the transfer dialog. Click Transfer to push the compiled .fwx runtime file to the panel.

This is the recommended method for project (HMI image) deployment and is not subject to the FTP client limitation.

11. Solution 5 — Use VBScript or Scheduled Task on the Panel to Pull Files

WinCE 3.0 includes a minimal wininet.dll and the ftp.exe command-line client. The FTP.EXE utility on WinCE 3.0 does support the -s:filename script switch and can authenticate:

1. Create a script file \Flash File System\getfile.txt containing:

   open 192.168.0.155
   user
   password
   binary
   get firmware.bin
   bye

2. On the panel, open a command prompt (Start → Programs → Command Prompt) and run:
   ftp -s:\Flash File System\getfile.txt
3. The transfer completes silently and the file is written to the panel's local storage.

Schedule the call with a WinCE scheduled task or call it from a VBScript in the WinCC flexible runtime using WshShell.Run "ftp -s:\Flash File System\getfile.txt", 0, True.

12. Commissioning Procedure for FTP File Transfer on TP177B

1. Document the firmware version of the TP177B (Start → Settings → System → About) and the catalog number.
2. Decide which solution fits the application:
   • Read-only public files → Anonymous FTP (Solution 1)
   • Authenticated engineering transfer → WinCC flexible Transfer (Solution 4) or HTTP/SMB (Solution 3)
   • Authenticated FTP from PIE specifically → Hardware migration to MP277/Comfort Panel (Solution 2)
   • Headless scripted transfer → FTP.EXE with -s script (Solution 5)
3. Apply the chosen configuration. Capture a Wireshark trace of TCP/21 during a test transfer to verify the protocol exchange.
4. From the TP177B, perform a controlled pull of a known test file (e.g., 1 MB binary) and confirm the MD5 checksum on both sides.
5. Record the procedure in the plant's automation network baseline (host, IP, ports, credentials, schedule).

13. Verification Checklist

14. Troubleshooting Matrix

15. Operational Notes and Caveats

• No firmware upgrade for TP177B: Siemens does not publish WinCE 3.0 patches. Plan hardware migration when the panel is end-of-life for spares (typically 10 years after product phase-out).
• PIE memory ceiling: WinCE 3.0 PIE has a hard 64 MB heap limit. Very large directory listings (thousands of files) can crash the browser. Mirror only the files required.
• Character encoding: PIE uses Windows-1252; filenames with non-Latin characters may not display correctly. Use ASCII filenames for FTP shares serving TP177B panels.
• Security baseline: Avoid placing an FTP server with anonymous read on the same VLAN as safety controllers (S7-300F, S7-400F, ET200S F-modules). Segregate engineering and process networks with a firewall or L2 ACL.
• Logging: Enable IIS FTP logging in W3C Extended format and ship logs to a central syslog server for audit. Set log file rollover at 10 MB / daily.
• Compliance: If the plant must follow IEC 62443, anonymous FTP and SMBv1 are not acceptable. Use Comfort Panel (WinCC RT Advanced) with HTTPS / SFTP instead.

16. Related Siemens Documentation

• Siemens Industry Online Support entry ID 15250466 — TP177B file transfer and FTP behavior
• Siemens Industry Online Support entry ID 13336639 — TP177B / Pocket Internet Explorer compatibility notes
• WinCC flexible 2008 SP5 Commissioning Manual (Siemens manual entry ID 21635027 in the legacy portal)
• SIMATIC TP177B Device Manual (6AV6 591-1DC01-0AB0)

17. FAQ