Troubleshooting KTP700 Basic Network Timeout and Display Failure

Troubleshooting KTP700 Basic 2nd Generation: Network Timeout and Display Failure

The Siemens SIMATIC KTP700 Basic 2nd Generation (6AV2 123-2GB03-0AX0) is a 7-inch widescreen HMI panel widely deployed on machines networked to S7-1200 and S7-1500 controllers. Field incidents have shown that panels shipped with image version 13.00.00.04_01.01 and boot loader date stamps around June/July 2016 can develop two coupled symptoms: (1) progressive Ethernet ping timeouts and intermittent TCP connectivity to the PLC and engineering station, and (2) a display failure in which the LCD shows only black and white horizontal/vertical lines instead of the WinCC Comfort/ Basic project. After a hard power cycle, the display typically recovers but the network fault persists or recurs. In severe cases the panel refuses to boot past the loader splash and the screen remains blank.

This article consolidates the corrective path recommended by Siemens Support: ProSave-based factory reset, image re-flashing with the correct service image, network/port verification, and post-recovery acceptance testing. Every step assumes WinCC (TIA Portal) engineering tools are installed on a Windows PC, and that the operator has read/write access to the panel via direct Ethernet or through a managed switch such as the SCALANCE XB005 (6GK5 005-0BA00-1AB2).

1. Affected Hardware and Firmware Identification

Before any recovery procedure, identify the exact panel variant, image, and boot loader. The values determine which service image and ProSave option set you need.

The firmware pairing 13.00.00.04_01.01 with a 2016 boot loader has been associated in Siemens support tickets with display driver corruption and a stuck network stack when exposed to long-duration ping traffic or broadcast storms. Either condition can independently trigger the symptoms; combined, they produce the field signature described in the source incident.

2. Symptom Matrix and Failure Modes

The failure progresses through four observable states. Treat each as a distinct diagnostic gate.

3. Pre-Recovery Network Diagnostics

Before assuming the HMI is defective, validate the upstream network. The SCALANCE XB005 is an unmanaged 5-port switch with no management interface; ports are equal-cost and store-and-forward. Verify the following on the engineering station:

1. Open Control Panel → Set PG/PC Interface on the Windows engineering PC. Under Access Point of the Application, select S7ONLINE → [your Ethernet adapter]. This routes TIA Portal, ProSave, and Ping diagnostics through the physical NIC rather than a virtual adapter.
2. Disable Wi-Fi, VPN clients, and any third-party firewall (Symantec, McAfee, Kaspersky) that may intercept ARP/ICMP. Windows Defender Firewall may be left enabled but must allow File and Printer Sharing (Echo Request - ICMPv4-In) on the active profile.
3. From the PC, run a continuous ping to the HMI MAC address via the static IP:

   ping -t -l 1472 192.168.0.10

   The -l 1472 payload size mimics full-size PROFINET frames. Watch for repeating timeout sequences at predictable intervals (often every 30, 60, or 90 minutes).
4. Capture traffic with Wireshark on the engineering NIC for 10 minutes. Filter on the panel MAC and inspect for: ARP storms, IGMP general queries the panel never answers, or broadcast packets exceeding 5 % of line rate.
5. Try a direct crossover (or modern auto-MDI/MDIX patch cable) PC-to-panel connection bypassing the SCALANCE. If the fault clears, the switch or another device on the segment is generating the broadcast pressure.
6. Replace the RJ45 patch cable with a known-good shielded industrial cable (e.g., 6XV1 850-2GH10) and re-seat both ends. Oxidation of the panel's internal transformer pins has been observed after years of 24/7 thermal cycling in panels shipped in the 2016 production window.

If the ping remains stable for 24 hours on a direct connection, reconnect through the SCALANCE. The unmanaged switch is rarely the root cause, but its lack of broadcast filtering can amplify traffic from other nodes.

4. Power and Display Verification

A panel showing black and white lines but with the backlight illuminated indicates the LCD controller receives power and a default test pattern, but the runtime image failed to load. Confirm:

1. Measure the 24 V DC supply at the panel terminal block (X80). Acceptable range: 19.2 V to 28.8 V (24 V ± 20 % per Siemens manual). Ripple < 5 % peak-to-peak.
2. Confirm the panel's functional ground is bonded to the cabinet PE at a single point. Floating grounds cause ESD-induced NAND write errors that mimic image corruption.
3. Power cycle the panel with a minimum 10-second off time to allow the internal DC/DC converters to fully discharge.
4. Observe the boot loader splash. The screen should display the Siemens logo, then the device name, IP address, and project name. If only the Siemens logo appears and then lines, the loader is healthy but the runtime image is corrupted (State C).

5. Factory Reset via ProSave (Primary Recovery)

The Siemens-recommended corrective action for the failure pattern described is a factory reset using ProSave, the service tool bundled with every WinCC (TIA Portal) installation. The reset clears the internal flash, removes the corrupted runtime image and project, and returns the panel to its out-of-box state.

5.1 Prerequisites

• ProSave (version matching or exceeding the installed TIA Portal). TIA V15.1 ships ProSave V15.1; TIA V16 ships ProSave V16. Mixed versions can recover older panels but always match major version when possible.
• PC with a free Ethernet port and IP address in the same subnet as the panel. The default panel IP is 192.168.0.10, subnet mask 255.255.255.0. Set your PC NIC to 192.168.0.1 / 255.255.255.0.
• Ethernet patch cable, ideally shielded.
• The 6-digit transfer password if one has been configured in the project; if the password is lost, a factory reset is the only path.

5.2 Procedure

1. Power on the panel and confirm you can ping it. If the panel is unreachable, hold the panel in reset by disconnecting power.
2. Launch ProSave from the Windows Start menu or from C:\Program Files\Siemens\Automation\Portal V16\Data\ProSave.exe.
3. Select General → Device Type = KTP700 Basic 2nd Generation PN. Connection = Ethernet.
4. In the IP Address field, type the panel's IP. In the MAC Address field, type the MAC printed on the rear label, separating the six hex pairs with hyphens, e.g., 28-63-36-0A-BC-DE. The MAC field allows ProSave to find the device even if its IP has been corrupted to an unreachable subnet.
5. Click Connect. ProSave queries the panel's boot loader over UDP/34866 (PROFINET commissioning port) and reports back the firmware version and loader date. If the panel is in State D and refuses the connection, force loader mode by entering a specific boot sequence (see Section 6).
6. Once connected, choose the Update OS tab. Tick the checkbox "Reset to factory settings" at the bottom of the dialog. Confirm the warning that all project data, recipes, logs, and the transfer password will be erased.
7. Browse to the correct service image. For image version 13.00.00.04_01.01, use the matching image file KTP700_Basic_2nd_13.00.00.04_01.01.0pkg distributed on the Siemens Support website entry ID 19701610. Newer images (e.g., 13.00.00.05_xx.xx, 13.01.0x.xx) are compatible and recommended if available.
8. Click Update OS. ProSave transfers approximately 90–120 MB over Ethernet in 5–10 minutes depending on link speed. Do not power off the panel during the write phase; interrupting the flash write bricks the panel.
9. When ProSave displays "Update completed successfully", click Reboot. The panel restarts into the loader, then the new runtime image, then the empty desktop with no project.
10. Reconfigure the panel IP, transfer mode, and transfer password as required. Transfer the project from TIA Portal via HMI → Compile → Download to Device → Ethernet.

5.3 Verification

• Loader splash displays new image version and loader date.
• Desktop renders without horizontal/white lines.
• Continuous ping ping -t 192.168.0.10 returns 0 % loss over a 24-hour soak.
• Transfer the project, cycle power once more, and verify tag polling to the PLC.

6. Boot Loader Recovery for State D (Hard Lockout)

If the panel will not pass the loader splash after a power cycle, you must force it into loader-only mode so ProSave can write a new image.

1. Power off the panel.
2. Press and hold the touch area in the upper-left corner of the screen (approximately 1 cm from the top edge, 1 cm from the left edge) while power is applied.
3. Apply 24 V DC. Continue to hold the touch contact for 10–15 seconds. The panel will skip the runtime image and remain in the loader.
4. The loader displays the device name, current image version, IP, and a "Connect to ProSave" prompt.
5. From ProSave, connect as in Section 5, run the factory reset, and reboot.

If the touch contact trick fails (display still blank), perform the reset button equivalent: insert a thin non-conductive pin into the service hole on the rear of the panel (present on 2nd generation Basic panels) and depress the recessed button for 5 seconds with the panel powered. This triggers the loader watchdog.

7. Updating to a Newer Image as a Preventive Measure

If the recovery image 13.00.00.04_01.01 is the latest available on Siemens Support for your region, you still have the option to migrate forward. Siemens periodically releases updated images that fix:

• LCD controller initialization race conditions.
• IP stack memory leaks under sustained broadcast load.
• Boot loader handoff corruption when the runtime image CRC fails.

Check the Siemens support entry for the panel at 109746433 and filter on "Firmware/Image Update". Verify compatibility with your TIA Portal version: an image compiled against TIA V14 SP1 may not accept a TIA V16 project without first being upgraded via ProSave.

8. Wiring and Power Quality Checks

Recurring image corruption is often traceable to supply noise rather than firmware. Verify:

If the cabinet contains VFDs or servo drives, install a SITOP PSE202U redundancy module or a separate 24 V DC branch fed from an isolated power supply. Shared neutrals and ground loops across multiple PROFINET devices have been confirmed in field reports to corrupt NAND writes on the KTP700.

9. Switch Configuration Review (SCALANCE XB005)

The XB005 is unmanaged and offers no configuration. However, deployment rules still apply:

• Maximum segment length per PROFINET specification: 100 m between any two devices. Cable impedance 100 ohm ± 15 %.
• Do not daisy-chain SCALANCE XB005s; each must connect back to a managed switch if more than one is used.
• Mount the switch with at least 30 mm clearance above and below for convective cooling. The XB005 derates above 60 °C ambient.
• Avoid running PROFINET cables parallel to VFD motor cables inside the same tray. Maintain 200 mm separation or use a metal divider.

10. Post-Recovery Acceptance Test

Document and run the following acceptance checklist before returning the machine to production.

1. Visual: project graphics render, no artifacts.
2. Touch: every touch area triggers the configured event in TIA online diagnostics.
3. Ping soak: 24-hour continuous ping, zero loss.
4. PLC link: verify each PROFINET tag in the HMI tag table reads and writes a known value from the PLC program.
5. Power cycle: three successive power cycles, each followed by automatic project restart within 30 seconds.
6. Network storm: introduce 5 % broadcast load with a third device on the switch. Monitor the HMI connection for 15 minutes.

11. Escalation Path

If the panel recovers the display but the network fault persists after a clean factory reset, the issue is no longer image-related. Open a support request via the Siemens Industry Online Support portal, providing:

• MLFB and serial number.
• Loader splash photo.
• ProSave diagnostic log (saved from File → Save Log).
• Wireshark capture of the failure window.
• Power quality measurements.

Reference Siemens support entry 19701610 (factory reset procedure for Comfort/Basic panels) and the operator's manual for the KTP700 Basic 2nd Generation in your TIA Portal installation under Documentation → HMI → KTP700 Basic.

12. Frequently Asked Questions