Resolving WinCC 6.0 VBScript Access Violation on PLC Tag

Resolving WinCC 6.0 VBScript Access Violation on PLC Tag Property Change

1. Problem Overview

WinCC 6.0 SP3 (build 6.0.3.0) Runtime crashes with an unhandled exception when VBScript (VBS) actions modify the properties (color, visibility, position) of grouped graphical objects whose trigger is bound to an external PLC tag. The same script works correctly when the trigger references an internal WinCC tag. The behavior is reproducible when two or more VBS actions are attached to the same group or when a single action manipulates multiple objects inside a group.

The runtime fault surfaces as a modal dialog Unhandled exception raised. See WinCC Diagnose Directory followed by a WinCC Runtime termination. The associated WinCC_Sys_.log records Access violation with a stack that points into CCWriteSTDOSet.exe or PDMrt.exe. The fault is consistently tied to the OPC/DP channel read path combined with rapid tag polling against grouped PDL objects.

2. Affected Environment

The fault is not present on internal tags because the internal tag manager re-uses a locked buffer; external tags traverse a channel DLL and an OPC stack that releases the calling thread before the property set completes, exposing a race condition inside the property writer of the grouped object.

3. Error Symptoms and Diagnostic Artifacts

When the trigger fires against a PLC tag, the following diagnostic artifacts are produced:

1. Modal message box: Unhandled exception raised. See WinCC Diagnose Directory.
2. Runtime closes without graceful deactivation; project *.RT is left in STOPPED state.
3. Log file <WinCC_install>\diagnose\WinCC_Sys_<hostname>.log contains:

   <date> <time>  PDMrt.exe          Access violation (0xC0000005) at address 0xXXXXXX reading 0xXXXXXXXX
   <date> <time>  GfxRt.exe          Runtime aborted by exception handler
   <date> <time>  CCWriteSTDOSet.exe Read of uncommitted tag value buffer
   

4. Dr. Watson / drwtsn32.log records a stack frame inside CCWriteSTDOSet!SetObjectProperty.
5. Performance monitor shows OPC channel thread CPU pinned at 100% during the second preceding the crash.

4. Root Cause Analysis

Three compounding defects cause the crash:

4.1 Property-set re-entrancy on grouped objects

WinCC V6.0 SP3 base ships a property writer (CCWriteSTDOSet.dll) that iterates a group synchronously and writes each child property while holding a non-re-entrant critical section. When a second action on the same group is dispatched by the tag manager, the second thread blocks on the same section; if the OPC channel completes the tag read between the iteration and the commit, the second thread enters the section before the buffer is invalidated, dereferencing a freed pointer.

4.2 Trigger-rate mismatch for external tags

The default recommended trigger cycle of 250 ms is intended for internal tags whose value changes are CPU-local. External tags traverse the channel DLL, the OPC server, and the S7 driver; a 250 ms cycle on a slow DP- or MPI-attached PLC saturates the channel and causes read completions to overlap. Each overlapped completion is dispatched on the same GUI thread that owns the property writer, re-arming the defect in 4.1.

4.3 Missing SP3 Hotfix 2 patch

Siemens published Hotfix 2 for V6.0 SP3 to address VBS runtime stability issues, including the Access Violation when scripting against grouped objects and external tags. The patch reroutes the property writer through a marshaled call and adds a per-group guard that serializes re-entrant access. Without Hotfix 2, the conditions in 4.1 and 4.2 reproduce on virtually every installation.

5. Resolution Procedure

Apply the following three fixes in order. Each step is independently necessary; skipping step 5.1 leaves the defect reproducible.

5.1 Install WinCC V6.0 SP3 Hotfix 2

1. Close WinCC Explorer and stop all WinCC services:

   net stop "CCAgent" /y
   net stop "S7DOS" /y
   net stop "SyNIEtch" /y

2. Locate the hotfix package referenced in the Siemens support entry ID 21480479 (Hotfix 2 for WinCC V6.0 SP3). Verify the downloaded file is signed by Siemens AG and matches the build date listed in the entry.
3. Run the installer with administrative rights and follow the wizard until Setup completed successfully is displayed.
4. Reboot the engineering station and the Runtime station.
5. Confirm the installed version with Start → Programs → SIMATIC → WinCC → Information. The version string must read 6.0.3.0 HF2 or higher.

5.2 Optimize VBS to cache tag reads

Replace every HMIRuntime.Tags(...).Read call with a single local variable assignment at the top of the trigger function. Each .Read call enters the channel DLL, allocates an OLE variant, and is released; doing this twice in a 250 ms cycle from a single trigger doubles the load on the OPC stack and amplifies the race condition.

Reference pattern (WinCC VBS, Runtime API):

Function BorderColor_Trigger(Byval Item)
    Dim tag1, tag2
    ' Read each external tag ONCE per trigger cycle
    tag1 = HMIRuntime.Tags("opc_bitprueba").Read
    tag2 = HMIRuntime.Tags("opc_bitprueba1").Read

    If (tag1 = 0) And (tag2 = 1) Then
        BorderColor_Trigger = vbGreen
    ElseIf (tag1 = 1) And (tag2 = 0) Then
        BorderColor_Trigger = vbRed
    Else
        BorderColor_Trigger = vbYellow
    End If
End Function

Best-practice constraints derived from the WinCC scripting reference:

• Declare all local variables with Dim; implicit variables in VBS force late binding and consume additional stack frames.
• Never call .Read more than once for the same tag inside a trigger function.
• Never use Wait, Sleep, or blocking COM calls inside a trigger function; the GUI thread will stall and the property writer critical section cannot be released.
• Prefer Select Case over nested If/ElseIf when more than three branches are required.

5.3 Adjust trigger cycles for external tags

Set the trigger cycle in the WinCC Explorer under Graphics Designer → Properties → Events → Mouse-Click or Variable. Use the dropdown Update and select Upon change where the PLC tag update rate exceeds 1 second; otherwise use 500 ms or 1000 ms.

6. Alternate Implementation with Dynamic Dialog

If the property mapping is purely a value-to-color or value-to-visibility translation with no business logic, replace the VBS with a Dynamic Dialog. Dynamic Dialogs are compiled into C actions, not VBS, and bypass the VBS property-writer path entirely. This is the most resilient fix for simple group property changes.

1. Open the object properties of the grouped element.
2. Select the target property (e.g., BorderColor, Visible).
3. Right-click → Dynamic Dialog.
4. Define the source PLC tag as the trigger.
5. Map each tag value to the desired output (e.g., 0 = vbGreen, 1 = vbRed).
6. Set the evaluation cycle to Upon change if the tag only toggles state, or to 1000 ms for continuous monitoring.

7. Multi-Action Strategy for Grouped Objects

When business logic prevents consolidation into a single function, attach one VBS per grouped object, not per child property. Inside that single VBS, set every required child property in sequence:

Function GroupVis_Trigger(Byval Item)
    Dim st
    st = HMIRuntime.Tags("PLC_DB100_DBW0").Read

    If st = 1 Then
        Item.SubItems("Rect_Body").Visible  = True
        Item.SubItems("Line_Border").Visible = True
        Item.SubItems("Text_Label").Visible  = True
    Else
        Item.SubItems("Rect_Body").Visible  = False
        Item.SubItems("Line_Border").Visible = False
        Item.SubItems("Text_Label").Visible  = False
    End If

    GroupVis_Trigger = 0   ' 0 = no error code returned
End Function

This pattern keeps the property writer critical section acquisition count at one per trigger cycle, eliminating the re-entrancy that drives the Access Violation.

8. Error Handling Inside VBS Triggers

The VBS Err object is reset to zero on every trigger entry. Use On Error Resume Next combined with an explicit Err.Clear at the top of the function to suppress spurious channel errors that would otherwise propagate to the Runtime:

Function SafeGroupTrigger(Byval Item)
    On Error Resume Next
    Err.Clear

    Dim v
    v = HMIRuntime.Tags("PLC_DB100_DBW0").Read

    If Err.Number <> 0 Then
        ' Channel temporarily unavailable - keep last state
        SafeGroupTrigger = 0
        Exit Function
    End If

    Item.SubItems("Rect_Body").BorderColor = vbRed
    SafeGroupTrigger = 0
End Function

The semantics of Err.Number, Err.Description, Err.Source, and the Raise method are documented in the Microsoft Learn VBScript reference for the Err object; always consult it before implementing production-grade error handling.

9. Object-Property Enumeration

When porting scripts between PDL files or migrating to WinCC TIA Portal RT Professional, the property names accepted by HMIRuntime.Tags and the screen object model differ. Use the WinCC scripting reference to enumerate valid properties on grouped objects:

• Open Graphics Designer → Tools → Cross Reference to list every property used by the project.
• Compare against the TIA Portal RT Professional example of writing object properties for TIA V20 compatibility.
• Replace deprecated property names (e.g., BorderColor → BorderBackColor) before recompiling.

10. Verification Checklist

Execute the following tests on the patched and optimized Runtime. Each item must pass before the fix is considered complete.

1. Open the PDL containing the grouped objects and start Graphics Runtime.
2. Confirm WinCC version is 6.0.3.0 HF2 via Start → SIMATIC → WinCC → Information.
3. Force the PLC tag through Tag Logging Simulation or directly from the PLC; cycle through every value mapping at least ten times.
4. Verify the property (color, visibility) updates on every cycle with no exception dialog.
5. Inspect diagnose\WinCC_Sys_<host>.log for new entries; Access violation must be absent.
6. Measure CPU on the OPC channel thread during sustained triggering; it should remain below 30% on a 1 s cycle.
7. Repeat the test with the WinCC service CCPDIS stopped and restarted to validate cold-start recovery.
8. Export the Runtime project to a clean VM and confirm the patch persists; VMware snapshots taken before Hotfix 2 must be invalidated.

11. Fallback Procedure When Hotfix 2 Is Unavailable

If the engineering environment cannot receive Hotfix 2 (offline air-gapped site, locked-down OT network), apply the following mitigations in order of priority:

1. Convert every grouping of more than one child into a flat structure (ungroup) so each child carries its own action. This removes the re-entrancy path entirely.
2. Replace VBS with Dynamic Dialog for all color/visibility mappings.
3. Set all external tag triggers to Upon change and add a debounce PLC block to guarantee at least 500 ms between changes.
4. Disable Tag Logging Runtime co-residency if it is not actively used; the logging thread competes for the same critical section.
5. Schedule Hotfix 2 deployment at the next maintenance window.

12. Troubleshooting Matrix